@astram/identity 0.7.0 → 0.7.2

package/dist/features/authz/grant-admin.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;;;;GAcG;AACH,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CACF,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC,mFAAmF;IAG7E,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAO9F;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC;;;;OAIG;IAGG,YAAY,CACT,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACb,GAAG,EAAE,MAAM;;;CAU5B"}
+{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;;;;GAcG;AACH,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;IAI3E,0CAA0C;IAGpC,KAAK,CACF,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC,mFAAmF;IAG7E,MAAM,CACH,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM;;;IAQ3B;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC;;;;OAIG;IAGG,YAAY,CACT,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM;;;CAU5B"}

package/dist/features/authz/grant-admin.controller.js

@@ -170,7 +170,7 @@ __decorate([
     (0, common_1.Get)('roles/:uuid/permissions'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -179,7 +179,7 @@ __decorate([
     (0, common_1.Post)('roles/:uuid/permissions'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -189,7 +189,7 @@ __decorate([
     (0, common_1.Delete)('roles/:uuid/permissions/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, String]),
@@ -206,7 +206,7 @@ __decorate([
     (0, common_1.Post)('roles/:uuid/access-bundles'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -216,7 +216,7 @@ __decorate([
     (0, common_1.Delete)('roles/:uuid/access-bundles/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, String]),

package/dist/features/authz/grant-admin.service.d.ts

@@ -148,6 +148,14 @@ export declare class GrantAdminService {
      * role after the candidate read is not seen; the outcome equals "this change, then that edit"
      * (a role delete leaves that agent an inert uuid: the role and its grants are gone).
      */
+    /**
+     * The role's uuid as stored (Phase 10 #1): `r_uuid` is `utf8mb4_unicode_ci`, so a route uuid in
+     * another letter case reaches the row, but `JSON_CONTAINS(sa_role_ids, …)` and the `sa_role_ids`
+     * rewrite are exact — an upper-cased uuid would find no holding agent (skipping their check) and
+     * write grants under a second spelling. Unknown → the input unchanged (later steps 404). A
+     * consistent read: `purgeRole` runs while the caller's delete of this row is uncommitted.
+     */
+    private storedRoleUuid;
     private lockAccountsHoldingRole;
     /** All active bundles + their resolved atomic keys, for the Access UI. */
     listBundles(): Promise<{

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAuC7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;OAQG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA;IAKpC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA0DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmDtE;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAc/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAuC7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;OAQG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA;IAKpC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA0DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAc/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}

package/dist/features/authz/grant-admin.service.js

@@ -242,6 +242,7 @@ class GrantAdminService {
      * (404/403) → ceiling (403) → write. Root bypasses the binding rule and the ceiling.
      */
     async grant(roleUuid, key, grantor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         await this.assertValidKey(key); // throws BadKeyError (400) before touching the store
         await this.assertMayChangeGrants(roleUuid, [key], grantor);
         const actorUuid = grantor.id;
@@ -263,6 +264,7 @@ class GrantAdminService {
      * role lock in `writeGrants`). Root bypasses.
      */
     async revoke(roleUuid, key, actor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         await this.assertMayChangeGrants(roleUuid, [key], actor);
         await this.writeGrants('role.permission_revoked', roleUuid, [key], actor, async (conn, k) => {
             await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, k]);
@@ -291,6 +293,7 @@ class GrantAdminService {
      * agents: fewer permissions, never live grants for a deleted role (fail closed).
      */
     async purgeRole(roleUuid, actor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         const conn = await this.pool.getConnection();
         try {
             await conn.beginTransaction();
@@ -336,6 +339,19 @@ class GrantAdminService {
      * role after the candidate read is not seen; the outcome equals "this change, then that edit"
      * (a role delete leaves that agent an inert uuid: the role and its grants are gone).
      */
+    /**
+     * The role's uuid as stored (Phase 10 #1): `r_uuid` is `utf8mb4_unicode_ci`, so a route uuid in
+     * another letter case reaches the row, but `JSON_CONTAINS(sa_role_ids, …)` and the `sa_role_ids`
+     * rewrite are exact — an upper-cased uuid would find no holding agent (skipping their check) and
+     * write grants under a second spelling. Unknown → the input unchanged (later steps 404). A
+     * consistent read: `purgeRole` runs while the caller's delete of this row is uncommitted.
+     */
+    async storedRoleUuid(roleUuid) {
+        if (typeof roleUuid !== 'string' || roleUuid.length === 0)
+            return roleUuid;
+        const rows = (await this.pool.query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
+        return rows[0]?.r_uuid ?? roleUuid;
+    }
     lockAccountsHoldingRole(conn, roleUuid) {
         return (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_role_ids, sa_updated_at_ms', {
             sql: 'JSON_CONTAINS(sa_role_ids, JSON_QUOTE(?))',
@@ -361,6 +377,7 @@ class GrantAdminService {
      * to; otherwise `GrantCeilingError` (403), checked before any write. Root bypasses.
      */
     async grantBundle(roleUuid, bundleKey, grantor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         const keys = await this.resolveBundleKeysOrThrow(bundleKey);
         // Binding rule + ADR-0029 ceiling: a non-root grantor must hold EVERY atomic key the bundle
         // expands to — checked before any write (no partial bundle escalation).
@@ -384,6 +401,7 @@ class GrantAdminService {
      * #1: the binding rule + "only revoke what you hold" apply (root bypasses).
      */
     async revokeBundle(roleUuid, bundleKey, actor) {
+        roleUuid = await this.storedRoleUuid(roleUuid);
         const keys = await this.resolveBundleKeysOrThrow(bundleKey);
         await this.assertMayChangeGrants(roleUuid, [...keys], actor);
         await this.writeGrants('role.bundle_revoked', roleUuid, keys, actor, async (conn, key) => {

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAetE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwD5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAetE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}

package/dist/features/authz/grant-ceiling.js

@@ -4,6 +4,7 @@ exports.GrantCeiling = exports.GrantCeilingError = void 0;
 exports.subtreeOf = subtreeOf;
 exports.coversKey = coversKey;
 const core_1 = require("@astram/core");
+const http_js_1 = require("../shared/http.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const role_binding_js_1 = require("./role-binding.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
@@ -192,12 +193,12 @@ class GrantCeiling {
     async assertDominates(actor, targetUserId) {
         if (actor.isRoot === true)
             return;
-        if (this.rootIds.includes(targetUserId)) {
+        if (this.rootIds.some((r) => (0, http_js_1.sameUuid)(r, targetUserId))) {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot change this user: they are a platform administrator.');
         }
         const subtree = new Set(subtreeOf(actor));
-        const { companies, roleIds, superuser } = await this.facts('target memberships', async () => {
-            const su = (await this.pool.query(`SELECT u_is_platform_superuser AS su FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
+        const { companies, roleIds, superuser, storedId } = await this.facts('target memberships', async () => {
+            const su = (await this.pool.query(`SELECT u_uuid, u_is_platform_superuser AS su FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
             const memberships = (await this.pool.query(`SELECT DISTINCT cm_company_uuid AS company
            FROM \`${APP}\`.\`company_membership\`
           WHERE cm_user_uuid = ?`, [targetUserId]));
@@ -209,9 +210,13 @@ class GrantCeiling {
                 companies: memberships.map((m) => m.company),
                 roleIds: postings.map((p) => p.role_uuid),
                 superuser: Number(su[0]?.su ?? 0) === 1,
+                storedId: typeof su[0]?.u_uuid === 'string' ? su[0].u_uuid : targetUserId,
             };
         });
-        if (superuser) {
+        // Phase 11 #1: `u_uuid` is `utf8mb4_unicode_ci` (case, trailing spaces and character width are
+        // ignored), so the caller's spelling may reach a platform administrator's row without matching
+        // `rootIds`. Judge the STORED uuid too.
+        if (superuser || this.rootIds.some((r) => (0, http_js_1.sameUuid)(r, storedId))) {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot change this user: they are a platform administrator.');
         }
         // Security review F5: a user with NO membership is in nobody's subtree — refuse like the

package/dist/features/company/company-hierarchy.service.d.ts

@@ -54,6 +54,13 @@ export declare class CompanyHierarchyService {
     ceiling: MemberDominance, audit?: AuditPort | undefined, now?: () => number);
     /** The actor's own root node (see {@link ownRootOf}). */
     private ownRoot;
+    /**
+     * The company's uuid as stored (Phase 10 #1): `c_uuid` is `utf8mb4_unicode_ci`, so a route uuid
+     * in another letter case still reaches the row, while JS-side comparisons (own root, agent
+     * tenants, `JSON_CONTAINS` over scope lists, name maps) are exact. Every entry resolves the
+     * stored spelling once and passes that down. Unknown → the input unchanged (later steps 404).
+     */
+    private storedUuid;
     /** Names of the given companies (unknown → absent). */
     private names;
     private recordAudit;

package/dist/features/company/company-hierarchy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAWxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAuCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBALH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAiF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IA+BpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAWxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAuCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBALH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAiF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IA+BpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/features/company/company-hierarchy.service.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CompanyHierarchyService = void 0;
 exports.ownRootOf = ownRootOf;
+const http_js_1 = require("../shared/http.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
@@ -46,6 +47,16 @@ class CompanyHierarchyService {
     ownRoot(actor) {
         return ownRootOf(actor);
     }
+    /**
+     * The company's uuid as stored (Phase 10 #1): `c_uuid` is `utf8mb4_unicode_ci`, so a route uuid
+     * in another letter case still reaches the row, while JS-side comparisons (own root, agent
+     * tenants, `JSON_CONTAINS` over scope lists, name maps) are exact. Every entry resolves the
+     * stored spelling once and passes that down. Unknown → the input unchanged (later steps 404).
+     */
+    async storedUuid(uuid) {
+        const rows = (await this.pool.query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [uuid]));
+        return rows[0]?.c_uuid ?? uuid;
+    }
     /** Names of the given companies (unknown → absent). */
     async names(q, ids) {
         const unique = [...new Set(ids)];
@@ -75,11 +86,14 @@ class CompanyHierarchyService {
             (typeof newParentUuid !== 'string' || newParentUuid.length === 0)) {
             throw new identity_errors_js_1.IdentityBadRequestError('parentUuid must be a company or null.');
         }
+        nodeUuid = await this.storedUuid(nodeUuid);
+        if (newParentUuid !== null)
+            newParentUuid = await this.storedUuid(newParentUuid);
         if (actor.isRoot !== true) {
             const subtree = new Set((0, grant_ceiling_js_1.subtreeOf)(actor));
             if (!subtree.has(nodeUuid))
                 throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
-            if (nodeUuid === this.ownRoot(actor)) {
+            if ((0, http_js_1.sameUuid)(nodeUuid, this.ownRoot(actor))) {
                 throw new identity_errors_js_1.IdentityForbiddenError('You cannot move the organisation your access is rooted at.');
             }
             if (newParentUuid === null || !subtree.has(newParentUuid)) {
@@ -125,9 +139,10 @@ class CompanyHierarchyService {
      * depending on it as they were; a commit leaves a deleted company with no live agent or grant.
      */
     async remove(actor, nodeUuid) {
+        nodeUuid = await this.storedUuid(nodeUuid); // Phase 10 #1: one spelling downstream
         // Security review F6: the same own-root guard as `move` — a sub-admin never deletes the
         // organisation its access is rooted at.
-        if (actor.isRoot !== true && nodeUuid === this.ownRoot(actor)) {
+        if (actor.isRoot !== true && (0, http_js_1.sameUuid)(nodeUuid, this.ownRoot(actor))) {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot delete the organisation your access is rooted at.');
         }
         const name = (await this.names(this.pool, [nodeUuid])).get(nodeUuid) ?? '(unknown)';

package/dist/features/company/company.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAa9C;;;OAGG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IASlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAI3E"}
+{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAA0B,IAAI,EAAE,MAAM;IAIhD;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAiB9C;;;OAGG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IASlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIrF"}

package/dist/features/company/company.controller.js

@@ -57,7 +57,11 @@ let CompanyController = class CompanyController {
             (body.parentUuid !== null && typeof body.parentUuid !== 'string')) {
             throw new common_1.BadRequestException('parentUuid (a company id, or null) is required');
         }
-        await this.companies.moveCompany(req.principal, uuid, body.parentUuid ?? null);
+        const parentUuid = (0, guard_1.optionalUuidField)(body.parentUuid, 'parentUuid', { keepNull: true });
+        if (parentUuid === undefined) {
+            throw new common_1.BadRequestException('parentUuid (a company id, or null) is required');
+        }
+        await this.companies.moveCompany(req.principal, uuid, parentUuid);
         return { success: true };
     }
     /**
@@ -98,7 +102,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'read' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
@@ -107,7 +111,7 @@ __decorate([
     (0, common_1.Put)('companies/:uuid/parent'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -117,7 +121,7 @@ __decorate([
     (0, common_1.Put)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -127,7 +131,7 @@ __decorate([
     (0, common_1.Delete)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/company/company.service.d.ts

@@ -33,6 +33,11 @@ export declare class CompanyService {
      * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
      * whole tenant above the actor's authority. Re-sending the current status (the company form
      * always sends both fields) stays allowed, so the own root can still be renamed.
+     *
+     * Phase 11 #1: the guard compares the STORED uuid, never the caller's spelling. `c_uuid` is
+     * `utf8mb4_unicode_ci`, which also ignores trailing spaces and character width, so a padded or
+     * fullwidth route uuid reaches the same row. A non-root status change therefore reads the company
+     * first (the walled read; out of reach → 404) and judges and writes by the id that read returns.
      */
     updateCompany(actor: Principal, uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */

package/dist/features/company/company.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAa,MAAM,gCAAgC,CAAC;AASpF;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC;IAiBhB,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}
+{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAa,MAAM,gCAAgC,CAAC;AAUpF;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC;IAsBhB,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}

package/dist/features/company/company.service.js

@@ -15,6 +15,7 @@ const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
 const list_query_js_1 = require("../shared/list-query.js");
 const company_hierarchy_service_js_1 = require("./company-hierarchy.service.js");
+const http_js_1 = require("../shared/http.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const COMPANY_SEARCH_FIELDS = ['name'];
 const COMPANY_SORT_FIELDS = ['name', 'status', 'createdAt'];
@@ -73,6 +74,11 @@ let CompanyService = CompanyService_1 = class CompanyService {
      * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
      * whole tenant above the actor's authority. Re-sending the current status (the company form
      * always sends both fields) stays allowed, so the own root can still be renamed.
+     *
+     * Phase 11 #1: the guard compares the STORED uuid, never the caller's spelling. `c_uuid` is
+     * `utf8mb4_unicode_ci`, which also ignores trailing spaces and character width, so a padded or
+     * fullwidth route uuid reaches the same row. A non-root status change therefore reads the company
+     * first (the walled read; out of reach → 404) and judges and writes by the id that read returns.
      */
     async updateCompany(actor, uuid, patch) {
         const fields = {};
@@ -80,15 +86,18 @@ let CompanyService = CompanyService_1 = class CompanyService {
             if (typeof patch?.[key] === 'string')
                 fields[key] = patch[key];
         }
-        if (actor.isRoot !== true && fields.status !== undefined && uuid === (0, company_hierarchy_service_js_1.ownRootOf)(actor)) {
+        let target = uuid;
+        if (actor.isRoot !== true && fields.status !== undefined) {
             const current = await this.records.get('company', uuid);
             if (current === null)
                 throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
-            if (current.fields.status !== fields.status) {
+            target = current.id;
+            if ((0, http_js_1.sameUuid)(String(current.id), (0, company_hierarchy_service_js_1.ownRootOf)(actor)) &&
+                current.fields.status !== fields.status) {
                 throw new identity_errors_js_1.IdentityForbiddenError('You cannot change the status of the organisation your access is rooted at.');
             }
         }
-        return this.records.update('company', uuid, { fields });
+        return this.records.update('company', target, { fields });
     }
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
     moveCompany(actor, uuid, parentUuid) {

package/dist/features/cross-tenant/cross-tenant-grant.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA8CA,OAAO,EAGL,sBAAsB,EAKvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAqDD,qBAEa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}
+{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA8CA,OAAO,EAGL,sBAAsB,EAOvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAgDD,qBAEa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;IAS7E;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;IAS7E;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}

package/dist/features/cross-tenant/cross-tenant-grant.controller.js

@@ -52,18 +52,13 @@ const cross_tenant_grant_read_service_js_1 = require("./cross-tenant-grant-read.
 const VALID_GRANTEE_KINDS = ['user', 'role'];
 /** Validate + narrow the offer body, throwing 400 on any missing/malformed field. */
 function parseOfferBody(body) {
-    const granteeTenantId = body?.granteeTenantId;
-    if (typeof granteeTenantId !== 'string' || granteeTenantId.length === 0) {
-        throw new common_1.BadRequestException('granteeTenantId is required');
-    }
+    // Phase 11 #1: ids are canonical uuids (400 otherwise) before they reach the writer.
+    const granteeTenantId = (0, guard_1.uuidField)(body?.granteeTenantId, 'granteeTenantId');
     const granteeKind = body?.granteeKind;
     if (!VALID_GRANTEE_KINDS.includes(granteeKind)) {
         throw new common_1.BadRequestException("granteeKind must be 'user' or 'role'");
     }
-    const granteeUuid = body?.granteeUuid;
-    if (typeof granteeUuid !== 'string' || granteeUuid.length === 0) {
-        throw new common_1.BadRequestException('granteeUuid is required');
-    }
+    const granteeUuid = (0, guard_1.uuidField)(body?.granteeUuid, 'granteeUuid');
     const typeKey = body?.typeKey;
     if (typeof typeKey !== 'string' || typeKey.length === 0) {
         throw new common_1.BadRequestException('typeKey is required');
@@ -193,7 +188,7 @@ __decorate([
     (0, common_1.Post)('cross-tenant-grants/:uuid/accept'),
     (0, guard_1.Classified)({ typeKey: 'cross_tenant_grant', action: 'accept' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -202,7 +197,7 @@ __decorate([
     (0, common_1.Post)('cross-tenant-grants/:uuid/revoke'),
     (0, guard_1.Classified)({ typeKey: 'cross_tenant_grant', action: 'revoke' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/membership/membership.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAAoB,QAAQ,EAAE,MAAM;;;IA0C7D,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACN,QAAQ,EAAE,MAAM,EAC3B,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAgB1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM;;;IAMjD,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IAO7C;;;;OAIG;YACW,WAAW;CAM1B"}
+{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAA8B,QAAQ,EAAE,MAAM;;;IA0CvE,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACI,QAAQ,EAAE,MAAM,EACrC,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAoB1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM;;;IAM3D,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IA4B7C;;;;OAIG;YACW,WAAW;CAM1B"}

package/dist/features/membership/membership.controller.js

@@ -83,7 +83,7 @@ let MembershipController = class MembershipController {
     }
     /** Add the user to a company (creates an inactive membership card). */
     async addUserMembership(req, userUuid, body) {
-        const id = await this.memberships.addMembership(req.principal, userUuid, body?.companyUuid ?? '');
+        const id = await this.memberships.addMembership(req.principal, userUuid, (0, guard_1.uuidField)(body?.companyUuid, 'companyUuid'));
         return { id };
     }
     /**
@@ -96,7 +96,7 @@ let MembershipController = class MembershipController {
             if (!body.userUuid) {
                 throw new common_1.ForbiddenException('userUuid is required to activate a membership');
             }
-            await this.memberships.setActive(req.principal, membershipUuid, body.userUuid);
+            await this.memberships.setActive(req.principal, membershipUuid, (0, guard_1.uuidField)(body.userUuid, 'userUuid'));
         }
         if (typeof body?.status === 'string') {
             await this.memberships.updateMembership(req.principal, membershipUuid, {
@@ -112,7 +112,24 @@ let MembershipController = class MembershipController {
     }
     /** Atomically replace a membership's full posting set (the diff sync). */
     async replacePostings(req, membershipUuid, body) {
-        const postings = Array.isArray(body?.postings) ? body.postings : [];
+        const raw = Array.isArray(body?.postings) ? body.postings : [];
+        // Phase 11 #1: every posting id is a canonical uuid (400 otherwise); the window bounds and any
+        // other key pass through to the service's own whitelist.
+        const postings = raw.map((p, i) => {
+            const entry = (p ?? {});
+            const departmentUuid = (0, guard_1.optionalUuidField)(entry.departmentUuid, `postings[${i}].departmentUuid`, {
+                keepNull: true,
+            });
+            const branchUuid = (0, guard_1.optionalUuidField)(entry.branchUuid, `postings[${i}].branchUuid`, {
+                keepNull: true,
+            });
+            return {
+                ...entry,
+                roleUuid: (0, guard_1.uuidField)(entry.roleUuid, `postings[${i}].roleUuid`),
+                ...(departmentUuid !== undefined ? { departmentUuid } : {}),
+                ...(branchUuid !== undefined ? { branchUuid } : {}),
+            };
+        });
         await this.postings.replacePostings(req.principal, membershipUuid, postings);
         return { success: true };
     }
@@ -133,7 +150,7 @@ exports.MembershipController = MembershipController;
 __decorate([
     (0, common_1.Get)('users/:userUuid/memberships'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'read' }),
-    __param(0, (0, common_1.Param)('userUuid')),
+    __param(0, (0, common_1.Param)('userUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
@@ -142,7 +159,7 @@ __decorate([
     (0, common_1.Post)('users/:userUuid/memberships'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'create' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('userUuid')),
+    __param(1, (0, common_1.Param)('userUuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -152,7 +169,7 @@ __decorate([
     (0, common_1.Put)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(1, (0, common_1.Param)('membershipUuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -162,7 +179,7 @@ __decorate([
     (0, common_1.Delete)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(1, (0, common_1.Param)('membershipUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -171,7 +188,7 @@ __decorate([
     (0, common_1.Put)('memberships/:membershipUuid/postings'),
     (0, guard_1.Classified)({ typeKey: 'membership_posting', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(1, (0, common_1.Param)('membershipUuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),

package/dist/features/org-structure/org-catalog.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kFAAkF;IAG5E,sBAAsB,CAAuB,WAAW,EAAE,MAAM;;;IAKtE,+EAA+E;IAGzE,mBAAmB,CAAuB,WAAW,EAAE,MAAM;;;CAIpE"}
+{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kFAAkF;IAG5E,sBAAsB,CAAiC,WAAW,EAAE,MAAM;;;IAKhF,+EAA+E;IAGzE,mBAAmB,CAAiC,WAAW,EAAE,MAAM;;;CAI9E"}

package/dist/features/org-structure/org-catalog.controller.js

@@ -44,7 +44,7 @@ exports.OrgCatalogController = OrgCatalogController;
 __decorate([
     (0, common_1.Get)('companies/:companyUuid/departments'),
     (0, guard_1.Classified)({ typeKey: 'company_department', action: 'read' }),
-    __param(0, (0, common_1.Param)('companyUuid')),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
@@ -52,7 +52,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('companies/:companyUuid/branches'),
     (0, guard_1.Classified)({ typeKey: 'company_branch', action: 'read' }),
-    __param(0, (0, common_1.Param)('companyUuid')),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)

package/dist/features/policy/policy.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.controller.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.controller.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,aAAa,EAId,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,qBAEa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAEpD;;;;;;;;OAQG;IAGG,MAAM,CAAmB,OAAO,CAAC,EAAE,MAAM;IAY/C;;;OAGG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAoB,OAAO,CAAC,EAAE,MAAM;;;IAQxE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,YAAY;;;IAWlE;;;;OAIG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAShE"}
+{"version":3,"file":"policy.controller.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.controller.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,aAAa,EAId,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,qBAEa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAEpD;;;;;;;;OAQG;IAGG,MAAM,CAAmB,OAAO,CAAC,EAAE,MAAM;IAY/C;;;OAGG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAoB,OAAO,CAAC,EAAE,MAAM;;;IAQxE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,YAAY;;;IAWlE;;;;OAIG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAyB,EAAE,EAAE,MAAM;;;CAS1E"}

package/dist/features/policy/policy.controller.js

@@ -140,7 +140,7 @@ __decorate([
     (0, common_1.Delete)('record-policies/:id'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/role/role.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKhD;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAIxE"}
+{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKhD;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/role/role.controller.js

@@ -78,7 +78,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
@@ -87,7 +87,7 @@ __decorate([
     (0, common_1.Put)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -97,7 +97,7 @@ __decorate([
     (0, common_1.Delete)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/service-account/service-account.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.controller.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.controller.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,qBAAqB,EAOtB,MAAM,8BAA8B,CAAC;AAGtC,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwDD,qBAEa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,qBAAqB;IAEvD,8FAA8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa;;;IAQpC;;;;;OAKG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa;IAQ1C,8FAA8F;IAGxF,GAAG,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;IAQ5D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAiB7D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAuBtF;;;;OAIG;IAGG,QAAQ,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAUxF;;;OAGG;IAGG,SAAS,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAUzF;;;OAGG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAQpE"}
+{"version":3,"file":"service-account.controller.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.controller.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,qBAAqB,EAOtB,MAAM,8BAA8B,CAAC;AAGtC,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAmDD,qBAEa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,qBAAqB;IAEvD,8FAA8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa;;;IAQpC;;;;;OAKG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa;IAQ1C,8FAA8F;IAGxF,GAAG,CAAQ,GAAG,EAAE,aAAa,EAAyB,EAAE,EAAE,MAAM;;;IAQtE;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAiB7D;;;OAGG;IAGG,MAAM,CACH,GAAG,EAAE,aAAa,EACF,EAAE,EAAE,MAAM,EACzB,IAAI,EAAE,OAAO;;;IAwBvB;;;;OAIG;IAGG,QAAQ,CACL,GAAG,EAAE,aAAa,EACF,EAAE,EAAE,MAAM,EACzB,IAAI,EAAE,OAAO;;;IAWvB;;;OAGG;IAGG,SAAS,CACN,GAAG,EAAE,aAAa,EACF,EAAE,EAAE,MAAM,EACzB,IAAI,EAAE,OAAO;;;IAWvB;;;OAGG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAyB,EAAE,EAAE,MAAM;;;CAQ9E"}

package/dist/features/service-account/service-account.controller.js

@@ -54,15 +54,9 @@ function mapError(e) {
         throw new common_1.ConflictException(e.message);
     throw e;
 }
-/** Narrow the OPTIONAL string[] fields of a body (scope/roles) — reject a non-string-array. */
-function optStringArray(v, field) {
-    if (v === undefined)
-        return undefined;
-    if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) {
-        throw new common_1.BadRequestException(`${field} must be an array of strings`);
-    }
-    return v;
-}
+// The OPTIONAL id-array fields of a body (scope/roles) go through `uuidArrayField`: each item a
+// canonical uuid (Phase 11 #1), 400 otherwise. The service re-checks (service-level callers bypass
+// this controller).
 /**
  * Narrow a key-issue/rotate body to its expiry choice (ADR-0033 §4): `expiresAtMs` (epoch-ms) or
  * `neverExpires: true`. Shape errors are 400 here; "neither", "both" and "not in the future" are
@@ -130,8 +124,8 @@ let ServiceAccountController = class ServiceAccountController {
         const b = (body ?? {});
         if (typeof b.label !== 'string')
             throw new common_1.BadRequestException('label is required');
-        const scope = optStringArray(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
-        const roles = optStringArray(b.roleIds, 'roleIds');
+        const scope = (0, guard_1.uuidArrayField)(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
+        const roles = (0, guard_1.uuidArrayField)(b.roleIds, 'roleIds');
         try {
             const account = await this.svc.create(adminOf(req), {
                 label: b.label,
@@ -156,8 +150,8 @@ let ServiceAccountController = class ServiceAccountController {
         if (b.status !== undefined && b.status !== 'active' && b.status !== 'disabled') {
             throw new common_1.BadRequestException("status must be 'active' or 'disabled'");
         }
-        const scope = optStringArray(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
-        const roles = optStringArray(b.roleIds, 'roleIds');
+        const scope = (0, guard_1.uuidArrayField)(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
+        const roles = (0, guard_1.uuidArrayField)(b.roleIds, 'roleIds');
         try {
             const account = await this.svc.update(adminOf(req), id, {
                 ...(b.label !== undefined ? { label: b.label } : {}),
@@ -235,7 +229,7 @@ __decorate([
     (0, common_1.Get)('service-accounts/:id'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'read' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -253,7 +247,7 @@ __decorate([
     (0, common_1.Patch)('service-accounts/:id'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -263,7 +257,7 @@ __decorate([
     (0, common_1.Post)('service-accounts/:id/keys'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -273,7 +267,7 @@ __decorate([
     (0, common_1.Post)('service-accounts/:id/keys/rotate'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -283,7 +277,7 @@ __decorate([
     (0, common_1.Post)('service-accounts/:id/keys/revoke'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/service-account/service-account.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}
+{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAKD,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AA+DD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IA0G9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}

package/dist/features/service-account/service-account.service.js

@@ -23,6 +23,7 @@ exports.ceilingAllowsRole = ceilingAllowsRole;
  */
 const node_crypto_1 = require("node:crypto");
 const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
 /** The account id was not in the caller's subtree (unknown or cross-tenant) → 404 (no leak). */
 class ServiceAccountNotFoundError extends Error {
     constructor() {
@@ -65,23 +66,39 @@ function scopeOf(admin) {
     const nodeIds = admin.scopeSubtreeNodeIds.length ? admin.scopeSubtreeNodeIds : [admin.tenantId];
     return { nodeIds, isRoot: admin.isRoot === true };
 }
+/** An id in the ceiling's comparison form: canonical when it is a uuid (Phase 11 #1). */
+const ceilingKey = (id) => (0, engine_1.canonicalUuid)(id) ?? id;
 function ceilingOf(admin, heldRoleIds) {
     return {
         isRoot: admin.isRoot === true,
-        nodeIds: new Set(scopeOf(admin).nodeIds),
-        roleIds: new Set(heldRoleIds),
+        nodeIds: new Set(scopeOf(admin).nodeIds.map(ceilingKey)),
+        roleIds: new Set(heldRoleIds.map(ceilingKey)),
     };
 }
 function ceilingAllowsNode(c, nodeId) {
-    return c.isRoot || c.nodeIds.has(nodeId);
+    return c.isRoot || c.nodeIds.has(ceilingKey(nodeId));
 }
 function ceilingAllowsRole(c, roleId) {
-    return c.isRoot || c.roleIds.has(roleId);
+    return c.isRoot || c.roleIds.has(ceilingKey(roleId));
 }
 /** Dedupe an id list keeping first-seen order (drops empty strings). */
 function uniqueIds(ids) {
     return [...new Set(ids.filter((x) => typeof x === 'string' && x.length > 0))];
 }
+/**
+ * REQUESTED ids (create/update input) → canonical uuids, deduped (Phase 11 #1). The id columns
+ * compare under `utf8mb4_unicode_ci` (case, trailing spaces and width ignored) while the ceiling
+ * Sets, `sa_role_ids` / `sa_scope_subtree` JSON and every `JSON_CONTAINS` are exact, so a padded or
+ * fullwidth id would be judged one way and stored another. Anything but a strict uuid → 400. This
+ * holds for service-level callers too (the controller's `uuidArrayField` is the HTTP edge).
+ */
+function requestIds(ids, field) {
+    const canonical = ids.map((x) => (0, engine_1.canonicalUuid)(x));
+    if (canonical.some((x) => x === null)) {
+        throw new ServiceAccountInputError(`${field} must be a list of ids`);
+    }
+    return uniqueIds(canonical);
+}
 /** `requested` then the `preserved` ids not already in it (first-seen order, no duplicates). */
 function mergeIds(requested, preserved) {
     return uniqueIds([...requested, ...preserved]);
@@ -313,13 +330,13 @@ class ServiceAccountService {
         if (!label)
             throw new ServiceAccountInputError('a label is required');
         // Default the scope to the admin's own subtree (least surprise; still least-privilege-bounded).
-        const requestedScope = uniqueIds(input.scopeSubtreeNodeIds ?? []);
+        const requestedScope = requestIds(input.scopeSubtreeNodeIds ?? [], 'scopeSubtreeNodeIds');
         const scopeSubtree = requestedScope.length > 0
             ? requestedScope
             : admin.scopeSubtreeNodeIds.length
                 ? uniqueIds(admin.scopeSubtreeNodeIds)
                 : [admin.tenantId];
-        const roleIds = uniqueIds(input.roleIds ?? []);
+        const roleIds = requestIds(input.roleIds ?? [], 'roleIds');
         await this.assertWithinCeiling(await this.ceilingFor(admin), scopeSubtree, roleIds);
         const id = (0, node_crypto_1.randomUUID)();
         const createdAtMs = this.now();
@@ -371,8 +388,10 @@ class ServiceAccountService {
         if (patch.status !== undefined && patch.status !== 'active' && patch.status !== 'disabled') {
             throw new ServiceAccountInputError("status must be 'active' or 'disabled'");
         }
-        const requestedScope = patch.scopeSubtreeNodeIds !== undefined ? uniqueIds(patch.scopeSubtreeNodeIds) : undefined;
-        const requestedRoles = patch.roleIds !== undefined ? uniqueIds(patch.roleIds) : undefined;
+        const requestedScope = patch.scopeSubtreeNodeIds !== undefined
+            ? requestIds(patch.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds')
+            : undefined;
+        const requestedRoles = patch.roleIds !== undefined ? requestIds(patch.roleIds, 'roleIds') : undefined;
         if (requestedScope !== undefined && requestedScope.length === 0) {
             throw new ServiceAccountInputError('choose at least one scope node');
         }

package/dist/features/share/share.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwBD,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}
+{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAuBD,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAatC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}

package/dist/features/share/share.controller.js

@@ -35,20 +35,19 @@ function toShareRequest(body) {
     const b = (body ?? {});
     if (!b.typeKey || typeof b.typeKey !== 'string')
         throw new common_1.BadRequestException('typeKey required');
-    if (!b.recordId || typeof b.recordId !== 'string')
-        throw new common_1.BadRequestException('recordId required');
+    // Phase 11 #1: `rs_record_uuid` / `rs_grantee_uuid` are uuid columns — canonical or 400.
+    const recordId = (0, guard_1.uuidField)(b.recordId, 'recordId');
     if (b.granteeKind !== 'user' && b.granteeKind !== 'role') {
         throw new common_1.BadRequestException("granteeKind must be 'user' or 'role'");
     }
-    if (!b.granteeUuid || typeof b.granteeUuid !== 'string')
-        throw new common_1.BadRequestException('granteeUuid required');
+    const granteeUuid = (0, guard_1.uuidField)(b.granteeUuid, 'granteeUuid');
     if (!b.action || typeof b.action !== 'string')
         throw new common_1.BadRequestException('action required');
     return {
         typeKey: b.typeKey,
-        recordId: b.recordId,
+        recordId,
         granteeKind: b.granteeKind,
-        granteeUuid: b.granteeUuid,
+        granteeUuid,
         action: b.action,
     };
 }
@@ -65,8 +64,9 @@ let ShareController = class ShareController {
     async list(req, typeKey, recordId) {
         if (!typeKey || !recordId)
             throw new common_1.BadRequestException('typeKey and recordId required');
+        const record = (0, guard_1.uuidField)(recordId, 'recordId'); // Phase 11 #1
         try {
-            const shares = await this.shares.listShares(req.principal, typeKey, recordId);
+            const shares = await this.shares.listShares(req.principal, typeKey, record);
             return { shares };
         }
         catch (e) {

package/dist/features/shared/http.d.ts

@@ -1,9 +1,21 @@
-import type { Principal } from '@astram/engine';
+import { type Principal } from '@astram/engine';
 /** The authenticated request shape: the framework guard attaches `principal`. */
 export interface AuthedRequest {
     principal: Principal;
 }
-/** Coerce an unknown field value to a string uuid or null. */
+/**
+ * Same id: identical strings, or the same uuid in canonical form (`canonicalUuid`, so letter case
+ * is ignored and anything padded or fullwidth is never "the same"). This is NOT how MariaDB
+ * compares: the uuid columns are `utf8mb4_unicode_ci`, which also ignores trailing spaces (PAD
+ * SPACE) and character width, so a caller's spelling can reach a row this function says differs
+ * (Phase 11 #1). Only compare ids that are already STORED or canonical (resolve the caller's id to
+ * the stored one first; route params and body fields are canonicalised by `UuidPipe`/`uuidField`).
+ */
+export declare function sameUuid(a: string | null | undefined, b: string | null | undefined): boolean;
+/**
+ * Coerce a STORED field value (a record view read back from the engine) to a string uuid or null.
+ * Not an input validator: request ids go through `UuidPipe` / `uuidField` (Phase 11 #1).
+ */
 export declare function asUuid(v: unknown): string | null;
 /**
  * Coerce a stored effective-window bound to an epoch-ms number, or null. The

package/dist/features/shared/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/features/shared/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,8DAA8D;AAC9D,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQnD"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/features/shared/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/D,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAK5F;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQnD"}

package/dist/features/shared/http.js

@@ -1,8 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameUuid = sameUuid;
 exports.asUuid = asUuid;
 exports.asEpochMs = asEpochMs;
-/** Coerce an unknown field value to a string uuid or null. */
+const engine_1 = require("@astram/engine");
+/**
+ * Same id: identical strings, or the same uuid in canonical form (`canonicalUuid`, so letter case
+ * is ignored and anything padded or fullwidth is never "the same"). This is NOT how MariaDB
+ * compares: the uuid columns are `utf8mb4_unicode_ci`, which also ignores trailing spaces (PAD
+ * SPACE) and character width, so a caller's spelling can reach a row this function says differs
+ * (Phase 11 #1). Only compare ids that are already STORED or canonical (resolve the caller's id to
+ * the stored one first; route params and body fields are canonicalised by `UuidPipe`/`uuidField`).
+ */
+function sameUuid(a, b) {
+    if (typeof a !== 'string' || typeof b !== 'string')
+        return false;
+    if (a === b)
+        return true;
+    const canonical = (0, engine_1.canonicalUuid)(a);
+    return canonical !== null && canonical === (0, engine_1.canonicalUuid)(b);
+}
+/**
+ * Coerce a STORED field value (a record view read back from the engine) to a string uuid or null.
+ * Not an input validator: request ids go through `UuidPipe` / `uuidField` (Phase 11 #1).
+ */
 function asUuid(v) {
     return typeof v === 'string' && v.length > 0 ? v : null;
 }

package/dist/features/user/user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAW3D;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAIxE"}
+{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAU3D;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/user/user.controller.js

@@ -42,11 +42,10 @@ let UserController = class UserController {
      * first (active) membership in the same transaction; it must be a company the caller manages.
      */
     async createUser(req, body) {
+        const companyUuid = (0, guard_1.optionalUuidField)(body?.companyUuid, 'companyUuid');
         const id = await this.users.createUser(req.principal, {
             username: body?.username ?? 'Untitled',
-            ...(typeof body?.companyUuid === 'string' && body.companyUuid.length > 0
-                ? { companyUuid: body.companyUuid }
-                : {}),
+            ...(companyUuid !== undefined ? { companyUuid } : {}),
         });
         return { id };
     }
@@ -91,7 +90,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'read' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
@@ -100,7 +99,7 @@ __decorate([
     (0, common_1.Put)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -110,7 +109,7 @@ __decorate([
     (0, common_1.Delete)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -37,8 +37,8 @@
   "dependencies": {
     "mariadb": "^3.5.4",
     "@astram/core": "1.4.0",
-    "@astram/engine": "0.5.1",
-    "@astram/guard": "0.10.0"
+    "@astram/guard": "0.10.2",
+    "@astram/engine": "0.5.2"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",