@astram/identity 0.5.0 → 0.7.0

package/dist/features/service-account/lock-service-accounts.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Lock the service accounts matching a predicate, without locking the table (Phase 9 #11).
+ *
+ * `service_account` has no index a role or scope predicate can use (`JSON_CONTAINS` on a JSON
+ * column, or an `OR` with one), so `SELECT … WHERE <predicate> FOR UPDATE` scans the whole table
+ * and InnoDB (REPEATABLE READ) keeps a next-key lock on every row it scanned: every other agent's
+ * edit, and every new agent, waits until the transaction ends. Instead:
+ *   1. a NON-locking read finds the candidate ids (a consistent read, no locks);
+ *   2. `FOR UPDATE` by primary key locks only those rows, sorted by id (a stable lock order), and
+ *      re-evaluates the predicate on the latest committed version of each, so a candidate that
+ *      stopped matching in between is dropped.
+ *
+ * A row that STARTS matching after step 1 (an agent that gains the role, or the company in its
+ * scope) is not locked or returned. Callers accept that (see their docs): the outcome equals the
+ * serial order "this transaction, then that edit", which the table-wide lock also allowed (the
+ * edit only waited, then applied).
+ *
+ * `columns` and `where.sql` are fixed SQL written by the caller (never client input); every value
+ * is `?`-bound.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockServiceAccountsWhere = lockServiceAccountsWhere;
+const APP = 'shield_app';
+async function lockServiceAccountsWhere(conn, columns, where) {
+    const candidates = (await conn.query(`SELECT sa_id FROM \`${APP}\`.\`service_account\` WHERE ${where.sql}`, [...where.params]));
+    const ids = [...new Set(candidates.map((r) => r.sa_id))].sort();
+    if (ids.length === 0)
+        return [];
+    return (await conn.query(`SELECT ${columns}
+       FROM \`${APP}\`.\`service_account\`
+      WHERE sa_id IN (${ids.map(() => '?').join(', ')}) AND (${where.sql})
+      ORDER BY sa_id
+      FOR UPDATE`, [...ids, ...where.params]));
+}

package/dist/features/service-account/no-expiry-key-report.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The non-expiring service-account key report (security hardening Phase 8 #13, shipped as the
+ * `astram-sa-keys-report` bin in Phase 9 #8).
+ *
+ * Keys issued before an expiry became mandatory have `sak_expires_at_ms IS NULL` and never expire
+ * (a key issued later with an explicit `neverExpires: true` looks the same). This read-only report
+ * lists each agent's CURRENT, unrevoked key with no expiry so an operator can rotate it with an
+ * expiry. It prints labels and company names only: never a secret, a hash or a raw id.
+ */
+/** Read-only: the current unrevoked key of each agent that has no expiry, with display names. */
+export declare const NO_EXPIRY_KEY_REPORT_SQL = "SELECT sa.sa_label AS label, c.c_name AS company,\n       sa.sa_status AS status, k.sak_version AS version, k.sak_created_at_ms AS issuedAtMs\n  FROM shield_authz.service_account_key k\n  LEFT JOIN shield_app.service_account sa ON sa.sa_id = k.sak_account_id\n  LEFT JOIN shield_app.companies c ON c.c_uuid = k.sak_tenant_id\n WHERE k.sak_expires_at_ms IS NULL\n   AND k.sak_revoked_at_ms IS NULL\n   AND k.sak_version = (SELECT MAX(v.sak_version)\n                          FROM shield_authz.service_account_key v\n                         WHERE v.sak_account_id = k.sak_account_id)\n ORDER BY k.sak_created_at_ms";
+/** One non-expiring key, as printed (no ids, no secrets). */
+export interface NonExpiringKey {
+    /** The agent's label; `null` when the agent row no longer exists. */
+    readonly label: string | null;
+    /** The tenant company's name; `null` when the company no longer exists. */
+    readonly company: string | null;
+    readonly status: string | null;
+    readonly version: number;
+    readonly issuedAtMs: number | null;
+}
+/** The query surface the report needs (a `mariadb` pool or connection satisfies it). */
+export interface ReportQueryable {
+    query(sql: string, params?: unknown[]): Promise<unknown>;
+}
+/** Run the report query and map the rows. Read-only. */
+export declare function findNonExpiringKeys(db: ReportQueryable): Promise<NonExpiringKey[]>;
+/** Human-readable report text (one line per key, plus a summary line). */
+export declare function formatNonExpiringKeyReport(keys: readonly NonExpiringKey[]): string;
+/** The bin's behaviour, testable without a process: returns the exit code. */
+export declare function runNonExpiringKeyReport(opts: {
+    readonly argv: readonly string[];
+    readonly openDb: () => ReportQueryable & {
+        end(): Promise<void>;
+    };
+    readonly out: (text: string) => void;
+    readonly err: (text: string) => void;
+}): Promise<number>;
+//# sourceMappingURL=no-expiry-key-report.d.ts.map

package/dist/features/service-account/no-expiry-key-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-expiry-key-report.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/no-expiry-key-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,2mBAUP,CAAC;AAE/B,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAMD,wDAAwD;AACxD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CASxF;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAalF;AAcD,8EAA8E;AAC9E,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,eAAe,GAAG;QAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB"}

package/dist/features/service-account/no-expiry-key-report.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * The non-expiring service-account key report (security hardening Phase 8 #13, shipped as the
+ * `astram-sa-keys-report` bin in Phase 9 #8).
+ *
+ * Keys issued before an expiry became mandatory have `sak_expires_at_ms IS NULL` and never expire
+ * (a key issued later with an explicit `neverExpires: true` looks the same). This read-only report
+ * lists each agent's CURRENT, unrevoked key with no expiry so an operator can rotate it with an
+ * expiry. It prints labels and company names only: never a secret, a hash or a raw id.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_EXPIRY_KEY_REPORT_SQL = void 0;
+exports.findNonExpiringKeys = findNonExpiringKeys;
+exports.formatNonExpiringKeyReport = formatNonExpiringKeyReport;
+exports.runNonExpiringKeyReport = runNonExpiringKeyReport;
+/** Read-only: the current unrevoked key of each agent that has no expiry, with display names. */
+exports.NO_EXPIRY_KEY_REPORT_SQL = `SELECT sa.sa_label AS label, c.c_name AS company,
+       sa.sa_status AS status, k.sak_version AS version, k.sak_created_at_ms AS issuedAtMs
+  FROM shield_authz.service_account_key k
+  LEFT JOIN shield_app.service_account sa ON sa.sa_id = k.sak_account_id
+  LEFT JOIN shield_app.companies c ON c.c_uuid = k.sak_tenant_id
+ WHERE k.sak_expires_at_ms IS NULL
+   AND k.sak_revoked_at_ms IS NULL
+   AND k.sak_version = (SELECT MAX(v.sak_version)
+                          FROM shield_authz.service_account_key v
+                         WHERE v.sak_account_id = k.sak_account_id)
+ ORDER BY k.sak_created_at_ms`;
+const str = (v) => (v === null || v === undefined ? null : String(v));
+const num = (v) => v === null || v === undefined || !Number.isFinite(Number(v)) ? null : Number(v);
+/** Run the report query and map the rows. Read-only. */
+async function findNonExpiringKeys(db) {
+    const rows = (await db.query(exports.NO_EXPIRY_KEY_REPORT_SQL));
+    return rows.map((r) => ({
+        label: str(r.label),
+        company: str(r.company),
+        status: str(r.status),
+        version: num(r.version) ?? 0,
+        issuedAtMs: num(r.issuedAtMs),
+    }));
+}
+/** Human-readable report text (one line per key, plus a summary line). */
+function formatNonExpiringKeyReport(keys) {
+    if (keys.length === 0)
+        return 'No service-account keys without an expiry.\n';
+    const lines = keys.map((k) => {
+        const issued = k.issuedAtMs === null ? 'unknown' : new Date(k.issuedAtMs).toISOString();
+        return (`- ${k.label ?? '(deleted agent)'} — company: ${k.company ?? '(deleted company)'}` +
+            ` — status: ${k.status ?? 'unknown'} — key version ${k.version}, issued ${issued}`);
+    });
+    return (`${keys.length} service-account key(s) with no expiry (rotate each with an expiry):\n` +
+        `${lines.join('\n')}\n`);
+}
+const USAGE = `Usage: astram-sa-keys-report [--fail-on-found]
+
+Lists service-account (agent) keys that never expire: each agent's current, unrevoked key with no
+expiry. Read-only. Connects with the APP_DB_HOST, APP_DB_PORT, APP_DB_USER, APP_DB_PASSWORD and
+APP_DB_NAME environment variables (the same as the identity module's authz pool).
+
+  --fail-on-found  exit 1 if any key is listed (for CI)
+  --help           show this text
+
+Exit codes: 0 done (or nothing found), 1 found with --fail-on-found, 2 error.
+`;
+/** The bin's behaviour, testable without a process: returns the exit code. */
+async function runNonExpiringKeyReport(opts) {
+    const known = new Set(['--fail-on-found', '--help', '-h']);
+    const unknown = opts.argv.filter((a) => !known.has(a));
+    if (unknown.length > 0) {
+        opts.err(`Unknown option: ${unknown.join(' ')}\n\n${USAGE}`);
+        return 2;
+    }
+    if (opts.argv.includes('--help') || opts.argv.includes('-h')) {
+        opts.out(USAGE);
+        return 0;
+    }
+    let db;
+    try {
+        db = opts.openDb();
+        const keys = await findNonExpiringKeys(db);
+        opts.out(formatNonExpiringKeyReport(keys));
+        return keys.length > 0 && opts.argv.includes('--fail-on-found') ? 1 : 0;
+    }
+    catch (e) {
+        // The driver's message names the failing step (host/user at most), never the password.
+        opts.err(`astram-sa-keys-report failed: ${e instanceof Error ? e.message : String(e)}\n`);
+        return 2;
+    }
+    finally {
+        await db?.end().catch(() => undefined);
+    }
+}

package/dist/features/service-account/service-account.service.d.ts

@@ -30,6 +30,21 @@ export interface ServiceAccountView {
     readonly createdByName: string | null;
     readonly createdAtMs: number;
     readonly updatedAtMs: number | null;
+    /** The account's current API key (the highest version), or `null` when none was ever issued. */
+    readonly currentKey: ServiceAccountKeyView | null;
+}
+/**
+ * The status of an account's current key (Phase 8 #13) — never the secret or its hash.
+ * `neverExpires` flags an ACTIVE key with no expiry: either issued before an expiry became
+ * mandatory (identity 0.5.0) or issued later with an explicit `neverExpires: true`. The stored row
+ * cannot tell the two apart, so both are flagged; review them and rotate with an expiry.
+ */
+export interface ServiceAccountKeyView {
+    readonly version: number;
+    readonly issuedAtMs: number;
+    readonly expiresAtMs: number | null;
+    readonly revoked: boolean;
+    readonly neverExpires: boolean;
 }
 /** The ONE-TIME key reveal returned by issue/rotate — the only time the raw key exists. */
 export interface IssuedKey {

package/dist/features/service-account/service-account.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAwBrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}
+{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}

package/dist/features/service-account/service-account.service.js

@@ -157,12 +157,27 @@ class ServiceAccountService {
     async toViews(rows) {
         if (rows.length === 0)
             return [];
-        const [roles, nodes] = await Promise.all([
+        const [roles, nodes, keys] = await Promise.all([
             this.accounts.rolesByIds(rows.flatMap((r) => r.roleIds)),
             this.accounts.nodesByIds(rows.flatMap((r) => r.scopeSubtreeNodeIds)),
+            this.accounts.currentKeys(rows.map((r) => r.id)),
         ]);
         const roleName = new Map(roles.map((r) => [r.id, r.name]));
         const nodeName = new Map(nodes.map((n) => [n.id, n.name]));
+        const keyOf = new Map(keys.map((k) => [k.accountId, k]));
+        const keyView = (id) => {
+            const k = keyOf.get(id);
+            if (k === undefined)
+                return null;
+            const revoked = k.revokedAtMs !== null;
+            return {
+                version: k.version,
+                issuedAtMs: k.createdAtMs,
+                expiresAtMs: k.expiresAtMs,
+                revoked,
+                neverExpires: k.expiresAtMs === null && !revoked,
+            };
+        };
         return Promise.all(rows.map(async (row) => ({
             id: row.id,
             label: row.label,
@@ -174,6 +189,7 @@ class ServiceAccountService {
             createdByName: row.createdBy ? await this.resolveName(row.createdBy) : null,
             createdAtMs: row.createdAtMs,
             updatedAtMs: row.updatedAtMs,
+            currentKey: keyView(row.id),
         })));
     }
     /**

package/dist/features/service-account/service-account.store.d.ts

@@ -12,6 +12,14 @@
  * stamped `sa_tenant_id` (from the session) on create — never client input.
  */
 import type { Pool } from 'mariadb';
+/** The status of an account's current key (no hash, no secret). Epoch-ms; `null` = not set. */
+export interface ServiceAccountKeyRow {
+    readonly accountId: string;
+    readonly version: number;
+    readonly expiresAtMs: number | null;
+    readonly revokedAtMs: number | null;
+    readonly createdAtMs: number;
+}
 /** The caller's reachable subtree (threaded from `req.principal`) — same shape as grant-admin. */
 export interface SubtreeScope {
     readonly nodeIds: readonly string[];
@@ -51,6 +59,13 @@ export declare class ServiceAccountStore {
     nodesByIds(ids: readonly string[]): Promise<ScopeNodeOption[]>;
     /** Every company (ROOT's assignable scope — root reaches all). */
     allNodes(): Promise<ScopeNodeOption[]>;
+    /**
+     * Phase 8 #13 — the CURRENT key (highest version: the only one the authenticator honours) of
+     * each account, from guard's `shield_authz.service_account_key`, in ONE batched read. Status
+     * columns only — never the hash. Read-only. Callers pass ids they already read through the
+     * own-tenant wall (`list`/`getById`); accounts with no key are simply absent.
+     */
+    currentKeys(accountIds: readonly string[]): Promise<ServiceAccountKeyRow[]>;
     /** List the caller's own-tenant accounts (newest first). Root sees all. */
     list(scope: SubtreeScope): Promise<ServiceAccountRow[]>;
     /** Fetch one account BY id, scoped to the caller's subtree. Cross-tenant/unknown → null (404). */

package/dist/features/service-account/service-account.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAIpC,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAMvC,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}
+{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAMpC,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAUD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAMvC,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBjF,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}

package/dist/features/service-account/service-account.store.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceAccountStore = void 0;
 const APP = 'shield_app';
+/** Guard's key table lives here (`1710000000017-CreateServiceAccountKey.cjs`); read-only here. */
+const AUTHZ = 'shield_authz';
 /** Normalize a JSON-array column (driver returns array OR string) → string[]. Fail-safe to []. */
 function jsonArray(v) {
     const arr = Array.isArray(v)
@@ -83,6 +85,33 @@ class ServiceAccountStore {
         const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` ORDER BY c_name`, []));
         return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
     }
+    /**
+     * Phase 8 #13 — the CURRENT key (highest version: the only one the authenticator honours) of
+     * each account, from guard's `shield_authz.service_account_key`, in ONE batched read. Status
+     * columns only — never the hash. Read-only. Callers pass ids they already read through the
+     * own-tenant wall (`list`/`getById`); accounts with no key are simply absent.
+     */
+    async currentKeys(accountIds) {
+        const u = uniqueIds(accountIds);
+        if (u.length === 0)
+            return [];
+        const rows = (await this.pool.query(`SELECT k.sak_account_id, k.sak_version, k.sak_expires_at_ms, k.sak_revoked_at_ms,
+              k.sak_created_at_ms
+         FROM \`${AUTHZ}\`.\`service_account_key\` k
+         JOIN (SELECT sak_account_id, MAX(sak_version) AS v
+                 FROM \`${AUTHZ}\`.\`service_account_key\`
+                WHERE sak_account_id IN (${u.map(() => '?').join(', ')})
+                GROUP BY sak_account_id) m
+           ON m.sak_account_id = k.sak_account_id AND m.v = k.sak_version`, u));
+        const ms = (v) => (v === null || v === undefined ? null : Number(v));
+        return rows.map((r) => ({
+            accountId: r.sak_account_id,
+            version: Number(r.sak_version),
+            expiresAtMs: ms(r.sak_expires_at_ms),
+            revokedAtMs: ms(r.sak_revoked_at_ms),
+            createdAtMs: Number(r.sak_created_at_ms),
+        }));
+    }
     /** List the caller's own-tenant accounts (newest first). Root sees all. */
     async list(scope) {
         const t = tenantScope(scope);

package/dist/features/user/user.service.d.ts

@@ -17,9 +17,9 @@ export interface UserPatch {
  * Users are GLOBAL (one user can belong to many tenants) and the email is a credential attribute:
  * forgot-password mails the reset link to it. So (security hardening #3, D2):
  *   - the patch is whitelisted to `{username, email, status}`;
- *   - changing `email` or `status`, and deleting a user, require the actor to DOMINATE the target
- *     (`GrantCeiling.assertDominates`: every membership of the target inside the actor's subtree,
- *     and every key the target could hold is held by the actor);
+ *   - changing `username` (Phase 9 #13a), `email` or `status`, and deleting a user, require the
+ *     actor to DOMINATE the target (`GrantCeiling.assertDominates`: every membership of the target
+ *     inside the actor's subtree, and every key the target could hold is held by the actor);
  *   - an email change burns the target's outstanding password-reset tokens BEFORE the change and
  *     notifies the OLD address after it (best-effort), when guard's reset-token store and email
  *     sender are wired (`ShieldModule.forRoot({ auth: true })`).
@@ -46,7 +46,7 @@ export declare class UserService {
     listUsers(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single user. */
     getUser(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a user (whitelisted patch; email/status changes need dominance — see the class doc). */
+    /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     updateUser(actor: Principal, uuid: string, patch: UserPatch): Promise<void>;
     /**
      * After a status change (security hardening Phase 3): bump every tenant the user is a member of

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAMzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;IAcpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BjF;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAMzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;IAcpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjF;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}

package/dist/features/user/user.service.js

@@ -30,9 +30,9 @@ const USER_SORT_FIELDS = ['username', 'email', 'status', 'createdAt'];
  * Users are GLOBAL (one user can belong to many tenants) and the email is a credential attribute:
  * forgot-password mails the reset link to it. So (security hardening #3, D2):
  *   - the patch is whitelisted to `{username, email, status}`;
- *   - changing `email` or `status`, and deleting a user, require the actor to DOMINATE the target
- *     (`GrantCeiling.assertDominates`: every membership of the target inside the actor's subtree,
- *     and every key the target could hold is held by the actor);
+ *   - changing `username` (Phase 9 #13a), `email` or `status`, and deleting a user, require the
+ *     actor to DOMINATE the target (`GrantCeiling.assertDominates`: every membership of the target
+ *     inside the actor's subtree, and every key the target could hold is held by the actor);
  *   - an email change burns the target's outstanding password-reset tokens BEFORE the change and
  *     notifies the OLD address after it (best-effort), when guard's reset-token store and email
  *     sender are wired (`ShieldModule.forRoot({ auth: true })`).
@@ -79,13 +79,16 @@ let UserService = UserService_1 = class UserService {
     getUser(uuid) {
         return this.records.get('user', uuid);
     }
-    /** Update a user (whitelisted patch; email/status changes need dominance — see the class doc). */
+    /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     async updateUser(actor, uuid, patch) {
         const current = await this.records.get('user', uuid);
         if (current === null)
             throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
         const fields = {};
-        if (typeof patch?.username === 'string')
+        // Phase 9 #13a: the username is a sign-in identifier like the email, so changing it needs the
+        // same dominance (re-sending the current username changes nothing and needs none).
+        const usernameChanged = typeof patch?.username === 'string' && patch.username !== current.fields.username;
+        if (usernameChanged)
             fields.username = patch.username;
         const oldEmail = typeof current.fields.email === 'string' ? current.fields.email : '';
         const emailChanged = typeof patch?.email === 'string' && patch.email !== oldEmail;
@@ -98,7 +101,7 @@ let UserService = UserService_1 = class UserService {
             fields.email = patch.email;
         if (statusChanged)
             fields.status = patch.status;
-        if (emailChanged || statusChanged || wantsInactive) {
+        if (usernameChanged || emailChanged || statusChanged || wantsInactive) {
             await this.ceiling.assertDominates(actor, uuid);
         }
         if (Object.keys(fields).length > 0) {

package/dist/index.d.ts

@@ -36,17 +36,9 @@ export { identityAuthActionKeys, identityControlPlaneKeys } from './auth-facts-k
  * `identityObjects`, and mounts the CRUD controllers — no separate engine setup needed.
  */
 export { IdentityFeatureModule } from './features/identity-feature.module.js';
-/**
- * The record-tier authorization wiring: the lean grant-read pool factory + the helper that
- * assembles `RecordAuthorizationInputs` for `ShieldModule.forRoot({ recordAuthorization })`.
- * Once wired, `decide()` is real (the framework's record-tier adapters run over the identity
- * app schema) instead of the deny-everything stub.
- */
-export { createIdentityAuthzPool, buildIdentityRecordAuthorization, } from './features/authz/record-authorization.js';
 /**
  * The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
- * that wants to construct it directly (rather than via `buildIdentityRecordAuthorization`)
- * can do so.
+ * that wants to construct it directly can do so.
  */
 export { AlsSessionFactsReader } from './features/authz/session-facts.reader.js';
 /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,EACvB,gCAAgC,GACjC,MAAM,0CAA0C,CAAC;AAElD;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAU9E;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.createIdentityAuthzPool = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -54,19 +54,16 @@ Object.defineProperty(exports, "identityControlPlaneKeys", { enumerable: true, g
  */
 var identity_feature_module_js_1 = require("./features/identity-feature.module.js");
 Object.defineProperty(exports, "IdentityFeatureModule", { enumerable: true, get: function () { return identity_feature_module_js_1.IdentityFeatureModule; } });
-/**
- * The record-tier authorization wiring: the lean grant-read pool factory + the helper that
- * assembles `RecordAuthorizationInputs` for `ShieldModule.forRoot({ recordAuthorization })`.
- * Once wired, `decide()` is real (the framework's record-tier adapters run over the identity
- * app schema) instead of the deny-everything stub.
+/*
+ * The record-tier authorization: since 0.7 (security hardening Phase 9 #7)
+ * `IdentityFeatureModule.forRoot({ extraObjects })` builds it and provides it to `ShieldModule`
+ * (guard's `SHIELD_RECORD_AUTHORIZATION`); `buildIdentityRecordAuthorization` is removed, and the
+ * app passes no `recordAuthorization`. `createIdentityAuthzPool` (a raw pool, e.g. for
+ * `DbScopeSubtreeResolver`) stays on `@astram/identity/internal`, composition root only.
  */
-var record_authorization_js_1 = require("./features/authz/record-authorization.js");
-Object.defineProperty(exports, "createIdentityAuthzPool", { enumerable: true, get: function () { return record_authorization_js_1.createIdentityAuthzPool; } });
-Object.defineProperty(exports, "buildIdentityRecordAuthorization", { enumerable: true, get: function () { return record_authorization_js_1.buildIdentityRecordAuthorization; } });
 /**
  * The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
- * that wants to construct it directly (rather than via `buildIdentityRecordAuthorization`)
- * can do so.
+ * that wants to construct it directly can do so.
  */
 var session_facts_reader_js_1 = require("./features/authz/session-facts.reader.js");
 Object.defineProperty(exports, "AlsSessionFactsReader", { enumerable: true, get: function () { return session_facts_reader_js_1.AlsSessionFactsReader; } });

package/dist/internal.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @astram/identity/internal — composition-root surface (Phase 8 #5).
+ *
+ * `createIdentityAuthzPool` opens a raw `mariadb` pool, so it is NOT on the package entry point
+ * (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire pool-backed ports
+ * such as `new DbScopeSubtreeResolver(authzPool)` (the record authorization itself is built by
+ * `IdentityFeatureModule` since 0.7); the scaffolded app's lint wall rejects this
+ * subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
+ */
+export { createIdentityAuthzPool } from './features/authz/record-authorization.js';
+//# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/internal.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createIdentityAuthzPool = void 0;
+/**
+ * @astram/identity/internal — composition-root surface (Phase 8 #5).
+ *
+ * `createIdentityAuthzPool` opens a raw `mariadb` pool, so it is NOT on the package entry point
+ * (`@astram/identity`). An app's `src/app.module.ts` imports it from here to wire pool-backed ports
+ * such as `new DbScopeSubtreeResolver(authzPool)` (the record authorization itself is built by
+ * `IdentityFeatureModule` since 0.7); the scaffolded app's lint wall rejects this
+ * subpath everywhere else. Feature code never holds a pool: it uses the RecordEngine.
+ */
+var record_authorization_js_1 = require("./features/authz/record-authorization.js");
+Object.defineProperty(exports, "createIdentityAuthzPool", { enumerable: true, get: function () { return record_authorization_js_1.createIdentityAuthzPool; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -10,8 +10,22 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./internal": {
+      "types": "./dist/internal.d.ts",
+      "default": "./dist/internal.js"
     }
   },
+  "typesVersions": {
+    "*": {
+      "internal": [
+        "dist/internal.d.ts"
+      ]
+    }
+  },
+  "bin": {
+    "astram-sa-keys-report": "dist/bin/sa-keys-report.js"
+  },
   "files": [
     "dist",
     "migrations"
@@ -21,10 +35,10 @@
     "access": "public"
   },
   "dependencies": {
-    "mariadb": "^3.4.0",
+    "mariadb": "^3.5.4",
     "@astram/core": "1.4.0",
-    "@astram/guard": "0.8.0",
-    "@astram/engine": "0.4.0"
+    "@astram/engine": "0.5.1",
+    "@astram/guard": "0.10.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",