@astram/identity 0.16.0 → 0.17.0

package/dist/features/audit/directory-label-resolver.d.ts

@@ -1,17 +1,26 @@
 import type { LabelResolver, LabelKind } from '@astram/core';
 import type { AuditQueryable } from './mariadb-audit-reader.js';
 import { type IdentitySchemaNames } from '../../schema.js';
+import type { ActorLabelResolver, ResolvedActor } from './audit-read.service.js';
 /**
  * The id->human-label chokepoint (ADR-0012, design §2.2). A deleted/unknown
  * entity resolves to a FALLBACK label (never the id); a directory OUTAGE throws
  * (fail-closed — a transient must not masquerade as a deletion).
  */
-export declare class DirectoryLabelResolver implements LabelResolver {
+export declare class DirectoryLabelResolver implements LabelResolver, ActorLabelResolver {
     private readonly db;
     private readonly schemas;
     /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
     constructor(db: AuditQueryable, schemas?: IdentitySchemaNames);
     resolve(kind: LabelKind, id: string, _tenantId?: string): Promise<string>;
+    /**
+     * Who an audit `actorId` is (KI #140): a user (`users.u_uuid`), else a service account (an
+     * `ask_…` API-key principal carries `sa_id`), else unknown → "Deleted user" as before. Both are
+     * primary-key lookups; the second runs only when the first misses. Reserved operation
+     * principals never reach here (the read service labels them from guard's registry).
+     */
+    resolveActor(id: string): Promise<ResolvedActor>;
+    private serviceAccountLabel;
     private fallback;
 }
 //# sourceMappingURL=directory-label-resolver.d.ts.map

package/dist/features/audit/directory-label-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-label-resolver.d.ts","sourceRoot":"","sources":["../../../src/features/audit/directory-label-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,aAAa;IAGxD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,EAAE,EAAE,cAAc,EAClB,OAAO,GAAE,mBAA+C;IAGrE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8B/E,OAAO,CAAC,QAAQ;CAMjB"}
+{"version":3,"file":"directory-label-resolver.d.ts","sourceRoot":"","sources":["../../../src/features/audit/directory-label-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEjF;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,aAAa,EAAE,kBAAkB;IAG5E,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,EAAE,EAAE,cAAc,EAClB,OAAO,GAAE,mBAA+C;IAGrE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkC/E;;;;;OAKG;IACG,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YAYxC,mBAAmB;IAQjC,OAAO,CAAC,QAAQ;CAOjB"}

package/dist/features/audit/directory-label-resolver.js

@@ -31,11 +31,36 @@ class DirectoryLabelResolver {
                 const rows = (await this.db.query(`SELECT r_name AS label FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [id]));
                 return rows[0]?.label ?? this.fallback(kind);
             }
+            case 'service_account': {
+                const label = await this.serviceAccountLabel(id);
+                return label ?? this.fallback(kind);
+            }
             default:
-                // service_account / object_type / permission not shown in v1 columns → safe fallback.
+                // object_type / permission not shown in v1 columns → safe fallback.
                 return '(unknown)';
         }
     }
+    /**
+     * Who an audit `actorId` is (KI #140): a user (`users.u_uuid`), else a service account (an
+     * `ask_…` API-key principal carries `sa_id`), else unknown → "Deleted user" as before. Both are
+     * primary-key lookups; the second runs only when the first misses. Reserved operation
+     * principals never reach here (the read service labels them from guard's registry).
+     */
+    async resolveActor(id) {
+        if (!id)
+            return { kind: 'unknown', label: this.fallback('principal') };
+        const users = (await this.db.query(`SELECT u_username AS label FROM \`${this.schemas.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [id]));
+        if (users[0]?.label !== undefined)
+            return { kind: 'user', label: users[0].label };
+        const sa = await this.serviceAccountLabel(id);
+        if (sa !== undefined)
+            return { kind: 'service_account', label: sa };
+        return { kind: 'unknown', label: this.fallback('principal') };
+    }
+    async serviceAccountLabel(id) {
+        const rows = (await this.db.query(`SELECT sa_label AS label FROM \`${this.schemas.app}\`.\`service_account\` WHERE sa_id = ? LIMIT 1`, [id]));
+        return rows[0]?.label;
+    }
     fallback(kind) {
         if (kind === 'principal')
             return 'Deleted user';
@@ -43,6 +68,8 @@ class DirectoryLabelResolver {
             return 'Deleted tenant';
         if (kind === 'role')
             return 'Deleted role';
+        if (kind === 'service_account')
+            return 'Deleted service account';
         return '(unknown)';
     }
 }

package/dist/features/authz/grant-admin.controller.d.ts

@@ -14,10 +14,10 @@ interface AuthedRequest {
  * registered object type — it is administered THROUGH `role`, never classified directly.)
  *
  * Mutating routes pass `req.principal` as the actor: it stamps who granted what (surfaced by the
- * grants-summary listing as "by <name>"), and grant AND revoke run the role-binding rule (a role
- * also used outside the caller's subtree is root-only) and the ADR-0029 ceiling ("only grant or
- * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling and
- * binding → 403, a role outside the caller's subtree → 404, unknown key/bundle → 400.
+ * grants-summary listing as "by <name>"), and grant AND revoke run the owner rule (G-013, ADR-0047:
+ * the role's owner company must be in the caller's subtree) and the ADR-0029 ceiling ("only grant or
+ * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling → 403,
+ * a role owned outside the caller's subtree (or ownerless, for non-root) → 404, unknown key/bundle → 400.
  */
 export declare class GrantAdminController {
     private readonly grants;

package/dist/features/authz/grant-admin.controller.js

@@ -40,10 +40,10 @@ function subtreeScopeOf(req) {
  * registered object type — it is administered THROUGH `role`, never classified directly.)
  *
  * Mutating routes pass `req.principal` as the actor: it stamps who granted what (surfaced by the
- * grants-summary listing as "by <name>"), and grant AND revoke run the role-binding rule (a role
- * also used outside the caller's subtree is root-only) and the ADR-0029 ceiling ("only grant or
- * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling and
- * binding → 403, a role outside the caller's subtree → 404, unknown key/bundle → 400.
+ * grants-summary listing as "by <name>"), and grant AND revoke run the owner rule (G-013, ADR-0047:
+ * the role's owner company must be in the caller's subtree) and the ADR-0029 ceiling ("only grant or
+ * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling → 403,
+ * a role owned outside the caller's subtree (or ownerless, for non-root) → 404, unknown key/bundle → 400.
  */
 let GrantAdminController = class GrantAdminController {
     grants;

package/dist/features/authz/grant-admin.service.d.ts

@@ -74,9 +74,10 @@ export declare class GrantAdminService {
         wildcards: string[];
     }>;
     /**
-     * A role's current grants. Task 4.2: subtree-guarded — a non-root caller may read a role's
-     * grants ONLY IF that role is bound within their reachable subtree; otherwise `{ grants: [] }`
-     * (fail-closed — never leak another tenant's role's permissions by uuid). Root skips the guard.
+     * A role's current grants. Subtree-guarded by the G-013 owner rule (spec §5.D): a non-root caller
+     * may read a role's grants ONLY IF the role's owner company is in their reachable subtree;
+     * otherwise `{ grants: [] }` (fail-closed — never leak another company's role's permissions by
+     * uuid; an ownerless role is root only, R5). An empty subtree matches nothing. Root skips the guard.
      */
     listRoleGrants(roleUuid: string, subtreeScope: SubtreeScope): Promise<{
         grants: string[];
@@ -84,11 +85,11 @@ export declare class GrantAdminService {
     /** Validate the key against the catalog + wildcard set. Throws BadKeyError if unknown. */
     private assertValidKey;
     /**
-     * Security hardening #1 (D1 interim rule) + ADR-0029, in this order, BEFORE any write: the role
-     * must be administrable by the actor (bound inside its subtree and nowhere outside — a shared
-     * role is root-only), then every key must be covered by the actor's own effective keys ("only
-     * grant — or revoke — what you hold"). Root bypasses both. No ceiling wired (legacy/tests) ⇒
-     * neither check runs; the identity module always wires it.
+     * G-013 owner rule (spec §5.B, replacing D1) + ADR-0029, in this order, BEFORE any write: the role
+     * must be administrable by the actor (its owner company in the actor's subtree, else 404), then
+     * every key must be covered by the actor's own effective keys ("only grant — or revoke — what you
+     * hold"). Root bypasses both. No ceiling wired (legacy/tests) ⇒ neither check runs; the identity
+     * module always wires it.
      */
     private assertMayChangeGrants;
     /**

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiCpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IAK3E,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA6DzB;;;;;;OAMG;YACW,gBAAgB;IAiE9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIlD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiCpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IAK3E,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAiBhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA2DzB;;;;;;OAMG;YACW,gBAAgB;IAiE9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}

package/dist/features/authz/grant-admin.service.js

@@ -91,22 +91,18 @@ class GrantAdminService {
         return { catalog, wildcards };
     }
     /**
-     * A role's current grants. Task 4.2: subtree-guarded — a non-root caller may read a role's
-     * grants ONLY IF that role is bound within their reachable subtree; otherwise `{ grants: [] }`
-     * (fail-closed — never leak another tenant's role's permissions by uuid). Root skips the guard.
+     * A role's current grants. Subtree-guarded by the G-013 owner rule (spec §5.D): a non-root caller
+     * may read a role's grants ONLY IF the role's owner company is in their reachable subtree;
+     * otherwise `{ grants: [] }` (fail-closed — never leak another company's role's permissions by
+     * uuid; an ownerless role is root only, R5). An empty subtree matches nothing. Root skips the guard.
      */
     async listRoleGrants(roleUuid, subtreeScope) {
         try {
             if (!subtreeScope.isRoot) {
-                const ph = subtreeScope.nodeIds.map(() => '?').join(', ');
-                // Empty subtree → no placeholders → the check can't match → fail-closed empty.
-                const bound = subtreeScope.nodeIds.length
-                    ? (await this.pool.query(`SELECT 1 FROM \`${this.schemas.app}\`.\`membership_posting\` mp
-                 JOIN \`${this.schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
-                WHERE mp.mp_role_uuid = ? AND cm.cm_company_uuid IN (${ph})
-                LIMIT 1`, [roleUuid, ...subtreeScope.nodeIds]))
-                    : [];
-                if (bound.length === 0)
+                if (subtreeScope.nodeIds.length === 0)
+                    return { grants: [] };
+                const role = await (0, role_binding_js_1.readRoleOwner)(this.pool, roleUuid, this.schemas);
+                if (!(0, role_binding_js_1.ownerInSubtree)(role, subtreeScope.nodeIds))
                     return { grants: [] };
             }
             const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid]));
@@ -124,11 +120,11 @@ class GrantAdminService {
             throw new BadKeyError(key);
     }
     /**
-     * Security hardening #1 (D1 interim rule) + ADR-0029, in this order, BEFORE any write: the role
-     * must be administrable by the actor (bound inside its subtree and nowhere outside — a shared
-     * role is root-only), then every key must be covered by the actor's own effective keys ("only
-     * grant — or revoke — what you hold"). Root bypasses both. No ceiling wired (legacy/tests) ⇒
-     * neither check runs; the identity module always wires it.
+     * G-013 owner rule (spec §5.B, replacing D1) + ADR-0029, in this order, BEFORE any write: the role
+     * must be administrable by the actor (its owner company in the actor's subtree, else 404), then
+     * every key must be covered by the actor's own effective keys ("only grant — or revoke — what you
+     * hold"). Root bypasses both. No ceiling wired (legacy/tests) ⇒ neither check runs; the identity
+     * module always wires it.
      */
     async assertMayChangeGrants(roleUuid, keys, actor) {
         if (!this.ceiling)
@@ -146,13 +142,13 @@ class GrantAdminService {
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
-            // Security review F2: serialise against a concurrent posting of this role (in any tenant).
-            // Lock the role row FIRST — the posting path locks the same row before it inserts — then
-            // re-run the binding rule on THIS connection, so a binding committed by a writer we waited
-            // for is seen, and a role that became shared in the meantime is refused (rolled back).
+            // Security review F2: serialise against a concurrent posting or delete of this role. Lock the
+            // role row FIRST — the posting and delete paths lock the same row — then re-run the owner
+            // rule (G-013) on THIS connection, so a role deleted (or ownerless after its company was
+            // deleted) while we waited is refused (rolled back).
             await conn.query(`SELECT r_uuid FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? FOR UPDATE`, [roleUuid]);
             if (this.ceiling && actor.isRoot !== true) {
-                grant_ceiling_js_1.GrantCeiling.checkAdministrable(await (0, role_binding_js_1.readRoleBinding)(conn, roleUuid, (0, grant_ceiling_js_1.subtreeOf)(actor), this.schemas));
+                grant_ceiling_js_1.GrantCeiling.checkAdministrable(actor, await (0, role_binding_js_1.readRoleOwner)(conn, roleUuid, this.schemas));
                 // Phase 8 #2: a revocation strips authority from every holder of the role, so the actor
                 // must dominate each of them — checked under the role lock (no holder can appear unseen).
                 // Phase 9 #9: that includes the service accounts holding the role, judged as a role
@@ -448,13 +444,13 @@ class GrantAdminService {
             const { catalog } = await this.listCatalog();
             const allKeys = catalog.map((c) => c.key);
             const { bundles } = await this.listBundles();
-            // Task 4.2 subtree scope: a non-root caller sees ONLY roles bound within their reachable
+            // Task 4.2 subtree scope: a non-root caller sees ONLY roles OWNED within their reachable
             // subtree (the EXISTS predicate); root spans all tenants (no predicate). The scope clause
             // sits FIRST in the WHERE (before the LIKE), so its ?-bound node params lead the arg list —
             // identical on BOTH the count and page queries so they can never disagree.
             const scope = subtreeScope.isRoot
                 ? { sql: '', params: [] }
-                : (0, role_binding_js_1.subtreeExists)(subtreeScope.nodeIds, this.schemas);
+                : (0, role_binding_js_1.ownedInSubtree)(subtreeScope.nodeIds);
             // Distinct granted roles (a role appears iff it has ≥1 role_permission row), filtered
             // by name search. Bind the LIKE term as a param (wildcards escaped).
             const likeClause = search ? `AND r.r_name LIKE ?` : '';

package/dist/features/authz/grant-ceiling.d.ts

@@ -14,7 +14,8 @@
  */
 import type { Pool } from 'mariadb';
 import type { ModuleRegistry, Principal } from '@astram/core';
-import { type RoleBinding } from './role-binding.js';
+import { type RoleOwner } from './role-binding.js';
+import type { Queryable } from './permission-version.bumper.js';
 import { type IdentitySchemaNames } from '../../schema.js';
 /** The grantor exceeds their own authority — cannot grant a key they do not hold (→ 403). */
 export declare class GrantCeilingError extends Error {
@@ -28,8 +29,10 @@ export declare class GrantCeilingError extends Error {
 export interface OperationRoleOptions {
     readonly operationRoleIds?: readonly string[];
 }
+/** The parts of a principal its reachable subtree is computed from. */
+export type SubtreeActor = Pick<Principal, 'tenantId' | 'scopeSubtreeNodeIds'>;
 /** The actor's reachable subtree: the session's cached closure, else the self node (non-widening). */
-export declare function subtreeOf(actor: Principal): readonly string[];
+export declare function subtreeOf(actor: SubtreeActor): readonly string[];
 /**
  * Does `effective` (the grantor's held EXACT keys) cover `granted`?
  *
@@ -67,10 +70,12 @@ export declare class GrantCeiling {
     now?: () => number, 
     /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
     schemas?: IdentitySchemaNames);
-    /** The D1 administer rule over a binding read: used inside and nowhere outside (404 / 403). */
-    static checkAdministrable(b: RoleBinding): void;
-    /** The #11 assign rule over a binding read: never a role also used outside (403). */
-    static checkAssignable(b: RoleBinding): void;
+    /**
+     * The G-013 administer rule for a NON-ROOT actor over an owner read (spec §5.B): the role's owner
+     * company is in the actor's subtree. Missing, ownerless (root only, R5) or owned outside is "not
+     * found" (404, no existence leak, no uuid in the message). Root is decided by the caller.
+     */
+    static checkAdministrable(actor: SubtreeActor, role: RoleOwner): void;
     /** The registry's exact-key universe (wildcard expansion bound). */
     private registeredKeys;
     /** The raw `role_permission` keys of `roleIds` (exact or wildcard). Store errors propagate. */
@@ -166,20 +171,34 @@ export declare class GrantCeiling {
         readonly departmentUuids: readonly string[];
         readonly branchUuids: readonly string[];
     }): Promise<void>;
-    /** Where `roleUuid` is bound relative to the actor's subtree (postings + service accounts). */
-    roleBinding(actor: Principal, roleUuid: string): Promise<RoleBinding>;
     /**
-     * Assert the actor may ADMINISTER the role — edit its grants, rename or delete it (#1, D1
-     * interim rule): the role is bound inside the actor's subtree AND bound nowhere outside it. A
-     * role not bound in the subtree is "not found" for the actor (no existence leak); a role also
-     * used outside (a shared role) is root-only. Root bypasses.
+     * `roleUuid`'s owner company (G-013), read on `q` (default: the shared authz pool; a caller holding
+     * the role row lock passes its transaction connection). Store outage → 503 (fail closed).
+     */
+    roleOwner(roleUuid: string, q?: Queryable): Promise<RoleOwner>;
+    /**
+     * Is the role visible to the actor by the owner rule (spec §5.D, security-policy role targets)?
+     * Root: the role exists (ownerless included, R5). Non-root: its owner company is in the actor's
+     * subtree. Store outage → 503.
+     */
+    roleOwnedInReach(actor: Principal, roleUuid: string): Promise<boolean>;
+    /**
+     * Assert the actor may ADMINISTER the role — edit its grants, rename or delete it (G-013, spec
+     * §5.B, replacing D1): the role's owner company is in the actor's subtree. Missing, ownerless
+     * (root only, R5) or owned outside ⇒ 404 "Role not found." (no existence leak). Root bypasses; so
+     * does the actor bound to the org bootstrap operation for the roles it declared.
      */
     assertRoleAdministrable(actor: Principal, roleUuid: string, opts?: OperationRoleOptions): Promise<void>;
     /**
-     * Assert the actor may POST someone to the role (#11): the role is bound within the actor's
-     * subtree or not bound at all — never a role also used outside it (a shared role's assignment
-     * would widen another tenant's role). Pair with {@link assertCanAssignRoles}. Root bypasses.
+     * Assert the role may be ASSIGNED in `companyUuid` — a posting of a membership of that company,
+     * or a service account of that company (G-013, spec §5.B, R2): the role's owner IS that company.
+     * Applies to every actor, root and the org bootstrap operation included (it is the data's shape,
+     * not a privilege, as {@link assertOrgUnitsInCompany}); `actor` and `opts` therefore relax nothing.
+     * A missing role, an ownerless role, another company's role, or no company (`null`) give the same
+     * 400. A non-root actor's reach to the role follows from its reach to the company (the caller
+     * reached the membership or account through the subtree wall). Pair with
+     * {@link assertCanAssignRoles}. Store outage → 503.
      */
-    assertRoleAssignable(actor: Principal, roleUuid: string, opts?: OperationRoleOptions): Promise<void>;
+    assertRoleAssignable(_actor: Pick<Principal, 'id' | 'tenantId' | 'isRoot'>, roleUuid: string, companyUuid: string | null, _opts?: OperationRoleOptions): Promise<void>;
 }
 //# sourceMappingURL=grant-ceiling.d.ts.map

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWtE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAcD,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAU3E,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAwB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CACxB,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAM3E;;;;;OAKG;IACG,uBAAuB,CAC3B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAMhB;;;;OAIG;IACG,oBAAoB,CACxB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;CAKjB"}
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9D,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAWhE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAcD,uEAAuE;AACvE,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,qBAAqB,CAAC,CAAC;AAE/E,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,MAAM,EAAE,CAEhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAU3E;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAIrE,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAwB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CACxB,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB;;;OAGG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAE,SAAqB,GAAG,OAAO,CAAC,SAAS,CAAC;IAI/E;;;;OAIG;IACG,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM5E;;;;;OAKG;IACG,uBAAuB,CAC3B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAMhB;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAC,EACrD,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,CAAC,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC;CAMjB"}

package/dist/features/authz/grant-ceiling.js

@@ -87,19 +87,14 @@ class GrantCeiling {
         }
         this.rootIds = rootIds ?? [];
     }
-    /** The D1 administer rule over a binding read: used inside and nowhere outside (404 / 403). */
-    static checkAdministrable(b) {
-        if (!b.inside)
+    /**
+     * The G-013 administer rule for a NON-ROOT actor over an owner read (spec §5.B): the role's owner
+     * company is in the actor's subtree. Missing, ownerless (root only, R5) or owned outside is "not
+     * found" (404, no existence leak, no uuid in the message). Root is decided by the caller.
+     */
+    static checkAdministrable(actor, role) {
+        if (!(0, role_binding_js_1.ownerInSubtree)(role, subtreeOf(actor)))
             throw new identity_errors_js_1.IdentityNotFoundError('Role not found.');
-        if (b.outside) {
-            throw new identity_errors_js_1.IdentityForbiddenError('This role is also used outside the organisations you manage; only a platform administrator can change it.');
-        }
-    }
-    /** The #11 assign rule over a binding read: never a role also used outside (403). */
-    static checkAssignable(b) {
-        if (b.outside) {
-            throw new identity_errors_js_1.IdentityForbiddenError('This role is also used outside the organisations you manage; you cannot assign it.');
-        }
     }
     /** The registry's exact-key universe (wildcard expansion bound). */
     registeredKeys() {
@@ -375,34 +370,54 @@ class GrantCeiling {
         await check(units.departmentUuids, 'company_departments', 'cd_company_uuid', 'cd_department_uuid', 'The department is not one of this company’s departments.');
         await check(units.branchUuids, 'company_branches', 'cb_company_uuid', 'cb_branch_uuid', 'The branch is not one of this company’s branches.');
     }
-    /** Where `roleUuid` is bound relative to the actor's subtree (postings + service accounts). */
-    async roleBinding(actor, roleUuid) {
-        return this.facts('role binding', () => (0, role_binding_js_1.readRoleBinding)(this.pool, roleUuid, subtreeOf(actor), this.schemas));
+    /**
+     * `roleUuid`'s owner company (G-013), read on `q` (default: the shared authz pool; a caller holding
+     * the role row lock passes its transaction connection). Store outage → 503 (fail closed).
+     */
+    async roleOwner(roleUuid, q = this.pool) {
+        return this.facts('role owner', () => (0, role_binding_js_1.readRoleOwner)(q, roleUuid, this.schemas));
     }
     /**
-     * Assert the actor may ADMINISTER the role — edit its grants, rename or delete it (#1, D1
-     * interim rule): the role is bound inside the actor's subtree AND bound nowhere outside it. A
-     * role not bound in the subtree is "not found" for the actor (no existence leak); a role also
-     * used outside (a shared role) is root-only. Root bypasses.
+     * Is the role visible to the actor by the owner rule (spec §5.D, security-policy role targets)?
+     * Root: the role exists (ownerless included, R5). Non-root: its owner company is in the actor's
+     * subtree. Store outage → 503.
      */
-    async assertRoleAdministrable(actor, roleUuid, opts) {
+    async roleOwnedInReach(actor, roleUuid) {
+        const role = await this.roleOwner(roleUuid);
         if (actor.isRoot === true)
-            return;
-        if (operationCovers(actor, [roleUuid], opts))
-            return;
-        GrantCeiling.checkAdministrable(await this.roleBinding(actor, roleUuid));
+            return role.exists;
+        return (0, role_binding_js_1.ownerInSubtree)(role, subtreeOf(actor));
     }
     /**
-     * Assert the actor may POST someone to the role (#11): the role is bound within the actor's
-     * subtree or not bound at all — never a role also used outside it (a shared role's assignment
-     * would widen another tenant's role). Pair with {@link assertCanAssignRoles}. Root bypasses.
+     * Assert the actor may ADMINISTER the role — edit its grants, rename or delete it (G-013, spec
+     * §5.B, replacing D1): the role's owner company is in the actor's subtree. Missing, ownerless
+     * (root only, R5) or owned outside ⇒ 404 "Role not found." (no existence leak). Root bypasses; so
+     * does the actor bound to the org bootstrap operation for the roles it declared.
      */
-    async assertRoleAssignable(actor, roleUuid, opts) {
+    async assertRoleAdministrable(actor, roleUuid, opts) {
         if (actor.isRoot === true)
             return;
         if (operationCovers(actor, [roleUuid], opts))
             return;
-        GrantCeiling.checkAssignable(await this.roleBinding(actor, roleUuid));
+        GrantCeiling.checkAdministrable(actor, await this.roleOwner(roleUuid));
+    }
+    /**
+     * Assert the role may be ASSIGNED in `companyUuid` — a posting of a membership of that company,
+     * or a service account of that company (G-013, spec §5.B, R2): the role's owner IS that company.
+     * Applies to every actor, root and the org bootstrap operation included (it is the data's shape,
+     * not a privilege, as {@link assertOrgUnitsInCompany}); `actor` and `opts` therefore relax nothing.
+     * A missing role, an ownerless role, another company's role, or no company (`null`) give the same
+     * 400. A non-root actor's reach to the role follows from its reach to the company (the caller
+     * reached the membership or account through the subtree wall). Pair with
+     * {@link assertCanAssignRoles}. Store outage → 503.
+     */
+    async assertRoleAssignable(_actor, roleUuid, companyUuid, _opts) {
+        const refuse = () => new identity_errors_js_1.IdentityBadRequestError(role_binding_js_1.ROLE_NOT_IN_COMPANY);
+        if (companyUuid === null || companyUuid.length === 0)
+            throw refuse();
+        const role = await this.roleOwner(roleUuid);
+        if (!role.exists || role.owner === null || !(0, http_js_1.sameUuid)(role.owner, companyUuid))
+            throw refuse();
     }
 }
 exports.GrantCeiling = GrantCeiling;

package/dist/features/authz/role-binding.d.ts

@@ -1,37 +1,38 @@
 /**
- * Role binding — where a GLOBAL role (`shield_app.roles`) is in use, relative to a caller's subtree.
+ * Role ownership reads — where a role (`<app>.roles`) belongs, relative to a caller's subtree.
  *
- * Roles are a global catalog, so one `role_permission` edit changes every tenant that uses the role
- * (review finding #1). Until roles are tenant-owned (D1 follow-up), "may this caller administer the
- * role" is decided by WHERE the role is bound:
- *   - a human binding: a `membership_posting` on a `company_membership` of company X;
- *   - a machine binding: a `service_account` of tenant X whose `sa_role_ids` holds the role.
- * `inside` = some binding's node is in the caller's subtree; `outside` = some binding's node is not.
+ * G-013 (spec §5.B, ADR-0047): every role is owned by exactly one company (`r_owner_company_uuid`),
+ * so "may this caller administer the role" is "is its owner in the caller's subtree", and "may this
+ * role be assigned in company X" is "is X its owner". `NULL` owner = an ownerless legacy row (or a
+ * deleted company's role): root only, never assignable. This replaces the D1 binding rule (a role
+ * bound by postings in several subtrees, root-only), which no longer applies: a role is never bound
+ * outside its owner.
  *
- * ONE definition, shared by grant administration (the `subtreeExists` read predicate below and the
- * write rule), role update/delete, and posting creation, via {@link GrantCeiling}. All node ids and
- * the role id are `?`-bound (never interpolated).
+ * ONE definition, shared by grant administration (the `ownedInSubtree` read predicate of the grants
+ * summary and the owner rule), role update/delete, postings, service accounts and security policies,
+ * via {@link GrantCeiling}. The role id and node ids are `?`-bound (never interpolated).
  */
 import type { Queryable } from './permission-version.bumper.js';
 import type { IdentitySchemaNames } from '../../schema.js';
-/** Where a role is bound relative to a set of subtree nodes. */
-export interface RoleBinding {
-    readonly inside: boolean;
-    readonly outside: boolean;
+/** The 400 of a posting or service-account role owned by another company (G-013, spec §10). */
+export declare const ROLE_NOT_IN_COMPANY = "The role is not one of this company's roles.";
+/** A role's owner as stored: `exists` false ⇒ no such role; `owner` null ⇒ ownerless legacy row. */
+export interface RoleOwner {
+    readonly exists: boolean;
+    readonly owner: string | null;
 }
 /**
- * The shared EXISTS-subtree fragment for a non-root caller's READS (Task 4.2): a role row `r`
- * qualifies only if it is bound (`membership_posting → company_membership`) to a node in the
- * subtree. The caller splices `params` where `sql` sits in the surrounding query.
+ * The grants-summary READ fragment for a non-root caller (G-013): a role row `r` qualifies only if
+ * its owner company is in the caller's subtree (the same owner rule as every other role route;
+ * before G-013 it was "posted to a node in the subtree", which hid owned roles nobody held yet). An
+ * empty subtree matches nothing. The caller splices `params` where `sql` sits in the query.
  */
-export declare function subtreeExists(nodeIds: readonly string[], schemas: IdentitySchemaNames): {
+export declare function ownedInSubtree(nodeIds: readonly string[]): {
     sql: string;
     params: string[];
 };
-/**
- * Read where `roleUuid` is bound relative to `nodeIds` (human postings + service accounts) in ONE
- * query. An empty `nodeIds` is treated as "nothing is inside" (every binding is outside) — fail
- * closed, never an `IN ()` syntax error.
- */
-export declare function readRoleBinding(q: Queryable, roleUuid: string, nodeIds: readonly string[], schemas: IdentitySchemaNames): Promise<RoleBinding>;
+/** Read `roleUuid`'s owner company on `q` (a pool or a transaction connection). */
+export declare function readRoleOwner(q: Queryable, roleUuid: string, schemas: IdentitySchemaNames): Promise<RoleOwner>;
+/** Is the stored role owned by a node of `nodeIds`? An ownerless or missing role never is. */
+export declare function ownerInSubtree(role: RoleOwner, nodeIds: readonly string[]): boolean;
 //# sourceMappingURL=role-binding.d.ts.map

package/dist/features/authz/role-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-binding.d.ts","sourceRoot":"","sources":["../../../src/features/authz/role-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,mBAAmB,GAC3B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAQnC;AASD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,SAAS,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAwBtB"}
+{"version":3,"file":"role-binding.d.ts","sourceRoot":"","sources":["../../../src/features/authz/role-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG3D,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,iDAAiD,CAAC;AAElF,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAI5F;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CACjC,CAAC,EAAE,SAAS,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,SAAS,CAAC,CAWpB;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAInF"}