@astram/identity 0.3.0 → 0.4.0

package/dist/features/service-account/service-account.store.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccountStore = void 0;
+const APP = 'shield_app';
+/** Normalize a JSON-array column (driver returns array OR string) → string[]. Fail-safe to []. */
+function jsonArray(v) {
+    const arr = Array.isArray(v)
+        ? v
+        : typeof v === 'string'
+            ? (() => {
+                try {
+                    return JSON.parse(v);
+                }
+                catch {
+                    return [];
+                }
+            })()
+            : [];
+    return Array.isArray(arr) ? arr.filter((x) => typeof x === 'string') : [];
+}
+function toRow(r) {
+    return {
+        id: r.sa_id,
+        tenantId: r.sa_tenant_id,
+        label: r.sa_label,
+        scopeSubtreeNodeIds: jsonArray(r.sa_scope_subtree),
+        roleIds: jsonArray(r.sa_role_ids),
+        status: r.sa_status,
+        createdBy: r.sa_created_by,
+        createdAtMs: Number(r.sa_created_at_ms),
+        updatedAtMs: r.sa_updated_at_ms === null ? null : Number(r.sa_updated_at_ms),
+    };
+}
+/**
+ * Build the own-tenant `AND sa_tenant_id IN (?, …)` fragment for a non-root caller. Root → no
+ * fragment (spans all). A non-root with an empty subtree yields `AND 1=0` (matches nothing —
+ * fail-closed). Node ids are `?`-bound. The caller splices `params` where `sql` sits.
+ */
+function tenantScope(scope) {
+    if (scope.isRoot)
+        return { sql: '', params: [] };
+    if (scope.nodeIds.length === 0)
+        return { sql: ' AND 1=0', params: [] };
+    const ph = scope.nodeIds.map(() => '?').join(', ');
+    return { sql: ` AND sa_tenant_id IN (${ph})`, params: [...scope.nodeIds] };
+}
+const COLS = 'sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_status, sa_created_by, sa_created_at_ms, sa_updated_at_ms';
+/** Dedupe an id list keeping first-seen order (drops empties). */
+function uniqueIds(ids) {
+    return [...new Set(ids.filter((x) => typeof x === 'string' && x.length > 0))];
+}
+class ServiceAccountStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    // ── directory reads (names for the picker, the view labels and the ceiling messages) ─────
+    // Read-only lookups over the global role catalog + the company tree (`shield_app.roles`,
+    // `shield_app.companies`). Ids are `?`-bound; an empty id list short-circuits (no query).
+    /** Roles by id (unknown ids are simply absent — the caller supplies a fallback label). */
+    async rolesByIds(ids) {
+        const u = uniqueIds(ids);
+        if (u.length === 0)
+            return [];
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${APP}\`.\`roles\` WHERE r_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY r_name`, u));
+        return rows.map((r) => ({ id: r.id, name: r.name }));
+    }
+    /** Every role in the catalog (ROOT's assignable set). */
+    async allRoles() {
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${APP}\`.\`roles\` ORDER BY r_name`, []));
+        return rows.map((r) => ({ id: r.id, name: r.name }));
+    }
+    /** Companies (scope nodes) by id, with their parent handle. Unknown ids are absent. */
+    async nodesByIds(ids) {
+        const u = uniqueIds(ids);
+        if (u.length === 0)
+            return [];
+        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY c_name`, u));
+        return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
+    }
+    /** Every company (ROOT's assignable scope — root reaches all). */
+    async allNodes() {
+        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` ORDER BY c_name`, []));
+        return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
+    }
+    /** List the caller's own-tenant accounts (newest first). Root sees all. */
+    async list(scope) {
+        const t = tenantScope(scope);
+        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${APP}\`.\`service_account\` WHERE 1=1${t.sql} ORDER BY sa_created_at_ms DESC`, t.params));
+        return rows.map(toRow);
+    }
+    /** Fetch one account BY id, scoped to the caller's subtree. Cross-tenant/unknown → null (404). */
+    async getById(id, scope) {
+        const t = tenantScope(scope);
+        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${APP}\`.\`service_account\` WHERE sa_id = ?${t.sql} LIMIT 1`, [id, ...t.params]));
+        return rows[0] ? toRow(rows[0]) : null;
+    }
+    /**
+     * Insert a new account. `tenantId` is server-stamped (from the session) — never client input.
+     * `scopeSubtreeNodeIds`/`roleIds` are stored as JSON. Idempotency is the caller's (a fresh uuid
+     * per create); the id is unique by construction.
+     */
+    async insert(input) {
+        await this.pool.query(`INSERT INTO \`${APP}\`.\`service_account\`
+         (sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_status,
+          sa_created_by, sa_created_at_ms, sa_updated_at_ms)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`, [
+            input.id,
+            input.tenantId,
+            input.label,
+            JSON.stringify([...input.scopeSubtreeNodeIds]),
+            JSON.stringify([...input.roleIds]),
+            input.status,
+            input.createdBy,
+            input.createdAtMs,
+        ]);
+    }
+    /**
+     * Update an account's mutable fields (label/scope/roles/status), scoped to the caller's subtree.
+     * Returns the number of rows changed — 0 means the id was not in the caller's subtree (→ 404).
+     * Only the provided fields are set; `sa_updated_at_ms` is always stamped.
+     */
+    async update(id, scope, patch, updatedAtMs, 
+    /**
+     * Optimistic guard: when given, the row is only written if `sa_updated_at_ms` still equals this
+     * value (NULL-safe). A concurrent edit makes it return 0, so a read-modify-write can't resurrect
+     * access another admin just removed.
+     */
+    expectedUpdatedAtMs) {
+        const sets = [];
+        const params = [];
+        if (patch.label !== undefined) {
+            sets.push('sa_label = ?');
+            params.push(patch.label);
+        }
+        if (patch.scopeSubtreeNodeIds !== undefined) {
+            sets.push('sa_scope_subtree = ?');
+            params.push(JSON.stringify([...patch.scopeSubtreeNodeIds]));
+        }
+        if (patch.roleIds !== undefined) {
+            sets.push('sa_role_ids = ?');
+            params.push(JSON.stringify([...patch.roleIds]));
+        }
+        if (patch.status !== undefined) {
+            sets.push('sa_status = ?');
+            params.push(patch.status);
+        }
+        // Always stamp the edit time (even for a no-field patch, which the service disallows anyway).
+        sets.push('sa_updated_at_ms = ?');
+        params.push(updatedAtMs);
+        const t = tenantScope(scope);
+        const guard = expectedUpdatedAtMs !== undefined ? ' AND sa_updated_at_ms <=> ?' : '';
+        const guardParams = expectedUpdatedAtMs !== undefined ? [expectedUpdatedAtMs] : [];
+        const res = (await this.pool.query(`UPDATE \`${APP}\`.\`service_account\` SET ${sets.join(', ')} WHERE sa_id = ?${t.sql}${guard}`, [...params, id, ...t.params, ...guardParams]));
+        return res.affectedRows ?? 0;
+    }
+}
+exports.ServiceAccountStore = ServiceAccountStore;

package/dist/features/share/share.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.controller.js","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;GAYG;AACH,2CAUwB;AACxB,yCAAmE;AAEnE,yDAAqE;AAOrE,gGAAgG;AAChG,SAAS,cAAc,CAAC,IAAa;IACnC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA0B,CAAC;IAChD,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;IACtG,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;IAC/G,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,4BAAmB,CAAC,iBAAiB,CAAC,CAAC;IAChG,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC;AACJ,CAAC;AAGM,IAAM,eAAe,GAArB,MAAM,eAAe;IACG;IAA7B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAErD;;;;OAIG;IAGG,AAAN,KAAK,CAAC,IAAI,CACD,GAAkB,EACP,OAAgB,EACf,QAAiB;QAEpC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9E,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,8BAAsB;gBAAE,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACjF,MAAM,CAAC,CAAC,CAAC,gDAAgD;QAC3D,CAAC;IACH,CAAC;IAED;;;;OAIG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAkB,EAAU,IAAa;QAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,8BAAsB;gBAAE,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACjF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,OAAO,CAAQ,GAAkB,EAAU,IAAa;QAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,8BAAsB;gBAAE,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACjF,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;CACF,CAAA;AA3DY,0CAAe;AAUpB;IAFL,IAAA,YAAG,EAAC,eAAe,CAAC;IACpB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAErD,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,SAAS,CAAC,CAAA;IAChB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;;;;2CAUnB;AASK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5C,WAAA,IAAA,YAAG,GAAE,CAAA;IAAsB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4CAS7C;AAQK;IAFL,IAAA,eAAM,EAAC,eAAe,CAAC;IACvB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1C,WAAA,IAAA,YAAG,GAAE,CAAA;IAAsB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;8CAS/C;0BA1DU,eAAe;IAD3B,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAEgB,+BAAY;GADtC,eAAe,CA2D3B"}

package/dist/features/share/share.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.service.js","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":";;;AAiFA,MAAa,YAAY;IAEJ;IACA;IAFnB,YACmB,MAA2C,EAC3C,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAqC;QAC3C,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,KAAgB,EAAE,GAAiB;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,kBAAkB;YAC5C,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,kDAAkD;SACvE,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,OAAO,CAAC,KAAgB,EAAE,GAAiB;QAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,KAAgB,EAChB,OAAe,EACf,QAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;YACP,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,EAAE;SACnB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,CAChB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrB,WAAW,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACpC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAC/C,CAAC,CAAC,WAAW,EACb,KAAK,CAAC,QAAQ,CACf;YACD,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;CACF;AAhED,oCAgEC"}

package/dist/features/shared/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/features/shared/http.ts"],"names":[],"mappings":";;AAQA,wBAEC;AAQD,8BAQC;AAnBD,8DAA8D;AAC9D,SAAgB,MAAM,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,CAAU;IAClC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/features/shared/list-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-query.js","sourceRoot":"","sources":["../../../src/features/shared/list-query.ts"],"names":[],"mappings":";;;AAqBA,wCAsBC;AAsBD,wCAuBC;AAzED;;;;;GAKG;AACH,SAAgB,cAAc,CAC5B,MAA8B,EAC9B,YAA+B,EAC/B,UAA6B;IAE7B,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAMP,EAAE,CAAC;IACP,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACxB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,gEAAgE;AACnD,QAAA,aAAa,GAAG,EAAE,CAAC;AACnB,QAAA,SAAS,GAAG,GAAG,CAAC;AAE7B;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,CAA2B;IAKxD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GACT,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAS,CAAC,CAAC,CAAC,CAAC,qBAAa,CAAC;IAE7F,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;IAElC,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,SAAS,GAAmB,CAAC,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAE3E,MAAM,MAAM,GAAe,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC9C,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAEnC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC"}

package/dist/features/shared/named-option.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-option.js","sourceRoot":"","sources":["../../../src/features/shared/named-option.ts"],"names":[],"mappings":""}

package/dist/features/shared/record-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-resolver.js","sourceRoot":"","sources":["../../../src/features/shared/record-resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2CAAgD;AAEhD;;;GAGG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACH;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD,SAAS,CAAC,OAAe,EAAE,IAAY;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AANY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAE2B,uBAAc;GADzC,qBAAqB,CAMjC"}

package/dist/features/user/user.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.controller.js","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwF;AACxF,yCAA2C;AAC3C,uDAAgD;AAChD,2DAA4E;AAE5E,uFAAuF;AACvF,uFAAuF;AACvF,4EAA4E;AAErE,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,KAAkB;QAAlB,UAAK,GAAL,KAAK,CAAa;IAAG,CAAC;IAEnD;;;;OAIG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAU,KAAmB;QAC1C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,uDAAuD;IAGjD,AAAN,KAAK,CAAC,UAAU,CAAS,IAA2B;QAClD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,IAAI,UAAU,CAAC,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;IAED;0CACsC;IAGtC,OAAO,CAAgB,IAAY;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,uDAAuD;IAGjD,AAAN,KAAK,CAAC,UAAU,CACC,IAAY,EACnB,IAA4D;QAEpE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,uDAAuD;IAGjD,AAAN,KAAK,CAAC,UAAU,CAAgB,IAAY;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAlDY,wCAAc;AAUnB;IAFL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAA,IAAA,cAAK,GAAE,CAAA;;;;+CAIvB;AAKK;IAFL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChC,WAAA,IAAA,aAAI,GAAE,CAAA;;;;gDAGvB;AAMD;IAFC,IAAA,YAAG,EAAC,aAAa,CAAC;IAClB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;;;;6CAErB;AAKK;IAFL,IAAA,YAAG,EAAC,aAAa,CAAC;IAClB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE/C,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,aAAI,GAAE,CAAA;;;;gDAIR;AAKK;IAFL,IAAA,eAAM,EAAC,aAAa,CAAC;IACrB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChC,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;;;;gDAG9B;yBAjDU,cAAc;IAD1B,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAEe,6BAAW;GADpC,cAAc,CAkD1B"}

package/dist/features/user/user.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.service.js","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2CAA+D;AAC/D,2DAA0E;AAE1E,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,OAAO,CAAU,CAAC;AAC1D,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAE/E;;;;GAIG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IACO;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD,qBAAqB;IACrB,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,MAAmB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAA,8BAAc,EAAC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,0BAA0B;IAC1B,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,qBAAqB;IACrB,UAAU,CACR,IAAY,EACZ,KAA6D;QAE7D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,qBAAqB;IACrB,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;AA9BY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAE2B,uBAAc;GADzC,WAAW,CA8BvB"}

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export { CompanyMembership } from './company-membership.object.js';
 export { MembershipPosting } from './membership-posting.object.js';
 export { CompanyDepartment } from './company-department.object.js';
 export { CompanyBranch } from './company-branch.object.js';
+export { ServiceAccount } from './service-account.object.js';
 export { identityMigrationsDir } from './migrations-dir.js';
 /**
  * All identity objects, registered with the engine at boot (same set + order as before).

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,EACvB,gCAAgC,GACjC,MAAM,0CAA0C,CAAC;AAElD;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,EACvB,gCAAgC,GACjC,MAAM,0CAA0C,CAAC;AAElD;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.createIdentityAuthzPool = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.createIdentityAuthzPool = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -25,6 +25,8 @@ var company_department_object_js_1 = require("./company-department.object.js");
 Object.defineProperty(exports, "CompanyDepartment", { enumerable: true, get: function () { return company_department_object_js_1.CompanyDepartment; } });
 var company_branch_object_js_1 = require("./company-branch.object.js");
 Object.defineProperty(exports, "CompanyBranch", { enumerable: true, get: function () { return company_branch_object_js_1.CompanyBranch; } });
+var service_account_object_js_1 = require("./service-account.object.js");
+Object.defineProperty(exports, "ServiceAccount", { enumerable: true, get: function () { return service_account_object_js_1.ServiceAccount; } });
 var migrations_dir_js_1 = require("./migrations-dir.js");
 Object.defineProperty(exports, "identityMigrationsDir", { enumerable: true, get: function () { return migrations_dir_js_1.identityMigrationsDir; } });
 /**

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,yDAA8C;AAArC,4GAAA,OAAO,OAAA;AAChB,mDAAwC;AAA/B,sGAAA,IAAI,OAAA;AACb,mDAAwC;AAA/B,sGAAA,IAAI,OAAA;AACb,+DAAoD;AAA3C,kHAAA,UAAU,OAAA;AACnB,uDAA4C;AAAnC,0GAAA,MAAM,OAAA;AACf,+EAAmE;AAA1D,iIAAA,iBAAiB,OAAA;AAC1B,+EAAmE;AAA1D,iIAAA,iBAAiB,OAAA;AAC1B,+EAAmE;AAA1D,iIAAA,iBAAiB,OAAA;AAC1B,uEAA2D;AAAlD,yHAAA,aAAa,OAAA;AACtB,yDAA4D;AAAnD,0HAAA,qBAAqB,OAAA;AAE9B;;;;GAIG;AACH,2CAA+C;AAAtC,6GAAA,eAAe,OAAA;AAExB;;;;;;GAMG;AACH,2DAAwF;AAA/E,4HAAA,sBAAsB,OAAA;AAAE,8HAAA,wBAAwB,OAAA;AAEzD;;;;;GAKG;AACH,oFAA8E;AAArE,mIAAA,qBAAqB,OAAA;AAE9B;;;;;GAKG;AACH,oFAGkD;AAFhD,kIAAA,uBAAuB,OAAA;AACvB,2IAAA,gCAAgC,OAAA;AAGlC;;;;GAIG;AACH,oFAAiF;AAAxE,gIAAA,qBAAqB,OAAA;AAE9B;;;;;;GAMG;AACH,wFAAoF;AAA3E,mIAAA,sBAAsB,OAAA;AAE/B;;;;;;;GAOG;AACH,qFAAkF;AAAzE,4HAAA,mBAAmB,OAAA"}

package/dist/membership-posting.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-posting.object.js","sourceRoot":"","sources":["../src/membership-posting.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAuF;AACvF,qCAAkC;AAElC;;;;GAIG;AAkBI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE5B,IAAI,CAAU;IAGd,cAAc,CAAU;IAGxB,QAAQ,CAAU;IAGlB,cAAc,CAAU;IAGxB,UAAU,CAAU;IAEpB,yFAAyF;IACzF,4FAA4F;IAC5F,sFAAsF;IACtF,yFAAyF;IACzF,iFAAiF;IAEjF,aAAa,CAAU;IAGvB,cAAc,CAAU;IAGxB,SAAS,CAAU;CACpB,CAAA;AA7BY,8CAAiB;AAE5B;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;+CACjD;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yDAC9C;AAGxB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDAC9C;AAGlB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;yDAC9B;AAGxB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDAC9B;AAQpB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;;wDAC1D;AAGvB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;;yDAC3D;AAGxB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;;oDAClD;4BA5BR,iBAAiB;IAjB7B,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QACvC,qFAAqF;QACrF,wFAAwF;QACxF,oFAAoF;QACpF,yFAAyF;QACzF,kBAAkB;QAClB,SAAS,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,oBAAoB;YAC9B,WAAW,EAAE,yBAAyB,eAAM,uDAAuD,+BAAsB,GAAG;SAC7H;KACF,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;GACnC,iBAAiB,CA6B7B"}

package/dist/migrations-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations-dir.js","sourceRoot":"","sources":["../src/migrations-dir.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,yCAAiC;AAEpB,QAAA,qBAAqB,GAAW,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC"}

package/dist/objects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AActD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAIrD,CAAC"}
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAetD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAIrD,CAAC"}

package/dist/objects.js

@@ -13,9 +13,10 @@ const company_branch_object_js_1 = require("./company-branch.object.js");
 const cross_tenant_grant_object_js_1 = require("./cross-tenant-grant.object.js");
 const record_share_object_js_1 = require("./record-share.object.js");
 const shared_resource_object_js_1 = require("./shared-resource.object.js");
+const service_account_object_js_1 = require("./service-account.object.js");
 /** All identity objects, registered with the engine at boot (same set + order as before). */
 exports.identityObjects = [
     company_object_js_1.Company, user_object_js_1.User, role_object_js_1.Role, department_object_js_1.Department, branch_object_js_1.Branch,
     company_membership_object_js_1.CompanyMembership, membership_posting_object_js_1.MembershipPosting, company_department_object_js_1.CompanyDepartment, company_branch_object_js_1.CompanyBranch,
-    cross_tenant_grant_object_js_1.CrossTenantGrant, record_share_object_js_1.RecordShare, shared_resource_object_js_1.SharedResource,
+    cross_tenant_grant_object_js_1.CrossTenantGrant, record_share_object_js_1.RecordShare, shared_resource_object_js_1.SharedResource, service_account_object_js_1.ServiceAccount,
 ];

package/dist/objects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objects.js","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":";;;AAUA,2DAA8C;AAC9C,qDAAwC;AACxC,qDAAwC;AACxC,iEAAoD;AACpD,yDAA4C;AAC5C,iFAAmE;AACnE,iFAAmE;AACnE,iFAAmE;AACnE,yEAA2D;AAC3D,iFAAkE;AAClE,qEAAuD;AACvD,2EAA6D;AAE7D,6FAA6F;AAChF,QAAA,eAAe,GAA+B;IACzD,2BAAO,EAAE,qBAAI,EAAE,qBAAI,EAAE,iCAAU,EAAE,yBAAM;IACvC,gDAAiB,EAAE,gDAAiB,EAAE,gDAAiB,EAAE,wCAAa;IACtE,+CAAgB,EAAE,oCAAW,EAAE,0CAAc;CAC9C,CAAC"}

package/dist/record-share.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-share.object.js","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAE/D,6EAA6E;AAC7E,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B;;;;;;;;;;;;;;;;;GAiBG;AAQI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAEtB,IAAI,CAAU;IAGd,UAAU,CAAU;IAGpB,UAAU,CAAU;CACrB,CAAA;AATY,kCAAW;AAEtB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;yCAC7B;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;+CAC9B;AAGpB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;+CAC9B;sBART,WAAW;IAPvB,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,cAAc;QACvB,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KAC3C,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;GACnC,WAAW,CASvB"}

package/dist/role.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.object.js","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAuF;AACvF,qCAAkC;AAElC,8BAA8B;AAkBvB,IAAM,IAAI,GAAV,MAAM,IAAI;IAEf,IAAI,CAAU;IAGd,IAAI,CAAU;IAGd,SAAS,CAAU;CACpB,CAAA;AATY,oBAAI;AAEf;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;kCAChD;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kCAC9C;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;uCAClC;eARR,IAAI;IAjBhB,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAC1C,2FAA2F;QAC3F,0FAA0F;QAC1F,4FAA4F;QAC5F,4FAA4F;QAC5F,8CAA8C;QAC9C,SAAS,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,iCAAiC,eAAM,uCAAuC,eAAM,mGAAmG,+BAAsB,GAAG;SAC9N;KACF,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;GAClC,IAAI,CAShB"}

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":";;;AAAA,yEAAyE;AAC5D,QAAA,MAAM,GAAG,YAAY,CAAC"}

package/dist/service-account.object.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `service_account` — a machine principal (ADR-0007 / ADR-0033): the identity an AI agent, an
+ * MCP server, or a script authenticates AS (via an `ask_…` API key, whose HASHED versions live in
+ * `shield_authz.service_account_key`). One row = one machine account, created + scoped + revoked by
+ * a tenant admin from the Service Accounts admin page.
+ *
+ * `plane: 'control'` — creating/scoping/revoking a service account IS who-may-act administration
+ * (the same posture as `user`/`role`/`cross_tenant_grant`): the capped root and a scoped tenant
+ * admin may administer them; a non-root admin needs the `identity:service_account:*` grant.
+ *
+ * `system: true` (never `tenantScoped`) — like `user`/`cross_tenant_grant`, the row-level tenant
+ * column (`sa_tenant_id`) plus the store's own tenant-scoped SELECTs + the grant-ceiling enforce
+ * isolation; we do NOT route it through the RecordEngine's `tenantScoped` create-stamp baseline
+ * (its `ServiceAccountStore` writes it directly, stamping `sa_tenant_id` from the admin's session).
+ *
+ * `readScope: nodeColumn(sa_tenant_id)` (ADR-0027 / ADR-0030) — the account's own row carries its
+ * tenant node, so a NON-ROOT admin's list/read/update/delete is walled to rows whose `sa_tenant_id`
+ * is IN their reachable subtree (a cross-tenant id is invisible → 404, no existence leak). Root
+ * spans all. This is the read/write wall that makes "own tenant only" structural, not handler-level.
+ *
+ * Action vocabulary is administration, not CRUD data ops — see `@astram/guard`'s
+ * `identity-actions.ts` (`read`/`manage` for `service_account`).
+ */
+export declare class ServiceAccount {
+    id: string;
+    tenantId: string;
+    label: string;
+    status: string;
+    createdAtMs: number;
+}
+//# sourceMappingURL=service-account.object.d.ts.map

package/dist/service-account.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account.object.d.ts","sourceRoot":"","sources":["../src/service-account.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAQa,cAAc;IAEzB,EAAE,EAAG,MAAM,CAAC;IAGZ,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/service-account.object.js

@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccount = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * `service_account` — a machine principal (ADR-0007 / ADR-0033): the identity an AI agent, an
+ * MCP server, or a script authenticates AS (via an `ask_…` API key, whose HASHED versions live in
+ * `shield_authz.service_account_key`). One row = one machine account, created + scoped + revoked by
+ * a tenant admin from the Service Accounts admin page.
+ *
+ * `plane: 'control'` — creating/scoping/revoking a service account IS who-may-act administration
+ * (the same posture as `user`/`role`/`cross_tenant_grant`): the capped root and a scoped tenant
+ * admin may administer them; a non-root admin needs the `identity:service_account:*` grant.
+ *
+ * `system: true` (never `tenantScoped`) — like `user`/`cross_tenant_grant`, the row-level tenant
+ * column (`sa_tenant_id`) plus the store's own tenant-scoped SELECTs + the grant-ceiling enforce
+ * isolation; we do NOT route it through the RecordEngine's `tenantScoped` create-stamp baseline
+ * (its `ServiceAccountStore` writes it directly, stamping `sa_tenant_id` from the admin's session).
+ *
+ * `readScope: nodeColumn(sa_tenant_id)` (ADR-0027 / ADR-0030) — the account's own row carries its
+ * tenant node, so a NON-ROOT admin's list/read/update/delete is walled to rows whose `sa_tenant_id`
+ * is IN their reachable subtree (a cross-tenant id is invisible → 404, no existence leak). Root
+ * spans all. This is the read/write wall that makes "own tenant only" structural, not handler-level.
+ *
+ * Action vocabulary is administration, not CRUD data ops — see `@astram/guard`'s
+ * `identity-actions.ts` (`read`/`manage` for `service_account`).
+ */
+let ServiceAccount = class ServiceAccount {
+    id;
+    tenantId;
+    label;
+    status;
+    createdAtMs;
+};
+exports.ServiceAccount = ServiceAccount;
+__decorate([
+    (0, engine_1.Field)({ column: 'sa_id', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], ServiceAccount.prototype, "id", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sa_tenant_id', type: 'uuid', required: true, trusted: 'tenantId' }),
+    __metadata("design:type", String)
+], ServiceAccount.prototype, "tenantId", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sa_label', type: 'string', required: true }),
+    __metadata("design:type", String)
+], ServiceAccount.prototype, "label", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sa_status', type: 'string', role: 'status' }),
+    __metadata("design:type", String)
+], ServiceAccount.prototype, "status", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sa_created_at_ms', type: 'number' }),
+    __metadata("design:type", Number)
+], ServiceAccount.prototype, "createdAtMs", void 0);
+exports.ServiceAccount = ServiceAccount = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'service_account',
+        table: 'service_account',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'control', system: true },
+        readScope: { kind: 'nodeColumn', column: 'sa_tenant_id' },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'sa_id' })
+], ServiceAccount);

package/dist/shared-resource.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-resource.object.js","sourceRoot":"","sources":["../src/shared-resource.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,qCAAkC;AAElC;;;;;;;;;;;;;;;;;;;;GAoBG;AAQI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEzB,IAAI,CAAU;IAEd,yFAAyF;IAEzF,QAAQ,CAAU;IAGlB,KAAK,CAAU;CAChB,CAAA;AAVY,wCAAc;AAEzB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;4CACjD;AAId;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;;gDACnD;AAGlB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CAC/C;yBATJ,cAAc;IAP1B,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,iBAAiB;QAC1B,KAAK,EAAE,iBAAiB;QACxB,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;KAC9C,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;GACnC,cAAc,CAU1B"}

package/dist/user.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.object.js","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAuF;AACvF,qCAAkC;AAElC;;;;GAIG;AAqBI,IAAM,IAAI,GAAV,MAAM,IAAI;IAEf,IAAI,CAAU;IAGd,QAAQ,CAAU;IAGlB,KAAK,CAAU;IAGf,MAAM,CAAU;IAGhB,SAAS,CAAU;CACpB,CAAA;AAfY,oBAAI;AAEf;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;kCAChD;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;;sCAChE;AAGlB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;;mCAC9B;AAGf;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;;oCAC9C;AAGhB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;uCAClC;eAdR,IAAI;IApBhB,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,eAAM;QACd,6FAA6F;QAC7F,kGAAkG;QAClG,mFAAmF;QACnF,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAC1C,0FAA0F;QAC1F,yFAAyF;QACzF,yFAAyF;QACzF,2FAA2F;QAC3F,2DAA2D;QAC3D,SAAS,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,8BAA8B,eAAM,uDAAuD,+BAAsB,GAAG;SAClI;KACF,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;GAClC,IAAI,CAehB"}

package/migrations/1710000000018-CreateServiceAccount.cjs

@@ -0,0 +1,53 @@
+/**
+ * Framework identity migration — `shield_app.service_account`: a MACHINE principal (ADR-0007 /
+ * ADR-0033). One row = one service account (an AI agent / MCP server / script identity) that a
+ * tenant admin creates, scopes, and revokes. Its HASHED API keys live separately in
+ * `shield_authz.service_account_key` (guard migration 1710000000017) — this table is the ACCOUNT,
+ * not the credential.
+ *
+ * Column names for the engine-reflected fields (`sa_id`, `sa_tenant_id`, `sa_label`, `sa_status`,
+ * `sa_created_at_ms`) are read from the `@astram/identity` `ServiceAccount` object registration so
+ * the DDL and runtime queries share ONE source of truth (rule 30). The additional columns
+ * (`sa_scope_subtree`, `sa_role_ids`, `sa_created_by`, `sa_updated_at_ms`) are read+written by the
+ * `ServiceAccountStore` directly (not through the RecordEngine), exactly as `users` carries
+ * `u_email`/`u_is_platform_superuser` beyond its declared fields.
+ *
+ * `sa_tenant_id` is server-stamped from the creating admin's session (never client input); a
+ * NON-ROOT admin's list/read/update is walled to their subtree by the object's
+ * `readScope: nodeColumn(sa_tenant_id)`. Schema `shield_app` is created by earlier migrations.
+ * Idempotent (CREATE TABLE IF NOT EXISTS). No hard-coded UUIDs, no seed (accounts are admin-made).
+ * `down` drops the table.
+ */
+const { ServiceAccount } = require('@astram/identity');
+const { columnForRole, reflectObjectType } = require('@astram/engine');
+
+const SCHEMA = 'shield_app';
+
+const SaReg = reflectObjectType(ServiceAccount);
+const col = (role) => columnForRole(SaReg, role);
+
+async function up({ query }) {
+  // Only `primaryKey` + `status` are engine ROLES (single-sourced via col()); the other columns
+  // carry no role, so they are named literally — matching their `@Field({ column })` on the object
+  // (sa_tenant_id/sa_label/sa_created_at_ms) or are store-only (sa_scope_subtree/sa_role_ids/…).
+  await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`${SaReg.table}\` (
+    ${col('primaryKey')} VARCHAR(36)  NOT NULL,          -- the <accountId> inside the ask_ key
+    sa_tenant_id         VARCHAR(36)  NOT NULL,          -- server-stamped; tenant the account is bound to
+    sa_label             VARCHAR(200) NOT NULL,          -- human name shown in the UI (no raw id ever shown)
+    sa_scope_subtree     JSON         NOT NULL,          -- reachable node ids (least privilege; ⊆ the creator's subtree)
+    sa_role_ids          JSON         NOT NULL,          -- roles the account holds
+    ${col('status')}     VARCHAR(20)  NOT NULL DEFAULT 'active',  -- 'active' | 'disabled' (disabled ⇒ keys fail closed)
+    sa_created_by        VARCHAR(36)  NULL,              -- admin principal id (attribution; resolved to a name in UI)
+    sa_created_at_ms     BIGINT       NOT NULL,          -- epoch-ms
+    sa_updated_at_ms     BIGINT       NULL,              -- epoch-ms of last edit
+    PRIMARY KEY (${col('primaryKey')}),
+    INDEX idx_sa_tenant (sa_tenant_id),
+    INDEX idx_sa_status (${col('status')})
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
+}
+
+async function down({ query }) {
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`${SaReg.table}\``);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -22,9 +22,9 @@
   },
   "dependencies": {
     "mariadb": "^3.4.0",
-    "@astram/core": "1.2.0",
-    "@astram/guard": "0.6.0",
-    "@astram/engine": "0.2.0"
+    "@astram/core": "1.3.0",
+    "@astram/guard": "0.7.0",
+    "@astram/engine": "0.3.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",