@astram/identity 0.6.0 → 0.7.1

package/dist/features/company/company-hierarchy.service.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CompanyHierarchyService = void 0;
+exports.ownRootOf = ownRootOf;
+const http_js_1 = require("../shared/http.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const APP = 'shield_app';
 const AUTHZ = 'shield_authz';
@@ -18,6 +21,13 @@ function jsonIdArray(v) {
     }
     return Array.isArray(arr) ? arr.filter((x) => typeof x === 'string') : [];
 }
+/**
+ * The actor's own root node (the active node its subtree hangs from). A non-root actor may not
+ * move, delete (F6) or change the status of (Phase 9 #13c) this node.
+ */
+function ownRootOf(actor) {
+    return actor.activeScopeNodeId ?? actor.tenantId;
+}
 class CompanyHierarchyService {
     pool;
     closure;
@@ -33,9 +43,19 @@ class CompanyHierarchyService {
         this.audit = audit;
         this.now = now;
     }
-    /** The actor's own root node (the active node its subtree hangs from). */
+    /** The actor's own root node (see {@link ownRootOf}). */
     ownRoot(actor) {
-        return actor.activeScopeNodeId ?? actor.tenantId;
+        return ownRootOf(actor);
+    }
+    /**
+     * The company's uuid as stored (Phase 10 #1): `c_uuid` is `utf8mb4_unicode_ci`, so a route uuid
+     * in another letter case still reaches the row, while JS-side comparisons (own root, agent
+     * tenants, `JSON_CONTAINS` over scope lists, name maps) are exact. Every entry resolves the
+     * stored spelling once and passes that down. Unknown → the input unchanged (later steps 404).
+     */
+    async storedUuid(uuid) {
+        const rows = (await this.pool.query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [uuid]));
+        return rows[0]?.c_uuid ?? uuid;
     }
     /** Names of the given companies (unknown → absent). */
     async names(q, ids) {
@@ -66,11 +86,14 @@ class CompanyHierarchyService {
             (typeof newParentUuid !== 'string' || newParentUuid.length === 0)) {
             throw new identity_errors_js_1.IdentityBadRequestError('parentUuid must be a company or null.');
         }
+        nodeUuid = await this.storedUuid(nodeUuid);
+        if (newParentUuid !== null)
+            newParentUuid = await this.storedUuid(newParentUuid);
         if (actor.isRoot !== true) {
             const subtree = new Set((0, grant_ceiling_js_1.subtreeOf)(actor));
             if (!subtree.has(nodeUuid))
                 throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
-            if (nodeUuid === this.ownRoot(actor)) {
+            if ((0, http_js_1.sameUuid)(nodeUuid, this.ownRoot(actor))) {
                 throw new identity_errors_js_1.IdentityForbiddenError('You cannot move the organisation your access is rooted at.');
             }
             if (newParentUuid === null || !subtree.has(newParentUuid)) {
@@ -116,9 +139,10 @@ class CompanyHierarchyService {
      * depending on it as they were; a commit leaves a deleted company with no live agent or grant.
      */
     async remove(actor, nodeUuid) {
+        nodeUuid = await this.storedUuid(nodeUuid); // Phase 10 #1: one spelling downstream
         // Security review F6: the same own-root guard as `move` — a sub-admin never deletes the
         // organisation its access is rooted at.
-        if (actor.isRoot !== true && nodeUuid === this.ownRoot(actor)) {
+        if (actor.isRoot !== true && (0, http_js_1.sameUuid)(nodeUuid, this.ownRoot(actor))) {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot delete the organisation your access is rooted at.');
         }
         const name = (await this.names(this.pool, [nodeUuid])).get(nodeUuid) ?? '(unknown)';
@@ -152,11 +176,14 @@ class CompanyHierarchyService {
      * Every change is audited on this transaction (names; ids only in structured attributes).
      */
     async retireDependents(conn, actor, nodeUuid, companyName) {
-        const agents = (await conn.query(`SELECT sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_updated_at_ms
-         FROM \`${APP}\`.\`service_account\`
-        WHERE sa_tenant_id = ? OR JSON_CONTAINS(sa_scope_subtree, JSON_QUOTE(?))
-        ORDER BY sa_id
-        FOR UPDATE`, [nodeUuid, nodeUuid]));
+        // Phase 9 #11: lock only the matching agents, never the whole table. An agent created in the
+        // company, or given it in scope, after the candidate read is not seen: the outcome equals
+        // "delete, then that edit" (the API-key path joins `companies`, so an agent of a deleted
+        // tenant cannot authenticate; a deleted node in a scope reaches nothing).
+        const agents = await (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_updated_at_ms', {
+            sql: 'sa_tenant_id = ? OR JSON_CONTAINS(sa_scope_subtree, JSON_QUOTE(?))',
+            params: [nodeUuid, nodeUuid],
+        });
         const own = agents.filter((a) => a.sa_tenant_id === nodeUuid);
         const others = agents.filter((a) => a.sa_tenant_id !== nodeUuid);
         // Root bypasses inside; a refusal (403, names no agent) rolls the whole delete back.

package/dist/features/company/company.controller.d.ts

@@ -41,7 +41,7 @@ export declare class CompanyController {
      * Update a company's name/status — gated on `identity:company:update`. Any other key
      * (parentUuid, type, …) is ignored: use `PUT companies/:uuid/parent` to move a company.
      */
-    updateCompany(uuid: string, body: {
+    updateCompany(req: AuthedRequest, uuid: string, body: {
         name?: string;
         status?: string;
     }): Promise<{

package/dist/features/company/company.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAa9C;;;OAGG;IAGG,aAAa,CACF,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAI3E"}
+{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAa9C;;;OAGG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IASlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAI3E"}

package/dist/features/company/company.controller.js

@@ -64,8 +64,11 @@ let CompanyController = class CompanyController {
      * Update a company's name/status — gated on `identity:company:update`. Any other key
      * (parentUuid, type, …) is ignored: use `PUT companies/:uuid/parent` to move a company.
      */
-    async updateCompany(uuid, body) {
-        await this.companies.updateCompany(uuid, { name: body?.name, status: body?.status });
+    async updateCompany(req, uuid, body) {
+        await this.companies.updateCompany(req.principal, uuid, {
+            name: body?.name,
+            status: body?.status,
+        });
         return { success: true };
     }
     /** Delete a company — gated on `identity:company:delete`. A company with sub-companies → 409. */
@@ -113,10 +116,11 @@ __decorate([
 __decorate([
     (0, common_1.Put)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
-    __param(0, (0, common_1.Param)('uuid')),
-    __param(1, (0, common_1.Body)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
+    __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [Object, String, Object]),
     __metadata("design:returntype", Promise)
 ], CompanyController.prototype, "updateCompany", null);
 __decorate([

package/dist/features/company/company.service.d.ts

@@ -26,8 +26,15 @@ export declare class CompanyService {
     listCompanies(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
     /** Read a single company. */
     getCompany(uuid: string): Promise<import("@astram/engine").RecordView | null>;
-    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
-    updateCompany(uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
+    /**
+     * Update a company's name/status. Any other key (parentUuid, type, …) is dropped.
+     *
+     * Phase 9 #13c: a non-root actor may not change the STATUS of the organisation its access is
+     * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
+     * whole tenant above the actor's authority. Re-sending the current status (the company form
+     * always sends both fields) stays allowed, so the own root can still be renamed.
+     */
+    updateCompany(actor: Principal, uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
     moveCompany(actor: Principal, uuid: string, parentUuid: string | null): Promise<void>;
     /**

package/dist/features/company/company.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AASzE;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB,sFAAsF;IACtF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpF,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}
+{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAa,MAAM,gCAAgC,CAAC;AAUpF;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC;IAiBhB,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}

package/dist/features/company/company.service.js

@@ -15,6 +15,7 @@ const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const list_query_js_1 = require("../shared/list-query.js");
 const company_hierarchy_service_js_1 = require("./company-hierarchy.service.js");
+const http_js_1 = require("../shared/http.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const COMPANY_SEARCH_FIELDS = ['name'];
 const COMPANY_SORT_FIELDS = ['name', 'status', 'createdAt'];
@@ -66,13 +67,28 @@ let CompanyService = CompanyService_1 = class CompanyService {
     getCompany(uuid) {
         return this.records.get('company', uuid);
     }
-    /** Update a company's name/status. Any other key (parentUuid, type, …) is dropped. */
-    updateCompany(uuid, patch) {
+    /**
+     * Update a company's name/status. Any other key (parentUuid, type, …) is dropped.
+     *
+     * Phase 9 #13c: a non-root actor may not change the STATUS of the organisation its access is
+     * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
+     * whole tenant above the actor's authority. Re-sending the current status (the company form
+     * always sends both fields) stays allowed, so the own root can still be renamed.
+     */
+    async updateCompany(actor, uuid, patch) {
         const fields = {};
         for (const key of COMPANY_PATCH_KEYS) {
             if (typeof patch?.[key] === 'string')
                 fields[key] = patch[key];
         }
+        if (actor.isRoot !== true && fields.status !== undefined && (0, http_js_1.sameUuid)(uuid, (0, company_hierarchy_service_js_1.ownRootOf)(actor))) {
+            const current = await this.records.get('company', uuid);
+            if (current === null)
+                throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
+            if (current.fields.status !== fields.status) {
+                throw new identity_errors_js_1.IdentityForbiddenError('You cannot change the status of the organisation your access is rooted at.');
+            }
+        }
         return this.records.update('company', uuid, { fields });
     }
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */

package/dist/features/identity-feature.module.d.ts

@@ -1,5 +1,13 @@
 import { type DynamicModule } from '@nestjs/common';
 import { type ObjectTypeInput } from '@astram/engine';
+/**
+ * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
+ * request path must decide with the authority guard built from this module's inputs. A missing
+ * authority (no `ShieldModule`) or the deny-everything stub (a guard that does not read
+ * `SHIELD_RECORD_AUTHORIZATION`) fails the boot instead of silently denying, or deciding with a
+ * different registry. (Another source next to this one is refused by `ShieldModule` itself.)
+ */
+export declare function assertRequestPathUsesIdentityAuthorization(authority: unknown): true;
 /**
  * IdentityFeatureModule — the framework-owned identity FEATURE surface (company/user/role CRUD;
  * more in later phases) as thin controllers over the engine's RecordsService. The CONSUMER imports
@@ -19,14 +27,13 @@ export declare class IdentityFeatureModule {
      *   by the writer's own `decide()` (a route-allows/writer-denies split). Omitted ⇒
      *   `isRoot` is always false (a non-root consumer works; only a root offering
      *   cross-tenant grants needs it). See ADR-0026 + the template wiring.
-     * @param extraObjects the consumer's OWN registered object types — pass the SAME array
-     *   given to `buildIdentityRecordAuthorization(pool, extraObjects)`. Without them, the
-     *   guided rule-builder SCHEMA (Phase 5) and the OWNER-SHARE resolver (Phase 6) only know
-     *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
-     *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
-     *   Passing them here lets an owner share their own records + author policies over them.
-     *   Phase 8 #4: if the action keys of these objects differ from the ones given to
-     *   `buildIdentityRecordAuthorization`, the boot fails with `IdentityRegistryMismatchError`.
+     * @param extraObjects the consumer's OWN registered object types (the ones it registers with
+     *   `EngineModule.forFeature`). The ONE place they are given (Phase 9 #7): the module builds
+     *   the record authorization from `[...identityObjects, ...extraObjects]` and provides it to
+     *   `ShieldModule` (request path, gate-5 key projection), and uses the same registry for its
+     *   cross-tenant / policy authority, grant ceiling, guided rule-builder schema and owner-share
+     *   resolver. Without them a consumer type is unregistered everywhere (denied), not policy-
+     *   authorable and not shareable ("type '…' is not registered — cannot share").
      */
     static forRoot({ rootIds, extraObjects, }?: {
         rootIds?: readonly string[];

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA8FxB;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CA8cvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA6FxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAiBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CA8dvB"}

package/dist/features/identity-feature.module.js

@@ -8,6 +8,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var IdentityFeatureModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdentityFeatureModule = void 0;
+exports.assertRequestPathUsesIdentityAuthorization = assertRequestPathUsesIdentityAuthorization;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const engine_1 = require("@astram/engine");
@@ -58,6 +59,35 @@ const grant_authorize_js_1 = require("./cross-tenant/grant-authorize.js");
 const IDENTITY_VERSION_PUBLISHER_LINK = Symbol('IDENTITY_VERSION_PUBLISHER_LINK');
 /** DI token of the boot check that warns when a user disable cannot revoke sessions. */
 const IDENTITY_SESSION_REVOCATION_CHECK = Symbol('IDENTITY_SESSION_REVOCATION_CHECK');
+/** DI token of the boot check that the request path decides with this module's authorization. */
+const IDENTITY_DECISION_AUTHORITY_CHECK = Symbol('IDENTITY_DECISION_AUTHORITY_CHECK');
+/**
+ * Holds the record-authorization inputs `IdentityFeatureModule.forRoot` builds, provided GLOBALLY
+ * under guard's `SHIELD_RECORD_AUTHORIZATION` so `ShieldModule` (a sibling, which never imports
+ * identity) builds the request-path decision authority from them (Phase 9 #7). Only this token is
+ * global; the feature module's own providers stay module-scoped.
+ */
+let IdentityRecordAuthorizationModule = class IdentityRecordAuthorizationModule {
+};
+IdentityRecordAuthorizationModule = __decorate([
+    (0, common_1.Module)({})
+], IdentityRecordAuthorizationModule);
+/**
+ * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
+ * request path must decide with the authority guard built from this module's inputs. A missing
+ * authority (no `ShieldModule`) or the deny-everything stub (a guard that does not read
+ * `SHIELD_RECORD_AUTHORIZATION`) fails the boot instead of silently denying, or deciding with a
+ * different registry. (Another source next to this one is refused by `ShieldModule` itself.)
+ */
+function assertRequestPathUsesIdentityAuthorization(authority) {
+    if (authority === undefined || authority === null || authority === guard_1.stubDecisionAuthority) {
+        throw new Error('IdentityFeatureModule: the request path has no decision authority built from the identity ' +
+            'record authorization. Import ShieldModule.forRoot(...) from @astram/guard >= 0.10 ' +
+            'without `recordAuthorization`/`decisionAuthority`: it builds the authority from the ' +
+            'inputs IdentityFeatureModule provides (SHIELD_RECORD_AUTHORIZATION).');
+    }
+    return true;
+}
 /** Map guard's env DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). */
 function engineDbFromEnv() {
     const db = (0, guard_1.loadDbConfig)();
@@ -91,29 +121,28 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   by the writer's own `decide()` (a route-allows/writer-denies split). Omitted ⇒
      *   `isRoot` is always false (a non-root consumer works; only a root offering
      *   cross-tenant grants needs it). See ADR-0026 + the template wiring.
-     * @param extraObjects the consumer's OWN registered object types — pass the SAME array
-     *   given to `buildIdentityRecordAuthorization(pool, extraObjects)`. Without them, the
-     *   guided rule-builder SCHEMA (Phase 5) and the OWNER-SHARE resolver (Phase 6) only know
-     *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
-     *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
-     *   Passing them here lets an owner share their own records + author policies over them.
-     *   Phase 8 #4: if the action keys of these objects differ from the ones given to
-     *   `buildIdentityRecordAuthorization`, the boot fails with `IdentityRegistryMismatchError`.
+     * @param extraObjects the consumer's OWN registered object types (the ones it registers with
+     *   `EngineModule.forFeature`). The ONE place they are given (Phase 9 #7): the module builds
+     *   the record authorization from `[...identityObjects, ...extraObjects]` and provides it to
+     *   `ShieldModule` (request path, gate-5 key projection), and uses the same registry for its
+     *   cross-tenant / policy authority, grant ceiling, guided rule-builder schema and owner-share
+     *   resolver. Without them a consumer type is unregistered everywhere (denied), not policy-
+     *   authorable and not shareable ("type '…' is not registered — cannot share").
      */
     static forRoot({ rootIds, extraObjects = [], } = {}) {
-        // The ceiling's key universe includes the consumer's `extraObjects` (the SAME registry shape
-        // `buildIdentityRecordAuthorization(pool, extraObjects)` gives the decision path): otherwise a
-        // role holding a consumer-type key could never be assigned or granted by a non-root admin who
-        // holds that key (review M5) — the security-hardening role-assignment ceiling makes that
-        // reachable from every posting edit. Phase 8 #4: the two registries must have the SAME action
-        // keys — checked here, before anything is opened; a mismatch fails the boot.
-        const ceilingRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
-        (0, record_authorization_js_1.noteIdentityCeilingRegistry)(ceilingRegistry);
         // ONE shared shield_authz pool for the whole grant-admin stack (ADR-0011): the
         // permission-version bumper, the AccessBundleStore, the GrantAdminService, and the two
         // reconcile jobs all run over this single pool (don't open several). Opened once at
-        // forRoot() (not import time) — mirrors the pre-existing bump-pool pattern.
+        // forRoot() (not import time) — mirrors the pre-existing bump-pool pattern. Since Phase 9 #7
+        // it also backs the request path's decision authority (provided to ShieldModule below).
         const authzPool = (0, record_authorization_js_1.createIdentityAuthzPool)();
+        // The ONE record authorization (Phase 9 #7, closes KI #55/#57): built here from this module's
+        // own `extraObjects`, provided to ShieldModule under SHIELD_RECORD_AUTHORIZATION, and reused for
+        // every internal authority below. Its registry is the ONE key universe: the grant ceiling sees
+        // every key the request path grants (review M5 / Phase 8 #4), and a consumer type is
+        // registered for the cross-tenant writer and the policy author too.
+        const recordAuthorization = (0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool, extraObjects);
+        const ceilingRegistry = recordAuthorization.registry;
         const bumper = new permission_version_bumper_js_1.PermissionVersionBumper();
         const postingVersionBump = {
             bumpTenant: (tenantUuid) => bumper.bumpForTenant(tenantUuid, authzPool),
@@ -123,8 +152,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             tenantsForRole: (roleUuid) => bumper.tenantsForRole(roleUuid, authzPool),
         };
         // The core ModuleRegistry the catalog reconcile job needs, built from the identity
-        // object registrations (guard's bridge reflects decorated classes → registry). Built BEFORE
-        // the grant-admin service so the GrantCeiling (ADR-0029) can share it as the key universe.
+        // object registrations only (guard's bridge reflects decorated classes → registry): it
+        // catalogs the identity permissions. Authorities use the shared `recordAuthorization.registry`.
         const identityRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects]);
         // The grant-admin collaborators built at forRoot() over the shared pool (mirrors the
         // postingVersionBump closure pattern above). GrantCeiling (ADR-0029) enforces the
@@ -132,8 +161,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // resolved over the SAME authz pool + registry the object-type gate uses (one source of
         // truth for "what a principal holds"). ALWAYS wired here, so production always enforces.
         const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool);
-        // (`ceilingRegistry` is built and parity-checked at the top of forRoot.) `rootIds` marks
-        // platform roots as never dominated.
+        // (`ceilingRegistry` is the shared record-authorization registry built at the top of forRoot.)
+        // `rootIds` marks platform roots as never dominated.
         // rootIds is passed EXPLICITLY (review F5): `null` states "not configured". The dominance
         // check still refuses any user flagged `u_is_platform_superuser`, so an unconfigured list
         // never lets a sub-admin take over a platform administrator.
@@ -174,8 +203,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // authz.module, the anti-pattern this replaces). A SECOND DecisionAuthority is built over the
         // same record-authorization inputs (matches astram3): the route guard's own decide() is the
         // first; this one backs the writer's server-side re-verification.
-        // (The non-recording builder: these internal authorities are not the consumer's decision path.)
-        const crossTenantAuthority = (0, guard_1.buildRecordAuthorization)((0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool));
+        // Same inputs as the request path (KI #57): a consumer type is registered here too.
+        const crossTenantAuthority = (0, guard_1.buildRecordAuthorization)(recordAuthorization);
         // Record-level LIST SCOPE (Task 3.1, Invariant #8): the engine-facing fn the engine's
         // `list()` ANDs into BOTH the data SELECT and the COUNT — the in-query visible-set filter.
         // Built HERE, over the SAME shared authzPool (guard constructs the un-overridable scope
@@ -183,7 +212,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // out-of-the-box into `EngineModule.forRoot({ listScope })` below (ADR-0003 injection seam —
         // the engine never imports guard). Fail-closed: a store outage propagates and `list()` fails
         // rather than returning unscoped rows.
-        const listScope = (0, guard_1.buildListScopeFn)((0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool));
+        const listScope = (0, guard_1.buildListScopeFn)(recordAuthorization);
         // The writer's `GrantAuthorizeFn`: decide()-backed, fail-closed (no try/catch — a throw
         // propagates and the writer maps it to a retryable 503). isRoot ← the SAME rootIds the
         // consumer passes to ShieldModule.forRoot (root-correctness for control-plane grants).
@@ -237,11 +266,12 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             audit: grantAudit,
         });
         // The read side (inbox/mine/incoming/offerable-types) over the same pool + the merged object
-        // set (offerable = tenantScoped types only) + the per-type action vocabulary.
-        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects], guard_1.actionsFor);
+        // set (offerable = tenantScoped types only, the consumer's included, KI #57) + the per-type
+        // action vocabulary.
+        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], guard_1.actionsFor);
         // ── GUIDED RULE-BUILDER (list-scoping engine Phase 5, §9.1) ──────────────────────────────
         // The policy-authoring surface over the guard `MariaDbPolicyStore` + core `makeAuthorPolicy`.
-        // Reuses the SAME `identityRegistry` + `crossTenantAuthority` (a DecisionAuthority over the
+        // Reuses the SAME shared registry + `crossTenantAuthority` (a DecisionAuthority over the
         // shared authzPool — the delegated-admin ceiling's decide()) as the cross-tenant writer. The
         // core AuditSink is one-arg (`record(event)`); the engine `MariaDbAuditSink` is two-arg
         // (`record(event, query)`) — so bind the query to the shared authzPool (mirrors the
@@ -275,7 +305,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             };
         });
         const policyService = new policy_service_js_1.PolicyService({
-            registry: identityRegistry,
+            // The shared registry (KI #57): the schema below already offers the consumer's types, so
+            // the author must know their actions too.
+            registry: recordAuthorization.registry,
             policyStore,
             decide: crossTenantAuthority,
             audit: policyAudit,
@@ -401,6 +433,14 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // NestJS DiscoveryService/MetadataScanner — the boot bootstrap provider reflects the
                 // live controllers through this to build the OperationInventory.
                 core_1.DiscoveryModule,
+                // Phase 9 #7: the ONE record authorization, global so ShieldModule's decision-authority
+                // factory reads it (guard never imports identity; the token is the seam).
+                {
+                    module: IdentityRecordAuthorizationModule,
+                    global: true,
+                    providers: [{ provide: guard_1.SHIELD_RECORD_AUTHORIZATION, useValue: recordAuthorization }],
+                    exports: [guard_1.SHIELD_RECORD_AUTHORIZATION],
+                },
             ],
             // Route order: RoleController stays AHEAD of GrantAdminController (documented Nest
             // route-precedence constraint — the summary route `access/role-grants` dodges
@@ -449,6 +489,13 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                         { token: guard_1.SHIELD_SESSION_SWEEPER, optional: true },
                     ],
                 },
+                // Phase 9 #7: fail the boot unless the request path decides with the authority guard
+                // built from this module's record authorization (never the silent deny-everything stub).
+                {
+                    provide: IDENTITY_DECISION_AUTHORITY_CHECK,
+                    useFactory: assertRequestPathUsesIdentityAuthorization,
+                    inject: [{ token: guard_1.SHIELD_DECISION_AUTHORITY, optional: true }],
+                },
                 {
                     provide: IDENTITY_VERSION_PUBLISHER_LINK,
                     useFactory: (cache) => {

package/dist/features/membership/posting.service.d.ts

@@ -14,6 +14,8 @@
  *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
  *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
  *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *   - for every ADDED posting: its department and branch belong to the membership's company
+ *     (`assertOrgUnitsInCompany`, Phase 9 #13b) — else 400.
  *
  * ── Atomicity (KI #16) ────────────────────────────────────────────────────────────────
  * The diff runs inside ONE `records.transaction` (ADR-0034): creates FIRST, then deletes, so a

package/dist/features/membership/posting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;CAuGjB"}
+{"version":3,"file":"posting.service.d.ts","sourceRoot":"","sources":["../../../src/features/membership/posting.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACzC;AA0ED,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBARZ,OAAO,EAAE,cAAc,EAGvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D,gEAAgE;IAC1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAK1E;;;;;OAKG;IACG,eAAe,CACnB,KAAK,EAAE,SAAS,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;CA8GjB"}

package/dist/features/membership/posting.service.js

@@ -15,6 +15,8 @@
  *     (`GrantCeiling.assertRoleAssignable` — a role also used elsewhere is never assignable),
  *     and the role's keys are all held by the actor (`assertCanAssignRoles`, ADR-0029 applied to
  *     assignment). Removals need no ceiling: self-demotion stays allowed.
+ *   - for every ADDED posting: its department and branch belong to the membership's company
+ *     (`assertOrgUnitsInCompany`, Phase 9 #13b) — else 400.
  *
  * ── Atomicity (KI #16) ────────────────────────────────────────────────────────────────
  * The diff runs inside ONE `records.transaction` (ADR-0034): creates FIRST, then deletes, so a
@@ -163,6 +165,13 @@ let PostingService = class PostingService {
             await this.ceiling.assertRoleAssignable(actor, roleUuid);
         }
         await this.ceiling.assertCanAssignRoles(actor, addedRoles);
+        // Phase 9 #13b (review F4): an added posting's department/branch must be the membership
+        // company's own (junction rows), never another tenant's (400).
+        const present = (v) => typeof v === 'string' && v.length > 0;
+        await this.ceiling.assertOrgUnitsInCompany(tenantUuid, {
+            departmentUuids: added.map((d) => d.departmentUuid).filter(present),
+            branchUuids: added.map((d) => d.branchUuid).filter(present),
+        });
         // Removing a PEER's postings strips their authority: the actor must dominate the member
         // (security review). Removing your OWN postings (self-demotion) stays allowed.
         const memberUuid = typeof membership.fields?.userUuid === 'string' ? membership.fields.userUuid : '';

package/dist/features/role/role.service.d.ts

@@ -42,13 +42,20 @@ export declare class RoleService {
      * cached grants silently stale.
      *
      * The role's `role_permission` rows (shield_authz, no FK) and its place in every service
-     * account's `sa_role_ids` (read live by the API-key store) do not cascade, so before the delete,
-     * still under the role lock, `GrantAdminService.purgeRole` removes both in its own committed
-     * authz transaction — checking first that the actor may change each holding account, and
-     * bumping every tenant that used the role (account tenants included). Order is fail-closed: a
-     * failure after the purge leaves a role with no grants and no agents, never live grants or an
-     * agent carrying a deleted role. A re-created role gets a fresh uuid (the engine mints it), so
-     * it can never pick up anything left behind.
+     * account's `sa_role_ids` (read live by the API-key store) do not cascade, so
+     * `GrantAdminService.purgeRole` removes both in its own committed authz transaction — checking
+     * first that the actor may change each holding account, and bumping every tenant that used the
+     * role (account tenants included).
+     *
+     * Phase 9 #5: the engine's delete (its full gate: the coarse `role:delete` decision, then the
+     * record-level one, through the single decision authority) runs BEFORE the purge, on this
+     * transaction. A refused delete throws before anything is purged, so nothing changes. The purge
+     * then commits on its own connection while this transaction still holds the role row; it reads
+     * only committed state (the postings this delete removes are still visible to it, so their
+     * tenants are bumped). A purge refusal or failure rolls the delete back. A failure after the
+     * purge committed (this commit) leaves a role with no grants and no agents: fewer permissions,
+     * never live grants or an agent carrying a deleted role. A re-created role gets a fresh uuid
+     * (the engine mints it), so it can never pick up anything left behind.
      */
     deleteRole(actor: Principal, uuid: string): Promise<void>;
 }

package/dist/features/role/role.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAK/C;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAXP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,MAAM,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGpD,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI3C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F;;;;;;;;;;;;;;;;;;;OAmBG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBhE"}
+{"version":3,"file":"role.service.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAK/C;;;;;;;;;GASG;AACH,qBACa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAK7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAXP,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAKrB,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAKvC,MAAM,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAGpD,qBAAqB;IACrB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI3C,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,8FAA8F;IACxF,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAoBhE"}

package/dist/features/role/role.service.js

@@ -75,13 +75,20 @@ let RoleService = class RoleService {
      * cached grants silently stale.
      *
      * The role's `role_permission` rows (shield_authz, no FK) and its place in every service
-     * account's `sa_role_ids` (read live by the API-key store) do not cascade, so before the delete,
-     * still under the role lock, `GrantAdminService.purgeRole` removes both in its own committed
-     * authz transaction — checking first that the actor may change each holding account, and
-     * bumping every tenant that used the role (account tenants included). Order is fail-closed: a
-     * failure after the purge leaves a role with no grants and no agents, never live grants or an
-     * agent carrying a deleted role. A re-created role gets a fresh uuid (the engine mints it), so
-     * it can never pick up anything left behind.
+     * account's `sa_role_ids` (read live by the API-key store) do not cascade, so
+     * `GrantAdminService.purgeRole` removes both in its own committed authz transaction — checking
+     * first that the actor may change each holding account, and bumping every tenant that used the
+     * role (account tenants included).
+     *
+     * Phase 9 #5: the engine's delete (its full gate: the coarse `role:delete` decision, then the
+     * record-level one, through the single decision authority) runs BEFORE the purge, on this
+     * transaction. A refused delete throws before anything is purged, so nothing changes. The purge
+     * then commits on its own connection while this transaction still holds the role row; it reads
+     * only committed state (the postings this delete removes are still visible to it, so their
+     * tenants are bumped). A purge refusal or failure rolls the delete back. A failure after the
+     * purge committed (this commit) leaves a role with no grants and no agents: fewer permissions,
+     * never live grants or an agent carrying a deleted role. A re-created role gets a fresh uuid
+     * (the engine mints it), so it can never pick up anything left behind.
      */
     async deleteRole(actor, uuid) {
         await this.ceiling.assertRoleAdministrable(actor, uuid);
@@ -93,8 +100,8 @@ let RoleService = class RoleService {
             await this.ceiling.assertRoleAdministrable(actor, uuid);
             await this.ceiling.assertDominatesRoleHolders(actor, uuid);
             const affected = (await this.versionBump?.tenantsForRole?.(uuid)) ?? [];
+            await tx.delete('role', uuid); // the engine's delete gate decides first (Phase 9 #5)
             await grants.purgeRole(uuid, actor);
-            await tx.delete('role', uuid);
             return affected;
         });
         if (!this.versionBump)

package/dist/features/service-account/lock-service-accounts.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Lock the service accounts matching a predicate, without locking the table (Phase 9 #11).
+ *
+ * `service_account` has no index a role or scope predicate can use (`JSON_CONTAINS` on a JSON
+ * column, or an `OR` with one), so `SELECT … WHERE <predicate> FOR UPDATE` scans the whole table
+ * and InnoDB (REPEATABLE READ) keeps a next-key lock on every row it scanned: every other agent's
+ * edit, and every new agent, waits until the transaction ends. Instead:
+ *   1. a NON-locking read finds the candidate ids (a consistent read, no locks);
+ *   2. `FOR UPDATE` by primary key locks only those rows, sorted by id (a stable lock order), and
+ *      re-evaluates the predicate on the latest committed version of each, so a candidate that
+ *      stopped matching in between is dropped.
+ *
+ * A row that STARTS matching after step 1 (an agent that gains the role, or the company in its
+ * scope) is not locked or returned. Callers accept that (see their docs): the outcome equals the
+ * serial order "this transaction, then that edit", which the table-wide lock also allowed (the
+ * edit only waited, then applied).
+ *
+ * `columns` and `where.sql` are fixed SQL written by the caller (never client input); every value
+ * is `?`-bound.
+ */
+/** The connection surface: one transaction's `query`. */
+export interface LockConn {
+    query(sql: string, params?: readonly unknown[]): Promise<unknown>;
+}
+export declare function lockServiceAccountsWhere<T>(conn: LockConn, columns: string, where: {
+    readonly sql: string;
+    readonly params: readonly unknown[];
+}): Promise<T[]>;
+//# sourceMappingURL=lock-service-accounts.d.ts.map

package/dist/features/service-account/lock-service-accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-service-accounts.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/lock-service-accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GACnE,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}