@astram/identity 0.4.0 → 0.6.0

package/dist/features/service-account/service-account.controller.js

@@ -29,6 +29,7 @@ exports.ServiceAccountController = void 0;
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const service_account_service_js_1 = require("./service-account.service.js");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 /** Project the resolved Principal to the AdminPrincipal the service consumes. */
 function adminOf(req) {
     const p = req.principal;
@@ -62,14 +63,27 @@ function optStringArray(v, field) {
     }
     return v;
 }
-/** Narrow an OPTIONAL positive-integer expiry (epoch-ms) from a key-issue body. */
-function optExpiry(v) {
-    if (v === undefined || v === null)
-        return undefined;
-    if (typeof v !== 'number' || !Number.isFinite(v) || v <= 0) {
-        throw new common_1.BadRequestException('expiresAtMs must be a positive epoch-ms number');
+/**
+ * Narrow a key-issue/rotate body to its expiry choice (ADR-0033 §4): `expiresAtMs` (epoch-ms) or
+ * `neverExpires: true`. Shape errors are 400 here; "neither", "both" and "not in the future" are
+ * decided by the service (it owns the clock) and also answer 400.
+ */
+function expiryOf(body) {
+    const out = {};
+    const v = body.expiresAtMs;
+    if (v !== undefined && v !== null) {
+        if (typeof v !== 'number' || !Number.isFinite(v) || v <= 0) {
+            throw new common_1.BadRequestException('expiresAtMs must be a positive epoch-ms number');
+        }
+        out.expiresAtMs = v;
     }
-    return v;
+    if (body.neverExpires !== undefined) {
+        if (typeof body.neverExpires !== 'boolean') {
+            throw new common_1.BadRequestException('neverExpires must be true or false');
+        }
+        out.neverExpires = body.neverExpires;
+    }
+    return out;
 }
 let ServiceAccountController = class ServiceAccountController {
     svc;
@@ -158,14 +172,14 @@ let ServiceAccountController = class ServiceAccountController {
         }
     }
     /**
-     * Issue a NEW key for an account. Gated `service_account:manage_keys`. Body: `{ expiresAtMs? }`.
+     * Issue a NEW key for an account. Gated `service_account:manage_keys`. Body: `{ expiresAtMs }`
+     * (a future epoch-ms) or `{ neverExpires: true }` — one of the two is required (400 otherwise).
      * Returns the raw `ask_…` key EXACTLY ONCE — copy it now, it is never retrievable again.
      */
     async issueKey(req, id, body) {
-        const b = (body ?? {});
-        const expiresAtMs = optExpiry(b.expiresAtMs);
+        const expiry = expiryOf((body ?? {}));
         try {
-            const key = await this.svc.issueKey(adminOf(req), id, expiresAtMs !== undefined ? { expiresAtMs } : {});
+            const key = await this.svc.issueKey(adminOf(req), id, expiry);
             return { key };
         }
         catch (e) {
@@ -174,13 +188,12 @@ let ServiceAccountController = class ServiceAccountController {
     }
     /**
      * Rotate an account's key. Gated `service_account:manage_keys`. The previous key stops
-     * authenticating; the new raw key is returned EXACTLY ONCE.
+     * authenticating; the new raw key is returned EXACTLY ONCE. Same expiry rule as issue.
      */
     async rotateKey(req, id, body) {
-        const b = (body ?? {});
-        const expiresAtMs = optExpiry(b.expiresAtMs);
+        const expiry = expiryOf((body ?? {}));
         try {
-            const key = await this.svc.rotateKey(adminOf(req), id, expiresAtMs !== undefined ? { expiresAtMs } : {});
+            const key = await this.svc.rotateKey(adminOf(req), id, expiry);
             return { key };
         }
         catch (e) {
@@ -277,5 +290,6 @@ __decorate([
 ], ServiceAccountController.prototype, "revokeKeys", null);
 exports.ServiceAccountController = ServiceAccountController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [service_account_service_js_1.ServiceAccountService])
 ], ServiceAccountController);

package/dist/features/service-account/service-account.service.d.ts

@@ -30,6 +30,21 @@ export interface ServiceAccountView {
     readonly createdByName: string | null;
     readonly createdAtMs: number;
     readonly updatedAtMs: number | null;
+    /** The account's current API key (the highest version), or `null` when none was ever issued. */
+    readonly currentKey: ServiceAccountKeyView | null;
+}
+/**
+ * The status of an account's current key (Phase 8 #13) — never the secret or its hash.
+ * `neverExpires` flags an ACTIVE key with no expiry: either issued before an expiry became
+ * mandatory (identity 0.5.0) or issued later with an explicit `neverExpires: true`. The stored row
+ * cannot tell the two apart, so both are flagged; review them and rotate with an expiry.
+ */
+export interface ServiceAccountKeyView {
+    readonly version: number;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number | null;
+    readonly revoked: boolean;
+    readonly neverExpires: boolean;
 }
 /** The ONE-TIME key reveal returned by issue/rotate — the only time the raw key exists. */
 export interface IssuedKey {
@@ -84,6 +99,11 @@ export interface AssignableAccess {
     readonly roles: readonly RoleOption[];
     readonly scopeNodes: readonly ScopeNodeOption[];
 }
+/** Key expiry on issue/rotate: a future `expiresAtMs`, or an explicit `neverExpires: true`. */
+export interface KeyExpiryOptions {
+    readonly expiresAtMs?: number;
+    readonly neverExpires?: boolean;
+}
 export declare class ServiceAccountService {
     private readonly accounts;
     private readonly keys;
@@ -179,19 +199,21 @@ export declare class ServiceAccountService {
      * Issue a NEW key for an account (own-tenant). Mints `ask_<id>_<secret>`, hashes the secret, and
      * persists the hash as the next version — carrying the ACCOUNT's current scope/roles onto the key
      * (so the key's Principal reflects the account as it stands). Returns the raw key ONCE.
-     * `expiresAtMs` is optional (a non-expiring key is discouraged; the caller opts in to no expiry).
+     * ADR-0033 §4 (security hardening): the caller must give a FUTURE `expiresAtMs`, or opt in to a
+     * non-expiring key explicitly with `neverExpires: true` — otherwise 400, nothing minted.
+     */
+    issueKey(admin: AdminPrincipal, id: string, opts?: KeyExpiryOptions): Promise<IssuedKey>;
+    /**
+     * The key's expiry from the request: a future epoch-ms, or `undefined` when the caller said
+     * `neverExpires: true`. Neither, both, or a past/invalid time → ServiceAccountInputError (400).
      */
-    issueKey(admin: AdminPrincipal, id: string, opts?: {
-        expiresAtMs?: number;
-    }): Promise<IssuedKey>;
+    private resolveExpiry;
     /**
      * Rotate an account's key: mint a new version (the old version stops being the current one —
      * `getByAccountId` returns the highest, so the previous key no longer authenticates). Returns the
      * new raw key ONCE.
      */
-    rotateKey(admin: AdminPrincipal, id: string, opts?: {
-        expiresAtMs?: number;
-    }): Promise<IssuedKey>;
+    rotateKey(admin: AdminPrincipal, id: string, opts?: KeyExpiryOptions): Promise<IssuedKey>;
     /** Revoke ALL of an account's keys (own-tenant) — fail-closed on the next request. Idempotent. */
     revokeKeys(admin: AdminPrincipal, id: string): Promise<void>;
     /** Shared mint path for issue + rotate: version bump, hash, putVersion, audit, one-time reveal. */

package/dist/features/service-account/service-account.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAerG;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,qBAAqB,CAMtG;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAwBrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAuBjC;;OAEG;YACW,iBAAiB;IAiB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAelE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAyF9B;;;;;OAKG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,SAAS,CAAC;IAMrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAClC,OAAO,CAAC,SAAS,CAAC;IAMrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAYxB"}
+{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}

package/dist/features/service-account/service-account.service.js

@@ -157,12 +157,27 @@ class ServiceAccountService {
     async toViews(rows) {
         if (rows.length === 0)
             return [];
-        const [roles, nodes] = await Promise.all([
+        const [roles, nodes, keys] = await Promise.all([
             this.accounts.rolesByIds(rows.flatMap((r) => r.roleIds)),
             this.accounts.nodesByIds(rows.flatMap((r) => r.scopeSubtreeNodeIds)),
+            this.accounts.currentKeys(rows.map((r) => r.id)),
         ]);
         const roleName = new Map(roles.map((r) => [r.id, r.name]));
         const nodeName = new Map(nodes.map((n) => [n.id, n.name]));
+        const keyOf = new Map(keys.map((k) => [k.accountId, k]));
+        const keyView = (id) => {
+            const k = keyOf.get(id);
+            if (k === undefined)
+                return null;
+            const revoked = k.revokedAtMs !== null;
+            return {
+                version: k.version,
+                issuedAtMs: k.createdAtMs,
+                expiresAtMs: k.expiresAtMs,
+                revoked,
+                neverExpires: k.expiresAtMs === null && !revoked,
+            };
+        };
         return Promise.all(rows.map(async (row) => ({
             id: row.id,
             label: row.label,
@@ -174,6 +189,7 @@ class ServiceAccountService {
             createdByName: row.createdBy ? await this.resolveName(row.createdBy) : null,
             createdAtMs: row.createdAtMs,
             updatedAtMs: row.updatedAtMs,
+            currentKey: keyView(row.id),
         })));
     }
     /**
@@ -193,7 +209,10 @@ class ServiceAccountService {
      * described generically: the role/company catalog reads are not caller-scoped, so resolving a
      * name for an arbitrary id would turn the 403 into a cross-tenant name/existence oracle.
      */
-    async assertWithinCeiling(ceiling, scopeSubtreeNodeIds, roleIds, onAgent = { nodes: [], roles: [] }) {
+    async assertWithinCeiling(ceiling, scopeSubtreeNodeIds, roleIds, onAgent = {
+        nodes: [],
+        roles: [],
+    }) {
         if (ceiling.isRoot)
             return;
         const badNodes = uniqueIds(scopeSubtreeNodeIds).filter((n) => !ceilingAllowsNode(ceiling, n));
@@ -213,13 +232,17 @@ class ServiceAccountService {
     async describeOffenders(bad, onAgent, lookup, noun, plural) {
         const known = new Set(onAgent);
         const nameable = bad.filter((id) => known.has(id));
-        const found = nameable.length > 0 ? new Map((await lookup(nameable)).map((x) => [x.id, x.name])) : new Map();
+        const found = nameable.length > 0
+            ? new Map((await lookup(nameable)).map((x) => [x.id, x.name]))
+            : new Map();
         const names = uniqueIds(nameable.map((id) => found.get(id) ?? '').filter((n) => n.length > 0));
         const rest = bad.length - names.length;
         if (names.length === 0)
             return rest === 1 ? `a ${noun}` : `${rest} ${plural}`;
         const named = `the ${names.length === 1 ? noun : plural} ${quoteNames(names)}`;
-        return rest === 0 ? named : `${named} and ${rest === 1 ? `1 other ${noun}` : `${rest} other ${plural}`}`;
+        return rest === 0
+            ? named
+            : `${named} and ${rest === 1 ? `1 other ${noun}` : `${rest} other ${plural}`}`;
     }
     /**
      * Resolve names for audit (ids already authorised for this caller: within ceiling, or on the
@@ -261,7 +284,9 @@ class ServiceAccountService {
             ]);
         return {
             // Defensive re-filter through the same predicates (a store that over-returns can't widen it).
-            roles: roles.filter((r) => ceilingAllowsRole(ceiling, r.id)).map((r) => ({ id: r.id, name: r.name })),
+            roles: roles
+                .filter((r) => ceilingAllowsRole(ceiling, r.id))
+                .map((r) => ({ id: r.id, name: r.name })),
             scopeNodes: treeOrder(nodes.filter((n) => ceilingAllowsNode(ceiling, n.id))),
         };
     }
@@ -374,8 +399,12 @@ class ServiceAccountService {
         const updatedAtMs = Math.max(this.now(), (existing.updatedAtMs ?? 0) + 1);
         const normalized = {
             ...(patch.label !== undefined ? { label: patch.label.trim() } : {}),
-            ...(requestedScope !== undefined ? { scopeSubtreeNodeIds: mergeIds(requestedScope, preservedScope) } : {}),
-            ...(requestedRoles !== undefined ? { roleIds: mergeIds(requestedRoles, preservedRoles) } : {}),
+            ...(requestedScope !== undefined
+                ? { scopeSubtreeNodeIds: mergeIds(requestedScope, preservedScope) }
+                : {}),
+            ...(requestedRoles !== undefined
+                ? { roleIds: mergeIds(requestedRoles, preservedRoles) }
+                : {}),
             ...(patch.status !== undefined ? { status: patch.status } : {}),
         };
         // The preserve-merge is a read-modify-write: guard it so a concurrent edit (e.g. root revoking an
@@ -393,7 +422,10 @@ class ServiceAccountService {
         // WHAT changed, by name: diff the stored sets (added ⊆ ceiling or root; removed were on the agent).
         const diff = (before, after) => after === undefined
             ? { added: [], removed: [] }
-            : { added: after.filter((x) => !before.includes(x)), removed: before.filter((x) => !after.includes(x)) };
+            : {
+                added: after.filter((x) => !before.includes(x)),
+                removed: before.filter((x) => !after.includes(x)),
+            };
         const roleDiff = diff(existing.roleIds, normalized.roleIds);
         const scopeDiff = diff(existing.scopeSubtreeNodeIds, normalized.scopeSubtreeNodeIds);
         const names = await this.auditNames([...roleDiff.added, ...roleDiff.removed], [...scopeDiff.added, ...scopeDiff.removed]);
@@ -414,13 +446,35 @@ class ServiceAccountService {
      * Issue a NEW key for an account (own-tenant). Mints `ask_<id>_<secret>`, hashes the secret, and
      * persists the hash as the next version — carrying the ACCOUNT's current scope/roles onto the key
      * (so the key's Principal reflects the account as it stands). Returns the raw key ONCE.
-     * `expiresAtMs` is optional (a non-expiring key is discouraged; the caller opts in to no expiry).
+     * ADR-0033 §4 (security hardening): the caller must give a FUTURE `expiresAtMs`, or opt in to a
+     * non-expiring key explicitly with `neverExpires: true` — otherwise 400, nothing minted.
      */
     async issueKey(admin, id, opts = {}) {
+        const expiresAtMs = this.resolveExpiry(opts);
         const account = await this.accounts.getById(id, scopeOf(admin));
         if (account === null)
             throw new ServiceAccountNotFoundError();
-        return this.mintFor(account, admin, 'service_account.key_issued', opts.expiresAtMs);
+        return this.mintFor(account, admin, 'service_account.key_issued', expiresAtMs);
+    }
+    /**
+     * The key's expiry from the request: a future epoch-ms, or `undefined` when the caller said
+     * `neverExpires: true`. Neither, both, or a past/invalid time → ServiceAccountInputError (400).
+     */
+    resolveExpiry(opts) {
+        const hasExpiry = opts.expiresAtMs !== undefined;
+        if (hasExpiry && opts.neverExpires === true) {
+            throw new ServiceAccountInputError('Give either an expiry or neverExpires: true, not both.');
+        }
+        if (opts.neverExpires === true)
+            return undefined;
+        if (!hasExpiry) {
+            throw new ServiceAccountInputError('Choose when the key expires (expiresAtMs), or set neverExpires: true for a key that never expires.');
+        }
+        const ms = opts.expiresAtMs;
+        if (typeof ms !== 'number' || !Number.isFinite(ms) || ms <= this.now()) {
+            throw new ServiceAccountInputError('expiresAtMs must be a time in the future (epoch-ms).');
+        }
+        return ms;
     }
     /**
      * Rotate an account's key: mint a new version (the old version stops being the current one —
@@ -428,10 +482,11 @@ class ServiceAccountService {
      * new raw key ONCE.
      */
     async rotateKey(admin, id, opts = {}) {
+        const expiresAtMs = this.resolveExpiry(opts);
         const account = await this.accounts.getById(id, scopeOf(admin));
         if (account === null)
             throw new ServiceAccountNotFoundError();
-        return this.mintFor(account, admin, 'service_account.key_rotated', opts.expiresAtMs);
+        return this.mintFor(account, admin, 'service_account.key_rotated', expiresAtMs);
     }
     /** Revoke ALL of an account's keys (own-tenant) — fail-closed on the next request. Idempotent. */
     async revokeKeys(admin, id) {
@@ -473,7 +528,13 @@ class ServiceAccountService {
     /** Best-effort audit — a sink throw must never fail a legitimate operation. */
     async safeAudit(action, admin, occurredAtMs, attributes) {
         try {
-            await this.audit.record({ action, actorId: admin.id, tenantId: admin.tenantId, occurredAtMs, attributes });
+            await this.audit.record({
+                action,
+                actorId: admin.id,
+                tenantId: admin.tenantId,
+                occurredAtMs,
+                attributes,
+            });
         }
         catch {
             // swallow — auditing is best-effort here (the durable sink already logs its own failures).

package/dist/features/service-account/service-account.store.d.ts

@@ -12,6 +12,14 @@
  * stamped `sa_tenant_id` (from the session) on create — never client input.
  */
 import type { Pool } from 'mariadb';
+/** The status of an account's current key (no hash, no secret). Epoch-ms; `null` = not set. */
+export interface ServiceAccountKeyRow {
+    readonly accountId: string;
+    readonly version: number;
+    readonly expiresAtMs: number | null;
+    readonly revokedAtMs: number | null;
+    readonly createdAtMs: number;
+}
 /** The caller's reachable subtree (threaded from `req.principal`) — same shape as grant-admin. */
 export interface SubtreeScope {
     readonly nodeIds: readonly string[];
@@ -51,6 +59,13 @@ export declare class ServiceAccountStore {
     nodesByIds(ids: readonly string[]): Promise<ScopeNodeOption[]>;
     /** Every company (ROOT's assignable scope — root reaches all). */
     allNodes(): Promise<ScopeNodeOption[]>;
+    /**
+     * Phase 8 #13 — the CURRENT key (highest version: the only one the authenticator honours) of
+     * each account, from guard's `shield_authz.service_account_key`, in ONE batched read. Status
+     * columns only — never the hash. Read-only. Callers pass ids they already read through the
+     * own-tenant wall (`list`/`getById`); accounts with no key are simply absent.
+     */
+    currentKeys(accountIds: readonly string[]): Promise<ServiceAccountKeyRow[]>;
     /** List the caller's own-tenant accounts (newest first). Root sees all. */
     list(scope: SubtreeScope): Promise<ServiceAccountRow[]>;
     /** Fetch one account BY id, scoped to the caller's subtree. Cross-tenant/unknown → null (404). */

package/dist/features/service-account/service-account.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAIpC,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAMvC,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}
+{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAMpC,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAUD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAMvC,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBjF,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}

package/dist/features/service-account/service-account.store.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceAccountStore = void 0;
 const APP = 'shield_app';
+/** Guard's key table lives here (`1710000000017-CreateServiceAccountKey.cjs`); read-only here. */
+const AUTHZ = 'shield_authz';
 /** Normalize a JSON-array column (driver returns array OR string) → string[]. Fail-safe to []. */
 function jsonArray(v) {
     const arr = Array.isArray(v)
@@ -83,6 +85,33 @@ class ServiceAccountStore {
         const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` ORDER BY c_name`, []));
         return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
     }
+    /**
+     * Phase 8 #13 — the CURRENT key (highest version: the only one the authenticator honours) of
+     * each account, from guard's `shield_authz.service_account_key`, in ONE batched read. Status
+     * columns only — never the hash. Read-only. Callers pass ids they already read through the
+     * own-tenant wall (`list`/`getById`); accounts with no key are simply absent.
+     */
+    async currentKeys(accountIds) {
+        const u = uniqueIds(accountIds);
+        if (u.length === 0)
+            return [];
+        const rows = (await this.pool.query(`SELECT k.sak_account_id, k.sak_version, k.sak_expires_at_ms, k.sak_revoked_at_ms,
+              k.sak_created_at_ms
+         FROM \`${AUTHZ}\`.\`service_account_key\` k
+         JOIN (SELECT sak_account_id, MAX(sak_version) AS v
+                 FROM \`${AUTHZ}\`.\`service_account_key\`
+                WHERE sak_account_id IN (${u.map(() => '?').join(', ')})
+                GROUP BY sak_account_id) m
+           ON m.sak_account_id = k.sak_account_id AND m.v = k.sak_version`, u));
+        const ms = (v) => (v === null || v === undefined ? null : Number(v));
+        return rows.map((r) => ({
+            accountId: r.sak_account_id,
+            version: Number(r.sak_version),
+            expiresAtMs: ms(r.sak_expires_at_ms),
+            revokedAtMs: ms(r.sak_revoked_at_ms),
+            createdAtMs: Number(r.sak_created_at_ms),
+        }));
+    }
     /** List the caller's own-tenant accounts (newest first). Root sees all. */
     async list(scope) {
         const t = tenantScope(scope);

package/dist/features/share/share.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAqBD,qBACa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}
+{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwBD,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}

package/dist/features/share/share.controller.js

@@ -28,6 +28,7 @@ exports.ShareController = void 0;
  */
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
 const share_service_js_1 = require("./share.service.js");
 /** Validate + narrow a share/unshare body to a {@link ShareRequest} (grantee + action only). */
 function toShareRequest(body) {
@@ -139,5 +140,6 @@ __decorate([
 ], ShareController.prototype, "unshare", null);
 exports.ShareController = ShareController = __decorate([
     (0, common_1.Controller)('identity'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
     __metadata("design:paramtypes", [share_service_js_1.ShareService])
 ], ShareController);

package/dist/features/share/share.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}
+{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}

package/dist/features/shared/identity-error.interceptor.d.ts

@@ -0,0 +1,24 @@
+/**
+ * IdentityErrorInterceptor — maps engine, ceiling and identity domain errors to HTTP for every
+ * identity route, in ONE place (security hardening Phase 1, ADR-0034 follow-up).
+ *
+ * Before this, an engine `AuthorizationDeniedError` (for example the ADR-0034 create wall's
+ * `create_outside_write_scope`) escaped a controller as an unmapped error → HTTP 500. Each mapping
+ * below uses a fixed, id-free message (ADR-0012): the engine's own message carries reason codes and
+ * detail that are for logs, not clients.
+ *
+ * Applied with `@UseInterceptors(IdentityErrorInterceptor)` on each identity controller. An
+ * `HttpException` (a controller's own 400/403/404) passes through untouched; anything unmapped is
+ * rethrown as-is (Nest's default handling).
+ */
+import { type CallHandler, type ExecutionContext, type NestInterceptor } from '@nestjs/common';
+import { type Observable } from 'rxjs';
+/**
+ * Map one error to the HTTP exception identity answers with, or return it unchanged when it is
+ * not an identity-mapped type. Exported for unit tests and for callers that map by hand.
+ */
+export declare function toIdentityHttpError(err: unknown): unknown;
+export declare class IdentityErrorInterceptor implements NestInterceptor {
+    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+//# sourceMappingURL=identity-error.interceptor.d.ts.map

package/dist/features/shared/identity-error.interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-error.interceptor.d.ts","sourceRoot":"","sources":["../../../src/features/shared/identity-error.interceptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAqB/D;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAwBzD;AAED,qBACa,wBAAyB,YAAW,eAAe;IAC9D,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CAK9E"}

package/dist/features/shared/identity-error.interceptor.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityErrorInterceptor = void 0;
+exports.toIdentityHttpError = toIdentityHttpError;
+/**
+ * IdentityErrorInterceptor — maps engine, ceiling and identity domain errors to HTTP for every
+ * identity route, in ONE place (security hardening Phase 1, ADR-0034 follow-up).
+ *
+ * Before this, an engine `AuthorizationDeniedError` (for example the ADR-0034 create wall's
+ * `create_outside_write_scope`) escaped a controller as an unmapped error → HTTP 500. Each mapping
+ * below uses a fixed, id-free message (ADR-0012): the engine's own message carries reason codes and
+ * detail that are for logs, not clients.
+ *
+ * Applied with `@UseInterceptors(IdentityErrorInterceptor)` on each identity controller. An
+ * `HttpException` (a controller's own 400/403/404) passes through untouched; anything unmapped is
+ * rethrown as-is (Nest's default handling).
+ */
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const engine_1 = require("@astram/engine");
+const core_1 = require("@astram/core");
+const guard_1 = require("@astram/guard");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const scope_closure_service_js_1 = require("../scope/scope-closure.service.js");
+const identity_errors_js_1 = require("./identity-errors.js");
+/** The fixed client message for an engine deny, by reason code (never the engine's own text). */
+function deniedMessage(reason) {
+    if (reason === 'create_outside_write_scope') {
+        return 'You cannot create this record: it is outside the organisations you manage.';
+    }
+    return 'You do not have access to perform this action.';
+}
+/**
+ * Map one error to the HTTP exception identity answers with, or return it unchanged when it is
+ * not an identity-mapped type. Exported for unit tests and for callers that map by hand.
+ */
+function toIdentityHttpError(err) {
+    if (err instanceof common_1.HttpException)
+        return err;
+    if (err instanceof engine_1.AuthorizationDeniedError)
+        return new common_1.ForbiddenException(deniedMessage(err.reason));
+    if (err instanceof grant_ceiling_js_1.GrantCeilingError)
+        return new common_1.ForbiddenException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityForbiddenError)
+        return new common_1.ForbiddenException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityNotFoundError)
+        return new common_1.NotFoundException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityConflictError)
+        return new common_1.ConflictException(err.message);
+    if (err instanceof identity_errors_js_1.IdentityBadRequestError)
+        return new common_1.BadRequestException(err.message);
+    if (err instanceof guard_1.ScopeCycleError) {
+        return new common_1.ConflictException('That move would put an organisation inside its own sub-tree.');
+    }
+    if (err instanceof scope_closure_service_js_1.NodeHasChildrenError) {
+        return new common_1.ConflictException('This organisation still has sub-organisations. Move or delete them first.');
+    }
+    if (err instanceof engine_1.ValidationError) {
+        return new common_1.BadRequestException(`Invalid value for '${err.field}'.`);
+    }
+    if (err instanceof core_1.AuthorizationUnavailableError || err instanceof engine_1.EngineUnavailableError) {
+        return new common_1.ServiceUnavailableException('Authorization is temporarily unavailable. Try again.');
+    }
+    return err;
+}
+let IdentityErrorInterceptor = class IdentityErrorInterceptor {
+    intercept(_context, next) {
+        return next
+            .handle()
+            .pipe((0, rxjs_1.catchError)((err) => (0, rxjs_1.throwError)(() => toIdentityHttpError(err))));
+    }
+};
+exports.IdentityErrorInterceptor = IdentityErrorInterceptor;
+exports.IdentityErrorInterceptor = IdentityErrorInterceptor = __decorate([
+    (0, common_1.Injectable)()
+], IdentityErrorInterceptor);

package/dist/features/shared/identity-errors.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Identity domain errors (security hardening Phase 1). Thrown by identity services, mapped to HTTP
+ * by {@link IdentityErrorInterceptor} in ONE place so every identity route answers the same way.
+ *
+ * Messages are user-facing: they name no raw ids (ADR-0012) and carry no store detail.
+ */
+/** The caller may not perform this action on this target (→ 403). */
+export declare class IdentityForbiddenError extends Error {
+    constructor(message: string);
+}
+/** The target does not exist or is outside the caller's reach (→ 404, no existence leak). */
+export declare class IdentityNotFoundError extends Error {
+    constructor(message: string);
+}
+/** The request conflicts with the current state (cycle, children present, … → 409). */
+export declare class IdentityConflictError extends Error {
+    constructor(message: string);
+}
+/** The request is malformed (→ 400). */
+export declare class IdentityBadRequestError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=identity-errors.d.ts.map

package/dist/features/shared/identity-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-errors.d.ts","sourceRoot":"","sources":["../../../src/features/shared/identity-errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qEAAqE;AACrE,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,uFAAuF;AACvF,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,wCAAwC;AACxC,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B"}