@astram/identity 0.6.0 → 0.7.1

package/README.md

@@ -14,3 +14,18 @@ destination for the identity model currently declared in consuming applications
 once relocated, apps declare only role-maps, extra columns, and session
 extensions, while the canonical identity objects, migrations, and resolver live
 here in the framework.
+
+## `astram-sa-keys-report`
+
+Service-account keys issued before an expiry became mandatory never expire. This read-only command
+lists each agent's current, unrevoked key with no expiry (agent label, company name, status, key
+version, issue date; never a secret, hash or id), so you can rotate it with an expiry:
+
+```sh
+APP_DB_HOST=… APP_DB_PORT=… APP_DB_USER=… APP_DB_PASSWORD=… APP_DB_NAME=shield_app \
+  npx astram-sa-keys-report            # exit 0
+npx astram-sa-keys-report --fail-on-found   # exit 1 if any key is listed (CI)
+```
+
+It uses the same `APP_DB_*` variables as the identity module's authz pool. Exit code 2 means it
+could not run (bad option, no database).

package/dist/bin/sa-keys-report.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=sa-keys-report.d.ts.map

package/dist/bin/sa-keys-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sa-keys-report.d.ts","sourceRoot":"","sources":["../../src/bin/sa-keys-report.ts"],"names":[],"mappings":""}

package/dist/bin/sa-keys-report.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * `astram-sa-keys-report` — list service-account keys that never expire (security hardening
+ * Phase 8 #13 / Phase 9 #8). Read-only; connects with the identity authz pool's `APP_DB_*` env.
+ * `--fail-on-found` exits 1 when any key is listed. Logic: `no-expiry-key-report.ts`.
+ */
+const record_authorization_js_1 = require("../features/authz/record-authorization.js");
+const no_expiry_key_report_js_1 = require("../features/service-account/no-expiry-key-report.js");
+void (0, no_expiry_key_report_js_1.runNonExpiringKeyReport)({
+    argv: process.argv.slice(2),
+    openDb: record_authorization_js_1.createIdentityAuthzPool,
+    out: (text) => process.stdout.write(text),
+    err: (text) => process.stderr.write(text),
+}).then((code) => {
+    process.exitCode = code;
+});

package/dist/features/authz/grant-admin.service.d.ts

@@ -133,13 +133,30 @@ export declare class GrantAdminService {
      *   4. audit as `role.permission_revoked` (`roleDeleted: true`), commit, publish the versions.
      * Returns the bumped tenants.
      *
-     * The CALLER (`RoleService.deleteRole`) holds the role row lock on its own engine connection and
-     * has already run the binding rule and user-holder dominance; this method therefore does NOT
-     * lock the role row (that would wait on the caller). It commits BEFORE the caller deletes the
-     * role, so a failure in between leaves a role with no grants and no agents: fewer permissions,
-     * never live grants for a deleted role (fail closed).
+     * The CALLER (`RoleService.deleteRole`) holds the role row lock on its own engine connection,
+     * has already run the binding rule and user-holder dominance, and has already run the engine's
+     * delete (gate included, Phase 9 #5) on that still-open transaction; this method therefore does
+     * NOT lock the role row (that would wait on the caller) and reads only committed state. It
+     * commits BEFORE the caller does, so a failure in between leaves a role with no grants and no
+     * agents: fewer permissions, never live grants for a deleted role (fail closed).
      */
     purgeRole(roleUuid: string, actor: Principal): Promise<string[]>;
+    /**
+     * The service accounts holding `roleUuid`, read with a row lock on the transaction `conn` (a
+     * concurrent edit of one of them waits until this transaction ends). Phase 9 #11: only those
+     * rows are locked, never the whole table (`lockServiceAccountsWhere`). An agent that gains the
+     * role after the candidate read is not seen; the outcome equals "this change, then that edit"
+     * (a role delete leaves that agent an inert uuid: the role and its grants are gone).
+     */
+    /**
+     * The role's uuid as stored (Phase 10 #1): `r_uuid` is `utf8mb4_unicode_ci`, so a route uuid in
+     * another letter case reaches the row, but `JSON_CONTAINS(sa_role_ids, …)` and the `sa_role_ids`
+     * rewrite are exact — an upper-cased uuid would find no holding agent (skipping their check) and
+     * write grants under a second spelling. Unknown → the input unchanged (later steps 404). A
+     * consistent read: `purgeRole` runs while the caller's delete of this row is uncommitted.
+     */
+    private storedRoleUuid;
+    private lockAccountsHoldingRole;
     /** All active bundles + their resolved atomic keys, for the Access UI. */
     listBundles(): Promise<{
         bundles: BundleView[];

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAsC7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;OAQG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA;IAKpC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IAgDzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5E;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA+DtE,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAuC7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;OAQG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA;IAKpC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA0DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAc/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}

package/dist/features/authz/grant-admin.service.js

@@ -7,6 +7,7 @@ const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.
 const grant_ceiling_js_1 = require("./grant-ceiling.js");
 const role_binding_js_1 = require("./role-binding.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
+const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
 const AUTHZ = 'shield_authz';
 const APP = 'shield_app';
 /** The grant-admin actions that REMOVE authority from a role's holders (Phase 8 #2). */
@@ -153,8 +154,13 @@ class GrantAdminService {
                 grant_ceiling_js_1.GrantCeiling.checkAdministrable(await (0, role_binding_js_1.readRoleBinding)(conn, roleUuid, (0, grant_ceiling_js_1.subtreeOf)(actor)));
                 // Phase 8 #2: a revocation strips authority from every holder of the role, so the actor
                 // must dominate each of them — checked under the role lock (no holder can appear unseen).
+                // Phase 9 #9: that includes the service accounts holding the role, judged as a role
+                // delete judges them (each account's tenant in the actor's subtree, the role held by the
+                // actor), over the accounts read under a row lock.
                 if (REVOKE_ACTIONS.has(action)) {
                     await this.ceiling.assertDominatesRoleHolders(actor, roleUuid);
+                    const accounts = await this.lockAccountsHoldingRole(conn, roleUuid);
+                    await this.ceiling.assertMayStripRoleFromServiceAccounts(actor, roleUuid, accounts.map((a) => a.sa_tenant_id), 'revoke');
                 }
             }
             for (const key of keys)
@@ -236,6 +242,7 @@ class GrantAdminService {
      * (404/403) → ceiling (403) → write. Root bypasses the binding rule and the ceiling.
      */
     async grant(roleUuid, key, grantor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         await this.assertValidKey(key); // throws BadKeyError (400) before touching the store
         await this.assertMayChangeGrants(roleUuid, [key], grantor);
         const actorUuid = grantor.id;
@@ -257,6 +264,7 @@ class GrantAdminService {
      * role lock in `writeGrants`). Root bypasses.
      */
     async revoke(roleUuid, key, actor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         await this.assertMayChangeGrants(roleUuid, [key], actor);
         await this.writeGrants('role.permission_revoked', roleUuid, [key], actor, async (conn, k) => {
             await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, k]);
@@ -277,22 +285,21 @@ class GrantAdminService {
      *   4. audit as `role.permission_revoked` (`roleDeleted: true`), commit, publish the versions.
      * Returns the bumped tenants.
      *
-     * The CALLER (`RoleService.deleteRole`) holds the role row lock on its own engine connection and
-     * has already run the binding rule and user-holder dominance; this method therefore does NOT
-     * lock the role row (that would wait on the caller). It commits BEFORE the caller deletes the
-     * role, so a failure in between leaves a role with no grants and no agents: fewer permissions,
-     * never live grants for a deleted role (fail closed).
+     * The CALLER (`RoleService.deleteRole`) holds the role row lock on its own engine connection,
+     * has already run the binding rule and user-holder dominance, and has already run the engine's
+     * delete (gate included, Phase 9 #5) on that still-open transaction; this method therefore does
+     * NOT lock the role row (that would wait on the caller) and reads only committed state. It
+     * commits BEFORE the caller does, so a failure in between leaves a role with no grants and no
+     * agents: fewer permissions, never live grants for a deleted role (fail closed).
      */
     async purgeRole(roleUuid, actor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
-            const accounts = (await conn.query(`SELECT sa_id, sa_tenant_id, sa_role_ids, sa_updated_at_ms
-           FROM \`${APP}\`.\`service_account\`
-          WHERE JSON_CONTAINS(sa_role_ids, JSON_QUOTE(?))
-          FOR UPDATE`, [roleUuid]));
+            const accounts = await this.lockAccountsHoldingRole(conn, roleUuid);
             if (this.ceiling && actor.isRoot !== true) {
-                await this.ceiling.assertMayStripRoleFromServiceAccounts(actor, roleUuid, accounts.map((a) => a.sa_tenant_id));
+                await this.ceiling.assertMayStripRoleFromServiceAccounts(actor, roleUuid, accounts.map((a) => a.sa_tenant_id), 'delete');
             }
             const keys = (await conn.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid])).map((r) => r.rp_perm_key);
             const bumped = await this.bumper.bumpForRole(roleUuid, conn);
@@ -325,6 +332,32 @@ class GrantAdminService {
             await conn.release();
         }
     }
+    /**
+     * The service accounts holding `roleUuid`, read with a row lock on the transaction `conn` (a
+     * concurrent edit of one of them waits until this transaction ends). Phase 9 #11: only those
+     * rows are locked, never the whole table (`lockServiceAccountsWhere`). An agent that gains the
+     * role after the candidate read is not seen; the outcome equals "this change, then that edit"
+     * (a role delete leaves that agent an inert uuid: the role and its grants are gone).
+     */
+    /**
+     * The role's uuid as stored (Phase 10 #1): `r_uuid` is `utf8mb4_unicode_ci`, so a route uuid in
+     * another letter case reaches the row, but `JSON_CONTAINS(sa_role_ids, …)` and the `sa_role_ids`
+     * rewrite are exact — an upper-cased uuid would find no holding agent (skipping their check) and
+     * write grants under a second spelling. Unknown → the input unchanged (later steps 404). A
+     * consistent read: `purgeRole` runs while the caller's delete of this row is uncommitted.
+     */
+    async storedRoleUuid(roleUuid) {
+        if (typeof roleUuid !== 'string' || roleUuid.length === 0)
+            return roleUuid;
+        const rows = (await this.pool.query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
+        return rows[0]?.r_uuid ?? roleUuid;
+    }
+    lockAccountsHoldingRole(conn, roleUuid) {
+        return (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_role_ids, sa_updated_at_ms', {
+            sql: 'JSON_CONTAINS(sa_role_ids, JSON_QUOTE(?))',
+            params: [roleUuid],
+        });
+    }
     // ── Access bundles ────────────────────────────────────────────────────────
     /** All active bundles + their resolved atomic keys, for the Access UI. */
     async listBundles() {
@@ -344,6 +377,7 @@ class GrantAdminService {
      * to; otherwise `GrantCeilingError` (403), checked before any write. Root bypasses.
      */
     async grantBundle(roleUuid, bundleKey, grantor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         const keys = await this.resolveBundleKeysOrThrow(bundleKey);
         // Binding rule + ADR-0029 ceiling: a non-root grantor must hold EVERY atomic key the bundle
         // expands to — checked before any write (no partial bundle escalation).
@@ -367,6 +401,7 @@ class GrantAdminService {
      * #1: the binding rule + "only revoke what you hold" apply (root bypasses).
      */
     async revokeBundle(roleUuid, bundleKey, actor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         const keys = await this.resolveBundleKeysOrThrow(bundleKey);
         await this.assertMayChangeGrants(roleUuid, [...keys], actor);
         await this.writeGrants('role.bundle_revoked', roleUuid, keys, actor, async (conn, key) => {

package/dist/features/authz/grant-ceiling.d.ts

@@ -107,10 +107,9 @@ export declare class GrantCeiling {
      * {@link assertDominates} the actor would need to change any one of them directly. Holders are
      * the users with a posting of the role in any membership and any window (potential authority).
      * The actor itself is skipped: giving up your own authority stays allowed (self-demotion).
-     * Service-account holders: a revoke is covered by the binding rule (`assertRoleAdministrable`:
-     * no binding outside the actor's subtree) plus "only revoke what you hold"; a role DELETE also
-     * strips the role from each account and checks {@link assertMayStripRoleFromServiceAccounts}.
-     * Root bypasses. Store outage → 503.
+     * Service-account holders are checked separately by {@link assertMayStripRoleFromServiceAccounts}
+     * (a role delete strips the role from each account; a revoke narrows what each account holds —
+     * Phase 9 #9). Root bypasses. Store outage → 503.
      *
      * Callers serialise against a concurrent posting by locking the role row first (the posting
      * path locks the same row before it inserts), then call this — so no holder appears unseen.
@@ -123,9 +122,10 @@ export declare class GrantCeiling {
      * {@link ceilingOf}): each account's tenant is inside the actor's subtree, and the role is one
      * the actor holds itself — a non-root admin's edit preserves (cannot strip) a role it does not
      * hold. `accountTenantIds` are the holding accounts' tenants, read by the caller under a row lock.
-     * Root bypasses. Refusals name no account. Store outage → 503.
+     * Phase 9 #9: a grant revoke (`operation: 'revoke'`) narrows every holding account the same way
+     * and is judged by the same rule. Root bypasses. Refusals name no account. Store outage → 503.
      */
-    assertMayStripRoleFromServiceAccounts(actor: Principal, roleUuid: string, accountTenantIds: readonly string[]): Promise<void>;
+    assertMayStripRoleFromServiceAccounts(actor: Principal, roleUuid: string, accountTenantIds: readonly string[], operation?: 'delete' | 'revoke'): Promise<void>;
     /**
      * Assert the actor may RETIRE (disable + revoke the keys of) each of these service accounts
      * (Phase 8 #3: a company delete retires the deleted company's own agents). Judged by the SAME
@@ -140,6 +140,19 @@ export declare class GrantCeiling {
         readonly scopeSubtreeNodeIds: readonly string[];
         readonly roleIds: readonly string[];
     }>): Promise<void>;
+    /**
+     * Assert every department and branch a posting names belongs to the membership's company
+     * (Phase 9 #13b, review F4): a `company_departments` / `company_branches` junction row links it
+     * to `companyUuid`. Otherwise a posting could carry another tenant's department or branch.
+     * Applies to every actor, root included (it is the data's shape, not a privilege). A missing
+     * company (`null`) admits none. A foreign and a nonexistent unit give the same 400. Read through
+     * the shared authz pool, not the engine: the posting admin need not hold `company_department` /
+     * `company_branch` read. Store outage → 503.
+     */
+    assertOrgUnitsInCompany(companyUuid: string | null, units: {
+        readonly departmentUuids: readonly string[];
+        readonly branchUuids: readonly string[];
+    }): Promise<void>;
     /** Where `roleUuid` is bound relative to the actor's subtree (postings + service accounts). */
     roleBinding(actor: Principal, roleUuid: string): Promise<RoleBinding>;
     /**

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWtE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwD5E;;;;;;;;;;;;;OAaG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;OAQG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,GAClC,OAAO,CAAC,IAAI,CAAC;IAoBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAetE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwD5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}

package/dist/features/authz/grant-ceiling.js

@@ -4,6 +4,7 @@ exports.GrantCeiling = exports.GrantCeilingError = void 0;
 exports.subtreeOf = subtreeOf;
 exports.coversKey = coversKey;
 const core_1 = require("@astram/core");
+const http_js_1 = require("../shared/http.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const role_binding_js_1 = require("./role-binding.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
@@ -192,7 +193,7 @@ class GrantCeiling {
     async assertDominates(actor, targetUserId) {
         if (actor.isRoot === true)
             return;
-        if (this.rootIds.includes(targetUserId)) {
+        if (this.rootIds.some((r) => (0, http_js_1.sameUuid)(r, targetUserId))) {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot change this user: they are a platform administrator.');
         }
         const subtree = new Set(subtreeOf(actor));
@@ -236,10 +237,9 @@ class GrantCeiling {
      * {@link assertDominates} the actor would need to change any one of them directly. Holders are
      * the users with a posting of the role in any membership and any window (potential authority).
      * The actor itself is skipped: giving up your own authority stays allowed (self-demotion).
-     * Service-account holders: a revoke is covered by the binding rule (`assertRoleAdministrable`:
-     * no binding outside the actor's subtree) plus "only revoke what you hold"; a role DELETE also
-     * strips the role from each account and checks {@link assertMayStripRoleFromServiceAccounts}.
-     * Root bypasses. Store outage → 503.
+     * Service-account holders are checked separately by {@link assertMayStripRoleFromServiceAccounts}
+     * (a role delete strips the role from each account; a revoke narrows what each account holds —
+     * Phase 9 #9). Root bypasses. Store outage → 503.
      *
      * Callers serialise against a concurrent posting by locking the role row first (the posting
      * path locks the same row before it inserts), then call this — so no holder appears unseen.
@@ -276,9 +276,10 @@ class GrantCeiling {
      * {@link ceilingOf}): each account's tenant is inside the actor's subtree, and the role is one
      * the actor holds itself — a non-root admin's edit preserves (cannot strip) a role it does not
      * hold. `accountTenantIds` are the holding accounts' tenants, read by the caller under a row lock.
-     * Root bypasses. Refusals name no account. Store outage → 503.
+     * Phase 9 #9: a grant revoke (`operation: 'revoke'`) narrows every holding account the same way
+     * and is judged by the same rule. Root bypasses. Refusals name no account. Store outage → 503.
      */
-    async assertMayStripRoleFromServiceAccounts(actor, roleUuid, accountTenantIds) {
+    async assertMayStripRoleFromServiceAccounts(actor, roleUuid, accountTenantIds, operation = 'delete') {
         if (actor.isRoot === true || accountTenantIds.length === 0)
             return;
         const admin = {
@@ -287,7 +288,9 @@ class GrantCeiling {
             scopeSubtreeNodeIds: subtreeOf(actor),
             isRoot: false,
         };
-        const refuse = () => new identity_errors_js_1.IdentityForbiddenError('You cannot delete this role: it is assigned to an agent you cannot change.');
+        const refuse = () => new identity_errors_js_1.IdentityForbiddenError(operation === 'revoke'
+            ? 'You cannot change this role: it is assigned to an agent you cannot change.'
+            : 'You cannot delete this role: it is assigned to an agent you cannot change.');
         const nodes = (0, service_account_service_js_1.ceilingOf)(admin, []);
         if (accountTenantIds.some((t) => !(0, service_account_service_js_1.ceilingAllowsNode)(nodes, t)))
             throw refuse();
@@ -327,6 +330,31 @@ class GrantCeiling {
             throw refuse();
         }
     }
+    /**
+     * Assert every department and branch a posting names belongs to the membership's company
+     * (Phase 9 #13b, review F4): a `company_departments` / `company_branches` junction row links it
+     * to `companyUuid`. Otherwise a posting could carry another tenant's department or branch.
+     * Applies to every actor, root included (it is the data's shape, not a privilege). A missing
+     * company (`null`) admits none. A foreign and a nonexistent unit give the same 400. Read through
+     * the shared authz pool, not the engine: the posting admin need not hold `company_department` /
+     * `company_branch` read. Store outage → 503.
+     */
+    async assertOrgUnitsInCompany(companyUuid, units) {
+        const check = async (ids, table, companyCol, unitCol, message) => {
+            const wanted = [...new Set(ids)];
+            if (wanted.length === 0)
+                return;
+            if (companyUuid === null)
+                throw new identity_errors_js_1.IdentityBadRequestError(message);
+            const rows = await this.facts('company org units', async () => (await this.pool.query(`SELECT ${unitCol} AS unit FROM \`${APP}\`.\`${table}\`
+            WHERE ${companyCol} = ? AND ${unitCol} IN (${wanted.map(() => '?').join(', ')})`, [companyUuid, ...wanted])));
+            const linked = new Set(rows.map((r) => r.unit));
+            if (wanted.some((u) => !linked.has(u)))
+                throw new identity_errors_js_1.IdentityBadRequestError(message);
+        };
+        await check(units.departmentUuids, 'company_departments', 'cd_company_uuid', 'cd_department_uuid', 'The department is not one of this company’s departments.');
+        await check(units.branchUuids, 'company_branches', 'cb_company_uuid', 'cb_branch_uuid', 'The branch is not one of this company’s branches.');
+    }
     /** Where `roleUuid` is bound relative to the actor's subtree (postings + service accounts). */
     async roleBinding(actor, roleUuid) {
         return this.facts('role binding', () => (0, role_binding_js_1.readRoleBinding)(this.pool, roleUuid, subtreeOf(actor)));

package/dist/features/authz/record-authorization.d.ts

@@ -1,52 +1,35 @@
 /**
- * Assemble the record-tier authorization wiring for `@astram/identity`: the lean grant-read
- * pool factory + the `recordAuthorization` inputs the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` becomes REAL (the
- * framework's four record-tier adapters are built internally over the supplied pool) instead
- * of the deny-everything stub.
+ * The record-tier authorization inputs for `@astram/identity`: the lean grant-read pool factory and
+ * the `RecordAuthorizationInputs` builder. `IdentityFeatureModule.forRoot({ extraObjects })` builds
+ * the inputs ONCE and uses them everywhere (security hardening Phase 9 #7):
+ *   - provided app-wide under guard's `SHIELD_RECORD_AUTHORIZATION`, so `ShieldModule` builds the
+ *     request path's decision authority from them (the framework's four record-tier adapters are
+ *     built inside guard);
+ *   - the module's own cross-tenant / policy authority, list scope and grant ceiling.
+ * One registry, one source of `extraObjects`: nothing can disagree.
  *
  * Modeled on astram3's `buildAuthorizationInputs` (`server/src/features/authz/authz.wiring.ts`),
- * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix
- * (`APP_DB_*`, per the Task-7 rename).
+ * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix (`APP_DB_*`).
  */
 import { type Pool } from 'mariadb';
 import { type RecordAuthorizationInputs } from '@astram/guard';
 import type { ObjectTypeInput } from '@astram/engine';
-import type { ModuleRegistry } from '@astram/core';
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
- * Opens the pool at CALL time (never at import) — the consumer (app lifecycle) owns closing it.
+ * Opens the pool at CALL time (never at import) — the caller owns closing it.
  */
 export declare function createIdentityAuthzPool(): Pool;
 /**
- * Build the `RecordAuthorizationInputs` the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. The framework owns the four record-tier
- * adapters internally; `@astram/identity` supplies only the app-schema ports:
+ * Build the `RecordAuthorizationInputs` over `pool`. `@astram/identity` supplies only the
+ * app-schema ports:
  *   - `permissionFacts` — coarse grants over `shield_authz.role_permission` +
  *     `company_membership`/`membership_posting`,
  *   - `sessionFacts` — the ADR-0011 ALS-backed per-request reader,
- *   - `registry` — bridged from `identityObjects` PLUS any consumer-supplied `extraObjects`,
+ *   - `registry` — bridged from `identityObjects` PLUS the consumer's `extraObjects` (their
+ *     `<module>:<type>:<action>` keys project into a principal's grants at gate 5; without them a
+ *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
- *
- * `extraObjects` (optional): a CONSUMER app that registers its OWN gated object types via
- * `EngineModule.forFeature([...])` must ALSO pass those types here, so their actions enter the
- * coarse-grant permission-facts registry (gate 5). Without this, a custom type's routes boot
- * and list-scope correctly (gate 6) but their `<module>:<type>:<action>` permission keys are
- * never projected into a principal's grants — so gate 5 denies them (deny-by-default). Passing
- * the same object types the app registered with the engine closes that gap: the app's grants on
- * those keys now project, and the framework still owns the four record-tier adapters + scope fn.
- */
-export declare function buildIdentityRecordAuthorization(pool: Pool, extraObjects?: readonly ObjectTypeInput[]): RecordAuthorizationInputs;
-/**
- * The inputs builder WITHOUT the boot parity record — for the identity module's own internal
- * authorities (they are not the decision path the consumer hands `ShieldModule`).
  */
 export declare function buildRecordAuthorizationInputs(pool: Pool, extraObjects?: readonly ObjectTypeInput[]): RecordAuthorizationInputs;
-/** The boot error: the two registries' action-key sets differ (names the first differing keys). */
-export declare class IdentityRegistryMismatchError extends Error {
-    constructor(onlyDecision: readonly string[], onlyCeiling: readonly string[]);
-}
-/** Called by `IdentityFeatureModule.forRoot` with the grant ceiling's registry (Phase 8 #4). */
-export declare function noteIdentityCeilingRegistry(registry: ModuleRegistry): void;
 //# sourceMappingURL=record-authorization.d.ts.map

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKnD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAI3B;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAS3B;AAmBD,mGAAmG;AACnG,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE;CAW5E;AAoBD,gGAAgG;AAChG,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE1E"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAS3B"}

package/dist/features/authz/record-authorization.js

@@ -3,21 +3,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdentityRegistryMismatchError = void 0;
 exports.createIdentityAuthzPool = createIdentityAuthzPool;
-exports.buildIdentityRecordAuthorization = buildIdentityRecordAuthorization;
 exports.buildRecordAuthorizationInputs = buildRecordAuthorizationInputs;
-exports.noteIdentityCeilingRegistry = noteIdentityCeilingRegistry;
 /**
- * Assemble the record-tier authorization wiring for `@astram/identity`: the lean grant-read
- * pool factory + the `recordAuthorization` inputs the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` becomes REAL (the
- * framework's four record-tier adapters are built internally over the supplied pool) instead
- * of the deny-everything stub.
+ * The record-tier authorization inputs for `@astram/identity`: the lean grant-read pool factory and
+ * the `RecordAuthorizationInputs` builder. `IdentityFeatureModule.forRoot({ extraObjects })` builds
+ * the inputs ONCE and uses them everywhere (security hardening Phase 9 #7):
+ *   - provided app-wide under guard's `SHIELD_RECORD_AUTHORIZATION`, so `ShieldModule` builds the
+ *     request path's decision authority from them (the framework's four record-tier adapters are
+ *     built inside guard);
+ *   - the module's own cross-tenant / policy authority, list scope and grant ceiling.
+ * One registry, one source of `extraObjects`: nothing can disagree.
  *
  * Modeled on astram3's `buildAuthorizationInputs` (`server/src/features/authz/authz.wiring.ts`),
- * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix
- * (`APP_DB_*`, per the Task-7 rename).
+ * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix (`APP_DB_*`).
  */
 const mariadb_1 = __importDefault(require("mariadb"));
 const guard_1 = require("@astram/guard");
@@ -27,7 +26,7 @@ const session_facts_reader_js_1 = require("./session-facts.reader.js");
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
- * Opens the pool at CALL time (never at import) — the consumer (app lifecycle) owns closing it.
+ * Opens the pool at CALL time (never at import) — the caller owns closing it.
  */
 function createIdentityAuthzPool() {
     const db = (0, guard_1.loadDbConfig)();
@@ -41,31 +40,15 @@ function createIdentityAuthzPool() {
     });
 }
 /**
- * Build the `RecordAuthorizationInputs` the consumer passes to
- * `ShieldModule.forRoot({ recordAuthorization })`. The framework owns the four record-tier
- * adapters internally; `@astram/identity` supplies only the app-schema ports:
+ * Build the `RecordAuthorizationInputs` over `pool`. `@astram/identity` supplies only the
+ * app-schema ports:
  *   - `permissionFacts` — coarse grants over `shield_authz.role_permission` +
  *     `company_membership`/`membership_posting`,
  *   - `sessionFacts` — the ADR-0011 ALS-backed per-request reader,
- *   - `registry` — bridged from `identityObjects` PLUS any consumer-supplied `extraObjects`,
+ *   - `registry` — bridged from `identityObjects` PLUS the consumer's `extraObjects` (their
+ *     `<module>:<type>:<action>` keys project into a principal's grants at gate 5; without them a
+ *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
- *
- * `extraObjects` (optional): a CONSUMER app that registers its OWN gated object types via
- * `EngineModule.forFeature([...])` must ALSO pass those types here, so their actions enter the
- * coarse-grant permission-facts registry (gate 5). Without this, a custom type's routes boot
- * and list-scope correctly (gate 6) but their `<module>:<type>:<action>` permission keys are
- * never projected into a principal's grants — so gate 5 denies them (deny-by-default). Passing
- * the same object types the app registered with the engine closes that gap: the app's grants on
- * those keys now project, and the framework still owns the four record-tier adapters + scope fn.
- */
-function buildIdentityRecordAuthorization(pool, extraObjects = []) {
-    const inputs = buildRecordAuthorizationInputs(pool, extraObjects);
-    noteRegistry('decision', inputs.registry);
-    return inputs;
-}
-/**
- * The inputs builder WITHOUT the boot parity record — for the identity module's own internal
- * authorities (they are not the decision path the consumer hands `ShieldModule`).
  */
 function buildRecordAuthorizationInputs(pool, extraObjects = []) {
     const registry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
@@ -77,40 +60,3 @@ function buildRecordAuthorizationInputs(pool, extraObjects = []) {
         operationManifest: [],
     };
 }
-const recordedKeySets = {
-    decision: new Map(),
-    ceiling: new Map(),
-};
-/** The boot error: the two registries' action-key sets differ (names the first differing keys). */
-class IdentityRegistryMismatchError extends Error {
-    constructor(onlyDecision, onlyCeiling) {
-        const sample = (keys) => keys.length === 0 ? 'none' : keys.slice(0, 10).join(', ') + (keys.length > 10 ? ', …' : '');
-        super('IdentityFeatureModule.forRoot({ extraObjects }) and buildIdentityRecordAuthorization(pool, ' +
-            'extraObjects) were given different object types. Pass the SAME array to both. ' +
-            `Only in the decision path: ${sample(onlyDecision)}. ` +
-            `Only in IdentityFeatureModule: ${sample(onlyCeiling)}.`);
-        this.name = 'IdentityRegistryMismatchError';
-    }
-}
-exports.IdentityRegistryMismatchError = IdentityRegistryMismatchError;
-/** Record one side's registry and throw if it disagrees with any recorded registry of the other. */
-function noteRegistry(role, registry) {
-    const keys = [...new Set(registry.listActions().map((a) => a.permissionKey))].sort();
-    const other = recordedKeySets[role === 'decision' ? 'ceiling' : 'decision'];
-    for (const otherKeys of other.values()) {
-        const mine = new Set(keys);
-        const theirs = new Set(otherKeys);
-        const onlyMine = keys.filter((k) => !theirs.has(k));
-        const onlyTheirs = otherKeys.filter((k) => !mine.has(k));
-        if (onlyMine.length > 0 || onlyTheirs.length > 0) {
-            throw role === 'decision'
-                ? new IdentityRegistryMismatchError(onlyMine, onlyTheirs)
-                : new IdentityRegistryMismatchError(onlyTheirs, onlyMine);
-        }
-    }
-    recordedKeySets[role].set(keys.join('\n'), keys);
-}
-/** Called by `IdentityFeatureModule.forRoot` with the grant ceiling's registry (Phase 8 #4). */
-function noteIdentityCeilingRegistry(registry) {
-    noteRegistry('ceiling', registry);
-}

package/dist/features/company/company-hierarchy.service.d.ts

@@ -37,6 +37,11 @@ export interface MemberDominance {
         readonly roleIds: readonly string[];
     }>): Promise<void>;
 }
+/**
+ * The actor's own root node (the active node its subtree hangs from). A non-root actor may not
+ * move, delete (F6) or change the status of (Phase 9 #13c) this node.
+ */
+export declare function ownRootOf(actor: Principal): string;
 export declare class CompanyHierarchyService {
     private readonly pool;
     private readonly closure;
@@ -47,8 +52,15 @@ export declare class CompanyHierarchyService {
     constructor(pool: HierarchyQueryable, closure: ScopeClosureService, 
     /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
     ceiling: MemberDominance, audit?: AuditPort | undefined, now?: () => number);
-    /** The actor's own root node (the active node its subtree hangs from). */
+    /** The actor's own root node (see {@link ownRootOf}). */
     private ownRoot;
+    /**
+     * The company's uuid as stored (Phase 10 #1): `c_uuid` is `utf8mb4_unicode_ci`, so a route uuid
+     * in another letter case still reaches the row, while JS-side comparisons (own root, agent
+     * tenants, `JSON_CONTAINS` over scope lists, name maps) are exact. Every entry resolves the
+     * stored spelling once and passes that down. Unknown → the input unchanged (later steps 404).
+     */
+    private storedUuid;
     /** Names of the given companies (unknown → absent). */
     private names;
     private recordAudit;

package/dist/features/company/company-hierarchy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAUxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAuCD,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBALH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,0EAA0E;IAC1E,OAAO,CAAC,OAAO;IAIf,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IA6E9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IA+BpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAWxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAuCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBALH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAiF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IA+BpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}