@astram/identity 0.3.1 → 0.4.0

package/dist/auth-facts-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-facts-keys.js","sourceRoot":"","sources":["../src/auth-facts-keys.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH,yCAA4D;AAC5D,6CAA+C;AAE/C,MAAM,QAAQ,GAAG,IAAA,mCAA2B,EAAC,4BAAe,CAAC,CAAC;AAEjD,QAAA,sBAAsB,GAAsB,QAAQ;KAC9D,WAAW,EAAE;KACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAuB,CAAC,CAAC;AAE5B,QAAA,wBAAwB,GAAsB,QAAQ;KAChE,WAAW,EAAE;KACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;KACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAuB,CAAC,CAAC"}

package/dist/branch.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch.object.js","sourceRoot":"","sources":["../src/branch.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,qCAAkC;AAElC,iCAAiC;AAQ1B,IAAM,MAAM,GAAZ,MAAM,MAAM;IAEjB,IAAI,CAAU;IAGd,IAAI,CAAU;CACf,CAAA;AANY,wBAAM;AAEjB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;oCAChD;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oCAC9C;iBALH,MAAM;IAPlB,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KAC3C,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;GAClC,MAAM,CAMlB"}

package/dist/company-branch.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-branch.object.js","sourceRoot":"","sources":["../src/company-branch.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,qCAAkC;AAElC;;;;;GAKG;AAQI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAExB,WAAW,CAAU;IAGrB,UAAU,CAAU;CACrB,CAAA;AANY,sCAAa;AAExB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDAC9C;AAGrB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDAC9C;wBALT,aAAa;IAPzB,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,gBAAgB;QACzB,KAAK,EAAE,kBAAkB;QACzB,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KAC3C,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;GACrE,aAAa,CAMzB"}

package/dist/company-department.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-department.object.js","sourceRoot":"","sources":["../src/company-department.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,qCAAkC;AAElC;;;;;;;GAOG;AAQI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE5B,WAAW,CAAU;IAGrB,cAAc,CAAU;CACzB,CAAA;AANY,8CAAiB;AAE5B;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDAC9C;AAGrB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yDAC9C;4BALb,iBAAiB;IAP7B,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KAC3C,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,EAAE,CAAC;GACzE,iBAAiB,CAM7B"}

package/dist/company-membership.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-membership.object.js","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,qCAAkC;AAElC;;;;;;GAMG;AAeI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE5B,IAAI,CAAU;IAGd,QAAQ,CAAU;IAGlB,WAAW,CAAU;IAGrB,QAAQ,CAAW;IAGnB,MAAM,CAAU;IAGhB,SAAS,CAAU;CACpB,CAAA;AAlBY,8CAAiB;AAE5B;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;+CACjD;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDAC9C;AAGlB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDAC9C;AAGrB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;;mDAChD;AAGnB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;;iDAC/C;AAGhB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;;oDAClD;4BAjBR,iBAAiB;IAd7B,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QACvC,kFAAkF;QAClF,yFAAyF;QACzF,oFAAoF;QACpF,sFAAsF;QACtF,yFAAyF;QACzF,sCAAsC;QACtC,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE;KAC7D,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;GACnC,iBAAiB,CAkB7B"}

package/dist/company.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.object.js","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,qCAAkC;AAElC,kFAAkF;AAoB3E,IAAM,OAAO,GAAb,MAAM,OAAO;IAElB,IAAI,CAAU;IAGd,IAAI,CAAU;IAGd,UAAU,CAAU;IAGpB,IAAI,CAAU;IAGd,MAAM,CAAU;IAGhB,SAAS,CAAU;CACpB,CAAA;AAlBY,0BAAO;AAElB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;qCAChD;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qCAC9C;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2CAC7B;AAGpB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;;qCAC9B;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;;uCAC9C;AAGhB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;;0CAClC;kBAjBR,OAAO;IAnBnB,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,eAAM;QACd,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,kHAAkH;QAClH,2FAA2F;QAC3F,6FAA6F;QAC7F,wFAAwF;QACxF,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAC1C,yFAAyF;QACzF,2FAA2F;QAC3F,uFAAuF;QACvF,8BAA8B;QAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;KACpD,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;GAClC,OAAO,CAkBnB"}

package/dist/cross-tenant-grant.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tenant-grant.object.js","sourceRoot":"","sources":["../src/cross-tenant-grant.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAE/D,mFAAmF;AACnF,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAE3B,IAAI,CAAU;IAGd,gBAAgB,CAAU;IAG1B,iBAAiB,CAAU;CAC5B,CAAA;AATY,4CAAgB;AAE3B;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;8CAC9B;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;0DAChC;AAG1B;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2DAChC;2BARhB,gBAAgB;IAP5B,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,oBAAoB;QAC7B,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KAC3C,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;GACpC,gBAAgB,CAS5B"}

package/dist/department.object.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"department.object.js","sourceRoot":"","sources":["../src/department.object.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,qCAAkC;AAElC,oCAAoC;AAQ7B,IAAM,UAAU,GAAhB,MAAM,UAAU;IAErB,IAAI,CAAU;IAGd,IAAI,CAAU;CACf,CAAA;AANY,gCAAU;AAErB;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;;wCAChD;AAGd;IADC,IAAA,cAAK,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;wCAC9C;qBALH,UAAU;IAPtB,IAAA,mBAAU,EAAC;QACV,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,eAAM;QACd,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;KAC3C,CAAC;IACD,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;GAClC,UAAU,CAMtB"}

package/dist/features/access/access-admin.access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-admin.access.js","sourceRoot":"","sources":["../../../src/features/access/access-admin.access.ts"],"names":[],"mappings":";;;;;;;;;AAAA;;;;GAIG;AACH,2CAA8C;AASvC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IAP7B,IAAA,qBAAY,EAAC;QACZ,GAAG,EAAE,cAAc;QACnB,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,8CAA8C;QAC3D,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;KACpF,CAAC;GACW,iBAAiB,CAAG"}

package/dist/features/access/company-admin.access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-admin.access.js","sourceRoot":"","sources":["../../../src/features/access/company-admin.access.ts"],"names":[],"mappings":";;;;;;;;;AAAA;;;;GAIG;AACH,2CAA8C;AAavC,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAAG,CAAA;AAArB,gDAAkB;6BAAlB,kBAAkB;IAX9B,IAAA,qBAAY,EAAC;QACZ,GAAG,EAAE,eAAe;QACpB,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EAAE,oDAAoD;QACjE,WAAW,EAAE;YACX,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACvE,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;YACpD,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;SACrD;KACF,CAAC;GACW,kBAAkB,CAAG"}

package/dist/features/access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/features/access/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;GAOG;AACH,qEAAgE;AAChE,iEAA4D;AAC5D,+DAA0D;AAE1D,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAC7B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAE1B,sEAAsE;AACzD,QAAA,qBAAqB,GAAG;IACnC,6CAAoB;IACpB,yCAAkB;IAClB,uCAAiB;CAClB,CAAC"}

package/dist/features/access/user-management.access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management.access.js","sourceRoot":"","sources":["../../../src/features/access/user-management.access.ts"],"names":[],"mappings":";;;;;;;;;AAAA;;;;;GAKG;AACH,2CAA8C;AAgBvC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAAG,CAAA;AAAvB,oDAAoB;+BAApB,oBAAoB;IAdhC,IAAA,qBAAY,EAAC;QACZ,GAAG,EAAE,iBAAiB;QACtB,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,6CAA6C;QAC1D,WAAW,EAAE;YACX,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACpE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;YACtC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;YAC5C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE;YACxC,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YAClF,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;SAC/D;KACF,CAAC;GACW,oBAAoB,CAAG"}

package/dist/features/audit/audit-read.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-read.service.js","sourceRoot":"","sources":["../../../src/features/audit/audit-read.service.ts"],"names":[],"mappings":";;;AA+DA,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;GAMG;AACH,MAAa,gBAAgB;IAER;IACA;IACA;IAHnB,YACmB,MAAwB,EACxB,MAAqB,EACrB,iBAAoC;QAFpC,WAAM,GAAN,MAAM,CAAkB;QACxB,WAAM,GAAN,MAAM,CAAe;QACrB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CACZ,SAAyB,EACzB,OAAoG;QAEpG,mFAAmF;QACnF,yFAAyF;QACzF,uDAAuD;QACvD,IAAI,QAAgB,CAAC;QACrB,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1G,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QAChC,CAAC;QAED,wFAAwF;QACxF,mEAAmE;QACnE,IAAI,OAA2B,CAAC;QAChC,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,gBAAgB,CAAC;QAClF,CAAC;QAED,sFAAsF;QACtF,2FAA2F;QAC3F,6FAA6F;QAC7F,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,KAAgB,CAAC,CAAC,CAAC,aAAa,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAK,OAAO,CAAC,IAAe,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QAElC,4FAA4F;QAC5F,8FAA8F;QAC9F,MAAM,UAAU,GAAe;YAC7B,QAAQ;YACR,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC;QAEF,yFAAyF;QACzF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SACnD,CAAC,CAAC;QAEH,8FAA8F;QAC9F,2FAA2F;QAC3F,sFAAsF;QACtF,MAAM,IAAI,GAAe,MAAM,OAAO,CAAC,GAAG,CACxC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3B,UAAU,EAAE,KAAK,CAAC,YAAY;YAC9B,UAAU,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;YACjE,MAAM,EAAI,KAAK,CAAC,MAAqE,EAAE,GAAG;mBACpF,KAAK,CAAC,MAA4B;mBACnC,SAAS;YACd,WAAW,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;YAChE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;SAC9C,CAAC,CAAC,CACJ,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,KAA8B;QAC7C,MAAM,IAAI,GAAG,iEAAiE,CAAC;QAC/E,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACxD,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QACf,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAxFD,4CAwFC"}

package/dist/features/audit/audit.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.controller.js","sourceRoot":"","sources":["../../../src/features/audit/audit.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sBAAsB;AACtB,2CAA0F;AAC1F,yCAA2C;AAE3C,0FAA0F;AAC1F,mFAAmF;AACnF,yEAAyE;AACzE,mEAA2D;AAmB3D;;;;GAIG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IACG;IAA7B,YAA6B,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;IAAG,CAAC;IAIpD,AAAN,KAAK,CAAC,IAAI,CACD,GAAkB,EAChB,CAAoF;QAE7F,MAAM,SAAS,GAAG;YAChB,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE;YACpB,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;YAChC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI;SACtC,CAAC;QACF,wFAAwF;QACxF,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAoB;YAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QACF,IAAI,CAAC;YACH,MAAM,EACJ,IAAI,EACJ,KAAK,EACL,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,aAAa,GACrB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oCAA2B,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;CACF,CAAA;AAtCY,0CAAe;AAKpB;IAFL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,GAAE,CAAA;;;;2CA8BT;0BArCU,eAAe;IAD3B,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAEiB,wCAAgB;GAD3C,eAAe,CAsC3B"}

package/dist/features/audit/directory-label-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-label-resolver.js","sourceRoot":"","sources":["../../../src/features/audit/directory-label-resolver.ts"],"names":[],"mappings":";;;AAIA,MAAM,GAAG,GAAG,YAAY,CAAC;AAEzB;;;;GAIG;AACH,MAAa,sBAAsB;IACJ;IAA7B,YAA6B,EAAkB;QAAlB,OAAE,GAAF,EAAE,CAAgB;IAAG,CAAC;IAEnD,KAAK,CAAC,OAAO,CAAC,IAAe,EAAE,EAAU,EAAE,SAAkB;QAC3D,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC/B,qCAAqC,GAAG,uCAAuC,EAC/E,CAAC,EAAE,CAAC,CACL,CAAwB,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC/B,iCAAiC,GAAG,2CAA2C,EAC/E,CAAC,EAAE,CAAC,CACL,CAAwB,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC/B,iCAAiC,GAAG,uCAAuC,EAC3E,CAAC,EAAE,CAAC,CACL,CAAwB,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YACD;gBACE,sFAAsF;gBACtF,OAAO,WAAW,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAe;QAC9B,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,cAAc,CAAC;QAChD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,gBAAgB,CAAC;QAC/C,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,cAAc,CAAC;QAC3C,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAvCD,wDAuCC"}

package/dist/features/audit/mariadb-audit-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-audit-reader.js","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":";;;AAkBA,MAAM,cAAc,GAAG,cAAc,CAAC;AACtC,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;;;GAKG;AACH,MAAa,kBAAkB;IACZ,EAAE,CAAiB;IACnB,MAAM,CAAS;IAEhC,YAAY,EAAkB,EAAE,OAA4B,EAAE;QAC5D,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAOV;QACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,cAAc,GAAG,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,cAAc,GAAG,UAAU,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1B,cAAc,IAAI,WAAW,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC/B,+DAA+D;YAC7D,0CAA0C;YAC1C,WAAW,IAAI,CAAC,MAAM,kBAAkB;YACxC,GAAG,QAAQ,mCAAmC,cAAc,EAAE,EAChE,MAAM,CACP,CAAe,CAAC;QAEjB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,KAA4D;QACtE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC/B,+BAA+B,IAAI,CAAC,MAAM,mBAAmB,QAAQ,EAAE,EACvE,MAAM,CACP,CAA2C,CAAC;QAE7C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,KAIxB;QACC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,iFAAiF;QACjF,qEAAqE;QACrE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAEO,OAAO,CAAC,CAAW;QACzB,IAAI,UAAU,GAA4B,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAY,CAAC,CAAC,kBAAkB,CAAC;QAC/C,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,oEAAoE;YACpE,UAAU,GAAG,QAAmC,CAAC;QACnD,CAAC;aAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnE,UAAU,GAAG,MAAiC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QACD,qFAAqF;QACrF,wFAAwF;QACxF,0FAA0F;QAC1F,wFAAwF;QACxF,8CAA8C;QAC9C,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,OAA6B;YACrC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACzC,OAAO,EAAE,CAAC,CAAC,WAAW;YACtB,QAAQ,EAAE,CAAC,CAAC,YAAY;YACxB,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,aAAgD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,UAAU;SACG,CAAC;IAClB,CAAC;CACF;AAhID,gDAgIC"}

package/dist/features/authz/access-bundle-reconcile.job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-bundle-reconcile.job.js","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":";;;AAIA,qEAA6D;AAE7D,MAAM,KAAK,GAAG,cAAc,CAAC;AAU7B;;;;;;;;;;;;;GAaG;AACH,MAAa,wBAAwB;IAKhB;IACA;IALF,KAAK,CAAoB;IAClC,OAAO,GAAG,KAAK,CAAC;IAExB,YACmB,IAAU,EACV,OAAoC;QADpC,SAAI,GAAJ,IAAI,CAAM;QACV,YAAO,GAAP,OAAO,CAA6B;QAErD,IAAI,CAAC,KAAK,GAAG,IAAI,0CAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAEzD,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,MAAM,WAAW,GAAa,EAAE,CAAC;YAEjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACtC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;wBACpC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACpD,IAAI,OAAO,KAAK,UAAU;oBAAE,KAAK,EAAE,CAAC;qBAC/B,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC;gBAE1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvE,IAAI,IAAI;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChE,CAAC;YAED,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,OAAO;iBACrB,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CACtE;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAU,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;YAEjC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CACV,2BAA2B,WAAW,CAAC,MAAM,6BAA6B;oBACxE,gCAAgC,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CACT,+BAA+B,KAAK,KAAK,OAAO,KAAK,QAAQ,GAAG;gBAC9D,IAAI,WAAW,CAAC,MAAM,WAAW,CACpC,CAAC;YAEF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,wBAAwB;QACpC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,0BAA0B,KAAK,gDAAgD,CAChF,CAAgC,CAAC;QAClC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF;AA1ED,4DA0EC"}

package/dist/features/authz/access-bundle-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-bundle-store.js","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-store.ts"],"names":[],"mappings":";;;AAIA,MAAM,KAAK,GAAG,cAAc,CAAC;AAY7B;;;;;;GAMG;AACH,MAAa,iBAAiB;IACC;IAA7B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,sFAAsF;IACtF,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;kBACY,KAAK,sBAAsB,CACxC,CAOC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,IAAI,EAAE,CAAC,CAAC,OAAO;YACf,GAAG,EAAE,CAAC,CAAC,MAAM;YACb,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,KAAK,EAAE,CAAC,CAAC,QAAQ;YACjB,WAAW,EAAE,CAAC,CAAC,cAAc;YAC7B,MAAM,EAAE,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;SAC3D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,GAAW;QACjD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,yBAAyB,KAAK;mDACe,EAC7C,CAAC,MAAM,EAAE,GAAG,CAAC,CACd,CAA+B,CAAC;QACjC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAAC,SAAiB;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;kBACY,KAAK;kBACL,KAAK;;;kCAGW,EAC5B,CAAC,SAAS,CAAC,CACZ,CAAgC,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,2EAA2E;YAC3E,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnC,mBAAmB,KAAK;4DAC4B,EACpD,CAAC,SAAS,CAAC,CACZ,CAAmB,CAAC;YACrB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,yBAAyB;QAS7B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;;kBAEY,KAAK;uBACA,KAAK;;;2DAG+B,CACtD,CAMC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,GAAG,EASlB,CAAC;QACJ,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG;oBACP,GAAG,EAAE,CAAC,CAAC,UAAU;oBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,cAAc,EAAE,EAAE;oBAClB,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,CAAC;gBACF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI;gBAAE,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,IAAsB;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;QAC7C,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACrC;kBACY,KAAK;mDAC4B,EAC7C,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CACxB,CAKC,CAAC;QAEH,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GACR,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK;gBAC3B,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,WAAW;gBAC5C,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC;YAC7B,IAAI,IAAI;gBAAE,OAAO,WAAW,CAAC;YAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,YAAY,KAAK;;4BAEG,EACpB,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CACvC,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,iBAAiB,KAAK;;+CAEmB,EACzC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CACjD,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,UAAkB,EAAE,IAAuB;QACrE,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACrC,8BAA8B,KAAK;kCACP,EAC5B,CAAC,UAAU,CAAC,CACb,CAAoC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,iBAAiB,KAAK;2DAC6B,EAAE,GAAG,EACxD,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,CAC1B,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,iBAAiB,KAAK;;iCAEG,EACzB,CAAC,UAAU,EAAE,GAAG,CAAC,CAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,kBAA4D;QAC7E,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,YAAY,KAAK;;6CAEoB,EACrC,CAAC,MAAM,EAAE,GAAG,CAAC,CACd,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAzND,8CAyNC"}

package/dist/features/authz/catalog-bootstrap.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-bootstrap.provider.js","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,iFAAiF;AACjF,qFAAqF;AACrF,0FAA0F;AAC1F,+BAA+B;AAC/B,2CAAiF;AACjF,uCAA4E;AAC5E,yCAIuB;AACvB,2CAA0D;AAE1D,yEAAiE;AACjE,qFAA4E;AAC5E,gFAAwE;AAExE,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,yCAAyC;AAEvF;;;;;;;;;;GAUG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAIhB;IACA;IACA;IACA;IACA;IACA;IAEA;IAVX,KAAK,GAA0B,IAAI,CAAC;IAE5C,YACmB,SAA2B,EAC3B,OAAwB,EACxB,SAAoB,EACpB,GAAwB,EACxB,eAAyC,EACzC,YAAiC,EAEjC,aAAoC;QAPpC,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAiB;QACxB,cAAS,GAAT,SAAS,CAAW;QACpB,QAAG,GAAH,GAAG,CAAqB;QACxB,oBAAe,GAAf,eAAe,CAA0B;QACzC,iBAAY,GAAZ,YAAY,CAAqB;QAEjC,kBAAa,GAAb,aAAa,CAAuB;IACpD,CAAC;IAEJ,KAAK,CAAC,sBAAsB;QAC1B,MAAM,QAAQ,GAAG,IAAA,mCAA2B,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,gBAAgB,GAAG,IAAI,iCAAyB,CACpD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,CACf,CAAC;QACF,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpD,mEAAmE;QACnE,IAAI,yBAAiB,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE3D,sEAAsE;QACtE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,gFAAgF;QAChF,qFAAqF;QACrF,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,4FAA4F;QAC5F,2FAA2F;QAC3F,wFAAwF;QACxF,yFAAyF;QACzF,0FAA0F;QAC1F,yCAAyC;QACzC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEnC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC5B,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACzC,KAAK,IAAI,CAAC,GAAG;qBACV,OAAO,CAAC,OAAO,CAAC;qBAChB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;qBACjD,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;YAC9C,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED;iGAC6F;IACrF,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF,CAAA;AA7DY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAWR,WAAA,IAAA,eAAM,EAAC,iCAAwB,CAAC,CAAA;qCANL,uBAAgB;QAClB,sBAAe;QACb,gBAAS;QACf,8CAAmB;QACP,yDAAwB;QAC3B,8CAAmB;GATzC,wBAAwB,CA6DpC"}

package/dist/features/authz/catalog-reconcile.job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-reconcile.job.js","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":";;;AAGA,yCAAwE;AAExE,yEAAiE;AAEjE;;;;;;;GAOG;AACH,MAAa,mBAAmB;IAMW;IALxB,UAAU,GAAG,IAAI,yBAAiB,EAAE,CAAC;IACrC,KAAK,CAAsB;IACpC,MAAM,GAA2B,IAAI,CAAC;IACtC,OAAO,GAAG,KAAK,CAAC;IAExB,YAAY,IAAU,EAAmB,QAAwB;QAAxB,aAAQ,GAAR,QAAQ,CAAgB;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,8CAAmB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAClF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACvC,CAAC,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CACT,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,WAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,aAAa;gBACxF,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,eAAe,UAAU,EAAE,CAC1D,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAjCD,kDAiCC"}

package/dist/features/authz/db-permission-facts.adapter.d.ts

@@ -22,10 +22,14 @@ import type { PermissionFactsPort, CoarseGrants, ModuleRegistry } from '@astram/
  */
 export declare function expandGrantKeys(rawKeys: string[], allKeys: string[]): string[];
 /**
- * The principal's role uuids from its ACTIVE membership's in-effect postings in
- * `tenantId` — the SAME in-effect-posting window query `DbPermissionFactsAdapter` uses,
- * extracted so any OTHER caller that needs a principal's roleIds for a tenant reuses this
- * ONE timezone-safe epoch-ms window read instead of re-inlining the SQL.
+ * The principal's role uuids in `tenantId` — the SINGLE source of "what roles does this principal
+ * hold here" used by the object-type gate (gate 5), the grant-ceiling (ADR-0029), and the
+ * cross-tenant grant authorize. KIND-AWARE (ADR-0033): a SERVICE ACCOUNT's roles come from its
+ * `service_account.sa_role_ids`; a USER's roles come from its ACTIVE membership's in-effect
+ * postings. The service-account lookup runs first — a hit short-circuits (a service-account id
+ * never has membership rows anyway); a miss falls through to the timezone-safe epoch-ms membership
+ * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
+ * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).

package/dist/features/authz/db-permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAYnB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalF,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAgBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}
+{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalF,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAgBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}

package/dist/features/authz/db-permission-facts.adapter.js

@@ -33,16 +33,59 @@ function expandGrantKeys(rawKeys, allKeys) {
     }
     return [...out];
 }
+/** Parse a `sa_role_ids` JSON column (driver returns it already-parsed OR as a string). */
+function parseRoleIdsJson(v) {
+    const arr = Array.isArray(v)
+        ? v
+        : typeof v === 'string'
+            ? (() => {
+                try {
+                    return JSON.parse(v);
+                }
+                catch {
+                    return [];
+                }
+            })()
+            : [];
+    return Array.isArray(arr) ? arr.filter((x) => typeof x === 'string') : [];
+}
+/**
+ * A SERVICE ACCOUNT (ADR-0033) holds its roles directly on `service_account.sa_role_ids` — it has
+ * NO `company_membership`/`membership_posting` rows (those model a human's org placement). So its
+ * roles are read from the account row: an ACTIVE account in this tenant → its `sa_role_ids`. Returns
+ * `null` when `principalId` is not a service account here (→ the caller falls through to the human
+ * membership path). A DISABLED account returns `[]` (in-scope but no roles → deny everything —
+ * defense-in-depth alongside the key's own revoke check).
+ */
+async function readServiceAccountRoleIds(pool, principalId, tenantId) {
+    const rows = (await pool.query(`SELECT sa_role_ids, sa_status FROM \`shield_app\`.\`service_account\`
+      WHERE sa_id = ? AND sa_tenant_id = ? LIMIT 1`, [principalId, tenantId]));
+    const row = rows[0];
+    if (row === undefined)
+        return null; // not a service account here → let the user path run.
+    if (row.sa_status !== 'active')
+        return []; // disabled → no roles (deny-by-default).
+    return parseRoleIdsJson(row.sa_role_ids);
+}
 /**
- * The principal's role uuids from its ACTIVE membership's in-effect postings in
- * `tenantId` — the SAME in-effect-posting window query `DbPermissionFactsAdapter` uses,
- * extracted so any OTHER caller that needs a principal's roleIds for a tenant reuses this
- * ONE timezone-safe epoch-ms window read instead of re-inlining the SQL.
+ * The principal's role uuids in `tenantId` — the SINGLE source of "what roles does this principal
+ * hold here" used by the object-type gate (gate 5), the grant-ceiling (ADR-0029), and the
+ * cross-tenant grant authorize. KIND-AWARE (ADR-0033): a SERVICE ACCOUNT's roles come from its
+ * `service_account.sa_role_ids`; a USER's roles come from its ACTIVE membership's in-effect
+ * postings. The service-account lookup runs first — a hit short-circuits (a service-account id
+ * never has membership rows anyway); a miss falls through to the timezone-safe epoch-ms membership
+ * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
+ * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
 async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now) {
+    // Service-account path (ADR-0033): its roles live on the account row, not memberships.
+    const saRoles = await readServiceAccountRoleIds(pool, principalId, tenantId);
+    if (saRoles !== null)
+        return saRoles;
+    // Human path: roles from the active membership's in-effect postings.
     const nowMs = now();
     const rows = (await pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
        FROM \`shield_app\`.\`company_membership\` cm

package/dist/features/authz/db-permission-facts.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-permission-facts.adapter.js","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":";;;AA0BA,0CAeC;AAWD,oDAiBC;AAtDD,uCAA6D;AAE7D,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,OAAiB,EAAE,OAAiB;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,GAAG,aAAa,IAAI,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,aAAa,GAAG,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;YAC3E,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,oBAAoB,CACxC,IAAU,EACV,WAAmB,EACnB,QAAgB,EAChB,MAAoB,IAAI,CAAC,GAAG;IAE5B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAC5B;;;;;+EAK2E,EAC3E,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CACtC,CAAiC,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,MAAa,wBAAwB;IAEhB;IACA;IAMA;IARnB,YACmB,IAAU,EACV,QAAwB;IACzC;;;;OAIG;IACc,MAAoB,IAAI,CAAC,GAAG;QAP5B,SAAI,GAAJ,IAAI,CAAM;QACV,aAAQ,GAAR,QAAQ,CAAgB;QAMxB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,KAAK,CAAC,yBAAyB,CAAC,YAAoB,EAAE,QAAgB;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;4CACoC,EACpC,CAAC,QAAQ,CAAC,CACX,CAAmC,CAAC;YACrC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oCAA6B,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;QAC1D,IAAI,OAAe,CAAC;QACpB,IAAI,OAAiB,CAAC;QACtB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxD,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oCAA6B;gBAAE,MAAM,KAAK,CAAC;YAChE,MAAM,IAAI,oCAA6B,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAuB,CAAC,CAAC;QAClF,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACnG,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAgB;QACxC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;0CACoC,EACpC,CAAC,QAAQ,CAAC,CACX,CAAmC,CAAC;QACrC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,QAAgB;QAC7D,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAiB;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;iCAC2B,YAAY,GAAG,EAC1C,OAAO,CACR,CAAmC,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;CACF;AAnED,4DAmEC"}

package/dist/features/authz/grant-admin.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAG1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYlG,mFAAmF;IAG7E,MAAM,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAOnE;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYxG;;;;OAIG;IAGG,YAAY,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;CAS1E"}
+{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAalG,mFAAmF;IAG7E,MAAM,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAOnE;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAaxG;;;;OAIG;IAGG,YAAY,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;CAS1E"}

package/dist/features/authz/grant-admin.controller.js

@@ -19,6 +19,7 @@ exports.GrantAdminController = void 0;
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const grant_admin_service_js_1 = require("./grant-admin.service.js");
+const grant_ceiling_js_1 = require("./grant-ceiling.js");
 /**
  * Derive the caller's subtree scope from the resolved principal (Task 4.2). Uses the SAME cached
  * `scopeSubtreeNodeIds` the RecordEngine's list-scope uses (one source of truth). Fail-safe to the
@@ -86,11 +87,13 @@ let GrantAdminController = class GrantAdminController {
         if (!key)
             throw new common_1.BadRequestException('key required');
         try {
-            await this.grants.grant(uuid, key, req.principal?.id);
+            await this.grants.grant(uuid, key, req.principal);
         }
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
                 throw new common_1.BadRequestException(e.message);
+            if (e instanceof grant_ceiling_js_1.GrantCeilingError)
+                throw new common_1.ForbiddenException(e.message);
             throw e;
         }
         return { success: true };
@@ -119,11 +122,13 @@ let GrantAdminController = class GrantAdminController {
         if (!key)
             throw new common_1.BadRequestException('key required');
         try {
-            await this.grants.grantBundle(uuid, key, req.principal?.id);
+            await this.grants.grantBundle(uuid, key, req.principal);
         }
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
                 throw new common_1.BadRequestException(e.message);
+            if (e instanceof grant_ceiling_js_1.GrantCeilingError)
+                throw new common_1.ForbiddenException(e.message);
             throw e;
         }
         return { success: true };

package/dist/features/authz/grant-admin.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-admin.controller.js","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,wFAAwF;AACxF,4EAA4E;AAC5E,2CAGwB;AACxB,yCAA2C;AAE3C,qEAA0E;AAE1E,yDAAuD;AAOvD;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAkB;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;IACxB,MAAM,OAAO,GAAG,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAE1D;;;;;;;;OAQG;IAGG,AAAN,KAAK,CAAC,aAAa,CACV,GAAkB,EAEzB,KAMC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,GAAuE;YACjF,SAAS,EAAE,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;SACxD,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACjD,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACpE,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACpE,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,sDAAsD;IAGhD,AAAN,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;kGAC8F;IAGxF,AAAN,KAAK,CAAC,IAAI,CAAQ,GAAkB,EAAiB,IAAY;QAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,0CAA0C;IAGpC,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAkB,EAAiB,IAAY,EAAU,IAAsB;QAChG,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,4BAAmB,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,oCAAW;gBAAE,MAAM,IAAI,4BAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,oCAAiB;gBAAE,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC5E,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,mFAAmF;IAG7E,AAAN,KAAK,CAAC,MAAM,CAAgB,IAAY,EAAgB,GAAW;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAE7E;;;;OAIG;IAGG,AAAN,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IAGG,AAAN,KAAK,CAAC,WAAW,CAAQ,GAAkB,EAAiB,IAAY,EAAU,IAAsB;QACtG,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,4BAAmB,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,oCAAW;gBAAE,MAAM,IAAI,4BAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvE,IAAI,CAAC,YAAY,oCAAiB;gBAAE,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC5E,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IAGG,AAAN,KAAK,CAAC,YAAY,CAAgB,IAAY,EAAgB,GAAW;QACvE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,oCAAW;gBAAE,MAAM,IAAI,4BAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA7HY,oDAAoB;AAczB;IAFL,IAAA,YAAG,EAAC,oBAAoB,CAAC;IACzB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,GAAE,CAAA;;;;yDAmBT;AAKK;IAFL,IAAA,YAAG,EAAC,oBAAoB,CAAC;IACzB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;;;;mDAG/C;AAMK;IAFL,IAAA,YAAG,EAAC,yBAAyB,CAAC;IAC9B,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAsB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;;;;gDAEnD;AAKK;IAFL,IAAA,aAAI,EAAC,yBAAyB,CAAC;IAC/B,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAsB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;iDAW1E;AAKK;IAFL,IAAA,eAAM,EAAC,8BAA8B,CAAC;IACtC,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpC,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;;;kDAGtD;AAWK;IAFL,IAAA,YAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;;;;mDAG/C;AASK;IAFL,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAClC,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAsB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAWhF;AASK;IAFL,IAAA,eAAM,EAAC,iCAAiC,CAAC;IACzC,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9B,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;;;wDAQ5D;+BA5HU,oBAAoB;IADhC,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAEgB,0CAAiB;GAD3C,oBAAoB,CA6HhC"}

package/dist/features/authz/grant-admin.service.d.ts

@@ -1,6 +1,8 @@
 import type { Pool } from 'mariadb';
+import type { Principal } from '@astram/core';
 import { PermissionVersionBumper } from './permission-version.bumper.js';
 import { AccessBundleStore } from './access-bundle-store.js';
+import type { GrantCeiling } from './grant-ceiling.js';
 /**
  * The caller's reachable subtree, threaded from `req.principal` (Task 4.2). It scopes the
  * grant-admin reads so a caller sees ONLY roles bound within their subtree — the SAME cached
@@ -49,8 +51,15 @@ export interface RoleGrantSummary {
 export declare class GrantAdminService {
     private readonly pool;
     private readonly bumper;
+    private readonly ceiling?;
     private readonly bundles;
-    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore);
+    /**
+     * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold"). Enforced
+     *   on `grant()`/`grantBundle()` for a non-root grantor. OPTIONAL for back-compat: when absent
+     *   (legacy wiring / tests that don't exercise the ceiling), the ceiling is not applied — the
+     *   identity module ALWAYS wires it, so production always enforces. Root bypasses regardless.
+     */
+    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined);
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
     listCatalog(): Promise<{
         catalog: CatalogRow[];
@@ -67,11 +76,13 @@ export declare class GrantAdminService {
     /** Validate the key against the catalog + wildcard set. Throws BadKeyError if unknown. */
     private assertValidKey;
     /**
-     * Grant a key to a role (idempotent) + bump the version, atomically. `actorUuid`, when
-     * given, stamps `rp_granted_at`/`rp_granted_by` on a NEWLY-inserted row (a duplicate is a
-     * no-op and its existing stamp is left as-is).
+     * Grant a key to a role (idempotent) + bump the version, atomically. The `grantor` Principal
+     * stamps `rp_granted_at`/`rp_granted_by` on a NEWLY-inserted row (a duplicate is a no-op and
+     * its existing stamp is left as-is) AND is subjected to the ADR-0029 self-escalation ceiling:
+     * a non-root grantor may only grant a key they themselves effectively hold. Order: catalog
+     * validation (400) → ceiling (403) → write. Root bypasses the ceiling.
      */
-    grant(roleUuid: string, key: string, actorUuid?: string): Promise<void>;
+    grant(roleUuid: string, key: string, grantor: Principal): Promise<void>;
     /** Revoke a key from a role (no-op if absent) + bump the version, atomically. */
     revoke(roleUuid: string, key: string): Promise<void>;
     /** All active bundles + their resolved atomic keys, for the Access UI. */
@@ -82,8 +93,10 @@ export declare class GrantAdminService {
      * Grant a bundle to a role: resolve the bundle → its atomic keys, then INSERT each
      * into `role_permission` idempotently in ONE transaction with ONE version bump.
      * An unknown / orphaned bundle → `BadKeyError` (mapped to 400 by the controller).
+     * ADR-0029: a non-root `grantor` must effectively hold EVERY atomic key the bundle expands
+     * to; otherwise `GrantCeilingError` (403), checked before any write. Root bypasses.
      */
-    grantBundle(roleUuid: string, bundleKey: string, actorUuid?: string): Promise<void>;
+    grantBundle(roleUuid: string, bundleKey: string, grantor: Principal): Promise<void>;
     /**
      * Revoke a bundle from a role: resolve → DELETE each of the bundle's atomic keys, in
      * ONE transaction with ONE version bump. Caveat (design §5.1): this removes exactly the

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAM7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAmBD;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAI1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB;IAKjC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0B5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B7E,iFAAiF;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB1D,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;OAIG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BzF;;;;;OAKG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtE,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GAAG,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA4HrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKvD;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAmBD;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAU1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAZ3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;OAKG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA;IAKzC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0B5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B7E,iFAAiF;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB1D,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BzF;;;;;OAKG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtE,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GAAG,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA4HrF"}

package/dist/features/authz/grant-admin.service.js

@@ -33,10 +33,18 @@ exports.BadKeyError = BadKeyError;
 class GrantAdminService {
     pool;
     bumper;
+    ceiling;
     bundles;
-    constructor(pool, bumper, bundleStore) {
+    /**
+     * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold"). Enforced
+     *   on `grant()`/`grantBundle()` for a non-root grantor. OPTIONAL for back-compat: when absent
+     *   (legacy wiring / tests that don't exercise the ceiling), the ceiling is not applied — the
+     *   identity module ALWAYS wires it, so production always enforces. Root bypasses regardless.
+     */
+    constructor(pool, bumper, bundleStore, ceiling) {
         this.pool = pool;
         this.bumper = bumper;
+        this.ceiling = ceiling;
         this.bundles = bundleStore ?? new access_bundle_store_js_1.AccessBundleStore(pool);
     }
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
@@ -98,12 +106,17 @@ class GrantAdminService {
             throw new BadKeyError(key);
     }
     /**
-     * Grant a key to a role (idempotent) + bump the version, atomically. `actorUuid`, when
-     * given, stamps `rp_granted_at`/`rp_granted_by` on a NEWLY-inserted row (a duplicate is a
-     * no-op and its existing stamp is left as-is).
+     * Grant a key to a role (idempotent) + bump the version, atomically. The `grantor` Principal
+     * stamps `rp_granted_at`/`rp_granted_by` on a NEWLY-inserted row (a duplicate is a no-op and
+     * its existing stamp is left as-is) AND is subjected to the ADR-0029 self-escalation ceiling:
+     * a non-root grantor may only grant a key they themselves effectively hold. Order: catalog
+     * validation (400) → ceiling (403) → write. Root bypasses the ceiling.
      */
-    async grant(roleUuid, key, actorUuid) {
+    async grant(roleUuid, key, grantor) {
         await this.assertValidKey(key); // throws BadKeyError (400) before touching the store
+        // ADR-0029 ceiling: throws GrantCeilingError (403) if the grantor exceeds their authority.
+        await this.ceiling?.assertCanGrant(grantor, [key]);
+        const actorUuid = grantor.id;
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
@@ -159,9 +172,15 @@ class GrantAdminService {
      * Grant a bundle to a role: resolve the bundle → its atomic keys, then INSERT each
      * into `role_permission` idempotently in ONE transaction with ONE version bump.
      * An unknown / orphaned bundle → `BadKeyError` (mapped to 400 by the controller).
+     * ADR-0029: a non-root `grantor` must effectively hold EVERY atomic key the bundle expands
+     * to; otherwise `GrantCeilingError` (403), checked before any write. Root bypasses.
      */
-    async grantBundle(roleUuid, bundleKey, actorUuid) {
+    async grantBundle(roleUuid, bundleKey, grantor) {
         const keys = await this.resolveBundleKeysOrThrow(bundleKey);
+        // ADR-0029 ceiling: a non-root grantor must hold EVERY atomic key the bundle expands to,
+        // else GrantCeilingError (403) — checked before any write (no partial bundle escalation).
+        await this.ceiling?.assertCanGrant(grantor, [...keys]);
+        const actorUuid = grantor.id;
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();

package/dist/features/authz/grant-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-admin.service.js","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":";;;AAKA,uCAA6D;AAE7D,qEAA6D;AAC7D,qFAAmE;AAGnE,MAAM,KAAK,GAAG,cAAc,CAAC;AAC7B,MAAM,GAAG,GAAG,YAAY,CAAC;AAczB;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,GAAG,GACP,eAAe;QACf,mBAAmB,GAAG,8BAA8B;QACpD,WAAW,GAAG,oEAAoE;QAClF,gEAAgE,EAAE,IAAI,CAAC;IACzE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;6EAC6E;AAC7E,MAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,GAAW;QACrB,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AALD,kCAKC;AA4BD,MAAa,iBAAiB;IAUT;IACA;IAEA;IAZF,OAAO,CAAoB;IAE5C;;;;;OAKG;IACH,YACmB,IAAU,EACV,MAA+B,EAChD,WAA+B,EACd,OAAsB;QAHtB,SAAI,GAAJ,IAAI,CAAM;QACV,WAAM,GAAN,MAAM,CAAyB;QAE/B,YAAO,GAAP,OAAO,CAAe;QAEvC,IAAI,CAAC,OAAO,GAAG,WAAW,IAAI,IAAI,0CAAiB,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,WAAW;QACf,IAAI,IAAsH,CAAC;QAC3H,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC3B;oBACY,KAAK;;8CAEqB,CACvC,CAAgB,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oCAA6B,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAiB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW;YAC3D,OAAO,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW;SAChD,CAAC,CAAC,CAAC;QACJ,sDAAsD;QACtD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG;YAChB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;YAC/B,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC;SACjF,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,YAA0B;QAE1B,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,+EAA+E;gBAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM;oBACvC,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACrB,mBAAmB,GAAG;0BACV,GAAG;uEAC0C,EAAE;wBACjD,EACV,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CACpC,CAAe;oBAClB,CAAC,CAAC,EAAE,CAAC;gBACP,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,6BAA6B,KAAK,oEAAoE,EACtG,CAAC,QAAQ,CAAC,CACX,CAAmC,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oCAA6B,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,0FAA0F;IAClF,KAAK,CAAC,cAAc,CAAC,GAAW;QACtC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,QAAgB,EAAE,GAAW,EAAE,OAAkB;QAC3D,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,qDAAqD;QACrF,2FAA2F;QAC3F,MAAM,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,kFAAkF;YAClF,MAAM,IAAI,CAAC,KAAK,CACd,iBAAiB,KAAK;;;;gCAIE,KAAK;cACvB,EACN,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAClD,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,IAAI,KAAK,YAAY,WAAW;gBAAE,MAAM,KAAK,CAAC;YAC9C,MAAM,IAAI,oCAA6B,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,GAAW;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,KAAK,CACd,iBAAiB,KAAK,mEAAmE,EACzF,CAAC,QAAQ,EAAE,GAAG,CAAC,CAChB,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,oCAA6B,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E,0EAA0E;IAC1E,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oCAA6B,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,SAAiB,EAAE,OAAkB;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC5D,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,2EAA2E;gBAC3E,MAAM,IAAI,CAAC,KAAK,CACd,iBAAiB,KAAK;;;;kCAIE,KAAK;gBACvB,EACN,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,oCAA6B,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,SAAiB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,KAAK,CACd,iBAAiB,KAAK,mEAAmE,EACzF,CAAC,QAAQ,EAAE,GAAG,CAAC,CAChB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,oCAA6B,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,KAAK,CAAC,wBAAwB,CAAC,SAAiB;QACtD,IAAI,IAA8B,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oCAA6B,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAMa,EACb,YAA0B;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAE7C,yFAAyF;YACzF,0FAA0F;YAC1F,4FAA4F;YAC5F,2EAA2E;YAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAc,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAE9G,sFAAsF;YACtF,qEAAqE;YACrE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1E,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjD;oBACY,KAAK;;uBAEF,KAAK,CAAC,GAAG,IAAI,UAAU,EAAE,EACxC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAC/B,CAA6B,CAAC;YAE/B,qFAAqF;YACrF,iFAAiF;YACjF,MAAM,QAAQ,GACZ,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;YACpD,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACtC;;;oBAGY,KAAK;;uBAEF,KAAK,CAAC,GAAG,IAAI,UAAU;;qBAEzB,QAAQ,IAAI,GAAG;2BACT,EACnB,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAC9C,CAAqF,CAAC;YAEvF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACzD,CAAC;YAED,8DAA8D;YAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACtC;;;;oBAIY,KAAK;;sCAEa,EAAE,GAAG,EACnC,SAAS,CACV,CAKC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4E,CAAC;YACnG,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACP,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;gBAC/B,CAAC;gBACD,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACpB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;oBAChB,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;gBAC3C,CAAC;YACH,CAAC;YAED,MAAM,SAAS,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBACzD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACpF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAA,gDAAe,EAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;gBACnC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC1D,IAAI,OAAO;wBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,CACV,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtF,EAAE,KAAK,IAAI,IAAI,CAAC;gBACnB,OAAO;oBACL,QAAQ,EAAE,EAAE,CAAC,SAAS;oBACtB,QAAQ,EAAE,EAAE,CAAC,SAAS;oBACtB,WAAW,EAAE,QAAQ,CAAC,IAAI;oBAC1B,SAAS,EAAE,SAAS,CAAC,IAAI;oBACzB,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;oBAC3B,MAAM;oBACN,SAAS,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;oBACtE,aAAa,EAAE,CAAC,CAAC,QAAQ;iBAC1B,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,qFAAqF;YACrF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtB,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CACvE,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,oCAA6B,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF;AAxXD,8CAwXC"}

package/dist/features/authz/grant-ceiling.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Grant-admin self-escalation ceiling (ADR-0029) — "only grant what you hold".
+ *
+ * A non-root grantor may only grant a role a permission key the grantor THEMSELVES effectively
+ * holds. This module provides:
+ *   • `coversKey` — a PURE predicate: does an effective key set cover a granted key (exact or
+ *     wildcard)? A wildcard is covered only if EVERY registered exact key it expands to is held.
+ *   • `GrantCeiling` — resolves a grantor's effective keys (their roles' `role_permission` rows in
+ *     their tenant, wildcards expanded) and asserts coverage; throws `GrantCeilingError` (→ 403) on
+ *     violation, `AuthorizationUnavailableError` (→ 503) on a store outage (fail-closed).
+ *
+ * Reuses the SAME `expandGrantKeys` + `readRoleIdsForTenant` the object-type gate uses — one
+ * definition of "what a principal holds". Root (strict `isRoot === true`) bypasses.
+ */
+import type { Pool } from 'mariadb';
+import type { ModuleRegistry, Principal } from '@astram/core';
+/** The grantor exceeds their own authority — cannot grant a key they do not hold (→ 403). */
+export declare class GrantCeilingError extends Error {
+    constructor(key: string);
+}
+/**
+ * Does `effective` (the grantor's held EXACT keys) cover `granted`?
+ *
+ * - An EXACT key is covered iff it is in `effective`.
+ * - A WILDCARD key (`module:*`, `module:type:*`, bare `module`) is covered iff EVERY registered
+ *   exact key it expands to is in `effective` — you cannot grant a wildcard you don't fully hold.
+ *   A wildcard that expands to ZERO registered keys is treated as NOT covered (nothing to hold ⇒
+ *   no basis to grant; also prevents a typo'd wildcard from vacuously passing).
+ *
+ * `effective` is assumed already expanded to exact keys (the grantor's wildcards resolved).
+ * PURE — no I/O; `registeredKeys` is the live registry's exact-key universe.
+ */
+export declare function coversKey(effective: ReadonlySet<string>, registeredKeys: readonly string[], granted: string): boolean;
+/**
+ * Resolves a grantor's effective keys and enforces the ADR-0029 ceiling. Constructed in the
+ * identity module over the shared authz pool + the identity registry.
+ */
+export declare class GrantCeiling {
+    private readonly pool;
+    private readonly registry;
+    /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
+    private readonly now;
+    constructor(pool: Pool, registry: ModuleRegistry, 
+    /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
+    now?: () => number);
+    /**
+     * The grantor's EFFECTIVE exact keys: the keys granted to the grantor's roles (active
+     * membership's in-effect postings in the grantor's tenant), wildcards expanded against the
+     * live registry. Fail-closed: a store outage throws AuthorizationUnavailableError (never an
+     * empty set masking an outage).
+     */
+    effectiveKeys(grantor: Principal): Promise<Set<string>>;
+    /**
+     * Assert the grantor may grant EVERY key in `keys`. Root (strict) bypasses. A non-root grantor
+     * must effectively hold each key (exact) or fully hold each wildcard's expansion. Throws
+     * `GrantCeilingError` on the FIRST key that exceeds the grantor's authority.
+     */
+    assertCanGrant(grantor: Principal, keys: readonly string[]): Promise<void>;
+}
+//# sourceMappingURL=grant-ceiling.d.ts.map

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9D,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM;CAIxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAUjF"}