@astram/identity 0.7.1 → 0.8.0

package/dist/features/authz/grant-admin.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;;;;GAcG;AACH,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CACF,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC,mFAAmF;IAG7E,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAO9F;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC;;;;OAIG;IAGG,YAAY,CACT,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACb,GAAG,EAAE,MAAM;;;CAU5B"}
+{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAI1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;;;;GAcG;AACH,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;IAI3E,0CAA0C;IAGpC,KAAK,CACF,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC,mFAAmF;IAG7E,MAAM,CACH,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM;;;IAQ3B;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAahC;;;;OAIG;IAGG,YAAY,CACT,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM;;;CAU5B"}

package/dist/features/authz/grant-admin.controller.js

@@ -170,7 +170,7 @@ __decorate([
     (0, common_1.Get)('roles/:uuid/permissions'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -179,7 +179,7 @@ __decorate([
     (0, common_1.Post)('roles/:uuid/permissions'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -189,7 +189,7 @@ __decorate([
     (0, common_1.Delete)('roles/:uuid/permissions/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, String]),
@@ -206,7 +206,7 @@ __decorate([
     (0, common_1.Post)('roles/:uuid/access-bundles'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -216,7 +216,7 @@ __decorate([
     (0, common_1.Delete)('roles/:uuid/access-bundles/:key'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Param)('key')),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, String]),

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAetE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwD5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAetE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}

package/dist/features/authz/grant-ceiling.js

@@ -197,8 +197,8 @@ class GrantCeiling {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot change this user: they are a platform administrator.');
         }
         const subtree = new Set(subtreeOf(actor));
-        const { companies, roleIds, superuser } = await this.facts('target memberships', async () => {
-            const su = (await this.pool.query(`SELECT u_is_platform_superuser AS su FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
+        const { companies, roleIds, superuser, storedId } = await this.facts('target memberships', async () => {
+            const su = (await this.pool.query(`SELECT u_uuid, u_is_platform_superuser AS su FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
             const memberships = (await this.pool.query(`SELECT DISTINCT cm_company_uuid AS company
            FROM \`${APP}\`.\`company_membership\`
           WHERE cm_user_uuid = ?`, [targetUserId]));
@@ -210,9 +210,13 @@ class GrantCeiling {
                 companies: memberships.map((m) => m.company),
                 roleIds: postings.map((p) => p.role_uuid),
                 superuser: Number(su[0]?.su ?? 0) === 1,
+                storedId: typeof su[0]?.u_uuid === 'string' ? su[0].u_uuid : targetUserId,
             };
         });
-        if (superuser) {
+        // Phase 11 #1: `u_uuid` is `utf8mb4_unicode_ci` (case, trailing spaces and character width are
+        // ignored), so the caller's spelling may reach a platform administrator's row without matching
+        // `rootIds`. Judge the STORED uuid too.
+        if (superuser || this.rootIds.some((r) => (0, http_js_1.sameUuid)(r, storedId))) {
             throw new identity_errors_js_1.IdentityForbiddenError('You cannot change this user: they are a platform administrator.');
         }
         // Security review F5: a user with NO membership is in nobody's subtree — refuse like the

package/dist/features/company/company.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAa9C;;;OAGG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IASlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAI3E"}
+{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,qBAEa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD;;;OAGG;IAGG,aAAa,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAK9E,2DAA2D;IAG3D,UAAU,CAA0B,IAAI,EAAE,MAAM;IAIhD;;;;;OAKG;IAGG,WAAW,CACR,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;;;IAiB9C;;;OAGG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IASlD,iGAAiG;IAG3F,aAAa,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIrF"}

package/dist/features/company/company.controller.js

@@ -57,7 +57,11 @@ let CompanyController = class CompanyController {
             (body.parentUuid !== null && typeof body.parentUuid !== 'string')) {
             throw new common_1.BadRequestException('parentUuid (a company id, or null) is required');
         }
-        await this.companies.moveCompany(req.principal, uuid, body.parentUuid ?? null);
+        const parentUuid = (0, guard_1.optionalUuidField)(body.parentUuid, 'parentUuid', { keepNull: true });
+        if (parentUuid === undefined) {
+            throw new common_1.BadRequestException('parentUuid (a company id, or null) is required');
+        }
+        await this.companies.moveCompany(req.principal, uuid, parentUuid);
         return { success: true };
     }
     /**
@@ -98,7 +102,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'read' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
@@ -107,7 +111,7 @@ __decorate([
     (0, common_1.Put)('companies/:uuid/parent'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -117,7 +121,7 @@ __decorate([
     (0, common_1.Put)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -127,7 +131,7 @@ __decorate([
     (0, common_1.Delete)('companies/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'company', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/company/company.service.d.ts

@@ -33,6 +33,11 @@ export declare class CompanyService {
      * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
      * whole tenant above the actor's authority. Re-sending the current status (the company form
      * always sends both fields) stays allowed, so the own root can still be renamed.
+     *
+     * Phase 11 #1: the guard compares the STORED uuid, never the caller's spelling. `c_uuid` is
+     * `utf8mb4_unicode_ci`, which also ignores trailing spaces and character width, so a padded or
+     * fullwidth route uuid reaches the same row. A non-root status change therefore reads the company
+     * first (the walled read; out of reach → 404) and judges and writes by the id that read returns.
      */
     updateCompany(actor: Principal, uuid: string, patch: Readonly<Record<string, unknown>>): Promise<void>;
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */

package/dist/features/company/company.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAa,MAAM,gCAAgC,CAAC;AAUpF;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC;IAiBhB,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}
+{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAa,MAAM,gCAAgC,CAAC;AAUpF;;;;;;;GAOG;AACH,qBACa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,uBAAuB;IAGrD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAetE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAE1D,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAOjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,OAAO,CAAC,IAAI,CAAC;IAsBhB,oGAAoG;IACpG,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKnE"}

package/dist/features/company/company.service.js

@@ -74,6 +74,11 @@ let CompanyService = CompanyService_1 = class CompanyService {
      * rooted at (the same own-root guard as move and delete, F6): deactivating it would act on the
      * whole tenant above the actor's authority. Re-sending the current status (the company form
      * always sends both fields) stays allowed, so the own root can still be renamed.
+     *
+     * Phase 11 #1: the guard compares the STORED uuid, never the caller's spelling. `c_uuid` is
+     * `utf8mb4_unicode_ci`, which also ignores trailing spaces and character width, so a padded or
+     * fullwidth route uuid reaches the same row. A non-root status change therefore reads the company
+     * first (the walled read; out of reach → 404) and judges and writes by the id that read returns.
      */
     async updateCompany(actor, uuid, patch) {
         const fields = {};
@@ -81,15 +86,18 @@ let CompanyService = CompanyService_1 = class CompanyService {
             if (typeof patch?.[key] === 'string')
                 fields[key] = patch[key];
         }
-        if (actor.isRoot !== true && fields.status !== undefined && (0, http_js_1.sameUuid)(uuid, (0, company_hierarchy_service_js_1.ownRootOf)(actor))) {
+        let target = uuid;
+        if (actor.isRoot !== true && fields.status !== undefined) {
             const current = await this.records.get('company', uuid);
             if (current === null)
                 throw new identity_errors_js_1.IdentityNotFoundError('Company not found.');
-            if (current.fields.status !== fields.status) {
+            target = current.id;
+            if ((0, http_js_1.sameUuid)(String(current.id), (0, company_hierarchy_service_js_1.ownRootOf)(actor)) &&
+                current.fields.status !== fields.status) {
                 throw new identity_errors_js_1.IdentityForbiddenError('You cannot change the status of the organisation your access is rooted at.');
             }
         }
-        return this.records.update('company', uuid, { fields });
+        return this.records.update('company', target, { fields });
     }
     /** Move a company under a new parent (hierarchy rules + cycle check, see the hierarchy service). */
     moveCompany(actor, uuid, parentUuid) {

package/dist/features/cross-tenant/cross-tenant-grant.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA8CA,OAAO,EAGL,sBAAsB,EAKvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAqDD,qBAEa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IASnE;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}
+{"version":3,"file":"cross-tenant-grant.controller.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant.controller.ts"],"names":[],"mappings":"AA8CA,OAAO,EAGL,sBAAsB,EAOvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,gGAAgG;AAChG,UAAU,iBAAiB;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAgDD,qBAEa,0BAA0B;IAEO,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADqC,WAAW,EAAE,sBAAsB,EAC7E,KAAK,EAAE,2BAA2B;IAGrD;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,iBAAiB;;;;IA+BtE,yFAAyF;IAGnF,MAAM,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;IAS7E;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;IAS7E;;;OAGG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa;;;IAKrC;;;;OAIG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa;;;;IAQpC,wFAAwF;IAGlF,cAAc;;;CAIrB"}

package/dist/features/cross-tenant/cross-tenant-grant.controller.js

@@ -52,18 +52,13 @@ const cross_tenant_grant_read_service_js_1 = require("./cross-tenant-grant-read.
 const VALID_GRANTEE_KINDS = ['user', 'role'];
 /** Validate + narrow the offer body, throwing 400 on any missing/malformed field. */
 function parseOfferBody(body) {
-    const granteeTenantId = body?.granteeTenantId;
-    if (typeof granteeTenantId !== 'string' || granteeTenantId.length === 0) {
-        throw new common_1.BadRequestException('granteeTenantId is required');
-    }
+    // Phase 11 #1: ids are canonical uuids (400 otherwise) before they reach the writer.
+    const granteeTenantId = (0, guard_1.uuidField)(body?.granteeTenantId, 'granteeTenantId');
     const granteeKind = body?.granteeKind;
     if (!VALID_GRANTEE_KINDS.includes(granteeKind)) {
         throw new common_1.BadRequestException("granteeKind must be 'user' or 'role'");
     }
-    const granteeUuid = body?.granteeUuid;
-    if (typeof granteeUuid !== 'string' || granteeUuid.length === 0) {
-        throw new common_1.BadRequestException('granteeUuid is required');
-    }
+    const granteeUuid = (0, guard_1.uuidField)(body?.granteeUuid, 'granteeUuid');
     const typeKey = body?.typeKey;
     if (typeof typeKey !== 'string' || typeKey.length === 0) {
         throw new common_1.BadRequestException('typeKey is required');
@@ -193,7 +188,7 @@ __decorate([
     (0, common_1.Post)('cross-tenant-grants/:uuid/accept'),
     (0, guard_1.Classified)({ typeKey: 'cross_tenant_grant', action: 'accept' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -202,7 +197,7 @@ __decorate([
     (0, common_1.Post)('cross-tenant-grants/:uuid/revoke'),
     (0, guard_1.Classified)({ typeKey: 'cross_tenant_grant', action: 'revoke' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA6FxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAiBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CA8dvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA+FxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAiBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CAoevB"}

package/dist/features/identity-feature.module.js

@@ -21,6 +21,7 @@ const company_hierarchy_service_js_1 = require("./company/company-hierarchy.serv
 const role_service_js_1 = require("./role/role.service.js");
 const role_controller_js_1 = require("./role/role.controller.js");
 const user_service_js_1 = require("./user/user.service.js");
+const email_address_changer_token_js_1 = require("./user/email-address-changer.token.js");
 const user_controller_js_1 = require("./user/user.controller.js");
 const membership_controller_js_1 = require("./membership/membership.controller.js");
 const membership_service_js_1 = require("./membership/membership.service.js");
@@ -475,6 +476,12 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 org_catalog_service_js_1.OrgCatalogService,
                 record_resolver_js_1.RecordResolverService,
                 { provide: posting_version_bump_js_1.POSTING_VERSION_BUMP, useValue: postingVersionBump },
+                // Phase 12 (KI #14): the admin email change goes through guard's ONE email-change helper
+                // (collision refusal + login-hint follow in one transaction), over the shared authz pool.
+                {
+                    provide: email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER,
+                    useValue: new guard_1.MariaDbEmailAddressChanger(authzPool),
+                },
                 // ADR-0035 (GAPS #6): attach the guard's Redis permission-version cache to the ONE shared
                 // bumper, so every committed bump (postings, grants, hierarchy) is published to Redis,
                 // where gate 5 reads it. Provided by the auth surface under `auth: true` (through the

package/dist/features/membership/membership.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAAoB,QAAQ,EAAE,MAAM;;;IA0C7D,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACN,QAAQ,EAAE,MAAM,EAC3B,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAgB1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM;;;IAMjD,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACA,cAAc,EAAE,MAAM,EACvC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IAO7C;;;;OAIG;YACW,WAAW;CAM1B"}
+{"version":3,"file":"membership.controller.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1E,iFAAiF;AACjF,UAAU,iBAAiB;IACzB,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,4EAA4E;AAC5E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAYD,qBAEa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,WAAW,EAAE,iBAAiB,EAC9B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGlD;;;;;OAKG;IAGG,mBAAmB,CAA8B,QAAQ,EAAE,MAAM;;;IA0CvE,uEAAuE;IAGjE,iBAAiB,CACd,GAAG,EAAE,aAAa,EACI,QAAQ,EAAE,MAAM,EACrC,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUxC;;;;OAIG;IAGG,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAoB1E,2FAA2F;IAGrF,gBAAgB,CACb,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM;;;IAM3D,0EAA0E;IAGpE,eAAe,CACZ,GAAG,EAAE,aAAa,EACU,cAAc,EAAE,MAAM,EACjD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAA;KAAE;;;IA4B7C;;;;OAIG;YACW,WAAW;CAM1B"}

package/dist/features/membership/membership.controller.js

@@ -83,7 +83,7 @@ let MembershipController = class MembershipController {
     }
     /** Add the user to a company (creates an inactive membership card). */
     async addUserMembership(req, userUuid, body) {
-        const id = await this.memberships.addMembership(req.principal, userUuid, body?.companyUuid ?? '');
+        const id = await this.memberships.addMembership(req.principal, userUuid, (0, guard_1.uuidField)(body?.companyUuid, 'companyUuid'));
         return { id };
     }
     /**
@@ -96,7 +96,7 @@ let MembershipController = class MembershipController {
             if (!body.userUuid) {
                 throw new common_1.ForbiddenException('userUuid is required to activate a membership');
             }
-            await this.memberships.setActive(req.principal, membershipUuid, body.userUuid);
+            await this.memberships.setActive(req.principal, membershipUuid, (0, guard_1.uuidField)(body.userUuid, 'userUuid'));
         }
         if (typeof body?.status === 'string') {
             await this.memberships.updateMembership(req.principal, membershipUuid, {
@@ -112,7 +112,24 @@ let MembershipController = class MembershipController {
     }
     /** Atomically replace a membership's full posting set (the diff sync). */
     async replacePostings(req, membershipUuid, body) {
-        const postings = Array.isArray(body?.postings) ? body.postings : [];
+        const raw = Array.isArray(body?.postings) ? body.postings : [];
+        // Phase 11 #1: every posting id is a canonical uuid (400 otherwise); the window bounds and any
+        // other key pass through to the service's own whitelist.
+        const postings = raw.map((p, i) => {
+            const entry = (p ?? {});
+            const departmentUuid = (0, guard_1.optionalUuidField)(entry.departmentUuid, `postings[${i}].departmentUuid`, {
+                keepNull: true,
+            });
+            const branchUuid = (0, guard_1.optionalUuidField)(entry.branchUuid, `postings[${i}].branchUuid`, {
+                keepNull: true,
+            });
+            return {
+                ...entry,
+                roleUuid: (0, guard_1.uuidField)(entry.roleUuid, `postings[${i}].roleUuid`),
+                ...(departmentUuid !== undefined ? { departmentUuid } : {}),
+                ...(branchUuid !== undefined ? { branchUuid } : {}),
+            };
+        });
         await this.postings.replacePostings(req.principal, membershipUuid, postings);
         return { success: true };
     }
@@ -133,7 +150,7 @@ exports.MembershipController = MembershipController;
 __decorate([
     (0, common_1.Get)('users/:userUuid/memberships'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'read' }),
-    __param(0, (0, common_1.Param)('userUuid')),
+    __param(0, (0, common_1.Param)('userUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
@@ -142,7 +159,7 @@ __decorate([
     (0, common_1.Post)('users/:userUuid/memberships'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'create' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('userUuid')),
+    __param(1, (0, common_1.Param)('userUuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -152,7 +169,7 @@ __decorate([
     (0, common_1.Put)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(1, (0, common_1.Param)('membershipUuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -162,7 +179,7 @@ __decorate([
     (0, common_1.Delete)('memberships/:membershipUuid'),
     (0, guard_1.Classified)({ typeKey: 'company_membership', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(1, (0, common_1.Param)('membershipUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -171,7 +188,7 @@ __decorate([
     (0, common_1.Put)('memberships/:membershipUuid/postings'),
     (0, guard_1.Classified)({ typeKey: 'membership_posting', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('membershipUuid')),
+    __param(1, (0, common_1.Param)('membershipUuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),

package/dist/features/org-structure/org-catalog.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kFAAkF;IAG5E,sBAAsB,CAAuB,WAAW,EAAE,MAAM;;;IAKtE,+EAA+E;IAGzE,mBAAmB,CAAuB,WAAW,EAAE,MAAM;;;CAIpE"}
+{"version":3,"file":"org-catalog.controller.d.ts","sourceRoot":"","sources":["../../../src/features/org-structure/org-catalog.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAU7D,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAEvD,kFAAkF;IAG5E,sBAAsB,CAAiC,WAAW,EAAE,MAAM;;;IAKhF,+EAA+E;IAGzE,mBAAmB,CAAiC,WAAW,EAAE,MAAM;;;CAI9E"}

package/dist/features/org-structure/org-catalog.controller.js

@@ -44,7 +44,7 @@ exports.OrgCatalogController = OrgCatalogController;
 __decorate([
     (0, common_1.Get)('companies/:companyUuid/departments'),
     (0, guard_1.Classified)({ typeKey: 'company_department', action: 'read' }),
-    __param(0, (0, common_1.Param)('companyUuid')),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
@@ -52,7 +52,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('companies/:companyUuid/branches'),
     (0, guard_1.Classified)({ typeKey: 'company_branch', action: 'read' }),
-    __param(0, (0, common_1.Param)('companyUuid')),
+    __param(0, (0, common_1.Param)('companyUuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)

package/dist/features/policy/policy.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.controller.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.controller.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,aAAa,EAId,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,qBAEa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAEpD;;;;;;;;OAQG;IAGG,MAAM,CAAmB,OAAO,CAAC,EAAE,MAAM;IAY/C;;;OAGG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAoB,OAAO,CAAC,EAAE,MAAM;;;IAQxE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,YAAY;;;IAWlE;;;;OAIG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAShE"}
+{"version":3,"file":"policy.controller.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.controller.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,aAAa,EAId,MAAM,qBAAqB,CAAC;AAE7B,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,qBAEa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,aAAa;IAEpD;;;;;;;;OAQG;IAGG,MAAM,CAAmB,OAAO,CAAC,EAAE,MAAM;IAY/C;;;OAGG;IAGG,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAoB,OAAO,CAAC,EAAE,MAAM;;;IAQxE;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,YAAY;;;IAWlE;;;;OAIG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAyB,EAAE,EAAE,MAAM;;;CAS1E"}

package/dist/features/policy/policy.controller.js

@@ -140,7 +140,7 @@ __decorate([
     (0, common_1.Delete)('record-policies/:id'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/role/role.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKhD;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAIxE"}
+{"version":3,"file":"role.controller.d.ts","sourceRoot":"","sources":["../../../src/features/role/role.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C,uDAAuD;IAGjD,UAAU,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKhD;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,uDAAuD;IAGjD,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAMjC,uDAAuD;IAGjD,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/role/role.controller.js

@@ -78,7 +78,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
@@ -87,7 +87,7 @@ __decorate([
     (0, common_1.Put)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -97,7 +97,7 @@ __decorate([
     (0, common_1.Delete)('roles/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/service-account/service-account.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.controller.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.controller.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,qBAAqB,EAOtB,MAAM,8BAA8B,CAAC;AAGtC,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwDD,qBAEa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,qBAAqB;IAEvD,8FAA8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa;;;IAQpC;;;;;OAKG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa;IAQ1C,8FAA8F;IAGxF,GAAG,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;IAQ5D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAiB7D;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAuBtF;;;;OAIG;IAGG,QAAQ,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAUxF;;;OAGG;IAGG,SAAS,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO;;;IAUzF;;;OAGG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAe,EAAE,EAAE,MAAM;;;CAQpE"}
+{"version":3,"file":"service-account.controller.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.controller.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,qBAAqB,EAOtB,MAAM,8BAA8B,CAAC;AAGtC,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAmDD,qBAEa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,qBAAqB;IAEvD,8FAA8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa;;;IAQpC;;;;;OAKG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa;IAQ1C,8FAA8F;IAGxF,GAAG,CAAQ,GAAG,EAAE,aAAa,EAAyB,EAAE,EAAE,MAAM;;;IAQtE;;;OAGG;IAGG,MAAM,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAiB7D;;;OAGG;IAGG,MAAM,CACH,GAAG,EAAE,aAAa,EACF,EAAE,EAAE,MAAM,EACzB,IAAI,EAAE,OAAO;;;IAwBvB;;;;OAIG;IAGG,QAAQ,CACL,GAAG,EAAE,aAAa,EACF,EAAE,EAAE,MAAM,EACzB,IAAI,EAAE,OAAO;;;IAWvB;;;OAGG;IAGG,SAAS,CACN,GAAG,EAAE,aAAa,EACF,EAAE,EAAE,MAAM,EACzB,IAAI,EAAE,OAAO;;;IAWvB;;;OAGG;IAGG,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAyB,EAAE,EAAE,MAAM;;;CAQ9E"}

package/dist/features/service-account/service-account.controller.js

@@ -54,15 +54,9 @@ function mapError(e) {
         throw new common_1.ConflictException(e.message);
     throw e;
 }
-/** Narrow the OPTIONAL string[] fields of a body (scope/roles) — reject a non-string-array. */
-function optStringArray(v, field) {
-    if (v === undefined)
-        return undefined;
-    if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) {
-        throw new common_1.BadRequestException(`${field} must be an array of strings`);
-    }
-    return v;
-}
+// The OPTIONAL id-array fields of a body (scope/roles) go through `uuidArrayField`: each item a
+// canonical uuid (Phase 11 #1), 400 otherwise. The service re-checks (service-level callers bypass
+// this controller).
 /**
  * Narrow a key-issue/rotate body to its expiry choice (ADR-0033 §4): `expiresAtMs` (epoch-ms) or
  * `neverExpires: true`. Shape errors are 400 here; "neither", "both" and "not in the future" are
@@ -130,8 +124,8 @@ let ServiceAccountController = class ServiceAccountController {
         const b = (body ?? {});
         if (typeof b.label !== 'string')
             throw new common_1.BadRequestException('label is required');
-        const scope = optStringArray(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
-        const roles = optStringArray(b.roleIds, 'roleIds');
+        const scope = (0, guard_1.uuidArrayField)(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
+        const roles = (0, guard_1.uuidArrayField)(b.roleIds, 'roleIds');
         try {
             const account = await this.svc.create(adminOf(req), {
                 label: b.label,
@@ -156,8 +150,8 @@ let ServiceAccountController = class ServiceAccountController {
         if (b.status !== undefined && b.status !== 'active' && b.status !== 'disabled') {
             throw new common_1.BadRequestException("status must be 'active' or 'disabled'");
         }
-        const scope = optStringArray(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
-        const roles = optStringArray(b.roleIds, 'roleIds');
+        const scope = (0, guard_1.uuidArrayField)(b.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds');
+        const roles = (0, guard_1.uuidArrayField)(b.roleIds, 'roleIds');
         try {
             const account = await this.svc.update(adminOf(req), id, {
                 ...(b.label !== undefined ? { label: b.label } : {}),
@@ -235,7 +229,7 @@ __decorate([
     (0, common_1.Get)('service-accounts/:id'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'read' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
@@ -253,7 +247,7 @@ __decorate([
     (0, common_1.Patch)('service-accounts/:id'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -263,7 +257,7 @@ __decorate([
     (0, common_1.Post)('service-accounts/:id/keys'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -273,7 +267,7 @@ __decorate([
     (0, common_1.Post)('service-accounts/:id/keys/rotate'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -283,7 +277,7 @@ __decorate([
     (0, common_1.Post)('service-accounts/:id/keys/revoke'),
     (0, guard_1.Classified)({ typeKey: 'service_account', action: 'manage_keys' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('id', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/service-account/service-account.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAgDD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}
+{"version":3,"file":"service-account.service.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.service.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,KAAK,EACV,mBAAmB,EAGnB,UAAU,EACV,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAEpC,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,oFAAoF;AACpF,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAED,4FAA4F;AAC5F,qBAAa,2BAA4B,SAAQ,KAAK;;CAKrD;AAED,0EAA0E;AAC1E,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,kGAAkG;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAElE,kGAAkG;AAClG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAehC;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAKD,wBAAgB,SAAS,CACvB,KAAK,EAAE,cAAc,EACrB,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,qBAAqB,CAMvB;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnF;AA+DD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAWD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAcrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAnBH,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW,GAAG;QACnC,UAAU,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;YACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAClB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,EACgB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,gBAAgB,EAC3B,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;YACW,OAAO;IAuCrB;;;OAGG;YACW,UAAU;IAKxB;;;;;;;OAOG;YACW,mBAAmB;IAsCjC;;OAEG;YACW,iBAAiB;IAsB/B;;;;OAIG;YACW,UAAU;IAmBxB;;;;;OAKG;IACG,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBlE,wEAAwE;IAClE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAKhE,gEAAgE;IAC1D,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOzE;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC7F,OAAO,CAAC,kBAAkB,CAAC;IAuC9B;;;;;;;;;;;;OAYG;IACG,MAAM,CACV,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GACA,OAAO,CAAC,kBAAkB,CAAC;IA0G9B;;;;;;OAMG;IACG,QAAQ,CACZ,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACG,SAAS,CACb,KAAK,EAAE,cAAc,EACrB,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,SAAS,CAAC;IAOrB,kGAAkG;IAC5F,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,mGAAmG;YACrF,OAAO;IAiCrB,+EAA+E;YACjE,SAAS;CAkBxB"}

package/dist/features/service-account/service-account.service.js

@@ -23,6 +23,7 @@ exports.ceilingAllowsRole = ceilingAllowsRole;
  */
 const node_crypto_1 = require("node:crypto");
 const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
 /** The account id was not in the caller's subtree (unknown or cross-tenant) → 404 (no leak). */
 class ServiceAccountNotFoundError extends Error {
     constructor() {
@@ -65,23 +66,39 @@ function scopeOf(admin) {
     const nodeIds = admin.scopeSubtreeNodeIds.length ? admin.scopeSubtreeNodeIds : [admin.tenantId];
     return { nodeIds, isRoot: admin.isRoot === true };
 }
+/** An id in the ceiling's comparison form: canonical when it is a uuid (Phase 11 #1). */
+const ceilingKey = (id) => (0, engine_1.canonicalUuid)(id) ?? id;
 function ceilingOf(admin, heldRoleIds) {
     return {
         isRoot: admin.isRoot === true,
-        nodeIds: new Set(scopeOf(admin).nodeIds),
-        roleIds: new Set(heldRoleIds),
+        nodeIds: new Set(scopeOf(admin).nodeIds.map(ceilingKey)),
+        roleIds: new Set(heldRoleIds.map(ceilingKey)),
     };
 }
 function ceilingAllowsNode(c, nodeId) {
-    return c.isRoot || c.nodeIds.has(nodeId);
+    return c.isRoot || c.nodeIds.has(ceilingKey(nodeId));
 }
 function ceilingAllowsRole(c, roleId) {
-    return c.isRoot || c.roleIds.has(roleId);
+    return c.isRoot || c.roleIds.has(ceilingKey(roleId));
 }
 /** Dedupe an id list keeping first-seen order (drops empty strings). */
 function uniqueIds(ids) {
     return [...new Set(ids.filter((x) => typeof x === 'string' && x.length > 0))];
 }
+/**
+ * REQUESTED ids (create/update input) → canonical uuids, deduped (Phase 11 #1). The id columns
+ * compare under `utf8mb4_unicode_ci` (case, trailing spaces and width ignored) while the ceiling
+ * Sets, `sa_role_ids` / `sa_scope_subtree` JSON and every `JSON_CONTAINS` are exact, so a padded or
+ * fullwidth id would be judged one way and stored another. Anything but a strict uuid → 400. This
+ * holds for service-level callers too (the controller's `uuidArrayField` is the HTTP edge).
+ */
+function requestIds(ids, field) {
+    const canonical = ids.map((x) => (0, engine_1.canonicalUuid)(x));
+    if (canonical.some((x) => x === null)) {
+        throw new ServiceAccountInputError(`${field} must be a list of ids`);
+    }
+    return uniqueIds(canonical);
+}
 /** `requested` then the `preserved` ids not already in it (first-seen order, no duplicates). */
 function mergeIds(requested, preserved) {
     return uniqueIds([...requested, ...preserved]);
@@ -313,13 +330,13 @@ class ServiceAccountService {
         if (!label)
             throw new ServiceAccountInputError('a label is required');
         // Default the scope to the admin's own subtree (least surprise; still least-privilege-bounded).
-        const requestedScope = uniqueIds(input.scopeSubtreeNodeIds ?? []);
+        const requestedScope = requestIds(input.scopeSubtreeNodeIds ?? [], 'scopeSubtreeNodeIds');
         const scopeSubtree = requestedScope.length > 0
             ? requestedScope
             : admin.scopeSubtreeNodeIds.length
                 ? uniqueIds(admin.scopeSubtreeNodeIds)
                 : [admin.tenantId];
-        const roleIds = uniqueIds(input.roleIds ?? []);
+        const roleIds = requestIds(input.roleIds ?? [], 'roleIds');
         await this.assertWithinCeiling(await this.ceilingFor(admin), scopeSubtree, roleIds);
         const id = (0, node_crypto_1.randomUUID)();
         const createdAtMs = this.now();
@@ -371,8 +388,10 @@ class ServiceAccountService {
         if (patch.status !== undefined && patch.status !== 'active' && patch.status !== 'disabled') {
             throw new ServiceAccountInputError("status must be 'active' or 'disabled'");
         }
-        const requestedScope = patch.scopeSubtreeNodeIds !== undefined ? uniqueIds(patch.scopeSubtreeNodeIds) : undefined;
-        const requestedRoles = patch.roleIds !== undefined ? uniqueIds(patch.roleIds) : undefined;
+        const requestedScope = patch.scopeSubtreeNodeIds !== undefined
+            ? requestIds(patch.scopeSubtreeNodeIds, 'scopeSubtreeNodeIds')
+            : undefined;
+        const requestedRoles = patch.roleIds !== undefined ? requestIds(patch.roleIds, 'roleIds') : undefined;
         if (requestedScope !== undefined && requestedScope.length === 0) {
             throw new ServiceAccountInputError('choose at least one scope node');
         }

package/dist/features/share/share.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAwBD,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAYtC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}
+{"version":3,"file":"share.controller.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.controller.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAuBD,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,YAAY;IAEjD;;;;OAIG;IAGG,IAAI,CACD,GAAG,EAAE,aAAa,EACP,OAAO,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;;;IAatC;;;;OAIG;IAGG,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;IAW5D;;;OAGG;IAGG,OAAO,CAAQ,GAAG,EAAE,aAAa,EAAU,IAAI,EAAE,OAAO;;;CAU/D"}

package/dist/features/share/share.controller.js

@@ -35,20 +35,19 @@ function toShareRequest(body) {
     const b = (body ?? {});
     if (!b.typeKey || typeof b.typeKey !== 'string')
         throw new common_1.BadRequestException('typeKey required');
-    if (!b.recordId || typeof b.recordId !== 'string')
-        throw new common_1.BadRequestException('recordId required');
+    // Phase 11 #1: `rs_record_uuid` / `rs_grantee_uuid` are uuid columns — canonical or 400.
+    const recordId = (0, guard_1.uuidField)(b.recordId, 'recordId');
     if (b.granteeKind !== 'user' && b.granteeKind !== 'role') {
         throw new common_1.BadRequestException("granteeKind must be 'user' or 'role'");
     }
-    if (!b.granteeUuid || typeof b.granteeUuid !== 'string')
-        throw new common_1.BadRequestException('granteeUuid required');
+    const granteeUuid = (0, guard_1.uuidField)(b.granteeUuid, 'granteeUuid');
     if (!b.action || typeof b.action !== 'string')
         throw new common_1.BadRequestException('action required');
     return {
         typeKey: b.typeKey,
-        recordId: b.recordId,
+        recordId,
         granteeKind: b.granteeKind,
-        granteeUuid: b.granteeUuid,
+        granteeUuid,
         action: b.action,
     };
 }
@@ -65,8 +64,9 @@ let ShareController = class ShareController {
     async list(req, typeKey, recordId) {
         if (!typeKey || !recordId)
             throw new common_1.BadRequestException('typeKey and recordId required');
+        const record = (0, guard_1.uuidField)(recordId, 'recordId'); // Phase 11 #1
         try {
-            const shares = await this.shares.listShares(req.principal, typeKey, recordId);
+            const shares = await this.shares.listShares(req.principal, typeKey, record);
             return { shares };
         }
         catch (e) {

package/dist/features/shared/http.d.ts

@@ -1,15 +1,21 @@
-import type { Principal } from '@astram/engine';
+import { type Principal } from '@astram/engine';
 /** The authenticated request shape: the framework guard attaches `principal`. */
 export interface AuthedRequest {
     principal: Principal;
 }
 /**
- * Same uuid, compared the way MariaDB does: the uuid columns are `utf8mb4_unicode_ci`, so a route
- * param that differs only in case reaches the same row. Every JS-side id guard (own root, platform
- * administrators) must use this, never `===` (Phase 10 #1).
+ * Same id: identical strings, or the same uuid in canonical form (`canonicalUuid`, so letter case
+ * is ignored and anything padded or fullwidth is never "the same"). This is NOT how MariaDB
+ * compares: the uuid columns are `utf8mb4_unicode_ci`, which also ignores trailing spaces (PAD
+ * SPACE) and character width, so a caller's spelling can reach a row this function says differs
+ * (Phase 11 #1). Only compare ids that are already STORED or canonical (resolve the caller's id to
+ * the stored one first; route params and body fields are canonicalised by `UuidPipe`/`uuidField`).
  */
 export declare function sameUuid(a: string | null | undefined, b: string | null | undefined): boolean;
-/** Coerce an unknown field value to a string uuid or null. */
+/**
+ * Coerce a STORED field value (a record view read back from the engine) to a string uuid or null.
+ * Not an input validator: request ids go through `UuidPipe` / `uuidField` (Phase 11 #1).
+ */
 export declare function asUuid(v: unknown): string | null;
 /**
  * Coerce a stored effective-window bound to an epoch-ms number, or null. The

package/dist/features/shared/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/features/shared/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5F;AAED,8DAA8D;AAC9D,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQnD"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/features/shared/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE/D,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAK5F;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQnD"}

package/dist/features/shared/http.js

@@ -3,15 +3,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sameUuid = sameUuid;
 exports.asUuid = asUuid;
 exports.asEpochMs = asEpochMs;
+const engine_1 = require("@astram/engine");
 /**
- * Same uuid, compared the way MariaDB does: the uuid columns are `utf8mb4_unicode_ci`, so a route
- * param that differs only in case reaches the same row. Every JS-side id guard (own root, platform
- * administrators) must use this, never `===` (Phase 10 #1).
+ * Same id: identical strings, or the same uuid in canonical form (`canonicalUuid`, so letter case
+ * is ignored and anything padded or fullwidth is never "the same"). This is NOT how MariaDB
+ * compares: the uuid columns are `utf8mb4_unicode_ci`, which also ignores trailing spaces (PAD
+ * SPACE) and character width, so a caller's spelling can reach a row this function says differs
+ * (Phase 11 #1). Only compare ids that are already STORED or canonical (resolve the caller's id to
+ * the stored one first; route params and body fields are canonicalised by `UuidPipe`/`uuidField`).
  */
 function sameUuid(a, b) {
-    return typeof a === 'string' && typeof b === 'string' && a.toLowerCase() === b.toLowerCase();
+    if (typeof a !== 'string' || typeof b !== 'string')
+        return false;
+    if (a === b)
+        return true;
+    const canonical = (0, engine_1.canonicalUuid)(a);
+    return canonical !== null && canonical === (0, engine_1.canonicalUuid)(b);
 }
-/** Coerce an unknown field value to a string uuid or null. */
+/**
+ * Coerce a STORED field value (a record view read back from the engine) to a string uuid or null.
+ * Not an input validator: request ids go through `UuidPipe` / `uuidField` (Phase 11 #1).
+ */
 function asUuid(v) {
     return typeof v === 'string' && v.length > 0 ? v : null;
 }

package/dist/features/user/email-address-changer.token.d.ts

@@ -0,0 +1,8 @@
+/**
+ * DI token for the administrator path's email changer (security hardening Phase 12, KI #14):
+ * guard's `MariaDbEmailAddressChanger`, built by `IdentityFeatureModule.forRoot()` over the ONE
+ * shared authz pool and injected into `UserService`. It is the same class guard's
+ * `POST /auth/confirm-email` uses, so the collision and login-hint rules never drift.
+ */
+export declare const IDENTITY_EMAIL_ADDRESS_CHANGER: unique symbol;
+//# sourceMappingURL=email-address-changer.token.d.ts.map

package/dist/features/user/email-address-changer.token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-address-changer.token.d.ts","sourceRoot":"","sources":["../../../src/features/user/email-address-changer.token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC"}

package/dist/features/user/email-address-changer.token.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_EMAIL_ADDRESS_CHANGER = void 0;
+/**
+ * DI token for the administrator path's email changer (security hardening Phase 12, KI #14):
+ * guard's `MariaDbEmailAddressChanger`, built by `IdentityFeatureModule.forRoot()` over the ONE
+ * shared authz pool and injected into `UserService`. It is the same class guard's
+ * `POST /auth/confirm-email` uses, so the collision and login-hint rules never drift.
+ */
+exports.IDENTITY_EMAIL_ADDRESS_CHANGER = Symbol('IDENTITY_EMAIL_ADDRESS_CHANGER');

package/dist/features/user/user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAW3D;0CACsC;IAGtC,OAAO,CAAgB,IAAI,EAAE,MAAM;IAInC,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACV,IAAI,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;CAIxE"}
+{"version":3,"file":"user.controller.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAOvD,qBAEa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,WAAW;IAE/C;;;;OAIG;IAGG,SAAS,CAAU,KAAK,EAAE,YAAY;;;;;;IAM5C;;;OAGG;IAGG,UAAU,CACP,GAAG,EAAE,aAAa,EACjB,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAU3D;0CACsC;IAGtC,OAAO,CAA0B,IAAI,EAAE,MAAM;IAI7C,iGAAiG;IAG3F,UAAU,CACP,GAAG,EAAE,aAAa,EACA,IAAI,EAAE,MAAM,EAC7B,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAUtE,0FAA0F;IAGpF,UAAU,CAAQ,GAAG,EAAE,aAAa,EAA2B,IAAI,EAAE,MAAM;;;CAIlF"}

package/dist/features/user/user.controller.js

@@ -42,11 +42,10 @@ let UserController = class UserController {
      * first (active) membership in the same transaction; it must be a company the caller manages.
      */
     async createUser(req, body) {
+        const companyUuid = (0, guard_1.optionalUuidField)(body?.companyUuid, 'companyUuid');
         const id = await this.users.createUser(req.principal, {
             username: body?.username ?? 'Untitled',
-            ...(typeof body?.companyUuid === 'string' && body.companyUuid.length > 0
-                ? { companyUuid: body.companyUuid }
-                : {}),
+            ...(companyUuid !== undefined ? { companyUuid } : {}),
         });
         return { id };
     }
@@ -91,7 +90,7 @@ __decorate([
 __decorate([
     (0, common_1.Get)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'read' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", void 0)
@@ -100,7 +99,7 @@ __decorate([
     (0, common_1.Put)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'update' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __param(2, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String, Object]),
@@ -110,7 +109,7 @@ __decorate([
     (0, common_1.Delete)('users/:uuid'),
     (0, guard_1.Classified)({ typeKey: 'user', action: 'delete' }),
     __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)

package/dist/features/user/user.service.d.ts

@@ -1,6 +1,6 @@
 import { RecordsService, type RecordId } from '@astram/engine';
 import type { Principal } from '@astram/core';
-import { type EmailSender, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
+import { type EmailAddressChanger, type EmailSender, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
 import { type PostingVersionBump } from '../membership/posting-version-bump.js';
 import { type ListParams } from '../shared/list-query.js';
 import { GrantCeiling } from '../authz/grant-ceiling.js';
@@ -23,6 +23,11 @@ export interface UserPatch {
  *   - an email change burns the target's outstanding password-reset tokens BEFORE the change and
  *     notifies the OLD address after it (best-effort), when guard's reset-token store and email
  *     sender are wired (`ShieldModule.forRoot({ auth: true })`).
+ *   - Phase 12 (KI #14): the email itself is written through guard's ONE email-change helper
+ *     (`MariaDbEmailAddressChanger`, the same one `POST /auth/confirm-email` uses): canonical
+ *     address (trim → NFKC → lower-case), collision refusal (409) and login-hint follow in ONE
+ *     transaction, the user's pending self-service tokens burned in it, and an audit row in the
+ *     engine's shape written on that transaction (fail closed). Not wired → the change is refused.
  */
 export declare class UserService {
     private readonly records;
@@ -31,8 +36,11 @@ export declare class UserService {
     private readonly emailSender?;
     private readonly sessions?;
     private readonly versionBump?;
+    private readonly emailAddresses?;
     private readonly logger;
-    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined);
+    /** The engine's audit sink, used on the email helper's transaction (no pool of its own). */
+    private readonly emailAudit;
+    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined);
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
      * ONE transaction — the onboarding path for a non-root admin, whose membership create is checked
@@ -48,6 +56,14 @@ export declare class UserService {
     getUser(uuid: string): Promise<import("@astram/engine").RecordView | null>;
     /** Update a user (whitelisted patch; username/email/status changes need dominance — class doc). */
     updateUser(actor: Principal, uuid: string, patch: UserPatch): Promise<void>;
+    /**
+     * Phase 12 (KI #14): write a dominated user's new (canonical) email through guard's
+     * email-change helper — ONE transaction that locks the user and credential rows, refuses a
+     * collision with another user's email or login hint (→ 409), moves the login hint when it
+     * equalled the old email, burns the user's pending self-service tokens, and writes the audit row
+     * (engine shape, fail closed). Reset links are burned BEFORE (a failure aborts the change).
+     */
+    private changeEmail;
     /**
      * After a status change (security hardening Phase 3): bump every tenant the user is a member of
      * (the next request reloads its grants: none while disabled, back when re-enabled), and, when the

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAMzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAnB/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA;IAG1D;;;;OAIG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;IAcpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjF;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAWzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAMpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAzBlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA;IAG9D;;;;OAIG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC5D,OAAO,CAAC,QAAQ,CAAC;IAcpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAmCzB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}

package/dist/features/user/user.service.js

@@ -21,6 +21,7 @@ const posting_version_bump_js_1 = require("../membership/posting-version-bump.js
 const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
+const email_address_changer_token_js_1 = require("./email-address-changer.token.js");
 const USER_SEARCH_FIELDS = ['username', 'email'];
 const USER_SORT_FIELDS = ['username', 'email', 'status', 'createdAt'];
 /**
@@ -36,6 +37,11 @@ const USER_SORT_FIELDS = ['username', 'email', 'status', 'createdAt'];
  *   - an email change burns the target's outstanding password-reset tokens BEFORE the change and
  *     notifies the OLD address after it (best-effort), when guard's reset-token store and email
  *     sender are wired (`ShieldModule.forRoot({ auth: true })`).
+ *   - Phase 12 (KI #14): the email itself is written through guard's ONE email-change helper
+ *     (`MariaDbEmailAddressChanger`, the same one `POST /auth/confirm-email` uses): canonical
+ *     address (trim → NFKC → lower-case), collision refusal (409) and login-hint follow in ONE
+ *     transaction, the user's pending self-service tokens burned in it, and an audit row in the
+ *     engine's shape written on that transaction (fail closed). Not wired → the change is refused.
  */
 let UserService = UserService_1 = class UserService {
     records;
@@ -44,14 +50,18 @@ let UserService = UserService_1 = class UserService {
     emailSender;
     sessions;
     versionBump;
+    emailAddresses;
     logger = new common_1.Logger(UserService_1.name);
-    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump) {
+    /** The engine's audit sink, used on the email helper's transaction (no pool of its own). */
+    emailAudit = new engine_1.MariaDbAuditSink({});
+    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses) {
         this.records = records;
         this.ceiling = ceiling;
         this.resetTokens = resetTokens;
         this.emailSender = emailSender;
         this.sessions = sessions;
         this.versionBump = versionBump;
+        this.emailAddresses = emailAddresses;
     }
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
@@ -91,23 +101,26 @@ let UserService = UserService_1 = class UserService {
         if (usernameChanged)
             fields.username = patch.username;
         const oldEmail = typeof current.fields.email === 'string' ? current.fields.email : '';
-        const emailChanged = typeof patch?.email === 'string' && patch.email !== oldEmail;
+        // Phase 12 (A5): the address is canonicalised once; that value is compared, checked and written.
+        const newEmail = typeof patch?.email === 'string' ? (0, guard_1.canonicalEmail)(patch.email) : undefined;
+        const emailChanged = newEmail !== undefined && newEmail !== (0, guard_1.canonicalEmail)(oldEmail);
+        if (emailChanged && !(0, guard_1.isEmailShaped)(newEmail)) {
+            throw new identity_errors_js_1.IdentityBadRequestError('Enter a valid email address.');
+        }
         const statusChanged = typeof patch?.status === 'string' && patch.status !== current.fields.status;
         // A request for a non-active status ALWAYS runs the follow-up (Phase 3 review P1), even when
         // the stored status already matches: re-sending "disable" repairs a disable whose bump or
         // session revoke failed earlier (idempotent).
         const wantsInactive = typeof patch?.status === 'string' && patch.status !== 'active';
-        if (emailChanged)
-            fields.email = patch.email;
         if (statusChanged)
             fields.status = patch.status;
         if (usernameChanged || emailChanged || statusChanged || wantsInactive) {
             await this.ceiling.assertDominates(actor, uuid);
         }
+        // The email first (the step most likely to be refused, 409), through the ONE helper.
+        if (emailChanged)
+            await this.changeEmail(actor, uuid, newEmail);
         if (Object.keys(fields).length > 0) {
-            // Burn outstanding reset links BEFORE the address changes (a failure aborts the change).
-            if (emailChanged && this.resetTokens)
-                await this.resetTokens.invalidateAllForPrincipal(uuid);
             await this.records.update('user', uuid, { fields });
         }
         if (statusChanged || wantsInactive)
@@ -115,6 +128,49 @@ let UserService = UserService_1 = class UserService {
         if (emailChanged && oldEmail)
             await this.notifyEmailChanged(oldEmail);
     }
+    /**
+     * Phase 12 (KI #14): write a dominated user's new (canonical) email through guard's
+     * email-change helper — ONE transaction that locks the user and credential rows, refuses a
+     * collision with another user's email or login hint (→ 409), moves the login hint when it
+     * equalled the old email, burns the user's pending self-service tokens, and writes the audit row
+     * (engine shape, fail closed). Reset links are burned BEFORE (a failure aborts the change).
+     */
+    async changeEmail(actor, uuid, newEmail) {
+        const changer = this.emailAddresses;
+        if (changer == null) {
+            // Fail closed: never an unchecked write that could collide or strand the login hint.
+            throw new Error('UserService: no email-address changer is wired; email changes are refused');
+        }
+        if (this.resetTokens)
+            await this.resetTokens.invalidateAllForPrincipal(uuid);
+        const outcome = await changer.change({
+            principalId: uuid,
+            newEmail,
+            withinTransaction: async (query, result) => {
+                const event = {
+                    type: 'admin_action',
+                    occurredAtMs: Date.now(),
+                    actorId: actor.id,
+                    tenantId: actor.tenantId,
+                    action: { key: 'update' },
+                    resource: { level: 'record', typeKey: 'user', tenantId: actor.tenantId, recordId: uuid },
+                    attributes: {
+                        op: 'update',
+                        typeKey: 'user',
+                        fields: ['email'],
+                        newEmail: (0, guard_1.maskEmail)(newEmail),
+                        loginHintMoved: result.hintMoved,
+                    },
+                };
+                await this.emailAudit.record(event, (sql, params) => query(sql, params));
+            },
+        });
+        if (outcome.status === 'unavailable') {
+            throw new identity_errors_js_1.IdentityConflictError('That email address is already in use.');
+        }
+        if (outcome.status !== 'changed')
+            throw new identity_errors_js_1.IdentityNotFoundError('User not found.');
+    }
     /**
      * After a status change (security hardening Phase 3): bump every tenant the user is a member of
      * (the next request reloads its grants: none while disabled, back when re-enabled), and, when the
@@ -178,6 +234,8 @@ exports.UserService = UserService = UserService_1 = __decorate([
     __param(4, (0, common_1.Inject)(guard_1.SHIELD_SESSION_SWEEPER)),
     __param(5, (0, common_1.Optional)()),
     __param(5, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
+    __param(6, (0, common_1.Optional)()),
+    __param(6, (0, common_1.Inject)(email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object])
 ], UserService);

package/migrations/1710000000020-CreateEmailChangeToken.cjs

@@ -0,0 +1,62 @@
+/**
+ * Framework identity migration — `shield_identity.email_change_token` (security hardening
+ * Phase 12, KI #14: verified self-service email change).
+ *
+ * `PATCH /account/profile` with a new email no longer writes `shield_app.users.u_email`; it
+ * stores a single-use, 30-minute token here and mails a confirm link to the NEW address.
+ * `POST /auth/confirm-email` consumes the token and applies the change.
+ *
+ * Columns:
+ *  - ect_token_hash: SHA-256 hex of the raw token (the raw token is never stored). PK, and
+ *    stated UNIQUE explicitly (A11).
+ *  - ect_principal_id: the user (`shield_app.users.u_uuid`). FK with ON DELETE CASCADE so a
+ *    deleted user leaves no pending change behind. The type matches the parent exactly
+ *    (VARCHAR(36), utf8mb4 / utf8mb4_unicode_ci) — InnoDB refuses an FK across mismatched
+ *    string types or collations.
+ *  - ect_new_email: the canonical new address (trim, NFKC, lower-case; A5).
+ *  - ect_old_email: the user's email at request time (A3): confirm refuses when the current
+ *    email no longer equals it (an admin or another flow changed it meanwhile).
+ *  - ect_session_id: the requesting session (`session.s_session_id` is CHAR(64)); confirm keeps
+ *    it and revokes every other session of the user (A7). No FK: a revoked/pruned session must
+ *    not block or cascade the token.
+ *  - ect_tenant_id: the requesting session's tenant (same type as `session.s_tenant_id`). The
+ *    confirm step may run with no session, so its audit rows take the tenant from here
+ *    (`shield_audit.audit_log.al_tenant_id` is NOT NULL).
+ *  - ect_expires_at_ms / ect_consumed_at_ms / ect_created_at_ms: TTL, single use, audit time.
+ *    The expiry index serves the cleanup that runs on every insert (A11).
+ *
+ * The runtime `shield_core` account already holds DML on `shield_identity.*` (no new grant).
+ * NOT in the @astram/identity object registry (engine-internal auth table) — literal column
+ * names. Idempotent (CREATE TABLE IF NOT EXISTS / DROP TABLE IF EXISTS).
+ */
+
+const SCHEMA = 'shield_identity';
+
+async function up({ query }) {
+  await query(
+    `CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`email_change_token\` (
+      ect_token_hash     VARCHAR(64)  NOT NULL,
+      ect_principal_id   VARCHAR(36)  NOT NULL,
+      ect_new_email      VARCHAR(255) NOT NULL,
+      ect_old_email      VARCHAR(255) NULL,
+      ect_session_id     CHAR(64)     NOT NULL,
+      ect_tenant_id      VARCHAR(255) NOT NULL,
+      ect_expires_at_ms  BIGINT       NOT NULL,
+      ect_consumed_at_ms BIGINT       NULL,
+      ect_created_at_ms  BIGINT       NOT NULL,
+      PRIMARY KEY (ect_token_hash),
+      UNIQUE KEY UQ_ect_token_hash (ect_token_hash),
+      INDEX idx_ect_principal (ect_principal_id),
+      INDEX idx_ect_expires (ect_expires_at_ms),
+      CONSTRAINT FK_email_change_token_user
+        FOREIGN KEY (ect_principal_id) REFERENCES \`shield_app\`.\`users\` (u_uuid)
+        ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  );
+}
+
+async function down({ query }) {
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`email_change_token\``);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
+    "@astram/guard": "0.11.0",
     "@astram/core": "1.4.0",
-    "@astram/guard": "0.10.1",
-    "@astram/engine": "0.5.1"
+    "@astram/engine": "0.5.2"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",