@astram/identity 0.5.0 → 0.7.0

package/dist/features/authz/record-authorization.d.ts

@@ -1,13 +1,15 @@
 /**
- * Assemble the record-tier authorization wiring for `@astram/identity`: the lean grant-read
- * pool factory + the `recordAuthorization` inputs the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` becomes REAL (the
- * framework's four record-tier adapters are built internally over the supplied pool) instead
- * of the deny-everything stub.
+ * The record-tier authorization inputs for `@astram/identity`: the lean grant-read pool factory and
+ * the `RecordAuthorizationInputs` builder. `IdentityFeatureModule.forRoot({ extraObjects })` builds
+ * the inputs ONCE and uses them everywhere (security hardening Phase 9 #7):
+ *   - provided app-wide under guard's `SHIELD_RECORD_AUTHORIZATION`, so `ShieldModule` builds the
+ *     request path's decision authority from them (the framework's four record-tier adapters are
+ *     built inside guard);
+ *   - the module's own cross-tenant / policy authority, list scope and grant ceiling.
+ * One registry, one source of `extraObjects`: nothing can disagree.
  *
  * Modeled on astram3's `buildAuthorizationInputs` (`server/src/features/authz/authz.wiring.ts`),
- * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix
- * (`APP_DB_*`, per the Task-7 rename).
+ * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix (`APP_DB_*`).
  */
 import { type Pool } from 'mariadb';
 import { type RecordAuthorizationInputs } from '@astram/guard';
@@ -15,26 +17,19 @@ import type { ObjectTypeInput } from '@astram/engine';
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
- * Opens the pool at CALL time (never at import) — the consumer (app lifecycle) owns closing it.
+ * Opens the pool at CALL time (never at import) — the caller owns closing it.
  */
 export declare function createIdentityAuthzPool(): Pool;
 /**
- * Build the `RecordAuthorizationInputs` the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. The framework owns the four record-tier
- * adapters internally; `@astram/identity` supplies only the app-schema ports:
+ * Build the `RecordAuthorizationInputs` over `pool`. `@astram/identity` supplies only the
+ * app-schema ports:
  *   - `permissionFacts` — coarse grants over `shield_authz.role_permission` +
  *     `company_membership`/`membership_posting`,
  *   - `sessionFacts` — the ADR-0011 ALS-backed per-request reader,
- *   - `registry` — bridged from `identityObjects` PLUS any consumer-supplied `extraObjects`,
+ *   - `registry` — bridged from `identityObjects` PLUS the consumer's `extraObjects` (their
+ *     `<module>:<type>:<action>` keys project into a principal's grants at gate 5; without them a
+ *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
- *
- * `extraObjects` (optional): a CONSUMER app that registers its OWN gated object types via
- * `EngineModule.forFeature([...])` must ALSO pass those types here, so their actions enter the
- * coarse-grant permission-facts registry (gate 5). Without this, a custom type's routes boot
- * and list-scope correctly (gate 6) but their `<module>:<type>:<action>` permission keys are
- * never projected into a principal's grants — so gate 5 denies them (deny-by-default). Passing
- * the same object types the app registered with the engine closes that gap: the app's grants on
- * those keys now project, and the framework still owns the four record-tier adapters + scope fn.
  */
-export declare function buildIdentityRecordAuthorization(pool: Pool, extraObjects?: readonly ObjectTypeInput[]): RecordAuthorizationInputs;
+export declare function buildRecordAuthorizationInputs(pool: Pool, extraObjects?: readonly ObjectTypeInput[]): RecordAuthorizationInputs;
 //# sourceMappingURL=record-authorization.d.ts.map

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAS3B"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAS3B"}

package/dist/features/authz/record-authorization.js

@@ -4,17 +4,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createIdentityAuthzPool = createIdentityAuthzPool;
-exports.buildIdentityRecordAuthorization = buildIdentityRecordAuthorization;
+exports.buildRecordAuthorizationInputs = buildRecordAuthorizationInputs;
 /**
- * Assemble the record-tier authorization wiring for `@astram/identity`: the lean grant-read
- * pool factory + the `recordAuthorization` inputs the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` becomes REAL (the
- * framework's four record-tier adapters are built internally over the supplied pool) instead
- * of the deny-everything stub.
+ * The record-tier authorization inputs for `@astram/identity`: the lean grant-read pool factory and
+ * the `RecordAuthorizationInputs` builder. `IdentityFeatureModule.forRoot({ extraObjects })` builds
+ * the inputs ONCE and uses them everywhere (security hardening Phase 9 #7):
+ *   - provided app-wide under guard's `SHIELD_RECORD_AUTHORIZATION`, so `ShieldModule` builds the
+ *     request path's decision authority from them (the framework's four record-tier adapters are
+ *     built inside guard);
+ *   - the module's own cross-tenant / policy authority, list scope and grant ceiling.
+ * One registry, one source of `extraObjects`: nothing can disagree.
  *
  * Modeled on astram3's `buildAuthorizationInputs` (`server/src/features/authz/authz.wiring.ts`),
- * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix
- * (`APP_DB_*`, per the Task-7 rename).
+ * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix (`APP_DB_*`).
  */
 const mariadb_1 = __importDefault(require("mariadb"));
 const guard_1 = require("@astram/guard");
@@ -24,7 +26,7 @@ const session_facts_reader_js_1 = require("./session-facts.reader.js");
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
- * Opens the pool at CALL time (never at import) — the consumer (app lifecycle) owns closing it.
+ * Opens the pool at CALL time (never at import) — the caller owns closing it.
  */
 function createIdentityAuthzPool() {
     const db = (0, guard_1.loadDbConfig)();
@@ -38,24 +40,17 @@ function createIdentityAuthzPool() {
     });
 }
 /**
- * Build the `RecordAuthorizationInputs` the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. The framework owns the four record-tier
- * adapters internally; `@astram/identity` supplies only the app-schema ports:
+ * Build the `RecordAuthorizationInputs` over `pool`. `@astram/identity` supplies only the
+ * app-schema ports:
  *   - `permissionFacts` — coarse grants over `shield_authz.role_permission` +
  *     `company_membership`/`membership_posting`,
  *   - `sessionFacts` — the ADR-0011 ALS-backed per-request reader,
- *   - `registry` — bridged from `identityObjects` PLUS any consumer-supplied `extraObjects`,
+ *   - `registry` — bridged from `identityObjects` PLUS the consumer's `extraObjects` (their
+ *     `<module>:<type>:<action>` keys project into a principal's grants at gate 5; without them a
+ *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
- *
- * `extraObjects` (optional): a CONSUMER app that registers its OWN gated object types via
- * `EngineModule.forFeature([...])` must ALSO pass those types here, so their actions enter the
- * coarse-grant permission-facts registry (gate 5). Without this, a custom type's routes boot
- * and list-scope correctly (gate 6) but their `<module>:<type>:<action>` permission keys are
- * never projected into a principal's grants — so gate 5 denies them (deny-by-default). Passing
- * the same object types the app registered with the engine closes that gap: the app's grants on
- * those keys now project, and the framework still owns the four record-tier adapters + scope fn.
  */
-function buildIdentityRecordAuthorization(pool, extraObjects = []) {
+function buildRecordAuthorizationInputs(pool, extraObjects = []) {
     const registry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
     return {
         pool,

package/dist/features/company/company-hierarchy.service.d.ts

@@ -10,7 +10,10 @@
  *   - move: the node is in the actor's subtree, is NOT the actor's own root node (a sub-admin can
  *     never re-home its whole tenant), and the new parent is in the actor's subtree and non-null
  *     (only root creates or promotes top-level tenants). A cycle → ScopeCycleError (409).
- *   - delete: the caller (CompanyService) has already read the node through the subtree wall.
+ *   - delete: the caller (CompanyService) has already read the node through the subtree wall; the
+ *     node is not the actor's own root; the actor dominates every member and may administer every
+ *     service account of the company (Phase 8 #3). The delete disables those agents, revokes their
+ *     keys, drops the node from other agents' scopes and revokes cross-tenant grants naming it.
  *
  * Move and delete are audited ON their own transaction (a failed audit rolls them back). Names,
  * never ids, in the audit detail (ADR-0012).
@@ -22,13 +25,34 @@ import { ScopeClosureService } from '../scope/scope-closure.service.js';
 export interface HierarchyQueryable {
     query(sql: string, params?: readonly unknown[]): Promise<unknown>;
 }
+/**
+ * The authority checks a company delete needs — over each member and each of the company's own
+ * service accounts. `GrantCeiling` satisfies it.
+ */
+export interface MemberDominance {
+    assertDominates(actor: Principal, targetUserId: string): Promise<void>;
+    assertMayRetireServiceAccounts(actor: Principal, accounts: ReadonlyArray<{
+        readonly tenantId: string;
+        readonly scopeSubtreeNodeIds: readonly string[];
+        readonly roleIds: readonly string[];
+    }>): Promise<void>;
+}
+/**
+ * The actor's own root node (the active node its subtree hangs from). A non-root actor may not
+ * move, delete (F6) or change the status of (Phase 9 #13c) this node.
+ */
+export declare function ownRootOf(actor: Principal): string;
 export declare class CompanyHierarchyService {
     private readonly pool;
     private readonly closure;
+    /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
+    private readonly ceiling;
     private readonly audit?;
     private readonly now;
-    constructor(pool: HierarchyQueryable, closure: ScopeClosureService, audit?: AuditPort | undefined, now?: () => number);
-    /** The actor's own root node (the active node its subtree hangs from). */
+    constructor(pool: HierarchyQueryable, closure: ScopeClosureService, 
+    /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
+    ceiling: MemberDominance, audit?: AuditPort | undefined, now?: () => number);
+    /** The actor's own root node (see {@link ownRootOf}). */
     private ownRoot;
     /** Names of the given companies (unknown → absent). */
     private names;
@@ -37,9 +61,52 @@ export declare class CompanyHierarchyService {
     move(actor: Principal, nodeUuid: string, newParentUuid: string | null): Promise<void>;
     /**
      * Delete a company through `deleteNode` (refuses a node with children; closure rows + ancestor
-     * bump in one transaction). The caller has already checked reach (walled read).
+     * and own-node bump in one transaction). The caller has already checked reach (walled read).
+     *
+     * Phase 8 #3: the delete cascades every membership and posting of the company, stripping its
+     * members' authority there, so a non-root actor must DOMINATE every member (the actor itself is
+     * skipped). Inside the delete's transaction and tree lock, before anything is deleted: lock the
+     * company row (a new membership's FK check waits on it), read the members with a locking read
+     * (latest committed rows, no insert into the range until commit), then `assertDominates` each.
+     * Any refusal rolls the whole delete back (403). Root bypasses the dominance check.
+     *
+     * Phase 8 #3 (continued): nothing in the database ties a service account or a cross-tenant grant
+     * to its company (no FK), so, still before the company row goes and on the same transaction,
+     * {@link retireDependents} disables the company's agents and revokes their keys, removes the
+     * company from other agents' scopes, and revokes every cross-tenant grant naming it — audited on
+     * that transaction. One transaction: a failure anywhere leaves the company and everything
+     * depending on it as they were; a commit leaves a deleted company with no live agent or grant.
      */
     remove(actor: Principal, nodeUuid: string): Promise<void>;
+    /**
+     * Retire what depends on a company being deleted (Phase 8 #3), on the delete's transaction after
+     * the company row lock and the member check, BEFORE the company row is deleted. Returns the
+     * tenants whose agents changed (the delete bumps them with the node and its ancestors).
+     *
+     *  1. Agents (`shield_app.service_account`) bound to the company, or whose scope names it, are
+     *     read with a locking read.
+     *  2. The company's OWN agents: a non-root actor must be able to administer every one of them
+     *     (`assertMayRetireServiceAccounts`, the ADR-0029 ceiling: scope and roles within its own) or
+     *     the whole delete is refused (403). Then each is disabled and its keys revoked (the same
+     *     `sak_revoked_at_ms` stamp `MariaDbApiKeyStore.revoke` writes, here on this transaction).
+     *  3. Other tenants' agents lose the company from their scope (reach over a deleted node only;
+     *     the actor dominates that node). An agent whose ENTIRE scope was the company is disabled and
+     *     its keys revoked instead — an empty scope would make the API-key path fall back to the
+     *     agent's own tenant, a widening — and its scope is left as it was (a dead reference, never
+     *     wider). These need no further authority check: they lose only reach over the deleted node.
+     *  4. Cross-tenant grants (`shield_authz.cross_tenant_grant`) where the company is the owning or
+     *     the grantee tenant and that are not yet revoked are revoked exactly as
+     *     `CrossTenantGrantWriter.revoke` does (status + `ctg_revoked_at`), and audited under both
+     *     tenants. The writer itself cannot join this transaction (it writes on its own pool, and
+     *     audits best-effort after the write); either side may revoke (ADR-0009), and the actor's
+     *     authority over the deleted side is the delete itself.
+     * Every change is audited on this transaction (names; ids only in structured attributes).
+     */
+    private retireDependents;
+    /** Step 4 of {@link retireDependents}: revoke and audit the grants naming the company. */
+    private revokeGrantsNaming;
+    /** Lock the company, then require dominance over each of its members (see `remove`). */
+    private assertMayDeleteMembers;
     /** A company was just created: give it closure rows now and bump its ancestors (D5). */
     attached(nodeUuid: string): Promise<void>;
 }

package/dist/features/company/company-hierarchy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAUxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB,EAC5B,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,0EAA0E;IAC1E,OAAO,CAAC,OAAO;IAIf,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAoBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3F;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc/D,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAWxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAuCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBALH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAiF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IA+BpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/features/company/company-hierarchy.service.js

@@ -1,23 +1,50 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CompanyHierarchyService = void 0;
+exports.ownRootOf = ownRootOf;
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const APP = 'shield_app';
+const AUTHZ = 'shield_authz';
+/** A JSON-array column (the driver returns an array OR a string) → its string items; else []. */
+function jsonIdArray(v) {
+    let arr = v;
+    if (typeof v === 'string') {
+        try {
+            arr = JSON.parse(v);
+        }
+        catch {
+            arr = [];
+        }
+    }
+    return Array.isArray(arr) ? arr.filter((x) => typeof x === 'string') : [];
+}
+/**
+ * The actor's own root node (the active node its subtree hangs from). A non-root actor may not
+ * move, delete (F6) or change the status of (Phase 9 #13c) this node.
+ */
+function ownRootOf(actor) {
+    return actor.activeScopeNodeId ?? actor.tenantId;
+}
 class CompanyHierarchyService {
     pool;
     closure;
+    ceiling;
     audit;
     now;
-    constructor(pool, closure, audit, now = Date.now) {
+    constructor(pool, closure, 
+    /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
+    ceiling, audit, now = Date.now) {
         this.pool = pool;
         this.closure = closure;
+        this.ceiling = ceiling;
         this.audit = audit;
         this.now = now;
     }
-    /** The actor's own root node (the active node its subtree hangs from). */
+    /** The actor's own root node (see {@link ownRootOf}). */
     ownRoot(actor) {
-        return actor.activeScopeNodeId ?? actor.tenantId;
+        return ownRootOf(actor);
     }
     /** Names of the given companies (unknown → absent). */
     async names(q, ids) {
@@ -27,14 +54,14 @@ class CompanyHierarchyService {
         const rows = (await q.query(`SELECT c_uuid, c_name FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${unique.map(() => '?').join(', ')})`, unique));
         return new Map(rows.map((r) => [r.c_uuid, r.c_name]));
     }
-    async recordAudit(conn, actor, action, attributes) {
+    async recordAudit(conn, actor, action, attributes, tenantId = actor.tenantId) {
         if (!this.audit)
             return;
         await this.audit.record({
             type: 'admin_action',
             occurredAtMs: this.now(),
             actorId: actor.id,
-            tenantId: actor.tenantId,
+            tenantId,
             action: { key: action },
             attributes: { eventType: 'company_hierarchy', ...attributes },
         }, (sql, params) => conn.query(sql, params));
@@ -81,7 +108,21 @@ class CompanyHierarchyService {
     }
     /**
      * Delete a company through `deleteNode` (refuses a node with children; closure rows + ancestor
-     * bump in one transaction). The caller has already checked reach (walled read).
+     * and own-node bump in one transaction). The caller has already checked reach (walled read).
+     *
+     * Phase 8 #3: the delete cascades every membership and posting of the company, stripping its
+     * members' authority there, so a non-root actor must DOMINATE every member (the actor itself is
+     * skipped). Inside the delete's transaction and tree lock, before anything is deleted: lock the
+     * company row (a new membership's FK check waits on it), read the members with a locking read
+     * (latest committed rows, no insert into the range until commit), then `assertDominates` each.
+     * Any refusal rolls the whole delete back (403). Root bypasses the dominance check.
+     *
+     * Phase 8 #3 (continued): nothing in the database ties a service account or a cross-tenant grant
+     * to its company (no FK), so, still before the company row goes and on the same transaction,
+     * {@link retireDependents} disables the company's agents and revokes their keys, removes the
+     * company from other agents' scopes, and revokes every cross-tenant grant naming it — audited on
+     * that transaction. One transaction: a failure anywhere leaves the company and everything
+     * depending on it as they were; a commit leaves a deleted company with no live agent or grant.
      */
     async remove(actor, nodeUuid) {
         // Security review F6: the same own-root guard as `move` — a sub-admin never deletes the
@@ -89,8 +130,156 @@ class CompanyHierarchyService {
         if (actor.isRoot !== true && nodeUuid === this.ownRoot(actor)) {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot delete the organisation your access is rooted at.');
         }
-        const name = (await this.names(this.pool, [nodeUuid])).get(nodeUuid);
-        await this.closure.deleteNode(nodeUuid, (conn) => this.recordAudit(conn, actor, 'company.deleted', { company: name ?? '(unknown)' }));
+        const name = (await this.names(this.pool, [nodeUuid])).get(nodeUuid) ?? '(unknown)';
+        await this.closure.deleteNode(nodeUuid, (conn) => this.recordAudit(conn, actor, 'company.deleted', { company: name }), async (conn) => {
+            await this.assertMayDeleteMembers(conn, actor, nodeUuid);
+            return this.retireDependents(conn, actor, nodeUuid, name);
+        });
+    }
+    /**
+     * Retire what depends on a company being deleted (Phase 8 #3), on the delete's transaction after
+     * the company row lock and the member check, BEFORE the company row is deleted. Returns the
+     * tenants whose agents changed (the delete bumps them with the node and its ancestors).
+     *
+     *  1. Agents (`shield_app.service_account`) bound to the company, or whose scope names it, are
+     *     read with a locking read.
+     *  2. The company's OWN agents: a non-root actor must be able to administer every one of them
+     *     (`assertMayRetireServiceAccounts`, the ADR-0029 ceiling: scope and roles within its own) or
+     *     the whole delete is refused (403). Then each is disabled and its keys revoked (the same
+     *     `sak_revoked_at_ms` stamp `MariaDbApiKeyStore.revoke` writes, here on this transaction).
+     *  3. Other tenants' agents lose the company from their scope (reach over a deleted node only;
+     *     the actor dominates that node). An agent whose ENTIRE scope was the company is disabled and
+     *     its keys revoked instead — an empty scope would make the API-key path fall back to the
+     *     agent's own tenant, a widening — and its scope is left as it was (a dead reference, never
+     *     wider). These need no further authority check: they lose only reach over the deleted node.
+     *  4. Cross-tenant grants (`shield_authz.cross_tenant_grant`) where the company is the owning or
+     *     the grantee tenant and that are not yet revoked are revoked exactly as
+     *     `CrossTenantGrantWriter.revoke` does (status + `ctg_revoked_at`), and audited under both
+     *     tenants. The writer itself cannot join this transaction (it writes on its own pool, and
+     *     audits best-effort after the write); either side may revoke (ADR-0009), and the actor's
+     *     authority over the deleted side is the delete itself.
+     * Every change is audited on this transaction (names; ids only in structured attributes).
+     */
+    async retireDependents(conn, actor, nodeUuid, companyName) {
+        // Phase 9 #11: lock only the matching agents, never the whole table. An agent created in the
+        // company, or given it in scope, after the candidate read is not seen: the outcome equals
+        // "delete, then that edit" (the API-key path joins `companies`, so an agent of a deleted
+        // tenant cannot authenticate; a deleted node in a scope reaches nothing).
+        const agents = await (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_updated_at_ms', {
+            sql: 'sa_tenant_id = ? OR JSON_CONTAINS(sa_scope_subtree, JSON_QUOTE(?))',
+            params: [nodeUuid, nodeUuid],
+        });
+        const own = agents.filter((a) => a.sa_tenant_id === nodeUuid);
+        const others = agents.filter((a) => a.sa_tenant_id !== nodeUuid);
+        // Root bypasses inside; a refusal (403, names no agent) rolls the whole delete back.
+        await this.ceiling.assertMayRetireServiceAccounts(actor, own.map((a) => ({
+            tenantId: a.sa_tenant_id,
+            scopeSubtreeNodeIds: jsonIdArray(a.sa_scope_subtree),
+            roleIds: jsonIdArray(a.sa_role_ids),
+        })));
+        const nowMs = this.now();
+        const touched = new Set();
+        const editStamp = (a) => Math.max(nowMs, (a.sa_updated_at_ms == null ? 0 : Number(a.sa_updated_at_ms)) + 1);
+        const retire = async (a, reason) => {
+            await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_status = 'disabled', sa_updated_at_ms = ? WHERE sa_id = ?`, [editStamp(a), a.sa_id]);
+            const res = (await conn.query(`UPDATE \`${AUTHZ}\`.\`service_account_key\`
+            SET sak_revoked_at_ms = ?
+          WHERE sak_account_id = ? AND sak_revoked_at_ms IS NULL`, [nowMs, a.sa_id]));
+            touched.add(a.sa_tenant_id);
+            await this.recordAudit(conn, actor, 'service_account.disabled', {
+                eventType: 'service_account',
+                accountId: a.sa_id,
+                account: a.sa_label,
+                company: companyName,
+                reason,
+                keysRevoked: Number(res?.affectedRows ?? 0),
+            });
+        };
+        for (const a of own)
+            await retire(a, 'company_deleted');
+        for (const a of others) {
+            const remaining = jsonIdArray(a.sa_scope_subtree).filter((n) => n !== nodeUuid);
+            if (remaining.length === 0) {
+                await retire(a, 'scope_company_deleted');
+                continue;
+            }
+            await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_scope_subtree = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), editStamp(a), a.sa_id]);
+            touched.add(a.sa_tenant_id);
+            await this.recordAudit(conn, actor, 'service_account.updated', {
+                eventType: 'service_account',
+                accountId: a.sa_id,
+                account: a.sa_label,
+                fields: ['scopeSubtreeNodeIds'],
+                scopeRemoved: [companyName],
+                reason: 'company_deleted',
+            });
+        }
+        await this.revokeGrantsNaming(conn, actor, nodeUuid, companyName);
+        return [...touched];
+    }
+    /** Step 4 of {@link retireDependents}: revoke and audit the grants naming the company. */
+    async revokeGrantsNaming(conn, actor, nodeUuid, companyName) {
+        const grants = (await conn.query(`SELECT ctg_uuid, ctg_owning_tenant_uuid, ctg_grantee_tenant_uuid, ctg_grantee_kind,
+              ctg_grantee_uuid, ctg_type_key, ctg_scope, ctg_allowed_actions
+         FROM \`${AUTHZ}\`.\`cross_tenant_grant\`
+        WHERE (ctg_owning_tenant_uuid = ? OR ctg_grantee_tenant_uuid = ?)
+          AND ctg_status <> 'revoked'
+        ORDER BY ctg_uuid
+        FOR UPDATE`, [nodeUuid, nodeUuid]));
+        if (grants.length === 0)
+            return;
+        const revokedAt = new Date(this.now());
+        const otherSides = grants.map((g) => g.ctg_owning_tenant_uuid === nodeUuid ? g.ctg_grantee_tenant_uuid : g.ctg_owning_tenant_uuid);
+        const names = await this.names(conn, otherSides);
+        for (const [i, g] of grants.entries()) {
+            await conn.query(`UPDATE \`${AUTHZ}\`.\`cross_tenant_grant\`
+            SET ctg_status = 'revoked', ctg_revoked_at = ?
+          WHERE ctg_uuid = ? AND ctg_status <> 'revoked'`, [revokedAt, g.ctg_uuid]);
+            const other = otherSides[i];
+            const attributes = {
+                eventType: 'cross_tenant_grant',
+                grantUuid: g.ctg_uuid,
+                typeKey: g.ctg_type_key,
+                scope: g.ctg_scope === 'record' ? 'record' : 'object_type',
+                granteeKind: g.ctg_grantee_kind === 'role' ? 'role' : 'user',
+                granteeUuid: g.ctg_grantee_uuid,
+                allowedActions: jsonIdArray(g.ctg_allowed_actions),
+                owningTenantId: g.ctg_owning_tenant_uuid,
+                granteeTenantId: g.ctg_grantee_tenant_uuid,
+                reason: 'company_deleted',
+                company: companyName,
+                otherCompany: names.get(other) ?? '(deleted organisation)',
+            };
+            // Audit on BOTH tenants (ADR-0009), one row each, as the writer's audit bridge files it.
+            for (const tenantId of new Set([g.ctg_owning_tenant_uuid, g.ctg_grantee_tenant_uuid])) {
+                await this.recordAudit(conn, actor, 'grant.revoked', attributes, tenantId);
+            }
+        }
+    }
+    /** Lock the company, then require dominance over each of its members (see `remove`). */
+    async assertMayDeleteMembers(conn, actor, nodeUuid) {
+        await conn.query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? FOR UPDATE`, [
+            nodeUuid,
+        ]);
+        if (actor.isRoot === true)
+            return;
+        const rows = (await conn.query(`SELECT cm_user_uuid AS member FROM \`${APP}\`.\`company_membership\`
+        WHERE cm_company_uuid = ? FOR UPDATE`, [nodeUuid]));
+        const members = [...new Set(rows.map((r) => r.member))].sort();
+        for (const member of members) {
+            if (member === actor.id)
+                continue; // leaving your own membership behind stays allowed
+            try {
+                await this.ceiling.assertDominates(actor, member);
+            }
+            catch (cause) {
+                if (cause instanceof identity_errors_js_1.IdentityForbiddenError || cause instanceof identity_errors_js_1.IdentityNotFoundError) {
+                    // Names no member (who belongs to the company is not the caller's to learn from a refusal).
+                    throw new identity_errors_js_1.IdentityForbiddenError('You cannot delete this company: one of its members is outside your authority.');
+                }
+                throw cause;
+            }
+        }
     }
     /** A company was just created: give it closure rows now and bump its ancestors (D5). */
     async attached(nodeUuid) {

package/dist/features/company/company.controller.d.ts

@@ -41,7 +41,7 @@ export declare class CompanyController {
      * Update a company's name/status — gated on `identity:company:update`. Any other key
      * (parentUuid, type, …) is ignored: use `PUT companies/:uuid/parent` to move a company.
      */
-    updateCompany(uuid: string, body: {
+    updateCompany(req: AuthedRequest, uuid: string, body: {
         name?: string;
         status?: string;
     }): Promise<{

package/dist/features/company/company.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAa9C;;;OAGG;IAGG,aAAa,CACF,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAI3E"}
+{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAa9C;;;OAGG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IASlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAI3E"}

package/dist/features/company/company.controller.js

@@ -64,8 +64,11 @@ let CompanyController = class CompanyController {
      * Update a company's name/status — gated on `identity:company:update`. Any other key
      * (parentUuid, type, …) is ignored: use `PUT companies/:uuid/parent` to move a company.
      */
-    async updateCompany(uuid, body) {
-        await this.companies.updateCompany(uuid, { name: body?.name, status: body?.status });
+    async updateCompany(req, uuid, body) {
+        await this.companies.updateCompany(req.principal, uuid, {
+            name: body?.name,
+            status: body?.status,
+        });
         return { success: true };
     }
     /** Delete a company — gated on `identity:company:delete`. A company with sub-companies → 409. */
@@ -113,10 +116,11 @@ __decorate([
 __decorate([
     (0, common_1.Put)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], CompanyController.prototype, "updateCompany", null);
 __decorate([

package/dist/features/company/company.service.d.ts

@@ -26,8 +26,15 @@ export declare class CompanyService {
     listCompanies(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single company. */
     getCompany(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
-    updateCompany(uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
+    /**
+     * Update a company's name/status. Any other key (parentUuid, type, …) is dropped.
+     *
+     * Phase 9 #13c: a non-root actor may not change the STATUS of the organisation its access is
+     * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
+     * whole tenant above the actor's authority. Re-sending the current status (the company form
+     * always sends both fields) stays allowed, so the own root can still be renamed.
+     */
+    updateCompany(actor: Principal, uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
     moveCompany(actor: Principal, uuid: string, parentUuid: string | null): Promise<void>;
     /**

package/dist/features/company/company.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AASzE;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB,sFAAsF;IACtF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpF,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}
+{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAa,MAAM,gCAAgC,CAAC;AASpF;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC;IAiBhB,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}

package/dist/features/company/company.service.js

@@ -66,13 +66,28 @@ let CompanyService = CompanyService_1 = class CompanyService {
     getCompany(uuid) {
         return this.records.get('company', uuid);
     }
-    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
-    updateCompany(uuid, patch) {
+    /**
+     * Update a company's name/status. Any other key (parentUuid, type, …) is dropped.
+     *
+     * Phase 9 #13c: a non-root actor may not change the STATUS of the organisation its access is
+     * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
+     * whole tenant above the actor's authority. Re-sending the current status (the company form
+     * always sends both fields) stays allowed, so the own root can still be renamed.
+     */
+    async updateCompany(actor, uuid, patch) {
         const fields = {};
         for (const key of COMPANY_PATCH_KEYS) {
             if (typeof patch?.[key] === 'string')
                 fields[key] = patch[key];
         }
+        if (actor.isRoot !== true && fields.status !== undefined && uuid === (0, company_hierarchy_service_js_1.ownRootOf)(actor)) {
+            const current = await this.records.get('company', uuid);
+            if (current === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+            if (current.fields.status !== fields.status) {
+                throw new identity_errors_js_1.IdentityForbiddenError('You cannot change the status of the organisation your access is rooted at.');
+            }
+        }
         return this.records.update('company', uuid, { fields });
     }
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */