@astram/identity 0.4.0 → 0.6.0

package/dist/company-membership.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-membership.object.d.ts","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAca,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,WAAW,EAAG,MAAM,CAAC;IAGrB,QAAQ,EAAG,OAAO,CAAC;IAGnB,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"company-membership.object.d.ts","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAca,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAId,QAAQ,EAAG,MAAM,CAAC;IAGlB,WAAW,EAAG,MAAM,CAAC;IAGrB,QAAQ,EAAG,OAAO,CAAC;IAGnB,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company-membership.object.js

@@ -21,6 +21,7 @@ const schema_1 = require("./schema");
  */
 let CompanyMembership = class CompanyMembership {
     uuid;
+    // immutable (ADR-0034): a membership never changes its user or company after create.
     userUuid;
     companyUuid;
     isActive;
@@ -33,11 +34,11 @@ __decorate([
     __metadata("design:type", String)
 ], CompanyMembership.prototype, "uuid", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'cm_user_uuid', type: 'uuid', required: true }),
+    (0, engine_1.Field)({ column: 'cm_user_uuid', type: 'uuid', required: true, immutable: true }),
     __metadata("design:type", String)
 ], CompanyMembership.prototype, "userUuid", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'cm_company_uuid', type: 'uuid', required: true }),
+    (0, engine_1.Field)({ column: 'cm_company_uuid', type: 'uuid', required: true, immutable: true }),
     __metadata("design:type", String)
 ], CompanyMembership.prototype, "companyUuid", void 0);
 __decorate([

package/dist/company.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.object.d.ts","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,qBAmBa,OAAO;IAElB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,IAAI,EAAG,MAAM,CAAC;IAGd,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"company.object.d.ts","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,qBAsBa,OAAO;IAElB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAKd,UAAU,EAAG,MAAM,CAAC;IAGpB,IAAI,EAAG,MAAM,CAAC;IAGd,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company.object.js

@@ -16,6 +16,8 @@ const schema_1 = require("./schema");
 let Company = class Company {
     uuid;
     name;
+    // immutable (ADR-0034): re-parenting is a hierarchy move (cycle check, closure rebuild,
+    // session bump), never a side effect of a generic patch.
     parentUuid;
     type;
     status;
@@ -31,11 +33,11 @@ __decorate([
     __metadata("design:type", String)
 ], Company.prototype, "name", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'c_parent_uuid', type: 'uuid' }),
+    (0, engine_1.Field)({ column: 'c_parent_uuid', type: 'uuid', immutable: true }),
     __metadata("design:type", String)
 ], Company.prototype, "parentUuid", void 0);
 __decorate([
-    (0, engine_1.Field)({ column: 'c_type', type: 'string' }),
+    (0, engine_1.Field)({ column: 'c_type', type: 'string', immutable: true }),
     __metadata("design:type", String)
 ], Company.prototype, "type", void 0);
 __decorate([
@@ -63,7 +65,10 @@ exports.Company = Company = __decorate([
         // the node (`c_uuid`), so a non-root LIST/GET is bounded to the caller's reachable subtree
         // (`c_uuid` IN my subtree). DECOUPLED from writes (no `trusted` change) — this filters
         // reads only. Root spans all.
-        readScope: { kind: 'nodeColumn', column: 'c_uuid' },
+        // create:'unscoped' (ADR-0034): a NEW company's c_uuid is not in anyone's subtree until the
+        // scope closure lists it, so the post-insert create wall would deny every create. Opted out
+        // explicitly; the company service owns where a non-root create may attach (parent stamping).
+        readScope: { kind: 'nodeColumn', column: 'c_uuid', create: 'unscoped' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'c_uuid' })
 ], Company);

package/dist/features/access/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/features/access/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAIhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iCAIjC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/features/access/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAIhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,iCAAgE,CAAC"}

package/dist/features/access/index.js

@@ -19,8 +19,4 @@ Object.defineProperty(exports, "CompanyAdminAccess", { enumerable: true, get: fu
 var access_admin_access_2 = require("./access-admin.access");
 Object.defineProperty(exports, "AccessAdminAccess", { enumerable: true, get: function () { return access_admin_access_2.AccessAdminAccess; } });
 /** All identity access bundles, collected into the engine at boot. */
-exports.identityAccessBundles = [
-    user_management_access_1.UserManagementAccess,
-    company_admin_access_1.CompanyAdminAccess,
-    access_admin_access_1.AccessAdminAccess,
-];
+exports.identityAccessBundles = [user_management_access_1.UserManagementAccess, company_admin_access_1.CompanyAdminAccess, access_admin_access_1.AccessAdminAccess];

package/dist/features/audit/audit-read.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit-read.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAMD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB;IAGvD;;;;;;OAMG;IACG,QAAQ,CACZ,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACnG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAyD5E;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAUjB"}
+{"version":3,"file":"audit-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit-read.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAMD;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,aAAa,EACrB,iBAAiB,EAAE,iBAAiB;IAGvD;;;;;;OAMG;IACG,QAAQ,CACZ,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACA,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAkE5E;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAUjB"}

package/dist/features/audit/audit-read.service.js

@@ -33,7 +33,10 @@ class AuditReadService {
         // and tenantFilter is ignored (cannot widen or cross).
         let tenantId;
         if (principal.isRoot) {
-            tenantId = filters.tenantFilter && filters.tenantFilter.length > 0 ? filters.tenantFilter : ALL_TENANTS;
+            tenantId =
+                filters.tenantFilter && filters.tenantFilter.length > 0
+                    ? filters.tenantFilter
+                    : ALL_TENANTS;
         }
         else {
             tenantId = principal.tenantId;
@@ -47,9 +50,13 @@ class AuditReadService {
         // Clamp the client-supplied limit to [1, MAX_LIMIT]; a non-finite value falls back to
         // DEFAULT_LIMIT (only an in-range-but-out-of-bounds number gets floored/capped). Floor the
         // page to >= 1. offset uses the CLAMPED limit, so the window never diverges from read.limit.
-        const requestedLimit = Number.isFinite(filters.limit) ? filters.limit : DEFAULT_LIMIT;
+        const requestedLimit = Number.isFinite(filters.limit)
+            ? filters.limit
+            : DEFAULT_LIMIT;
         const limit = Math.min(Math.max(1, requestedLimit), MAX_LIMIT);
-        const page = Number.isFinite(filters.page) && filters.page >= 1 ? Math.floor(filters.page) : 1;
+        const page = Number.isFinite(filters.page) && filters.page >= 1
+            ? Math.floor(filters.page)
+            : 1;
         const offset = (page - 1) * limit;
         // ONE scope query — spread into BOTH the count and the page read so their tenant/type/actor
         // WHERE is identical. A non-root's total therefore counts ONLY its own tenant (invariant #4).
@@ -69,9 +76,9 @@ class AuditReadService {
         const rows = await Promise.all(events.map(async (event) => ({
             occurredAt: event.occurredAtMs,
             actorLabel: await this.labels.resolve('principal', event.actorId),
-            action: event.action?.key
-                ?? event.action
-                ?? '(event)',
+            action: event.action?.key ??
+                event.action ??
+                '(event)',
             tenantLabel: await this.labels.resolve('tenant', event.tenantId),
             detail: this.stripIds(event.attributes ?? {}),
         })));

package/dist/features/audit/audit.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.controller.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit.controller.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAW3D;;;gEAGgE;AAChE,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBACa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,gBAAgB;IAIhD,IAAI,CACD,GAAG,EAAE,aAAa,EAChB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5F,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA8B3F"}
+{"version":3,"file":"audit.controller.d.ts","sourceRoot":"","sources":["../../../src/features/audit/audit.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAW3D;;;gEAGgE;AAChE,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,gBAAgB;IAIhD,IAAI,CACD,GAAG,EAAE,aAAa,EAChB,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5F,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA8B3F"}

package/dist/features/audit/audit.controller.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuditController = void 0;
 // audit.controller.ts
 const common_1 = require("@nestjs/common");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const guard_1 = require("@astram/guard");
 // `AuditReadService` is the DI token for the constructor injection below, so it MUST be a
 // value import — a type-only import is erased at compile time, leaving NestJS with
@@ -69,5 +70,6 @@ __decorate([
 ], AuditController.prototype, "list", null);
 exports.AuditController = AuditController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [audit_read_service_js_1.AuditReadService])
 ], AuditController);

package/dist/features/audit/mariadb-audit-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgBD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,OAAO;CA+BhB"}
+{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgBD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,OAAO,CAAC,OAAO;CA+BhB"}

package/dist/features/authz/access-bundle-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAGL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE;IAKvD,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAuDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}
+{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAGL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE;IAKvD,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}

package/dist/features/authz/catalog-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAMN,OAAO,CAAC,QAAQ,CAAC,QAAQ;IALjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;gBAEZ,IAAI,EAAE,IAAI,EAAmB,QAAQ,EAAE,cAAc;IAIjE,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAmB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}
+{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAQ5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAP3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;gBAGtB,IAAI,EAAE,IAAI,EACO,QAAQ,EAAE,cAAc;IAK3C,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAiB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}

package/dist/features/authz/catalog-reconcile.job.js

@@ -29,9 +29,7 @@ class CatalogReconcileJob {
         try {
             const report = await this.reconciler.reconcile(this.registry, this.store, nowIso);
             this.latest = report;
-            const orphanNote = report.orphaned.length
-                ? ` — ORPHANED: ${report.orphaned.join(', ')}`
-                : '';
+            const orphanNote = report.orphaned.length ? ` — ORPHANED: ${report.orphaned.join(', ')}` : '';
             console.log(`[catalog] reconcile: +${report.added.length} added, ${report.orphaned.length} orphaned, ` +
                 `${report.reactivated.length} reactivated${orphanNote}`);
             return report;

package/dist/features/authz/db-permission-facts.adapter.d.ts

@@ -35,6 +35,14 @@ export declare function expandGrantKeys(rawKeys: string[], allKeys: string[]): s
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
 export declare function readRoleIdsForTenant(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<string[]>;
+/**
+ * The next instant (epoch-ms, strictly after `now`) at which this USER's in-effect roles in
+ * `tenantId` change by themselves — the earliest future `mp_effective_from_ms` (a posting starts)
+ * or `mp_effective_until_ms` (a posting ends) of the active membership. No version bump marks
+ * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
+ * a service account (its roles have no windows). A query failure propagates (fail closed).
+ */
+export declare function readNextPostingBoundaryMs(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<number | null>;
 export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
     private readonly pool;
     private readonly registry;
@@ -52,6 +60,14 @@ export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
      */
     now?: () => number);
     currentPermissionsVersion(_principalId: string, tenantId: string): Promise<number>;
+    /**
+     * The coarse grants + (ADR-0035) the LIVE role ids they were derived from + the time bound of
+     * those roles. The version is read FIRST, so a bump racing this load can only make the facts look
+     * older (one extra reload), never newer. `roleIds` is always reported (empty = genuinely none),
+     * so the session layer binds the in-effect roles, never the credential's `ic_roles`.
+     * `validUntilMs` = the next posting window boundary (absent when there is none); an outage on
+     * that read fails closed like every other read here.
+     */
     loadCoarseGrants(principalId: string, tenantId: string): Promise<CoarseGrants>;
     private readVersion;
     /**

package/dist/features/authz/db-permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalF,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAgBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}
+{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxF;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAuBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}

package/dist/features/authz/db-permission-facts.adapter.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbPermissionFactsAdapter = void 0;
 exports.expandGrantKeys = expandGrantKeys;
 exports.readRoleIdsForTenant = readRoleIdsForTenant;
+exports.readNextPostingBoundaryMs = readNextPostingBoundaryMs;
 const core_1 = require("@astram/core");
 const MODULE_PREFIX = 'identity';
 /**
@@ -85,16 +86,44 @@ async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now)
     const saRoles = await readServiceAccountRoleIds(pool, principalId, tenantId);
     if (saRoles !== null)
         return saRoles;
-    // Human path: roles from the active membership's in-effect postings.
+    // Human path: roles from the active membership's in-effect postings — of an ACTIVE account only
+    // (security hardening Phase 3: a disabled user holds no roles, so gate 5 and every role-keyed
+    // path deny at once; `company_membership.cm_user_uuid` is an FK to `users`, so a member always
+    // has a users row).
     const nowMs = now();
     const rows = (await pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
        FROM \`shield_app\`.\`company_membership\` cm
+       JOIN \`shield_app\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
        JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
       WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1
         AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
         AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [principalId, tenantId, nowMs, nowMs]));
     return rows.map((r) => r.role_uuid);
 }
+/**
+ * The next instant (epoch-ms, strictly after `now`) at which this USER's in-effect roles in
+ * `tenantId` change by themselves — the earliest future `mp_effective_from_ms` (a posting starts)
+ * or `mp_effective_until_ms` (a posting ends) of the active membership. No version bump marks
+ * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
+ * a service account (its roles have no windows). A query failure propagates (fail closed).
+ */
+async function readNextPostingBoundaryMs(pool, principalId, tenantId, now = Date.now) {
+    const nowMs = now();
+    const rows = (await pool.query(`SELECT MIN(CASE
+              WHEN mp.mp_effective_from_ms IS NOT NULL AND mp.mp_effective_from_ms > ?
+                THEN mp.mp_effective_from_ms
+              WHEN mp.mp_effective_until_ms IS NOT NULL AND mp.mp_effective_until_ms > ?
+                THEN mp.mp_effective_until_ms
+            END) AS next_boundary_ms
+       FROM \`shield_app\`.\`company_membership\` cm
+       JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+      WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1`, [nowMs, nowMs, principalId, tenantId]));
+    const raw = rows[0]?.next_boundary_ms;
+    if (raw === null || raw === undefined)
+        return null;
+    const ms = Number(raw);
+    return Number.isFinite(ms) && ms > nowMs ? ms : null;
+}
 class DbPermissionFactsAdapter {
     pool;
     registry;
@@ -120,14 +149,24 @@ class DbPermissionFactsAdapter {
             throw new core_1.AuthorizationUnavailableError('permission version store unavailable', cause);
         }
     }
+    /**
+     * The coarse grants + (ADR-0035) the LIVE role ids they were derived from + the time bound of
+     * those roles. The version is read FIRST, so a bump racing this load can only make the facts look
+     * older (one extra reload), never newer. `roleIds` is always reported (empty = genuinely none),
+     * so the session layer binds the in-effect roles, never the credential's `ic_roles`.
+     * `validUntilMs` = the next posting window boundary (absent when there is none); an outage on
+     * that read fails closed like every other read here.
+     */
     async loadCoarseGrants(principalId, tenantId) {
         let version;
         let roleIds;
         let rawKeys;
+        let validUntilMs;
         try {
             version = await this.readVersion(tenantId);
             roleIds = await this.readRoleIds(principalId, tenantId);
             rawKeys = roleIds.length === 0 ? [] : await this.readGrantKeys(roleIds);
+            validUntilMs = await readNextPostingBoundaryMs(this.pool, principalId, tenantId, this.now);
         }
         catch (cause) {
             if (cause instanceof core_1.AuthorizationUnavailableError)
@@ -135,7 +174,12 @@ class DbPermissionFactsAdapter {
             throw new core_1.AuthorizationUnavailableError('permission facts store unavailable', cause);
         }
         const allKeys = this.registry.listActions().map((a) => a.permissionKey);
-        return { permissionsVersion: version, grantedPermissionKeys: expandGrantKeys(rawKeys, allKeys) };
+        return {
+            permissionsVersion: version,
+            grantedPermissionKeys: expandGrantKeys(rawKeys, allKeys),
+            roleIds,
+            ...(validUntilMs !== null ? { validUntilMs } : {}),
+        };
     }
     async readVersion(tenantId) {
         const rows = (await this.pool.query(`SELECT apv_version FROM \`shield_authz\`.\`authz_permission_version\`

package/dist/features/authz/grant-admin.controller.d.ts

@@ -13,8 +13,11 @@ interface AuthedRequest {
  * grant; a non-root caller needs the grant. (`role_permission` itself is not a
  * registered object type — it is administered THROUGH `role`, never classified directly.)
  *
- * Mutating routes pass `req.principal.id` as the grantor so `role_permission` records
- * who granted what (surfaced by the grants-summary listing as "by <name>").
+ * Mutating routes pass `req.principal` as the actor: it stamps who granted what (surfaced by the
+ * grants-summary listing as "by <name>"), and grant AND revoke run the role-binding rule (a role
+ * also used outside the caller's subtree is root-only) and the ADR-0029 ceiling ("only grant or
+ * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling and
+ * binding → 403, a role outside the caller's subtree → 404, unknown key/bundle → 400.
  */
 export declare class GrantAdminController {
     private readonly grants;
@@ -25,7 +28,7 @@ export declare class GrantAdminController {
      * grantor NAME (resolved server-side — no raw uuid). Gated `role:read`.
      *
      * ⚠️ Path is `access/role-grants` (NOT under `roles/...`) on purpose: a `roles/<x>` path
-     * would be captured by IdentityController's `@Get('roles/:uuid')` (registered first),
+     * would be captured by RoleController's `@Get('roles/:uuid')` (registered first),
      * routing this to getRole('role-grants') → a 500. Keep it off the `roles/:uuid` shape.
      */
     grantsSummary(req: AuthedRequest, query: {
@@ -63,7 +66,7 @@ export declare class GrantAdminController {
         success: boolean;
     }>;
     /** Revoke one permission key from a role. `:key` is URL-encoded (contains ':'). */
-    revoke(uuid: string, key: string): Promise<{
+    revoke(req: AuthedRequest, uuid: string, key: string): Promise<{
         success: boolean;
     }>;
     /**
@@ -89,7 +92,7 @@ export declare class GrantAdminController {
      * `role_permission` (see design §5.1 caveat re: shared keys). `:key` is the bundle slug.
      * Unknown bundle → 400. Gated `role:update`.
      */
-    revokeBundle(uuid: string, key: string): Promise<{
+    revokeBundle(req: AuthedRequest, uuid: string, key: string): Promise<{
         success: boolean;
     }>;
 }

package/dist/features/authz/grant-admin.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAalG,mFAAmF;IAG7E,MAAM,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAOnE;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAaxG;;;;OAIG;IAGG,YAAY,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;CAS1E"}
+{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;;;;GAcG;AACH,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CACF,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC,mFAAmF;IAG7E,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAO9F;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC;;;;OAIG;IAGG,YAAY,CACT,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACb,GAAG,EAAE,MAAM;;;CAU5B"}

package/dist/features/authz/grant-admin.controller.js

@@ -19,7 +19,7 @@ exports.GrantAdminController = void 0;
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const grant_admin_service_js_1 = require("./grant-admin.service.js");
-const grant_ceiling_js_1 = require("./grant-ceiling.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 /**
  * Derive the caller's subtree scope from the resolved principal (Task 4.2). Uses the SAME cached
  * `scopeSubtreeNodeIds` the RecordEngine's list-scope uses (one source of truth). Fail-safe to the
@@ -39,8 +39,11 @@ function subtreeScopeOf(req) {
  * grant; a non-root caller needs the grant. (`role_permission` itself is not a
  * registered object type — it is administered THROUGH `role`, never classified directly.)
  *
- * Mutating routes pass `req.principal.id` as the grantor so `role_permission` records
- * who granted what (surfaced by the grants-summary listing as "by <name>").
+ * Mutating routes pass `req.principal` as the actor: it stamps who granted what (surfaced by the
+ * grants-summary listing as "by <name>"), and grant AND revoke run the role-binding rule (a role
+ * also used outside the caller's subtree is root-only) and the ADR-0029 ceiling ("only grant or
+ * revoke what you hold"). Errors map in one place ({@link IdentityErrorInterceptor}): ceiling and
+ * binding → 403, a role outside the caller's subtree → 404, unknown key/bundle → 400.
  */
 let GrantAdminController = class GrantAdminController {
     grants;
@@ -53,7 +56,7 @@ let GrantAdminController = class GrantAdminController {
      * grantor NAME (resolved server-side — no raw uuid). Gated `role:read`.
      *
      * ⚠️ Path is `access/role-grants` (NOT under `roles/...`) on purpose: a `roles/<x>` path
-     * would be captured by IdentityController's `@Get('roles/:uuid')` (registered first),
+     * would be captured by RoleController's `@Get('roles/:uuid')` (registered first),
      * routing this to getRole('role-grants') → a 500. Keep it off the `roles/:uuid` shape.
      */
     async grantsSummary(req, query) {
@@ -92,15 +95,13 @@ let GrantAdminController = class GrantAdminController {
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
                 throw new common_1.BadRequestException(e.message);
-            if (e instanceof grant_ceiling_js_1.GrantCeilingError)
-                throw new common_1.ForbiddenException(e.message);
             throw e;
         }
         return { success: true };
     }
     /** Revoke one permission key from a role. `:key` is URL-encoded (contains ':'). */
-    async revoke(uuid, key) {
-        await this.grants.revoke(uuid, decodeURIComponent(key));
+    async revoke(req, uuid, key) {
+        await this.grants.revoke(uuid, decodeURIComponent(key), req.principal);
         return { success: true };
     }
     // ── Access bundles ────────────────────────────────────────────────────────
@@ -127,8 +128,6 @@ let GrantAdminController = class GrantAdminController {
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
                 throw new common_1.BadRequestException(e.message);
-            if (e instanceof grant_ceiling_js_1.GrantCeilingError)
-                throw new common_1.ForbiddenException(e.message);
             throw e;
         }
         return { success: true };
@@ -138,9 +137,9 @@ let GrantAdminController = class GrantAdminController {
      * `role_permission` (see design §5.1 caveat re: shared keys). `:key` is the bundle slug.
      * Unknown bundle → 400. Gated `role:update`.
      */
-    async revokeBundle(uuid, key) {
+    async revokeBundle(req, uuid, key) {
         try {
-            await this.grants.revokeBundle(uuid, decodeURIComponent(key));
+            await this.grants.revokeBundle(uuid, decodeURIComponent(key), req.principal);
         }
         catch (e) {
             if (e instanceof grant_admin_service_js_1.BadKeyError)
@@ -189,10 +188,11 @@ __decorate([
 __decorate([
     (0, common_1.Delete)('roles/:uuid/permissions/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Param)('key')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [Object, String, String]),
     __metadata("design:returntype", Promise)
 ], GrantAdminController.prototype, "revoke", null);
 __decorate([
@@ -215,13 +215,15 @@ __decorate([
 __decorate([
     (0, common_1.Delete)('roles/:uuid/access-bundles/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Param)('key')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:paramtypes", [Object, String, String]),
     __metadata("design:returntype", Promise)
 ], GrantAdminController.prototype, "revokeBundle", null);
 exports.GrantAdminController = GrantAdminController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [grant_admin_service_js_1.GrantAdminService])
 ], GrantAdminController);

package/dist/features/authz/grant-admin.service.d.ts

@@ -1,8 +1,9 @@
 import type { Pool } from 'mariadb';
 import type { Principal } from '@astram/core';
+import type { AuditPort } from '@astram/engine';
 import { PermissionVersionBumper } from './permission-version.bumper.js';
 import { AccessBundleStore } from './access-bundle-store.js';
-import type { GrantCeiling } from './grant-ceiling.js';
+import { GrantCeiling } from './grant-ceiling.js';
 /**
  * The caller's reachable subtree, threaded from `req.principal` (Task 4.2). It scopes the
  * grant-admin reads so a caller sees ONLY roles bound within their subtree — the SAME cached
@@ -52,14 +53,18 @@ export declare class GrantAdminService {
     private readonly pool;
     private readonly bumper;
     private readonly ceiling?;
+    private readonly audit?;
     private readonly bundles;
     /**
-     * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold"). Enforced
-     *   on `grant()`/`grantBundle()` for a non-root grantor. OPTIONAL for back-compat: when absent
-     *   (legacy wiring / tests that don't exercise the ceiling), the ceiling is not applied — the
-     *   identity module ALWAYS wires it, so production always enforces. Root bypasses regardless.
+     * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold") plus the
+     *   security-hardening role-binding rule. Enforced on grant/revoke/grantBundle/revokeBundle for a
+     *   non-root actor. OPTIONAL for back-compat: when absent (legacy wiring / tests that don't
+     *   exercise it), neither check runs — the identity module ALWAYS wires it, so production always
+     *   enforces. Root bypasses regardless.
+     * @param audit  The grant-administration audit sink (D6): written on the grant's own transaction
+     *   connection, fail-closed. The identity module ALWAYS wires the engine `MariaDbAuditSink`.
      */
-    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined);
+    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined, audit?: AuditPort | undefined);
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
     listCatalog(): Promise<{
         catalog: CatalogRow[];
@@ -76,15 +81,65 @@ export declare class GrantAdminService {
     /** Validate the key against the catalog + wildcard set. Throws BadKeyError if unknown. */
     private assertValidKey;
     /**
-     * Grant a key to a role (idempotent) + bump the version, atomically. The `grantor` Principal
-     * stamps `rp_granted_at`/`rp_granted_by` on a NEWLY-inserted row (a duplicate is a no-op and
-     * its existing stamp is left as-is) AND is subjected to the ADR-0029 self-escalation ceiling:
-     * a non-root grantor may only grant a key they themselves effectively hold. Order: catalog
-     * validation (400) → ceiling (403) → write. Root bypasses the ceiling.
+     * Security hardening #1 (D1 interim rule) + ADR-0029, in this order, BEFORE any write: the role
+     * must be administrable by the actor (bound inside its subtree and nowhere outside — a shared
+     * role is root-only), then every key must be covered by the actor's own effective keys ("only
+     * grant — or revoke — what you hold"). Root bypasses both. No ceiling wired (legacy/tests) ⇒
+     * neither check runs; the identity module always wires it.
+     */
+    private assertMayChangeGrants;
+    /**
+     * Run one grant-administration write in ONE transaction: the `role_permission` statements, the
+     * permission-version bump of every tenant using the role, and the audit row(s) (D6 — audited in
+     * the SAME transaction, fail-closed: an audit failure rolls the grant back). Store failures map
+     * to AuthorizationUnavailableError (503).
+     */
+    private writeGrants;
+    /**
+     * Write the grant-administration audit row(s) on the transaction connection (D6). One row per
+     * distinct tenant among the actor's tenant and every tenant the change bumped, so each affected
+     * tenant's auditor sees it. Names, never ids, in the detail (ADR-0012): the role name and the
+     * bumped tenants' names; the viewer resolves the actor and row tenant itself. No sink wired
+     * (legacy/tests) ⇒ nothing is written.
+     */
+    private auditGrantChange;
+    /**
+     * Grant a key to a role (idempotent) + bump the version + audit, atomically. The `grantor`
+     * Principal stamps `rp_granted_at`/`rp_granted_by` on a NEWLY-inserted row (a duplicate is a
+     * no-op and its existing stamp is left as-is). Order: catalog validation (400) → role binding
+     * (404/403) → ceiling (403) → write. Root bypasses the binding rule and the ceiling.
      */
     grant(roleUuid: string, key: string, grantor: Principal): Promise<void>;
-    /** Revoke a key from a role (no-op if absent) + bump the version, atomically. */
-    revoke(roleUuid: string, key: string): Promise<void>;
+    /**
+     * Revoke a key from a role (no-op if absent) + bump + audit, atomically. Security hardening #1:
+     * the actor must be able to administer the role (binding rule) and must hold the key itself —
+     * "only revoke what you hold" — so a delegated admin can no longer strip a role of authority it
+     * never had. Phase 8 #2: it must also dominate every user holding the role (checked under the
+     * role lock in `writeGrants`). Root bypasses.
+     */
+    revoke(roleUuid: string, key: string, actor: Principal): Promise<void>;
+    /**
+     * Remove a role that is being DELETED from authorization (Phase 8 #2 follow-up): every
+     * `role_permission` row of the role, and the role from every service account's `sa_role_ids`
+     * (guard's API-key store reads that column live, so a stale entry would keep the deleted role's
+     * keys on the agent). ONE transaction on the shared authz pool — the same pool, bump, audit and
+     * error mapping as {@link revoke}:
+     *   1. lock the holding accounts (`FOR UPDATE`), then check the actor may strip the role from
+     *      each (`GrantCeiling.assertMayStripRoleFromServiceAccounts`, root bypasses);
+     *   2. bump every tenant using the role — postings AND the accounts' tenants — before the strip,
+     *      so the account tenants are still found;
+     *   3. delete the role's grants; rewrite each account's role list without it (edit stamp moved
+     *      forward, so a concurrent preserve-merge edit conflicts instead of re-adding it);
+     *   4. audit as `role.permission_revoked` (`roleDeleted: true`), commit, publish the versions.
+     * Returns the bumped tenants.
+     *
+     * The CALLER (`RoleService.deleteRole`) holds the role row lock on its own engine connection and
+     * has already run the binding rule and user-holder dominance; this method therefore does NOT
+     * lock the role row (that would wait on the caller). It commits BEFORE the caller deletes the
+     * role, so a failure in between leaves a role with no grants and no agents: fewer permissions,
+     * never live grants for a deleted role (fail closed).
+     */
+    purgeRole(roleUuid: string, actor: Principal): Promise<string[]>;
     /** All active bundles + their resolved atomic keys, for the Access UI. */
     listBundles(): Promise<{
         bundles: BundleView[];
@@ -99,11 +154,12 @@ export declare class GrantAdminService {
     grantBundle(roleUuid: string, bundleKey: string, grantor: Principal): Promise<void>;
     /**
      * Revoke a bundle from a role: resolve → DELETE each of the bundle's atomic keys, in
-     * ONE transaction with ONE version bump. Caveat (design §5.1): this removes exactly the
+     * ONE transaction with ONE version bump + audit. Caveat (design §5.1): this removes exactly the
      * bundle's keys even if a manual grant or another bundle shares one — the model is
-     * key-based, not bundle-membership-based. Unknown bundle → `BadKeyError`.
+     * key-based, not bundle-membership-based. Unknown bundle → `BadKeyError`. Security hardening
+     * #1: the binding rule + "only revoke what you hold" apply (root bypasses).
      */
-    revokeBundle(roleUuid: string, bundleKey: string): Promise<void>;
+    revokeBundle(roleUuid: string, bundleKey: string, actor: Principal): Promise<void>;
     /** Resolve a bundle key → its atomic keys; throw BadKeyError when unknown/orphaned. */
     private resolveBundleKeysOrThrow;
     /**