@astram/identity 0.16.0 → 0.17.0

package/dist/features/membership/posting.service.js

@@ -11,10 +11,11 @@
  * A posting IS a role assignment, so before ANY write the actor (the request principal) must:
  *   - reach the membership (a walled `records.get` → null ⇒ 404; the engine's ADR-0034 create
  *     wall re-checks the posting's membership company inside the transaction);
- *   - for every ADDED role: the role is bound within the actor's subtree or not bound at all
- *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
- *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
- *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *   - for every ADDED role: the role is owned by the membership's company (G-013,
+ *     `GrantCeiling.assertRoleAssignable` — another company's or an ownerless role is a 400, for
+ *     every actor, root included), and the role's keys are all held by the actor
+ *     (`assertCanAssignRoles`, ADR-0029 applied to assignment). Removals need no ceiling:
+ *     self-demotion stays allowed.
  *   - for every ADDED posting: its department and branch belong to the membership's company
  *     (`assertOrgUnitsInCompany`, Phase 9 #13b) — else 400.
  *
@@ -150,7 +151,7 @@ let PostingService = class PostingService {
             seenAdded.add(k);
             return true;
         });
-        // 2) Authority for every ADDED role, before any write: binding rule, then the ceiling.
+        // 2) Authority for every ADDED role, before any write: owner rule (G-013), then the ceiling.
         const addedRoles = await this.assertMayAdd(actor, tenantUuid, added, undefined);
         // Removing a PEER's postings strips their authority: the actor must dominate the member
         // (security review). Removing your OWN postings (self-demotion) stays allowed.
@@ -163,11 +164,12 @@ let PostingService = class PostingService {
         // 3) Write atomically: creates first, then deletes (KI #16). Only whitelisted fields are sent,
         //    and `membershipUuid` always comes from the path (review F4).
         await this.records.transaction(async (tx) => {
-            // Review F2: serialise against a concurrent grant/posting of the same role. Lock each
-            // added role row on THIS transaction (grant administration locks the same row), then
-            // re-run the binding rule: a binding another tenant committed while we waited is now
-            // visible, and a role that became shared is refused before the INSERT (rolled back).
-            await this.lockAndRecheck(tx, actor, addedRoles, undefined);
+            // Review F2: serialise against a concurrent grant/delete of the same role. Lock each added
+            // role row on THIS transaction (grant administration and role delete lock the same row),
+            // then re-run the owner rule (G-013): a role deleted, or made ownerless by its company's
+            // delete, while we waited is refused before the INSERT (rolled back).
+            await this.lockAndRecheck(tx, actor, tenantUuid, addedRoles, undefined);
+            await this.lockOrgUnits(tx, tenantUuid, added);
             for (const d of added) {
                 await tx.create('membership_posting', { fields: { ...stripEmpty(d), membershipUuid } });
             }
@@ -208,7 +210,8 @@ let PostingService = class PostingService {
             return; // nothing missing: no write, no bump
         const addedRoles = await this.assertMayAdd(actor, tenantUuid, added, ceilingOpts);
         await this.records.transaction(async (tx) => {
-            await this.lockAndRecheck(tx, actor, addedRoles, ceilingOpts);
+            await this.lockAndRecheck(tx, actor, tenantUuid, addedRoles, ceilingOpts);
+            await this.lockOrgUnits(tx, tenantUuid, added);
             for (const d of added) {
                 await tx.create('membership_posting', { fields: { ...stripEmpty(d), membershipUuid } });
             }
@@ -232,11 +235,13 @@ let PostingService = class PostingService {
             : null;
         return { membership, tenantUuid };
     }
-    /** Authority for ADDED postings (binding rule, ceiling, org units); returns the distinct roles. */
+    /** Authority for ADDED postings (owner rule, ceiling, org units); returns the distinct roles. */
     async assertMayAdd(actor, tenantUuid, added, opts) {
         const addedRoles = [...new Set(added.map((d) => d.roleUuid))];
+        // G-013 (spec §5.D, R2): every added role is the membership company's own, for every actor
+        // (root and the bootstrap operation included) — 400 otherwise, before the ceiling.
         for (const roleUuid of addedRoles) {
-            await this.ceiling.assertRoleAssignable(actor, roleUuid, opts);
+            await this.ceiling.assertRoleAssignable(actor, roleUuid, tenantUuid, opts);
         }
         await this.ceiling.assertCanAssignRoles(actor, addedRoles, opts);
         // Phase 9 #13b (review F4): an added posting's department/branch must be the membership
@@ -248,13 +253,55 @@ let PostingService = class PostingService {
         });
         return addedRoles;
     }
-    /** Lock each added role row on the transaction, then re-run the binding rule (review F2). */
-    async lockAndRecheck(tx, actor, addedRoles, opts) {
+    /**
+     * Lock each added role row on the transaction, then re-check the owner rule (review F2, G-013).
+     * A role changes owner only through its company's delete (owner cleared), which also removes the
+     * memberships of that company, so the re-check after the lock sees the committed outcome.
+     */
+    async lockAndRecheck(tx, actor, tenantUuid, addedRoles, opts) {
         for (const roleUuid of addedRoles) {
             await tx.lockForUpdate('role', roleUuid);
-            await this.ceiling.assertRoleAssignable(actor, roleUuid, opts);
+            await this.ceiling.assertRoleAssignable(actor, roleUuid, tenantUuid, opts);
         }
     }
+    /**
+     * G-012 (spec §5.A, NAES review D): lock every ADDED posting's department and branch row on THIS
+     * transaction (departments then branches, each sorted and de-duplicated: one lock order), then
+     * re-check that each still belongs to the membership's company. A department/branch delete locks
+     * the same row and counts postings after its lock, so the two serialise: delete first ⇒ the unit
+     * (and its junction row, which cascades) is gone and this add is refused with 400; add first ⇒
+     * the delete counts this posting and answers 409. The FK is never reached, so no driver error.
+     *
+     * The re-check reuses `assertOrgUnitsInCompany` (fresh reads on the authz pool, after the lock is
+     * held, so they see the committed delete) rather than an engine read: the org bootstrap's
+     * `postings` step is gate-7 capped to membership types and may not read `department`/`branch`.
+     * The pre-transaction check already passed, so a failure here can only mean the row is gone.
+     */
+    async lockOrgUnits(tx, tenantUuid, added) {
+        const ids = (pick) => [
+            ...new Set(added.map(pick).filter((v) => typeof v === 'string' && v.length > 0)),
+        ].sort();
+        const departmentUuids = ids((d) => d.departmentUuid);
+        const branchUuids = ids((d) => d.branchUuid);
+        for (const id of departmentUuids)
+            await tx.lockForUpdate('department', id);
+        for (const id of branchUuids)
+            await tx.lockForUpdate('branch', id);
+        const recheck = async (units, message) => {
+            if (units.departmentUuids.length === 0 && units.branchUuids.length === 0)
+                return;
+            try {
+                await this.ceiling.assertOrgUnitsInCompany(tenantUuid, units);
+            }
+            catch (err) {
+                if (err instanceof identity_errors_js_1.IdentityBadRequestError)
+                    throw new identity_errors_js_1.IdentityBadRequestError(message);
+                throw err;
+            }
+        };
+        await recheck({ departmentUuids, branchUuids: [] }, 'That department no longer exists.');
+        await recheck({ departmentUuids: [], branchUuids }, 'That branch no longer exists.');
+    }
     async bumpTenant(tenantUuid) {
         // ADR-0011 STALENESS FIX: a posting add/remove changes the effective roles (→ coarse
         // grants) of the membership's user in that company, so bump the tenant's permission

package/dist/features/org-bootstrap/org-bootstrap-file.d.ts

@@ -3,6 +3,8 @@ export interface OrgBootstrapRoot {
     email: string;
     /** Tenant path: `A` or `A/B` (tenant name, then child names). */
     homeCompany: string;
+    /** Optional sign-in name (auth capabilities R1.7), normalized: lower-case `[a-z0-9._-]{3,64}`. */
+    loginName?: string;
 }
 export interface OrgBootstrapRole {
     name: string;
@@ -19,6 +21,8 @@ export interface OrgBootstrapUser {
     /** Path of child names relative to the tenant (`A/B` means tenant > A > B). */
     company?: string;
     postings?: OrgBootstrapPosting[];
+    /** Optional sign-in name (auth capabilities R1.7), normalized: lower-case `[a-z0-9._-]{3,64}`. */
+    loginName?: string;
 }
 export interface OrgBootstrapCompany {
     name: string;
@@ -44,10 +48,10 @@ export interface OrgBootstrapFileOptions {
 /** The closed key sets, exported so the schema parity test compares against the parser's own. */
 export declare const ORG_FILE_KEYS: {
     readonly file: readonly ["version", "roots", "tenants"];
-    readonly root: readonly ["username", "email", "homeCompany"];
+    readonly root: readonly ["username", "email", "homeCompany", "loginName"];
     readonly company: readonly ["name", "departments", "branches", "roles", "users", "children"];
     readonly role: readonly ["name", "permissions"];
-    readonly user: readonly ["username", "email", "company", "postings"];
+    readonly user: readonly ["username", "email", "company", "postings", "loginName"];
     readonly posting: readonly ["role", "department", "branch"];
 };
 export declare class OrgBootstrapFileError extends Error {

package/dist/features/org-bootstrap/org-bootstrap-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-bootstrap-file.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-file.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,oFAAoF;IACpF,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa;;;;;;;CAOhB,CAAC;AAEX,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAC7B,MAAM,EAAE,qBAAqB,EAAE;CAO5C;AAmBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CAqRlB"}
+{"version":3,"file":"org-bootstrap-file.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-file.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,oFAAoF;IACpF,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,iGAAiG;AACjG,eAAO,MAAM,aAAa;;;;;;;CAOhB,CAAC;AAEX,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;gBAC7B,MAAM,EAAE,qBAAqB,EAAE;CAO5C;AAoCD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,uBAAuB,GAC/B,gBAAgB,CA4SlB"}

package/dist/features/org-bootstrap/org-bootstrap-file.js

@@ -8,17 +8,20 @@ exports.parseOrgBootstrapFile = parseOrgBootstrapFile;
  * Hand-written (the repo carries no validator library) with closed key sets at every level;
  * `org-bootstrap.schema.json` documents the same shape and a parity test keeps them in step.
  * No I/O. Every problem is collected as `{ path, message }`; messages never echo input values, so a
- * stray `password` field is reported by name only.
+ * stray `password` field is reported by name only. The one exception is the G-013 posting-role
+ * message (spec §5.E), which names the role and the company path the operator's own file declares.
  */
+const core_1 = require("@astram/core");
 const guard_1 = require("@astram/guard");
+const org_unit_name_js_1 = require("../org-structure/org-unit-name.js");
 const org_names_js_1 = require("./org-names.js");
 /** The closed key sets, exported so the schema parity test compares against the parser's own. */
 exports.ORG_FILE_KEYS = {
     file: ['version', 'roots', 'tenants'],
-    root: ['username', 'email', 'homeCompany'],
+    root: ['username', 'email', 'homeCompany', 'loginName'],
     company: ['name', 'departments', 'branches', 'roles', 'users', 'children'],
     role: ['name', 'permissions'],
-    user: ['username', 'email', 'company', 'postings'],
+    user: ['username', 'email', 'company', 'postings', 'loginName'],
     posting: ['role', 'department', 'branch'],
 };
 class OrgBootstrapFileError extends Error {
@@ -32,6 +35,22 @@ class OrgBootstrapFileError extends Error {
 exports.OrgBootstrapFileError = OrgBootstrapFileError;
 const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 const join = (base, key) => (base === '' ? key : `${base}.${key}`);
+/**
+ * G-013: the comparison key of a role name — the shared name rule (`normaliseOrgUnitName`: NFC,
+ * trim, collapse whitespace), then `nameKey` (case, accents), as the planner and the per-company
+ * unique index compare. A name the rule refuses falls back to `nameKey` (the planner reports it).
+ */
+function roleKey(name) {
+    const n = (0, org_unit_name_js_1.normaliseOrgUnitName)(name);
+    return (0, org_names_js_1.nameKey)(n.ok ? n.value : name);
+}
+/** A company's `/`-joined name path from its tenant (`Acme/Sales`), as the file names it. */
+function namePath(node) {
+    const names = [];
+    for (let n = node; n; n = n.parent)
+        names.unshift(n.name);
+    return names.join('/');
+}
 function parseOrgBootstrapFile(input, options) {
     const issues = [];
     const add = (path, message) => issues.push({ path, message });
@@ -85,7 +104,6 @@ function parseOrgBootstrapFile(input, options) {
     if (f.version !== 1)
         add('version', 'must be the number 1');
     // ---- pass 1: companies (structure, roles, name uniqueness), building the lookup tree ----
-    const globalRoles = new Set();
     const tenantNodes = new Map();
     const nodes = []; // depth-first, parent before children
     const walkCompany = (raw, path, parent, siblings) => {
@@ -97,6 +115,9 @@ function parseOrgBootstrapFile(input, options) {
             add(`${path}.name`, 'must not contain "/"');
         const departments = nameList(c.departments, `${path}.departments`);
         const branches = nameList(c.branches, `${path}.branches`);
+        // G-013 (spec §5.E): roles are owned per company, so a role name is unique within its company
+        // only (compared as stored: the name rule, then the collation); another company may declare
+        // the same name and gets its own role.
         const roles = [];
         const roleNames = new Set();
         (optionalArray(c.roles, `${path}.roles`) ?? []).forEach((rr, i) => {
@@ -121,10 +142,10 @@ function parseOrgBootstrapFile(input, options) {
                 });
             }
             if (rname !== undefined) {
-                if (globalRoles.has((0, org_names_js_1.nameKey)(rname)))
-                    add(`${rp}.name`, 'duplicate role name (roles are global by name)');
-                globalRoles.add((0, org_names_js_1.nameKey)(rname));
-                roleNames.add(rname);
+                const key = roleKey(rname);
+                if (roleNames.has(key))
+                    add(`${rp}.name`, 'duplicate role name within this company');
+                roleNames.add(key);
                 roles.push({ name: rname, permissions: perms });
             }
         });
@@ -204,6 +225,21 @@ function parseOrgBootstrapFile(input, options) {
             emails.add(k);
         }
     };
+    // Auth capabilities R1.3 / R1.10: optional login name, normalized, validated, unique in the file.
+    const loginNames = new Set();
+    const loginNameOf = (v, path) => {
+        if (v === undefined)
+            return undefined;
+        const name = typeof v === 'string' ? (0, core_1.normalizeLoginName)(v) : '';
+        if (!(0, core_1.isValidLoginName)(name)) {
+            add(path, 'must be a valid sign-in name: 3-64 characters, letters a-z, digits, dot, underscore or hyphen');
+            return undefined;
+        }
+        if (loginNames.has(name))
+            add(path, 'duplicate login name (case-insensitive)');
+        loginNames.add(name);
+        return name;
+    };
     const emailOf = (v, path) => {
         if (typeof v !== 'string' || !(0, guard_1.isEmailShaped)(v.trim())) {
             add(path, 'must be a valid email address');
@@ -224,8 +260,9 @@ function parseOrgBootstrapFile(input, options) {
             add(`${p}.homeCompany`, 'does not name a company declared in this file');
         }
         claim(username, email, p);
+        const loginName = loginNameOf(r.loginName, `${p}.loginName`);
         if (username !== undefined && email !== undefined && home !== undefined) {
-            roots.push({ username, email, homeCompany: home });
+            roots.push({ username, email, homeCompany: home, ...(loginName ? { loginName } : {}) });
         }
     });
     const inScope = (start, pick, value) => {
@@ -246,6 +283,7 @@ function parseOrgBootstrapFile(input, options) {
             const username = text(u.username, `${p}.username`);
             const email = emailOf(u.email, `${p}.email`);
             claim(username, email, p);
+            const loginName = loginNameOf(u.loginName, `${p}.loginName`);
             let home = node;
             let companyRaw;
             if (u.company !== undefined) {
@@ -269,8 +307,11 @@ function parseOrgBootstrapFile(input, options) {
                 if (!po)
                     return;
                 const role = text(po.role, `${q}.role`);
-                if (role !== undefined && !inScope(home, (n) => n.roles, role)) {
-                    add(`${q}.role`, 'not declared on this company or an ancestor');
+                // G-013 (spec §5.E, R2): a role is assigned only in the company that owns it, so a
+                // posting's role must be declared on the posting's OWN company (an ancestor's role is
+                // that ancestor's, and the server would refuse it with 400).
+                if (role !== undefined && !home.roles.has(roleKey(role))) {
+                    add(`${q}.role`, `Role "${role}" is not declared on company "${namePath(home)}".`);
                 }
                 const posting = { role: role ?? '' };
                 for (const [key, pick] of [
@@ -299,6 +340,8 @@ function parseOrgBootstrapFile(input, options) {
                     user.company = companyRaw;
                 if (u.postings !== undefined)
                     user.postings = postings;
+                if (loginName !== undefined)
+                    user.loginName = loginName;
                 users.push(user);
             }
         });

package/dist/features/org-bootstrap/org-bootstrap-plan.d.ts

@@ -7,8 +7,17 @@
  * subtrees are looked at, so onboarding tenant B never reports tenant A.
  */
 import type { OrgBootstrapFile } from './org-bootstrap-file.js';
+/**
+ * G-012 (spec §5.A/§5.D, NAES review C): the comparison key of a department/branch name — the
+ * shared name rule (`normaliseOrgUnitName`: NFC, trim, collapse whitespace) then `nameKey` (case,
+ * accents). "Quality  Assurance" in a file therefore matches "Quality Assurance" in the database.
+ * A name the rule refuses falls back to `nameKey` alone (the planner reports it as a conflict).
+ */
+export declare function orgUnitKey(name: string): string;
+/** The drift note of a stored department/branch the file does not list (spec §5.D). */
+export declare const orgUnitDriftNote: (name: string) => string;
 export type CredentialState = 'none' | 'locked' | 'usable';
-export declare const PLAN_KIND_ORDER: readonly ["company", "department", "branch", "company_department", "company_branch", "role", "role_claim", "grant", "user", "membership", "posting", "credential", "root_flag"];
+export declare const PLAN_KIND_ORDER: readonly ["company", "department", "branch", "company_department", "company_branch", "role", "grant", "user", "membership", "posting", "credential", "root_flag"];
 export type PlanKind = (typeof PLAN_KIND_ORDER)[number];
 export type PlanStatus = 'create' | 'unchanged' | 'drift' | 'not-in-file' | 'conflict';
 export interface PlanEntry {
@@ -36,6 +45,8 @@ export interface OrgStateMembership {
 export interface OrgStateUser {
     username: string;
     email: string;
+    /** The stored login name (`u_login_name`); absent or null = none. */
+    loginName?: string | null;
     credential: CredentialState;
     isPlatformSuperuser: boolean;
     /** Memberships INSIDE the file's tenants' subtrees only. */
@@ -43,37 +54,45 @@ export interface OrgStateUser {
     /** Holds a membership OUTSIDE the file's tenants' subtrees (another tenant's user). */
     membershipsOutside: boolean;
 }
+/**
+ * A role OWNED by a company of the file's tenants' subtrees (G-013: every role belongs to one
+ * company; a name is unique within that company only).
+ */
 export interface OrgStateRole {
+    /** The owner company's path (`Tenant/Child/...`, names as stored). */
+    companyPath: string;
+    /** The role name as stored. */
     name: string;
-    /** Name of the owner's top-level tenant; null = no owner. */
-    ownerTenant: string | null;
-    /** Held by a posting outside the file's tenants' subtrees. */
-    heldOutside: boolean;
     permissions: string[];
 }
 export interface OrgStateCompany {
     path: string;
+    /** The company's OWN departments (G-012: owner column), names as stored. */
     departments: string[];
+    /** The company's OWN branches, names as stored. */
     branches: string[];
 }
 export interface OrgState {
     companies: OrgStateCompany[];
-    departments: string[];
-    branches: string[];
+    /** The roles owned by the companies of the file's tenants' subtrees (G-013). */
     roles: OrgStateRole[];
     users: OrgStateUser[];
     emailHolders: {
         email: string;
         username: string;
     }[];
+    /** Holders of the file's login names (read only when the file declares any). */
+    loginNameHolders?: {
+        loginName: string;
+        username: string;
+    }[];
     /**
      * File company paths whose name matches more than one stored company (several top-level companies
      * of the tenant's name, or several children of one parent with the child's name): never guessed.
      */
     ambiguousCompanies: string[];
 }
-export interface PlanOptions {
-    claimUnownedRoles: boolean;
-}
-export declare function planOrgBootstrap(file: OrgBootstrapFile, state: OrgState, options: PlanOptions): OrgPlan;
+/** The plan path of a company's own role (G-013, spec §5.E): `<company path>#role:<name>`. */
+export declare const rolePath: (companyPath: string, name: string) => string;
+export declare function planOrgBootstrap(file: OrgBootstrapFile, state: OrgState): OrgPlan;
 //# sourceMappingURL=org-bootstrap-plan.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-bootstrap-plan.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAEV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,eAAO,MAAM,eAAe,iLAclB,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;AAEvF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,4FAA4F;IAC5F,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,eAAe,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,8DAA8D;IAC9D,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD;;;OAGG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAQD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,WAAW,GACnB,OAAO,CA+WT"}
+{"version":3,"file":"org-bootstrap-plan.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAEV,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAKjC;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MACkC,CAAC;AAEnF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,eAAO,MAAM,eAAe,mKAalB,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;AAEvF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,4FAA4F;IAC5F,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,eAAe,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,uFAAuF;IACvF,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,gFAAgF;IAChF,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,YAAY,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD,gFAAgF;IAChF,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7D;;;OAGG;IACH,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,8FAA8F;AAC9F,eAAO,MAAM,QAAQ,GAAI,aAAa,MAAM,EAAE,MAAM,MAAM,KAAG,MAC9B,CAAC;AAQhC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAobjF"}