@astram/identity 0.3.1 → 0.5.0

package/dist/company-membership.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-membership.object.d.ts","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAca,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,WAAW,EAAG,MAAM,CAAC;IAGrB,QAAQ,EAAG,OAAO,CAAC;IAGnB,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"company-membership.object.d.ts","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAca,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAId,QAAQ,EAAG,MAAM,CAAC;IAGlB,WAAW,EAAG,MAAM,CAAC;IAGrB,QAAQ,EAAG,OAAO,CAAC;IAGnB,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company-membership.object.js

@@ -21,6 +21,7 @@ const schema_1 = require("./schema");
  */
 let CompanyMembership = class CompanyMembership {
     uuid;
+    // immutable (ADR-0034): a membership never changes its user or company after create.
     userUuid;
     companyUuid;
     isActive;
@@ -33,11 +34,11 @@ __decorate([
     __metadata("design:type", String)
 ], CompanyMembership.prototype, "uuid", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'cm_user_uuid', type: 'uuid', required: true }),
+    (0, engine_1.Field)({ column: 'cm_user_uuid', type: 'uuid', required: true, immutable: true }),
     __metadata("design:type", String)
 ], CompanyMembership.prototype, "userUuid", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'cm_company_uuid', type: 'uuid', required: true }),
+    (0, engine_1.Field)({ column: 'cm_company_uuid', type: 'uuid', required: true, immutable: true }),
     __metadata("design:type", String)
 ], CompanyMembership.prototype, "companyUuid", void 0);
 __decorate([

package/dist/company.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.object.d.ts","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,qBAmBa,OAAO;IAElB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,IAAI,EAAG,MAAM,CAAC;IAGd,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"company.object.d.ts","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,qBAsBa,OAAO;IAElB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAKd,UAAU,EAAG,MAAM,CAAC;IAGpB,IAAI,EAAG,MAAM,CAAC;IAGd,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company.object.js

@@ -16,6 +16,8 @@ const schema_1 = require("./schema");
 let Company = class Company {
     uuid;
     name;
+    // immutable (ADR-0034): re-parenting is a hierarchy move (cycle check, closure rebuild,
+    // session bump), never a side effect of a generic patch.
     parentUuid;
     type;
     status;
@@ -31,11 +33,11 @@ __decorate([
     __metadata("design:type", String)
 ], Company.prototype, "name", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'c_parent_uuid', type: 'uuid' }),
+    (0, engine_1.Field)({ column: 'c_parent_uuid', type: 'uuid', immutable: true }),
     __metadata("design:type", String)
 ], Company.prototype, "parentUuid", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'c_type', type: 'string' }),
+    (0, engine_1.Field)({ column: 'c_type', type: 'string', immutable: true }),
     __metadata("design:type", String)
 ], Company.prototype, "type", void 0);
 __decorate([
@@ -63,7 +65,10 @@ exports.Company = Company = __decorate([
         // the node (`c_uuid`), so a non-root LIST/GET is bounded to the caller's reachable subtree
         // (`c_uuid` IN my subtree). DECOUPLED from writes (no `trusted` change) — this filters
         // reads only. Root spans all.
-        readScope: { kind: 'nodeColumn', column: 'c_uuid' },
+        // create:'unscoped' (ADR-0034): a NEW company's c_uuid is not in anyone's subtree until the
+        // scope closure lists it, so the post-insert create wall would deny every create. Opted out
+        // explicitly; the company service owns where a non-root create may attach (parent stamping).
+        readScope: { kind: 'nodeColumn', column: 'c_uuid', create: 'unscoped' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'c_uuid' })
 ], Company);

package/dist/features/access/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/features/access/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAIhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iCAIjC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/features/access/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAIhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iCAAgE,CAAC"}

package/dist/features/access/index.js

@@ -19,8 +19,4 @@ Object.defineProperty(exports, "CompanyAdminAccess", { enumerable: true, get: fu
 var access_admin_access_2 = require("./access-admin.access");
 Object.defineProperty(exports, "AccessAdminAccess", { enumerable: true, get: function () { return access_admin_access_2.AccessAdminAccess; } });
 /** All identity access bundles, collected into the engine at boot. */
-exports.identityAccessBundles = [
-    user_management_access_1.UserManagementAccess,
-    company_admin_access_1.CompanyAdminAccess,
-    access_admin_access_1.AccessAdminAccess,
-];
+exports.identityAccessBundles = [user_management_access_1.UserManagementAccess, company_admin_access_1.CompanyAdminAccess, access_admin_access_1.AccessAdminAccess];

package/dist/features/audit/audit-read.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit-read.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAMD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB;IAGvD;;;;;;OAMG;IACG,QAAQ,CACZ,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACnG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAyD5E;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAUjB"}
+{"version":3,"file":"audit-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit-read.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAMD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB;IAGvD;;;;;;OAMG;IACG,QAAQ,CACZ,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACA,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAkE5E;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAUjB"}

package/dist/features/audit/audit-read.service.js

@@ -33,7 +33,10 @@ class AuditReadService {
         // and tenantFilter is ignored (cannot widen or cross).
         let tenantId;
         if (principal.isRoot) {
-            tenantId = filters.tenantFilter && filters.tenantFilter.length > 0 ? filters.tenantFilter : ALL_TENANTS;
+            tenantId =
+                filters.tenantFilter && filters.tenantFilter.length > 0
+                    ? filters.tenantFilter
+                    : ALL_TENANTS;
         }
         else {
             tenantId = principal.tenantId;
@@ -47,9 +50,13 @@ class AuditReadService {
         // Clamp the client-supplied limit to [1, MAX_LIMIT]; a non-finite value falls back to
         // DEFAULT_LIMIT (only an in-range-but-out-of-bounds number gets floored/capped). Floor the
         // page to >= 1. offset uses the CLAMPED limit, so the window never diverges from read.limit.
-        const requestedLimit = Number.isFinite(filters.limit) ? filters.limit : DEFAULT_LIMIT;
+        const requestedLimit = Number.isFinite(filters.limit)
+            ? filters.limit
+            : DEFAULT_LIMIT;
         const limit = Math.min(Math.max(1, requestedLimit), MAX_LIMIT);
-        const page = Number.isFinite(filters.page) && filters.page >= 1 ? Math.floor(filters.page) : 1;
+        const page = Number.isFinite(filters.page) && filters.page >= 1
+            ? Math.floor(filters.page)
+            : 1;
         const offset = (page - 1) * limit;
         // ONE scope query — spread into BOTH the count and the page read so their tenant/type/actor
         // WHERE is identical. A non-root's total therefore counts ONLY its own tenant (invariant #4).
@@ -69,9 +76,9 @@ class AuditReadService {
         const rows = await Promise.all(events.map(async (event) => ({
             occurredAt: event.occurredAtMs,
             actorLabel: await this.labels.resolve('principal', event.actorId),
-            action: event.action?.key
-                ?? event.action
-                ?? '(event)',
+            action: event.action?.key ??
+                event.action ??
+                '(event)',
             tenantLabel: await this.labels.resolve('tenant', event.tenantId),
             detail: this.stripIds(event.attributes ?? {}),
         })));

package/dist/features/audit/audit.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.controller.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit.controller.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAW3D;;;gEAGgE;AAChE,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBACa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,gBAAgB;IAIhD,IAAI,CACD,GAAG,EAAE,aAAa,EAChB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5F,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA8B3F"}
+{"version":3,"file":"audit.controller.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAW3D;;;gEAGgE;AAChE,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,gBAAgB;IAIhD,IAAI,CACD,GAAG,EAAE,aAAa,EAChB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5F,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA8B3F"}

package/dist/features/audit/audit.controller.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuditController = void 0;
 // audit.controller.ts
 const common_1 = require("@nestjs/common");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const guard_1 = require("@astram/guard");
 // `AuditReadService` is the DI token for the constructor injection below, so it MUST be a
 // value import — a type-only import is erased at compile time, leaving NestJS with
@@ -69,5 +70,6 @@ __decorate([
 ], AuditController.prototype, "list", null);
 exports.AuditController = AuditController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [audit_read_service_js_1.AuditReadService])
 ], AuditController);

package/dist/features/audit/mariadb-audit-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgBD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,OAAO;CA+BhB"}
+{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgBD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,OAAO,CAAC,OAAO;CA+BhB"}

package/dist/features/authz/access-bundle-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAGL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE;IAKvD,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAuDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}
+{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAGL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE;IAKvD,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}

package/dist/features/authz/catalog-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAMN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IALjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,IAAI,EAAmB,QAAQ,EAAE,cAAc;IAIjE,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAmB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}
+{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAQ5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAP3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;gBAGtB,IAAI,EAAE,IAAI,EACO,QAAQ,EAAE,cAAc;IAK3C,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAiB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}

package/dist/features/authz/catalog-reconcile.job.js

@@ -29,9 +29,7 @@ class CatalogReconcileJob {
         try {
             const report = await this.reconciler.reconcile(this.registry, this.store, nowIso);
             this.latest = report;
-            const orphanNote = report.orphaned.length
-                ? ` — ORPHANED: ${report.orphaned.join(', ')}`
-                : '';
+            const orphanNote = report.orphaned.length ? ` — ORPHANED: ${report.orphaned.join(', ')}` : '';
             console.log(`[catalog] reconcile: +${report.added.length} added, ${report.orphaned.length} orphaned, ` +
                 `${report.reactivated.length} reactivated${orphanNote}`);
             return report;

package/dist/features/authz/db-permission-facts.adapter.d.ts

@@ -22,15 +22,27 @@ import type { PermissionFactsPort, CoarseGrants, ModuleRegistry } from '@astram/
  */
 export declare function expandGrantKeys(rawKeys: string[], allKeys: string[]): string[];
 /**
- * The principal's role uuids from its ACTIVE membership's in-effect postings in
- * `tenantId` — the SAME in-effect-posting window query `DbPermissionFactsAdapter` uses,
- * extracted so any OTHER caller that needs a principal's roleIds for a tenant reuses this
- * ONE timezone-safe epoch-ms window read instead of re-inlining the SQL.
+ * The principal's role uuids in `tenantId` — the SINGLE source of "what roles does this principal
+ * hold here" used by the object-type gate (gate 5), the grant-ceiling (ADR-0029), and the
+ * cross-tenant grant authorize. KIND-AWARE (ADR-0033): a SERVICE ACCOUNT's roles come from its
+ * `service_account.sa_role_ids`; a USER's roles come from its ACTIVE membership's in-effect
+ * postings. The service-account lookup runs first — a hit short-circuits (a service-account id
+ * never has membership rows anyway); a miss falls through to the timezone-safe epoch-ms membership
+ * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
+ * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
 export declare function readRoleIdsForTenant(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<string[]>;
+/**
+ * The next instant (epoch-ms, strictly after `now`) at which this USER's in-effect roles in
+ * `tenantId` change by themselves — the earliest future `mp_effective_from_ms` (a posting starts)
+ * or `mp_effective_until_ms` (a posting ends) of the active membership. No version bump marks
+ * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
+ * a service account (its roles have no windows). A query failure propagates (fail closed).
+ */
+export declare function readNextPostingBoundaryMs(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<number | null>;
 export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
     private readonly pool;
     private readonly registry;
@@ -48,6 +60,14 @@ export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
      */
     now?: () => number);
     currentPermissionsVersion(_principalId: string, tenantId: string): Promise<number>;
+    /**
+     * The coarse grants + (ADR-0035) the LIVE role ids they were derived from + the time bound of
+     * those roles. The version is read FIRST, so a bump racing this load can only make the facts look
+     * older (one extra reload), never newer. `roleIds` is always reported (empty = genuinely none),
+     * so the session layer binds the in-effect roles, never the credential's `ic_roles`.
+     * `validUntilMs` = the next posting window boundary (absent when there is none); an outage on
+     * that read fails closed like every other read here.
+     */
     loadCoarseGrants(principalId: string, tenantId: string): Promise<CoarseGrants>;
     private readVersion;
     /**

package/dist/features/authz/db-permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAYnB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalF,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAgBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}
+{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxF;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAuBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}

package/dist/features/authz/db-permission-facts.adapter.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbPermissionFactsAdapter = void 0;
 exports.expandGrantKeys = expandGrantKeys;
 exports.readRoleIdsForTenant = readRoleIdsForTenant;
+exports.readNextPostingBoundaryMs = readNextPostingBoundaryMs;
 const core_1 = require("@astram/core");
 const MODULE_PREFIX = 'identity';
 /**
@@ -33,25 +34,96 @@ function expandGrantKeys(rawKeys, allKeys) {
     }
     return [...out];
 }
+/** Parse a `sa_role_ids` JSON column (driver returns it already-parsed OR as a string). */
+function parseRoleIdsJson(v) {
+    const arr = Array.isArray(v)
+        ? v
+        : typeof v === 'string'
+            ? (() => {
+                try {
+                    return JSON.parse(v);
+                }
+                catch {
+                    return [];
+                }
+            })()
+            : [];
+    return Array.isArray(arr) ? arr.filter((x) => typeof x === 'string') : [];
+}
+/**
+ * A SERVICE ACCOUNT (ADR-0033) holds its roles directly on `service_account.sa_role_ids` — it has
+ * NO `company_membership`/`membership_posting` rows (those model a human's org placement). So its
+ * roles are read from the account row: an ACTIVE account in this tenant → its `sa_role_ids`. Returns
+ * `null` when `principalId` is not a service account here (→ the caller falls through to the human
+ * membership path). A DISABLED account returns `[]` (in-scope but no roles → deny everything —
+ * defense-in-depth alongside the key's own revoke check).
+ */
+async function readServiceAccountRoleIds(pool, principalId, tenantId) {
+    const rows = (await pool.query(`SELECT sa_role_ids, sa_status FROM \`shield_app\`.\`service_account\`
+      WHERE sa_id = ? AND sa_tenant_id = ? LIMIT 1`, [principalId, tenantId]));
+    const row = rows[0];
+    if (row === undefined)
+        return null; // not a service account here → let the user path run.
+    if (row.sa_status !== 'active')
+        return []; // disabled → no roles (deny-by-default).
+    return parseRoleIdsJson(row.sa_role_ids);
+}
 /**
- * The principal's role uuids from its ACTIVE membership's in-effect postings in
- * `tenantId` — the SAME in-effect-posting window query `DbPermissionFactsAdapter` uses,
- * extracted so any OTHER caller that needs a principal's roleIds for a tenant reuses this
- * ONE timezone-safe epoch-ms window read instead of re-inlining the SQL.
+ * The principal's role uuids in `tenantId` — the SINGLE source of "what roles does this principal
+ * hold here" used by the object-type gate (gate 5), the grant-ceiling (ADR-0029), and the
+ * cross-tenant grant authorize. KIND-AWARE (ADR-0033): a SERVICE ACCOUNT's roles come from its
+ * `service_account.sa_role_ids`; a USER's roles come from its ACTIVE membership's in-effect
+ * postings. The service-account lookup runs first — a hit short-circuits (a service-account id
+ * never has membership rows anyway); a miss falls through to the timezone-safe epoch-ms membership
+ * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
+ * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
 async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now) {
+    // Service-account path (ADR-0033): its roles live on the account row, not memberships.
+    const saRoles = await readServiceAccountRoleIds(pool, principalId, tenantId);
+    if (saRoles !== null)
+        return saRoles;
+    // Human path: roles from the active membership's in-effect postings — of an ACTIVE account only
+    // (security hardening Phase 3: a disabled user holds no roles, so gate 5 and every role-keyed
+    // path deny at once; `company_membership.cm_user_uuid` is an FK to `users`, so a member always
+    // has a users row).
     const nowMs = now();
     const rows = (await pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
        FROM \`shield_app\`.\`company_membership\` cm
+       JOIN \`shield_app\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
        JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
       WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1
         AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
         AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [principalId, tenantId, nowMs, nowMs]));
     return rows.map((r) => r.role_uuid);
 }
+/**
+ * The next instant (epoch-ms, strictly after `now`) at which this USER's in-effect roles in
+ * `tenantId` change by themselves — the earliest future `mp_effective_from_ms` (a posting starts)
+ * or `mp_effective_until_ms` (a posting ends) of the active membership. No version bump marks
+ * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
+ * a service account (its roles have no windows). A query failure propagates (fail closed).
+ */
+async function readNextPostingBoundaryMs(pool, principalId, tenantId, now = Date.now) {
+    const nowMs = now();
+    const rows = (await pool.query(`SELECT MIN(CASE
+              WHEN mp.mp_effective_from_ms IS NOT NULL AND mp.mp_effective_from_ms > ?
+                THEN mp.mp_effective_from_ms
+              WHEN mp.mp_effective_until_ms IS NOT NULL AND mp.mp_effective_until_ms > ?
+                THEN mp.mp_effective_until_ms
+            END) AS next_boundary_ms
+       FROM \`shield_app\`.\`company_membership\` cm
+       JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+      WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1`, [nowMs, nowMs, principalId, tenantId]));
+    const raw = rows[0]?.next_boundary_ms;
+    if (raw === null || raw === undefined)
+        return null;
+    const ms = Number(raw);
+    return Number.isFinite(ms) && ms > nowMs ? ms : null;
+}
 class DbPermissionFactsAdapter {
     pool;
     registry;
@@ -77,14 +149,24 @@ class DbPermissionFactsAdapter {
             throw new core_1.AuthorizationUnavailableError('permission version store unavailable', cause);
         }
     }
+    /**
+     * The coarse grants + (ADR-0035) the LIVE role ids they were derived from + the time bound of
+     * those roles. The version is read FIRST, so a bump racing this load can only make the facts look
+     * older (one extra reload), never newer. `roleIds` is always reported (empty = genuinely none),
+     * so the session layer binds the in-effect roles, never the credential's `ic_roles`.
+     * `validUntilMs` = the next posting window boundary (absent when there is none); an outage on
+     * that read fails closed like every other read here.
+     */
     async loadCoarseGrants(principalId, tenantId) {
         let version;
         let roleIds;
         let rawKeys;
+        let validUntilMs;
         try {
             version = await this.readVersion(tenantId);
             roleIds = await this.readRoleIds(principalId, tenantId);
             rawKeys = roleIds.length === 0 ? [] : await this.readGrantKeys(roleIds);
+            validUntilMs = await readNextPostingBoundaryMs(this.pool, principalId, tenantId, this.now);
         }
         catch (cause) {
             if (cause instanceof core_1.AuthorizationUnavailableError)
@@ -92,7 +174,12 @@ class DbPermissionFactsAdapter {
             throw new core_1.AuthorizationUnavailableError('permission facts store unavailable', cause);
         }
         const allKeys = this.registry.listActions().map((a) => a.permissionKey);
-        return { permissionsVersion: version, grantedPermissionKeys: expandGrantKeys(rawKeys, allKeys) };
+        return {
+            permissionsVersion: version,
+            grantedPermissionKeys: expandGrantKeys(rawKeys, allKeys),
+            roleIds,
+            ...(validUntilMs !== null ? { validUntilMs } : {}),
+        };
     }
     async readVersion(tenantId) {
         const rows = (await this.pool.query(`SELECT apv_version FROM \`shield_authz\`.\`authz_permission_version\`

package/dist/features/authz/grant-admin.controller.d.ts

@@ -13,8 +13,11 @@ interface AuthedRequest {
  * grant; a non-root caller needs the grant. (`role_permission` itself is not a
  * registered object type — it is administered THROUGH `role`, never classified directly.)
  *
- * Mutating routes pass `req.principal.id` as the grantor so `role_permission` records
- * who granted what (surfaced by the grants-summary listing as "by <name>").
+ * Mutating routes pass `req.principal` as the actor: it stamps who granted what (surfaced by the
+ * grants-summary listing as "by <name>"), and grant AND revoke run the role-binding rule (a role
+ * also used outside the caller's subtree is root-only) and the ADR-0029 ceiling ("only grant or
+ * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling and
+ * binding → 403, a role outside the caller's subtree → 404, unknown key/bundle → 400.
  */
 export declare class GrantAdminController {
     private readonly grants;
@@ -25,7 +28,7 @@ export declare class GrantAdminController {
      * grantor NAME (resolved server-side — no raw uuid). Gated `role:read`.
      *
      * ⚠️ Path is `access/role-grants` (NOT under `roles/...`) on purpose: a `roles/<x>` path
-     * would be captured by IdentityController's `@Get('roles/:uuid')` (registered first),
+     * would be captured by RoleController's `@Get('roles/:uuid')` (registered first),
      * routing this to getRole('role-grants') → a 500. Keep it off the `roles/:uuid` shape.
      */
     grantsSummary(req: AuthedRequest, query: {
@@ -63,7 +66,7 @@ export declare class GrantAdminController {
         success: boolean;
     }>;
     /** Revoke one permission key from a role. `:key` is URL-encoded (contains ':'). */
-    revoke(uuid: string, key: string): Promise<{
+    revoke(req: AuthedRequest, uuid: string, key: string): Promise<{
         success: boolean;
     }>;
     /**
@@ -89,7 +92,7 @@ export declare class GrantAdminController {
      * `role_permission` (see design §5.1 caveat re: shared keys). `:key` is the bundle slug.
      * Unknown bundle → 400. Gated `role:update`.
      */
-    revokeBundle(uuid: string, key: string): Promise<{
+    revokeBundle(req: AuthedRequest, uuid: string, key: string): Promise<{
         success: boolean;
     }>;
 }

package/dist/features/authz/grant-admin.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAG1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYlG,mFAAmF;IAG7E,MAAM,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAOnE;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYxG;;;;OAIG;IAGG,YAAY,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;CAS1E"}
+{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;;;;GAcG;AACH,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CACF,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC,mFAAmF;IAG7E,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAO9F;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC;;;;OAIG;IAGG,YAAY,CACT,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACb,GAAG,EAAE,MAAM;;;CAU5B"}

package/dist/features/authz/grant-admin.controller.js

@@ -19,6 +19,7 @@ exports.GrantAdminController = void 0;
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const grant_admin_service_js_1 = require("./grant-admin.service.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 /**
  * Derive the caller's subtree scope from the resolved principal (Task 4.2). Uses the SAME cached
  * `scopeSubtreeNodeIds` the RecordEngine's list-scope uses (one source of truth). Fail-safe to the
@@ -38,8 +39,11 @@ function subtreeScopeOf(req) {
  * grant; a non-root caller needs the grant. (`role_permission` itself is not a
  * registered object type — it is administered THROUGH `role`, never classified directly.)
  *
- * Mutating routes pass `req.principal.id` as the grantor so `role_permission` records
- * who granted what (surfaced by the grants-summary listing as "by <name>").
+ * Mutating routes pass `req.principal` as the actor: it stamps who granted what (surfaced by the
+ * grants-summary listing as "by <name>"), and grant AND revoke run the role-binding rule (a role
+ * also used outside the caller's subtree is root-only) and the ADR-0029 ceiling ("only grant or
+ * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling and
+ * binding → 403, a role outside the caller's subtree → 404, unknown key/bundle → 400.
  */
 let GrantAdminController = class GrantAdminController {
     grants;
@@ -52,7 +56,7 @@ let GrantAdminController = class GrantAdminController {
      * grantor NAME (resolved server-side — no raw uuid). Gated `role:read`.
      *
      * ⚠️ Path is `access/role-grants` (NOT under `roles/...`) on purpose: a `roles/<x>` path
-     * would be captured by IdentityController's `@Get('roles/:uuid')` (registered first),
+     * would be captured by RoleController's `@Get('roles/:uuid')` (registered first),
      * routing this to getRole('role-grants') → a 500. Keep it off the `roles/:uuid` shape.
      */
     async grantsSummary(req, query) {
@@ -86,7 +90,7 @@ let GrantAdminController = class GrantAdminController {
         if (!key)
             throw new common_1.BadRequestException('key required');
         try {
-            await this.grants.grant(uuid, key, req.principal?.id);
+            await this.grants.grant(uuid, key, req.principal);
         }
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
@@ -96,8 +100,8 @@ let GrantAdminController = class GrantAdminController {
         return { success: true };
     }
     /** Revoke one permission key from a role. `:key` is URL-encoded (contains ':'). */
-    async revoke(uuid, key) {
-        await this.grants.revoke(uuid, decodeURIComponent(key));
+    async revoke(req, uuid, key) {
+        await this.grants.revoke(uuid, decodeURIComponent(key), req.principal);
         return { success: true };
     }
     // ── Access bundles ────────────────────────────────────────────────────────
@@ -119,7 +123,7 @@ let GrantAdminController = class GrantAdminController {
         if (!key)
             throw new common_1.BadRequestException('key required');
         try {
-            await this.grants.grantBundle(uuid, key, req.principal?.id);
+            await this.grants.grantBundle(uuid, key, req.principal);
         }
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
@@ -133,9 +137,9 @@ let GrantAdminController = class GrantAdminController {
      * `role_permission` (see design §5.1 caveat re: shared keys). `:key` is the bundle slug.
      * Unknown bundle → 400. Gated `role:update`.
      */
-    async revokeBundle(uuid, key) {
+    async revokeBundle(req, uuid, key) {
         try {
-            await this.grants.revokeBundle(uuid, decodeURIComponent(key));
+            await this.grants.revokeBundle(uuid, decodeURIComponent(key), req.principal);
         }
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
@@ -184,10 +188,11 @@ __decorate([
 __decorate([
     (0, common_1.Delete)('roles/:uuid/permissions/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Param)('key')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [Object, String, String]),
     __metadata("design:returntype", Promise)
 ], GrantAdminController.prototype, "revoke", null);
 __decorate([
@@ -210,13 +215,15 @@ __decorate([
 __decorate([
     (0, common_1.Delete)('roles/:uuid/access-bundles/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Param)('key')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [Object, String, String]),
     __metadata("design:returntype", Promise)
 ], GrantAdminController.prototype, "revokeBundle", null);
 exports.GrantAdminController = GrantAdminController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [grant_admin_service_js_1.GrantAdminService])
 ], GrantAdminController);