@astram/identity 0.16.0 → 0.17.1

package/dist/features/org-bootstrap/org-bootstrap-plan.js

@@ -1,8 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLAN_KIND_ORDER = void 0;
+exports.rolePath = exports.PLAN_KIND_ORDER = exports.orgUnitDriftNote = void 0;
+exports.orgUnitKey = orgUnitKey;
 exports.planOrgBootstrap = planOrgBootstrap;
 const org_names_js_1 = require("./org-names.js");
+const org_unit_name_js_1 = require("../org-structure/org-unit-name.js");
+const role_service_js_1 = require("../role/role.service.js");
+/**
+ * G-012 (spec §5.A/§5.D, NAES review C): the comparison key of a department/branch name — the
+ * shared name rule (`normaliseOrgUnitName`: NFC, trim, collapse whitespace) then `nameKey` (case,
+ * accents). "Quality  Assurance" in a file therefore matches "Quality Assurance" in the database.
+ * A name the rule refuses falls back to `nameKey` alone (the planner reports it as a conflict).
+ */
+function orgUnitKey(name) {
+    const n = (0, org_unit_name_js_1.normaliseOrgUnitName)(name);
+    return (0, org_names_js_1.nameKey)(n.ok ? n.value : name);
+}
+/** The drift note of a stored department/branch the file does not list (spec §5.D). */
+const orgUnitDriftNote = (name) => `in the database, not in the file: ${name} — renamed or added outside the file?`;
+exports.orgUnitDriftNote = orgUnitDriftNote;
 exports.PLAN_KIND_ORDER = [
     'company',
     'department',
@@ -10,7 +26,6 @@ exports.PLAN_KIND_ORDER = [
     'company_department',
     'company_branch',
     'role',
-    'role_claim',
     'grant',
     'user',
     'membership',
@@ -18,7 +33,10 @@ exports.PLAN_KIND_ORDER = [
     'credential',
     'root_flag',
 ];
-function planOrgBootstrap(file, state, options) {
+/** The plan path of a company's own role (G-013, spec §5.E): `<company path>#role:<name>`. */
+const rolePath = (companyPath, name) => `${companyPath}#role:${name}`;
+exports.rolePath = rolePath;
+function planOrgBootstrap(file, state) {
     const out = [];
     const add = (kind, path, status, detail) => {
         out.push(detail === undefined ? { kind, path, status } : { kind, path, status, detail });
@@ -37,8 +55,6 @@ function planOrgBootstrap(file, state, options) {
     const inFileTenant = (path) => tenantKeys.has((0, org_names_js_1.nameKey)(path.split('/')[0] ?? ''));
     // ---- companies, org units ----
     const stateCompany = new Map(state.companies.map((c) => [(0, org_names_js_1.pathKey)(c.path), c]));
-    const stateDepts = new Set(state.departments.map(org_names_js_1.nameKey));
-    const stateBranches = new Set(state.branches.map(org_names_js_1.nameKey));
     const declaredCompanyKeys = new Set(companies.map((c) => (0, org_names_js_1.pathKey)(c.path)));
     const ambiguous = new Set(state.ambiguousCompanies.map(org_names_js_1.pathKey));
     for (const c of companies) {
@@ -53,71 +69,105 @@ function planOrgBootstrap(file, state, options) {
             add('company', c.path, 'not-in-file');
         }
     }
-    const seenDept = new Set();
-    const seenBranch = new Set();
-    for (const c of companies) {
-        for (const d of c.node.departments ?? []) {
-            if (seenDept.has((0, org_names_js_1.nameKey)(d)))
-                continue;
-            seenDept.add((0, org_names_js_1.nameKey)(d));
-            add('department', `dept:${d}`, stateDepts.has((0, org_names_js_1.nameKey)(d)) ? 'unchanged' : 'create');
-        }
-        for (const b of c.node.branches ?? []) {
-            if (seenBranch.has((0, org_names_js_1.nameKey)(b)))
-                continue;
-            seenBranch.add((0, org_names_js_1.nameKey)(b));
-            add('branch', `branch:${b}`, stateBranches.has((0, org_names_js_1.nameKey)(b)) ? 'unchanged' : 'create');
+    // G-012: departments and branches are owned per company (no shared row), keyed
+    // `<company path>#dept:<name>` / `#branch:<name>`. A created row comes with its one junction row
+    // (`OrgCatalogService.ensure*`), so the junction entry mirrors the row's status.
+    const UNIT_KINDS = [
+        {
+            kind: 'department',
+            junction: 'company_department',
+            tag: 'dept',
+            declared: (c) => c.departments ?? [],
+            stored: (c) => c?.departments ?? [],
+        },
+        {
+            kind: 'branch',
+            junction: 'company_branch',
+            tag: 'branch',
+            declared: (c) => c.branches ?? [],
+            stored: (c) => c?.branches ?? [],
+        },
+    ];
+    /** Per company path key: the unit keys the file declares or the database holds. */
+    const unitsHere = new Map();
+    const unitsOf = (path) => {
+        let u = unitsHere.get((0, org_names_js_1.pathKey)(path));
+        if (u === undefined) {
+            u = { department: new Set(), branch: new Set() };
+            unitsHere.set((0, org_names_js_1.pathKey)(path), u);
         }
-    }
+        return u;
+    };
     for (const c of companies) {
         const sc = stateCompany.get((0, org_names_js_1.pathKey)(c.path));
-        const haveD = new Set((sc?.departments ?? []).map(org_names_js_1.nameKey));
-        const haveB = new Set((sc?.branches ?? []).map(org_names_js_1.nameKey));
-        for (const d of c.node.departments ?? []) {
-            add('company_department', `${c.path}#dept:${d}`, haveD.has((0, org_names_js_1.nameKey)(d)) ? 'unchanged' : 'create');
+        for (const k of UNIT_KINDS) {
+            const have = new Set(k.stored(sc).map(orgUnitKey));
+            for (const key of have)
+                unitsOf(c.path)[k.kind].add(key);
+            const seen = new Set();
+            for (const name of k.declared(c.node)) {
+                const path = `${c.path}#${k.tag}:${name}`;
+                const n = (0, org_unit_name_js_1.normaliseOrgUnitName)(name);
+                if (!n.ok) {
+                    add(k.kind, path, 'conflict', `${k.kind} ${JSON.stringify(name)}: ${(0, org_unit_name_js_1.orgUnitNameMessage)(k.kind, n.reason)}`);
+                    continue;
+                }
+                const key = (0, org_names_js_1.nameKey)(n.value);
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                unitsOf(c.path)[k.kind].add(key);
+                const status = have.has(key) ? 'unchanged' : 'create';
+                add(k.kind, path, status);
+                add(k.junction, path, status);
+            }
         }
-        for (const b of c.node.branches ?? []) {
-            add('company_branch', `${c.path}#branch:${b}`, haveB.has((0, org_names_js_1.nameKey)(b)) ? 'unchanged' : 'create');
+    }
+    // Drift note (spec §5.D, NAES review #2): per company of the file's tenants, the stored units the
+    // file does not list. Informational only: the bootstrap is additive and never renames or deletes.
+    const declaredCompany = new Map(companies.map((c) => [(0, org_names_js_1.pathKey)(c.path), c.node]));
+    for (const sc of state.companies) {
+        if (!inFileTenant(sc.path))
+            continue;
+        const node = declaredCompany.get((0, org_names_js_1.pathKey)(sc.path));
+        for (const k of UNIT_KINDS) {
+            const declared = new Set((node ? k.declared(node) : []).map(orgUnitKey));
+            for (const name of k.stored(sc)) {
+                if (declared.has(orgUnitKey(name)))
+                    continue;
+                add(k.kind, `${sc.path}#${k.tag}:${name}`, 'not-in-file', (0, exports.orgUnitDriftNote)(name));
+            }
         }
     }
     // ---- roles and grants ----
-    const stateRole = new Map(state.roles.map((r) => [(0, org_names_js_1.nameKey)(r.name), r]));
-    const declaredRoles = new Set();
+    // G-013 (spec §5.E): every role is OWNED by the company that declares it, keyed
+    // `<company path>#role:<name>` (name rule + `nameKey`, as the per-company unique index compares).
+    // A name another company uses is simply that company's own role: no cross-company conflict.
+    const stateRoles = new Map();
+    for (const r of state.roles)
+        stateRoles.set(`${(0, org_names_js_1.pathKey)(r.companyPath)}\u0000${orgUnitKey(r.name)}`, r);
+    const roleOf = (companyPath, name) => stateRoles.get(`${(0, org_names_js_1.pathKey)(companyPath)}\u0000${orgUnitKey(name)}`);
     for (const c of companies) {
+        const seen = new Set();
         for (const r of c.node.roles ?? []) {
-            const key = (0, org_names_js_1.nameKey)(r.name);
-            declaredRoles.add(key);
-            const path = `role:${r.name}`;
-            const existing = stateRole.get(key);
+            const path = (0, exports.rolePath)(c.path, r.name);
+            const n = (0, org_unit_name_js_1.normaliseOrgUnitName)(r.name);
+            if (!n.ok) {
+                add('role', path, 'conflict', `role ${JSON.stringify(r.name)}: ${(0, role_service_js_1.roleNameMessage)(n.reason)}`);
+                continue;
+            }
+            const key = (0, org_names_js_1.nameKey)(n.value);
+            if (seen.has(key))
+                continue; // the parser refuses a duplicate; never planned twice
+            seen.add(key);
+            const existing = roleOf(c.path, r.name);
             if (!existing) {
                 add('role', path, 'create');
                 for (const k of r.permissions)
                     add('grant', `${path}#${k}`, 'create');
                 continue;
             }
-            if (existing.ownerTenant !== null && !tenantKeys.has((0, org_names_js_1.nameKey)(existing.ownerTenant))) {
-                add('role', path, 'conflict', `role "${r.name}" is owned by another tenant`);
-                continue;
-            }
-            if (existing.ownerTenant !== null && (0, org_names_js_1.nameKey)(existing.ownerTenant) !== (0, org_names_js_1.nameKey)(c.tenant)) {
-                add('role', path, 'conflict', `role "${r.name}" is owned by tenant "${existing.ownerTenant}", not by "${c.tenant}" which declares it`);
-                continue;
-            }
-            if (existing.ownerTenant === null) {
-                if (existing.heldOutside) {
-                    add('role', path, 'conflict', `role "${r.name}" has no owner and is held outside the file's tenants`);
-                    continue;
-                }
-                if (!options.claimUnownedRoles) {
-                    add('role', path, 'conflict', `role "${r.name}" has no owner; pass --claim-unowned-roles to claim it`);
-                    continue;
-                }
-                add('role', path, 'unchanged');
-                add('role_claim', path, 'create', `claim "${r.name}" for tenant ${c.tenant}`);
-            }
-            else {
-                add('role', path, 'unchanged');
-            }
+            add('role', path, 'unchanged');
             const have = new Set(existing.permissions);
             for (const k of r.permissions)
                 add('grant', `${path}#${k}`, have.has(k) ? 'unchanged' : 'create');
@@ -127,20 +177,50 @@ function planOrgBootstrap(file, state, options) {
                     add('grant', `${path}#${k}`, 'not-in-file');
         }
     }
+    // Drift note (as G-012's units): per company of the file's tenants, the stored roles the file
+    // does not declare on it. Informational only: the bootstrap is additive and never renames or
+    // deletes a role.
     for (const r of state.roles) {
-        if (r.ownerTenant !== null &&
-            tenantKeys.has((0, org_names_js_1.nameKey)(r.ownerTenant)) &&
-            !declaredRoles.has((0, org_names_js_1.nameKey)(r.name))) {
-            add('role', `role:${r.name}`, 'not-in-file');
-        }
+        if (!inFileTenant(r.companyPath))
+            continue;
+        const node = declaredCompany.get((0, org_names_js_1.pathKey)(r.companyPath));
+        const declared = new Set((node?.roles ?? []).map((x) => orgUnitKey(x.name)));
+        if (declared.has(orgUnitKey(r.name)))
+            continue;
+        add('role', (0, exports.rolePath)(r.companyPath, r.name), 'not-in-file', (0, exports.orgUnitDriftNote)(r.name));
     }
     // ---- users, memberships, postings, credentials ----
     const stateUser = new Map(state.users.map((u) => [(0, org_names_js_1.nameKey)(u.username), u]));
     const emailHolder = new Map(state.emailHolders.map((h) => [(0, org_names_js_1.nameKey)(h.email), h.username]));
+    const loginNameHolder = new Map((state.loginNameHolders ?? []).map((h) => [h.loginName.toLowerCase(), h.username]));
     const declaredUsers = new Set();
-    const postingKey = (p) => [(0, org_names_js_1.nameKey)(p.role), (0, org_names_js_1.nameKey)(p.department ?? ''), (0, org_names_js_1.nameKey)(p.branch ?? '')].join('|');
+    const postingKey = (p) => [orgUnitKey(p.role), orgUnitKey(p.department ?? ''), orgUnitKey(p.branch ?? '')].join('|');
     const postingPath = (user, company, p) => `user:${user}@${company} role:${p.role}${p.department ? ` dept:${p.department}` : ''}${p.branch ? ` branch:${p.branch}` : ''}`;
-    const planUser = (username, email, company, postings, isRoot) => {
+    /**
+     * G-012: a posting resolves its department/branch within its OWN company (the posting check
+     * reads that company's junction rows). One declared only on an ancestor in the file, and not
+     * held by the company in the database, could never be posted: refuse it at plan time.
+     */
+    const postingUnitProblem = (company, p) => {
+        const units = unitsOf(company);
+        for (const [kind, name] of [
+            ['department', p.department],
+            ['branch', p.branch],
+        ]) {
+            if (name !== undefined && !units[kind].has(orgUnitKey(name))) {
+                return `${kind} "${name}" is not one of company "${company}"'s own ${kind === 'department' ? 'departments' : 'branches'}; declare it on that company`;
+            }
+        }
+        return undefined;
+    };
+    const addPostingCreate = (path, company, p) => {
+        const problem = postingUnitProblem(company, p);
+        if (problem === undefined)
+            add('posting', path, 'create');
+        else
+            add('posting', path, 'conflict', problem);
+    };
+    const planUser = (username, email, company, postings, isRoot, loginName) => {
         declaredUsers.add((0, org_names_js_1.nameKey)(username));
         const path = `user:${username}`;
         const existing = stateUser.get((0, org_names_js_1.nameKey)(username));
@@ -150,11 +230,17 @@ function planOrgBootstrap(file, state, options) {
                 add('user', path, 'conflict', `email of "${username}" is already held by another user`);
                 return;
             }
+            // Auth capabilities R1.10: login names are global; a new user cannot take a held one.
+            const nameHolder = loginName === undefined ? undefined : loginNameHolder.get(loginName);
+            if (nameHolder !== undefined && (0, org_names_js_1.nameKey)(nameHolder) !== (0, org_names_js_1.nameKey)(username)) {
+                add('user', path, 'conflict', `login name of "${username}" is already held by another user`);
+                return;
+            }
             add('user', path, 'create');
             if (isRoot)
                 add('credential', path, 'create', 'password credential from the operator-supplied root password');
             for (const p of postings)
-                add('posting', postingPath(username, company, p), 'create');
+                addPostingCreate(postingPath(username, company, p), company, p);
             if (isRoot)
                 add('root_flag', path, 'create');
             return;
@@ -186,7 +272,21 @@ function planOrgBootstrap(file, state, options) {
             add('user', path, 'drift', 'user exists with no membership; add it from the admin console, the bootstrap plans nothing for it');
             return;
         }
-        add('user', path, emailDiffers ? 'drift' : 'unchanged', emailDiffers ? 'email differs from the file; not overwritten' : undefined);
+        // Auth capabilities R1.7: an existing user's login name is never set or changed here (as its
+        // email): a stored one that differs from the file's, or none stored, is reported only.
+        const storedLoginName = typeof existing.loginName === 'string' && existing.loginName !== ''
+            ? existing.loginName.toLowerCase()
+            : null;
+        const loginNameDiffers = loginName !== undefined && storedLoginName !== loginName;
+        const drifts = [
+            ...(emailDiffers ? ['email differs from the file; not overwritten'] : []),
+            ...(loginNameDiffers
+                ? [
+                    'login name differs from the file; not set or overwritten (set it from the admin console)',
+                ]
+                : []),
+        ];
+        add('user', path, drifts.length > 0 ? 'drift' : 'unchanged', drifts.length > 0 ? drifts.join('; ') : undefined);
         // A root holds no membership: root is barred from the data plane, and its home company only
         // anchors the credential (`ic_tenant_id`). Planning one would be denied and never converge.
         const declaredKey = (0, org_names_js_1.pathKey)(company);
@@ -198,7 +298,7 @@ function planOrgBootstrap(file, state, options) {
         else if (!membership) {
             add('membership', mpath, 'create');
             for (const p of postings)
-                add('posting', postingPath(username, company, p), 'create');
+                addPostingCreate(postingPath(username, company, p), company, p);
         }
         else if (!membership.active) {
             add('membership', mpath, 'drift', 'inactive membership; the bootstrap never activates it');
@@ -211,7 +311,11 @@ function planOrgBootstrap(file, state, options) {
             add('membership', mpath, 'unchanged');
             const have = new Set(membership.postings.map(postingKey));
             for (const p of postings) {
-                add('posting', postingPath(username, company, p), have.has(postingKey(p)) ? 'unchanged' : 'create');
+                const path = postingPath(username, company, p);
+                if (have.has(postingKey(p)))
+                    add('posting', path, 'unchanged');
+                else
+                    addPostingCreate(path, company, p);
             }
         }
         if (isRoot) {
@@ -258,11 +362,11 @@ function planOrgBootstrap(file, state, options) {
     };
     const tenantPath = (tenantName, rel) => rel === undefined ? tenantName : `${tenantName}/${rel}`;
     for (const r of file.roots)
-        planUser(r.username, r.email, r.homeCompany, [], true);
+        planUser(r.username, r.email, r.homeCompany, [], true, r.loginName);
     for (const c of companies) {
         for (const u of c.node.users ?? []) {
             const company = u.company === undefined ? c.path : tenantPath(c.tenant, u.company);
-            planUser(u.username, u.email, company, u.postings ?? [], false);
+            planUser(u.username, u.email, company, u.postings ?? [], false, u.loginName);
         }
     }
     for (const u of state.users) {

package/dist/features/org-bootstrap/org-state.reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-state.reader.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-state.reader.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAuB,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,KAAK,EAEV,QAAQ,EAMT,MAAM,yBAAyB,CAAC;AAEjC,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,CAAC;CAC/D;AA6CD,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,qBAAqB;IAElD,IAAI,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;CA6NtD"}
+{"version":3,"file":"org-state.reader.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-state.reader.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAuB,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAErF,OAAO,KAAK,EAEV,QAAQ,EAMT,MAAM,yBAAyB,CAAC;AAEjC,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,CAAC;CAC/D;AAuCD,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,qBAAqB;IAElD,IAAI,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;CA2OtD"}

package/dist/features/org-bootstrap/org-state.reader.js

@@ -6,8 +6,9 @@ exports.OrgStateReader = void 0;
  *
  * Issues SELECTs only, every name bound as a parameter, database names taken from the injected
  * `schemas` (never a literal). Scope: the file's tenants' subtrees (top-level companies matched by name,
- * then `scope_closure`), plus the global lookups the planner's conflicts need (roles by name and the
- * tenant that owns them, usernames, emails, credential state). The row-to-state mapping is proven live.
+ * then `scope_closure`), plus the global lookups the planner's conflicts need (usernames, emails,
+ * credential state). Roles, like departments and branches, are read per owner company inside the
+ * subtrees (G-013: names are unique per company only). The row-to-state mapping is proven live.
  * A query failure propagates: a partial state is never returned.
  */
 const guard_1 = require("@astram/guard");
@@ -15,26 +16,19 @@ const org_names_js_1 = require("./org-names.js");
 /** `?, ?, ?`; an empty list reads as `NULL` so the clause stays valid SQL and matches nothing. */
 const marks = (n) => n === 0 ? 'NULL' : Array.from({ length: n }, () => '?').join(', ');
 const str = (v) => (v === null || v === undefined ? '' : String(v));
-const strOrNull = (v) => (v === null || v === undefined ? null : String(v));
 function collect(file) {
     const names = {
         tenants: [],
-        roles: new Set(),
-        departments: new Set(),
-        branches: new Set(),
         usernames: new Set(),
         emails: new Set(),
+        loginNames: new Set(),
     };
     const walk = (c) => {
-        for (const d of c.departments ?? [])
-            names.departments.add(d);
-        for (const b of c.branches ?? [])
-            names.branches.add(b);
-        for (const r of c.roles ?? [])
-            names.roles.add(r.name);
         for (const u of c.users ?? []) {
             names.usernames.add(u.username);
             names.emails.add(u.email);
+            if (u.loginName !== undefined)
+                names.loginNames.add(u.loginName);
         }
         for (const ch of c.children ?? [])
             walk(ch);
@@ -46,14 +40,14 @@ function collect(file) {
     for (const r of file.roots) {
         names.usernames.add(r.username);
         names.emails.add(r.email);
+        if (r.loginName !== undefined)
+            names.loginNames.add(r.loginName);
     }
     return {
         tenants: names.tenants,
-        roles: [...names.roles],
-        departments: [...names.departments],
-        branches: [...names.branches],
         usernames: [...names.usernames],
         emails: [...names.emails],
+        loginNames: [...names.loginNames],
     };
 }
 class OrgStateReader {
@@ -100,30 +94,22 @@ class OrgStateReader {
         };
         markAmbiguous(tenantRows, (r) => (0, org_names_js_1.nameKey)(str(r.c_name)), (r) => str(r.c_name));
         markAmbiguous(subtreeRows.filter((r) => r.c_parent_uuid !== null && r.c_parent_uuid !== undefined), (r) => `${str(r.c_parent_uuid)}\u0000${(0, org_names_js_1.nameKey)(str(r.c_name))}`, (r) => pathOf(str(r.c_uuid)));
-        // 3. catalogs and the company junctions
-        const deptCatalog = await query(`SELECT d_name FROM ${app}.departments WHERE d_name IN (${marks(names.departments.length)})`, names.departments);
-        const branchCatalog = await query(`SELECT b_name FROM ${app}.branches WHERE b_name IN (${marks(names.branches.length)})`, names.branches);
-        const deptJunction = await query(`SELECT cd.cd_company_uuid, d.d_name FROM ${app}.company_departments cd ` +
-            `JOIN ${app}.departments d ON d.d_uuid = cd.cd_department_uuid WHERE cd.cd_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
-        const branchJunction = await query(`SELECT cb.cb_company_uuid, b.b_name FROM ${app}.company_branches cb ` +
-            `JOIN ${app}.branches b ON b.b_uuid = cb.cb_branch_uuid WHERE cb.cb_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
+        // 3. each company's OWN departments and branches (G-012: the owner column, migration 105;
+        //    no row is shared between companies, so there is no global catalog to read)
+        const deptRows = await query(`SELECT d_company_uuid, d_name FROM ${app}.departments WHERE d_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
+        const branchRows = await query(`SELECT b_company_uuid, b_name FROM ${app}.branches WHERE b_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
         const companies = new Map();
         for (const uuid of subtreeUuids) {
             companies.set(uuid, { path: pathOf(uuid), departments: [], branches: [] });
         }
-        for (const r of deptJunction)
-            companies.get(str(r.cd_company_uuid))?.departments.push(str(r.d_name));
-        for (const r of branchJunction)
-            companies.get(str(r.cb_company_uuid))?.branches.push(str(r.b_name));
-        // 4. roles by name or owned in the subtrees; owner's top-level tenant; held outside the subtrees
-        const roleRows = await query(`SELECT r.r_uuid, r.r_name, r.r_owner_company_uuid, t.c_name AS owner_tenant, ` +
-            `EXISTS (SELECT 1 FROM ${app}.membership_posting mp JOIN ${app}.company_membership cm ON cm.cm_uuid = mp.mp_membership_uuid ` +
-            `WHERE mp.mp_role_uuid = r.r_uuid AND cm.cm_company_uuid NOT IN (` +
-            `SELECT sc2.descendant_uuid FROM ${authz}.scope_closure sc2 WHERE sc2.ancestor_uuid IN (${marks(tenantUuids.length)}))) AS held_outside ` +
-            `FROM ${app}.roles r ` +
-            `LEFT JOIN ${authz}.scope_closure oc ON oc.descendant_uuid = r.r_owner_company_uuid ` +
-            `LEFT JOIN ${app}.companies t ON t.c_uuid = oc.ancestor_uuid AND t.c_parent_uuid IS NULL ` +
-            `WHERE r.r_name IN (${marks(names.roles.length)}) OR r.r_owner_company_uuid IN (${marks(subtreeUuids.length)})`, [...tenantUuids, ...names.roles, ...subtreeUuids]);
+        for (const r of deptRows)
+            companies.get(str(r.d_company_uuid))?.departments.push(str(r.d_name));
+        for (const r of branchRows)
+            companies.get(str(r.b_company_uuid))?.branches.push(str(r.b_name));
+        // 4. each company's OWN roles (G-013: the owner column; a name is unique per company only, so
+        //    roles are read by (owner, name) and never merged by name across companies)
+        const roleRows = await query(`SELECT r_uuid, r_name, r_owner_company_uuid FROM ${app}.roles ` +
+            `WHERE r_owner_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
         const roleUuids = roleRows.map((r) => str(r.r_uuid));
         const grantRows = await query(`SELECT rp_role_uuid, rp_perm_key FROM ${authz}.role_permission WHERE rp_role_uuid IN (${marks(roleUuids.length)})`, roleUuids);
         const grants = new Map();
@@ -132,19 +118,13 @@ class OrgStateReader {
             list.push(str(g.rp_perm_key));
             grants.set(str(g.rp_role_uuid), list);
         }
-        const roles = [];
-        for (const r of roleRows) {
-            if (roles.some((x) => x.name === str(r.r_name)))
-                continue; // duplicate rows from closure joins
-            roles.push({
-                name: str(r.r_name),
-                ownerTenant: strOrNull(r.owner_tenant),
-                heldOutside: Number(r.held_outside) === 1,
-                permissions: grants.get(str(r.r_uuid)) ?? [],
-            });
-        }
+        const roles = roleRows.map((r) => ({
+            companyPath: pathOf(str(r.r_owner_company_uuid)),
+            name: str(r.r_name),
+            permissions: grants.get(str(r.r_uuid)) ?? [],
+        }));
         // 5. users (by username, or a member of the subtrees) with their credential
-        const userRows = await query(`SELECT u.u_uuid, u.u_username, u.u_email, u.u_is_platform_superuser, ic.ic_password_hash ` +
+        const userRows = await query(`SELECT u.u_uuid, u.u_username, u.u_email, u.u_login_name, u.u_is_platform_superuser, ic.ic_password_hash ` +
             `FROM ${app}.users u LEFT JOIN ${identity}.identity_credential ic ON ic.ic_principal_id = u.u_uuid ` +
             `WHERE u.u_username IN (${marks(names.usernames.length)}) ` +
             `OR u.u_uuid IN (SELECT cm_user_uuid FROM ${app}.company_membership WHERE cm_company_uuid IN (${marks(subtreeUuids.length)}))`, [...names.usernames, ...subtreeUuids]);
@@ -156,6 +136,18 @@ class OrgStateReader {
             `SELECT sc3.descendant_uuid FROM ${authz}.scope_closure sc3 WHERE sc3.ancestor_uuid IN (${marks(tenantUuids.length)}))`, [...userUuids, ...tenantUuids]);
         const outsideUsers = new Set(outsideRows.map((r) => str(r.cm_user_uuid)));
         const emailRows = await query(`SELECT u_email, u_username FROM ${app}.users WHERE u_email IN (${marks(names.emails.length)})`, names.emails);
+        // Auth capabilities R1.10: who holds the file's login names (read only when it declares any).
+        const loginNameRows = names.loginNames.length === 0
+            ? null
+            : await query(`SELECT u_login_name, u_username FROM ${app}.users WHERE u_login_name IN (${marks(names.loginNames.length)})`, names.loginNames);
+        // Review round 1, item F: a legacy (non-email) sign-in hint equal to a file login name holds it
+        // too (the sign-in lookup would match two accounts). Compared under the column's collation; an
+        // orphan credential (no user row) is a holder with no username.
+        const hintRows = names.loginNames.length === 0
+            ? []
+            : await query(`SELECT ic.ic_identity_hint AS hint, u.u_username FROM ${identity}.identity_credential ic ` +
+                `LEFT JOIN ${app}.users u ON u.u_uuid = ic.ic_principal_id ` +
+                `WHERE ic.ic_identity_hint IN (${marks(names.loginNames.length)})`, names.loginNames);
         // 6. memberships and postings inside the subtrees
         const memberRows = await query(`SELECT cm_uuid, cm_user_uuid, cm_company_uuid, cm_is_active FROM ${app}.company_membership ` +
             `WHERE cm_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
@@ -205,6 +197,9 @@ class OrgStateReader {
             users.set(id, {
                 username: str(u.u_username),
                 email: str(u.u_email),
+                ...(u.u_login_name !== null && u.u_login_name !== undefined
+                    ? { loginName: str(u.u_login_name) }
+                    : {}),
                 credential,
                 isPlatformSuperuser: Number(u.u_is_platform_superuser) === 1,
                 memberships: memberships.get(id) ?? [],
@@ -213,11 +208,23 @@ class OrgStateReader {
         }
         return {
             companies: [...companies.values()],
-            departments: deptCatalog.map((r) => str(r.d_name)),
-            branches: branchCatalog.map((r) => str(r.b_name)),
             roles,
             users: [...users.values()],
             emailHolders: emailRows.map((r) => ({ email: str(r.u_email), username: str(r.u_username) })),
+            ...(loginNameRows === null
+                ? {}
+                : {
+                    loginNameHolders: [
+                        ...loginNameRows.map((r) => ({
+                            loginName: str(r.u_login_name),
+                            username: str(r.u_username),
+                        })),
+                        ...hintRows.map((r) => ({
+                            loginName: str(r.hint),
+                            username: str(r.u_username),
+                        })),
+                    ],
+                }),
             ambiguousCompanies,
         };
     }

package/dist/features/org-bootstrap/run-org-bootstrap.d.ts

@@ -11,7 +11,10 @@ export interface RunOrgBootstrapOptions {
     /** The human operator (audit `onBehalfOf`); else `ASTRAM_BOOTSTRAP_OPERATOR`. Required with `apply`. */
     operator?: string;
     env?: NodeJS.ProcessEnv;
-    /** Claim roles that have no owner and that nobody outside the file's tenants holds. */
+    /**
+     * No longer needed (G-013): roles belong to the company that declares them, so there is nothing
+     * to claim. Accepted for compatibility; it changes nothing and prints {@link CLAIM_UNOWNED_NOTICE}.
+     */
     claimUnownedRoles?: boolean;
     /** Issue a fresh set-password link to users whose credential is still locked. */
     reissueLinks?: boolean;
@@ -57,5 +60,7 @@ export interface OrgBootstrapReport {
     /** Uuid of every root in the file that exists after the run. */
     rootIds: string[];
 }
+/** Printed when `claimUnownedRoles` is passed (G-013, spec §5.E): the flag now does nothing. */
+export declare const CLAIM_UNOWNED_NOTICE = "--claim-unowned-roles is no longer needed: roles belong to the company that declares them.";
 export declare function runOrgBootstrap(app: INestApplicationContext, opts: RunOrgBootstrapOptions): Promise<OrgBootstrapReport>;
 //# sourceMappingURL=run-org-bootstrap.d.ts.map

package/dist/features/org-bootstrap/run-org-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-org-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/run-org-bootstrap.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAQ,MAAM,gBAAgB,CAAC;AA+BpE,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAEL,KAAK,OAAO,EAIb,MAAM,yBAAyB,CAAC;AAiBjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwFD,wBAAsB,eAAe,CACnC,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAqtB7B"}
+{"version":3,"file":"run-org-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/run-org-bootstrap.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAQ,MAAM,gBAAgB,CAAC;AA8BpE,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAIL,KAAK,OAAO,EAIb,MAAM,yBAAyB,CAAC;AAkBjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwCD,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,+FAC6D,CAAC;AA8D/F,wBAAsB,eAAe,CACnC,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAmqB7B"}