@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js

@@ -0,0 +1,162 @@
+/**
+ * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant
+ * boundary leaves evidence, per tenant reached.
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ *
+ * ## The gap this closes
+ *
+ * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on
+ * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and
+ * records the crossing when the caller holds no organization-wide entry for it.
+ *
+ * An APPLICATION-scoped resource never traverses that path — there is no organization in its route
+ * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches
+ * every tenant with nothing written down. That is the same invariant applied at some of its sites
+ * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts
+ * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and
+ * the trail is the worst possible surface on which to make an operator read invisible
+ * (`.claude/rules/administrative-continuity-floors.md`).
+ *
+ * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and
+ * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,
+ * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.
+ *
+ * ## Why only a DECLARED crossing is observed
+ *
+ * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,
+ * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it
+ * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in
+ * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from
+ * anywhere other than the variant's own flag would be a second derivation of one predicate, which is
+ * how a gate and its trail start disagreeing.
+ *
+ * So the enrolment rule is exact, and it is one act: **declaring
+ * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**
+ * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED
+ * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —
+ * and the answer to it is a declaration or a confinement, never an audit row that misdescribes
+ * itself.
+ *
+ * ## Why ORGANIZATIONS-scoped resources are excluded
+ *
+ * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well
+ * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a
+ * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches
+ * would over-count without any way to tell.
+ *
+ * ## Why membership comes from ROLE ENTRIES
+ *
+ * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the
+ * request is acting in, which cannot answer "is this caller a member of the tenant THIS ROW belongs
+ * to" for a result set spanning many. Role entries are the one input a request cannot author for
+ * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation
+ * and the confinement authorities can never disagree about who is a member.
+ */
+import { CoreResourceOperation, ExecutionContext_ExecutionType, ResourcePrimaryScope, } from '@wildo-ai/saas-models';
+import { resolveCallerOrganizationIds, } from '../../security/authorizations/scope-root-collection-confinement.backend.js';
+import { INITIATOR_ORGANIZATION_CONFINEMENT_FIELD } from '../../security/authorizations/initiator-organization-confinement.backend.js';
+/**
+ * The read operations this observation covers.
+ *
+ * All three of the audit door's operations, deliberately. A per-instance READ is included even
+ * though it names one row: reading ONE tenant's audit row from a cross-tenant door is exactly the
+ * access the event exists to show, and covering only the collection verbs would leave the cheapest
+ * crossing — fetch by id — unrecorded.
+ *
+ * COUNT is absent because it returns no rows, so it discloses no tenant's data and this authority
+ * has nothing to attribute. That is a decision, not an omission: if a count is ever considered a
+ * disclosure, it needs a different event carrying a number, the way `PLATFORM_DIRECTORY_ACCESS` does.
+ */
+const OBSERVED_READ_OPERATIONS = [
+    CoreResourceOperation.READ,
+    CoreResourceOperation.LIST,
+    CoreResourceOperation.SEARCH,
+];
+/**
+ * Execution types that carry no operator to attribute.
+ *
+ * Mirrors {@link SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES} and is exempt for the same reason:
+ * `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron, cascade,
+ * bootstrap, and the audit writer's own synthesised temp context) and `WEBHOOK_CALLBACK` is trusted
+ * after signature verification. Recording framework machinery as operator browsing would bury the
+ * signal this event exists to carry — and for the audit resources specifically it would make the
+ * retention scrub and the archive batch emit a crossing per tenant on every run.
+ */
+const OBSERVATION_EXEMPT_EXECUTION_TYPES = [
+    ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,
+    ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,
+];
+/**
+ * Is this read enrolled in the crossing trail at all?
+ *
+ * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing
+ * for a read that is not enrolled — which is every read of all but a handful of resources.
+ */
+export function isObservedCrossTenantRead(params) {
+    if (!params.executedCoreOperation)
+        return false;
+    if (!OBSERVED_READ_OPERATIONS.includes(params.executedCoreOperation))
+        return false;
+    if (OBSERVATION_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType))
+        return false;
+    // Only a DECLARED crossing — see the module JSDoc. This is also what keeps the enrolled set
+    // enumerable: `rg admitsCrossTenantPlatformAdministration` names every door in the trail.
+    if (params.operation?.admitsCrossTenantPlatformAdministration !== true)
+        return false;
+    // Already emitted by `authorizeOrganizations` for this scope; observing again would double-count.
+    if (params.resourceConfiguration.resourcePrimaryScope === String(ResourcePrimaryScope.ORGANIZATIONS))
+        return false;
+    return true;
+}
+/**
+ * The distinct tenants a read reached into, and which of their rows it returned.
+ *
+ * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every
+ * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is
+ * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,
+ * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing
+ * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.
+ *
+ * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three
+ * seams that call this differ in shape and normalising at each of them is how one of them would come
+ * to normalise differently.
+ */
+export function collectCrossTenantReadCrossings(params) {
+    if (!isObservedCrossTenantRead(params))
+        return [];
+    const rows = Array.isArray(params.rows)
+        ? params.rows
+        : params.rows && typeof params.rows === 'object' ? [params.rows] : [];
+    if (rows.length === 0)
+        return [];
+    const callerOrganizationIds = new Set(resolveCallerOrganizationIds(params.executionContext));
+    const byTenant = new Map();
+    for (const row of rows) {
+        const record = row;
+        if (!record || typeof record !== 'object')
+            continue;
+        const rowOrganizationId = String(record[INITIATOR_ORGANIZATION_CONFINEMENT_FIELD] ?? '');
+        // A row with no tenant is not a crossing — it is application-wide data, which is the majority of
+        // the audit trail (94 of 127 rows on the dogfood application that motivated this door).
+        if (!rowOrganizationId)
+            continue;
+        if (callerOrganizationIds.has(rowOrganizationId))
+            continue;
+        const rowId = String(record._id ?? '');
+        const ids = byTenant.get(rowOrganizationId);
+        if (ids) {
+            if (rowId)
+                ids.push(rowId);
+        }
+        else {
+            byTenant.set(rowOrganizationId, rowId ? [rowId] : []);
+        }
+    }
+    return [...byTenant.entries()].map(([targetOrganizationId, targetResourceIds]) => ({
+        targetOrganizationId,
+        targetResourceIds,
+    }));
+}
+//# sourceMappingURL=cross-tenant-read-observation.backend.js.map

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tenant-read-observation.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,4BAA4B,GAE7B,MAAM,sFAAsF,CAAC;AAC9F,OAAO,EAAE,wCAAwC,EAAE,MAAM,uFAAuF,CAAC;AAEjJ;;;;;;;;;;;GAWG;AACH,MAAM,wBAAwB,GAAqC;IACjE,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,kCAAkC,GAA8C;IACpF,8BAA8B,CAAC,4BAA4B;IAC3D,8BAA8B,CAAC,gBAAgB;CAChD,CAAC;AA8BF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAKzC;IACC,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,kCAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACrG,4FAA4F;IAC5F,0FAA0F;IAC1F,IAAI,MAAM,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrF,kGAAkG;IAClG,IAAI,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,KAAK,MAAM,CAAC,oBAAoB,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAM/C;IACC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAElD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,4BAA4B,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAiD,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,wCAAwC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzF,iGAAiG;QACjG,wFAAwF;QACxF,IAAI,CAAC,iBAAiB;YAAE,SAAS;QACjC,IAAI,qBAAqB,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAAE,SAAS;QAE3D,MAAM,KAAK,GAAG,MAAM,CAAE,MAA4B,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,oBAAoB;QACpB,iBAAiB;KAClB,CAAC,CAAC,CAAC;AACN,CAAC","sourcesContent":["/**\n * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see\n *\n * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant\n * boundary leaves evidence, per tenant reached.\n * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT\n *\n * ## The gap this closes\n *\n * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on\n * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and\n * records the crossing when the caller holds no organization-wide entry for it.\n *\n * An APPLICATION-scoped resource never traverses that path — there is no organization in its route\n * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches\n * every tenant with nothing written down. That is the same invariant applied at some of its sites\n * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts\n * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and\n * the trail is the worst possible surface on which to make an operator read invisible\n * (`.claude/rules/administrative-continuity-floors.md`).\n *\n * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and\n * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,\n * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.\n *\n * ## Why only a DECLARED crossing is observed\n *\n * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,\n * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it\n * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in\n * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from\n * anywhere other than the variant's own flag would be a second derivation of one predicate, which is\n * how a gate and its trail start disagreeing.\n *\n * So the enrolment rule is exact, and it is one act: **declaring\n * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**\n * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED\n * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —\n * and the answer to it is a declaration or a confinement, never an audit row that misdescribes\n * itself.\n *\n * ## Why ORGANIZATIONS-scoped resources are excluded\n *\n * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well\n * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a\n * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches\n * would over-count without any way to tell.\n *\n * ## Why membership comes from ROLE ENTRIES\n *\n * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the\n * request is acting in, which cannot answer \"is this caller a member of the tenant THIS ROW belongs\n * to\" for a result set spanning many. Role entries are the one input a request cannot author for\n * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation\n * and the confinement authorities can never disagree about who is a member.\n */\n\nimport {\n  CoreResourceOperation,\n  ExecutionContext_ExecutionType,\n  ResourcePrimaryScope,\n} from '@wildo-ai/saas-models';\n\nimport {\n  resolveCallerOrganizationIds,\n  type ScopeRootCollectionConfinementSignal,\n} from '~wildo-backend-lib/security/authorizations/scope-root-collection-confinement.backend';\nimport { INITIATOR_ORGANIZATION_CONFINEMENT_FIELD } from '~wildo-backend-lib/security/authorizations/initiator-organization-confinement.backend';\n\n/**\n * The read operations this observation covers.\n *\n * All three of the audit door's operations, deliberately. A per-instance READ is included even\n * though it names one row: reading ONE tenant's audit row from a cross-tenant door is exactly the\n * access the event exists to show, and covering only the collection verbs would leave the cheapest\n * crossing — fetch by id — unrecorded.\n *\n * COUNT is absent because it returns no rows, so it discloses no tenant's data and this authority\n * has nothing to attribute. That is a decision, not an omission: if a count is ever considered a\n * disclosure, it needs a different event carrying a number, the way `PLATFORM_DIRECTORY_ACCESS` does.\n */\nconst OBSERVED_READ_OPERATIONS: readonly CoreResourceOperation[] = [\n  CoreResourceOperation.READ,\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n];\n\n/**\n * Execution types that carry no operator to attribute.\n *\n * Mirrors {@link SCOPE_ROOT_CONFINEMENT_EXEMPT_EXECUTION_TYPES} and is exempt for the same reason:\n * `INTERNALLY_INITIATED_REQUEST` is the framework's context-free system actor (batch, cron, cascade,\n * bootstrap, and the audit writer's own synthesised temp context) and `WEBHOOK_CALLBACK` is trusted\n * after signature verification. Recording framework machinery as operator browsing would bury the\n * signal this event exists to carry — and for the audit resources specifically it would make the\n * retention scrub and the archive batch emit a crossing per tenant on every run.\n */\nconst OBSERVATION_EXEMPT_EXECUTION_TYPES: readonly ExecutionContext_ExecutionType[] = [\n  ExecutionContext_ExecutionType.INTERNALLY_INITIATED_REQUEST,\n  ExecutionContext_ExecutionType.WEBHOOK_CALLBACK,\n];\n\n/**\n * The EXECUTED operation variant — the one whose declaration decides enrolment.\n *\n * Passed explicitly rather than read off `executionContext.operation`, and that is a correctness\n * requirement rather than a style choice. A resource authors ONE variant per operation and the\n * config factory derives `summary` and `context` variants from it, so \"the operation\" is ambiguous\n * unless the executed one is named; `authorizations.backend.service` already hedges by consulting\n * BOTH the passed operation and the context's, which is the tell that the context's copy cannot be\n * relied on. Taking it here means the enrolment decision and the `admissionDeclared` the emitter\n * writes are read from the SAME object and cannot disagree — the failure this repository keeps\n * paying for when one predicate is derived twice.\n */\nexport interface CrossTenantReadObservationOperation {\n  readonly admitsCrossTenantPlatformAdministration?: boolean;\n}\n\n/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */\nexport interface CrossTenantReadObservationResource {\n  readonly resourceIdentifier?: string;\n  readonly resourcePrimaryScope?: string;\n}\n\n/** One tenant reached by a single read, with the rows of that tenant it returned. */\nexport interface CrossTenantReadCrossing {\n  readonly targetOrganizationId: string;\n  readonly targetResourceIds: string[];\n}\n\n/**\n * Is this read enrolled in the crossing trail at all?\n *\n * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing\n * for a read that is not enrolled — which is every read of all but a handful of resources.\n */\nexport function isObservedCrossTenantRead(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n}): boolean {\n  if (!params.executedCoreOperation) return false;\n  if (!OBSERVED_READ_OPERATIONS.includes(params.executedCoreOperation)) return false;\n  if (OBSERVATION_EXEMPT_EXECUTION_TYPES.includes(params.executionContext.executionType)) return false;\n  // Only a DECLARED crossing — see the module JSDoc. This is also what keeps the enrolled set\n  // enumerable: `rg admitsCrossTenantPlatformAdministration` names every door in the trail.\n  if (params.operation?.admitsCrossTenantPlatformAdministration !== true) return false;\n  // Already emitted by `authorizeOrganizations` for this scope; observing again would double-count.\n  if (params.resourceConfiguration.resourcePrimaryScope === String(ResourcePrimaryScope.ORGANIZATIONS)) return false;\n  return true;\n}\n\n/**\n * The distinct tenants a read reached into, and which of their rows it returned.\n *\n * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every\n * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is\n * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,\n * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing\n * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.\n *\n * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three\n * seams that call this differ in shape and normalising at each of them is how one of them would come\n * to normalise differently.\n */\nexport function collectCrossTenantReadCrossings(params: {\n  readonly executionContext: ScopeRootCollectionConfinementSignal;\n  readonly operation: CrossTenantReadObservationOperation | undefined;\n  readonly resourceConfiguration: CrossTenantReadObservationResource;\n  readonly executedCoreOperation: CoreResourceOperation | undefined;\n  readonly rows: unknown;\n}): CrossTenantReadCrossing[] {\n  if (!isObservedCrossTenantRead(params)) return [];\n\n  const rows = Array.isArray(params.rows)\n    ? params.rows\n    : params.rows && typeof params.rows === 'object' ? [params.rows] : [];\n  if (rows.length === 0) return [];\n\n  const callerOrganizationIds = new Set(resolveCallerOrganizationIds(params.executionContext));\n\n  const byTenant = new Map<string, string[]>();\n  for (const row of rows) {\n    const record = row as Record<string, unknown> | null | undefined;\n    if (!record || typeof record !== 'object') continue;\n    const rowOrganizationId = String(record[INITIATOR_ORGANIZATION_CONFINEMENT_FIELD] ?? '');\n    // A row with no tenant is not a crossing — it is application-wide data, which is the majority of\n    // the audit trail (94 of 127 rows on the dogfood application that motivated this door).\n    if (!rowOrganizationId) continue;\n    if (callerOrganizationIds.has(rowOrganizationId)) continue;\n\n    const rowId = String((record as { _id?: unknown })._id ?? '');\n    const ids = byTenant.get(rowOrganizationId);\n    if (ids) {\n      if (rowId) ids.push(rowId);\n    } else {\n      byTenant.set(rowOrganizationId, rowId ? [rowId] : []);\n    }\n  }\n\n  return [...byTenant.entries()].map(([targetOrganizationId, targetResourceIds]) => ({\n    targetOrganizationId,\n    targetResourceIds,\n  }));\n}\n"]}

package/dist/esm/security/authorizations/initiator-organization-confinement.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initiator-organization-confinement.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5F;AAED,qFAAqF;AACrF,MAAM,WAAW,4CAA4C;IAC3D,iCAAiC,CAAC,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,sFAAsF;AACtF,eAAO,MAAM,wCAAwC,mBAAmB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8CAA8C,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;IAClE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,4CAA4C,CAAC;IACnE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,OAAO,CAkCV"}
+{"version":3,"file":"initiator-organization-confinement.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5F;AAED,qFAAqF;AACrF,MAAM,WAAW,4CAA4C;IAC3D,iCAAiC,CAAC,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,sFAAsF;AACtF,eAAO,MAAM,wCAAwC,mBAAmB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8CAA8C,CAAC,OAAO,SAAS,MAAM,EAAE,MAAM,EAAE;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;IAClE,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,4CAA4C,CAAC;IACnE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,OAAO,CAyDV"}

package/dist/esm/security/authorizations/initiator-organization-confinement.backend.js

@@ -59,7 +59,30 @@ export function assignInitiatorOrganizationConfinementToFilter(params) {
         || !params.isFieldPersisted(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)) {
         return false;
     }
-    const organizationPaths = params.schemaPaths.findNestedFieldPathsFromZodSchema(params.mainSchema, INITIATOR_ORGANIZATION_CONFINEMENT_FIELD);
+    /*
+     * TOP-LEVEL PATHS ONLY — a correction measured on 2026-09-01, in both directions at once.
+     *
+     * `findNestedFieldPathsFromZodSchema` returns EVERY schema path ending in `organizationId`,
+     * and the first control-plane resource to reach this rule over HTTP
+     * (`wildoApplicationActorTasks`) models one NESTED occurrence:
+     * `errorStates.errorItems.initiatorIds.organizationId` — a RECORDED FACT about a past error's
+     * initiator, not a tenancy column. Confining on it failed differently per adapter, and the loud
+     * failure was the harmless one:
+     *
+     * - PostgreSQL: `invalid column reference errorStates.errorItems.initiatorIds.organizationId`
+     *   — a 400 on every LIST. Visible, kind.
+     * - MongoDB: `{ "errorStates…organizationId": org }` matches only rows where a nested error
+     *   item CARRIES that value — so every row with no recorded errors would silently vanish from
+     *   its OWN tenant's listings. Invisible, and the dangerous direction
+     *   (`negative-results-require-a-positive-probe.md`: under-reporting reads as truth).
+     *
+     * Top-level is not an approximation of the rule — it IS the rule. The write path's own
+     * invariant (documented at the contextual-filter builder beside
+     * `enrichDataWithContextFields`) is that a scoped resource always carries its scope FK as a
+     * top-level column; tenancy never lives only inside a nested value. A deeper occurrence of the
+     * field NAME is data about something else and was never this confinement's subject.
+     */
+    const organizationPaths = params.schemaPaths.findNestedFieldPathsFromZodSchema(params.mainSchema, INITIATOR_ORGANIZATION_CONFINEMENT_FIELD).filter((fullPath) => !fullPath.includes('.'));
     let applied = false;
     organizationPaths.forEach((fullPath) => {
         if (!params.schemaPaths.hasNestedPath(params.filter, fullPath)) {

package/dist/esm/security/authorizations/initiator-organization-confinement.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"initiator-organization-confinement.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAoBH,sFAAsF;AACtF,MAAM,CAAC,MAAM,wCAAwC,GAAG,gBAAgB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8CAA8C,CAAyB,MAOtF;IACC,MAAM,uBAAuB,GAAG,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,cAAc,CAAC;IACrF,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,4FAA4F;IAC5F,2EAA2E;IAC3E,IAAI,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,wCAAwC,CAAC;WACnE,CAAC,MAAM,CAAC,gBAAgB,CAAC,wCAAwC,CAAC,EACrE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,iCAAiC,CAC5E,MAAM,CAAC,UAAU,EACjB,wCAAwC,CACzC,CAAC;IAEF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YACpF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["/**\n * Initiator-organization confinement — ONE definition, compiled by both adapters (D3).\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines a query to the tenant the\n * caller is acting in.\n *\n * A caller's `initiatorIds.organizationId` is not a value they can choose: the execution-context\n * creator validates a requested organization against their MEMBERSHIPS and refuses one they do\n * not belong to. So it is a trustworthy statement of \"the tenant this request is acting in\", and\n * rows of other tenants are not part of what was asked for.\n *\n * **Why this exists as an authority rather than a repository branch.** PostgreSQL applied this\n * confinement and MongoDB did not — divergence D3, and the only measured divergence where the\n * two adapters disagreed about WHO CAN SEE WHOSE ROWS. Under the layering principle that\n * tenancy is a resource-system rule and adapters carry dialect only, a predicate about who may\n * read what has no business being written twice, or once.\n *\n * **The crossing is the part that was missing, and it is why the PostgreSQL version was wrong.**\n * The platform declares deliberate, reviewed cross-tenant doors per operation variant\n * (`admitsCrossTenantPlatformAdministration`) — `organizationMembers.grantOwnership`, the\n * owner-floor repair door, is one. Those are admitted at the AUTHORIZATION layer, before any\n * repository runs. A confinement that does not know about them lets authorization admit the\n * crossing and then silently filters the query to the operator's own tenant — so the repair door\n * reports success and repairs nothing, which is precisely the failure mode\n * `.claude/rules/administrative-continuity-floors.md` warns about.\n *\n * So: confine by default, and step aside ONLY for an operation that has declared the crossing.\n */\n\n/** What this authority needs from the execution context. Deliberately narrow, like its siblings. */\nexport interface InitiatorOrganizationConfinementSignal {\n  readonly initiatorIds?: { readonly organizationId?: string | null } | null;\n  /**\n   * The operation being executed. Only its crossing declaration is read — an operation that\n   * did NOT declare one is confined, which is what makes the opt-in enumerable rather than a\n   * privilege-based bypass.\n   */\n  readonly operation?: { readonly admitsCrossTenantPlatformAdministration?: boolean } | null;\n}\n\n/** The schema-path operations this rule performs, supplied by the resource layer. */\nexport interface InitiatorOrganizationConfinementPathResolver {\n  findNestedFieldPathsFromZodSchema(mainSchema: any, fieldIdentifier: string): string[];\n  hasNestedPath(target: object, path: string): boolean;\n  setNestedValue(target: object, path: string, value: unknown): void;\n}\n\n/** The field this confinement is keyed on. Named once so no call site can typo it. */\nexport const INITIATOR_ORGANIZATION_CONFINEMENT_FIELD = 'organizationId';\n\n/**\n * Confine `filter` to the caller's organization, unless the operation declares a crossing.\n *\n * Returns whether the confinement was applied, so a caller can report or pin the decision\n * rather than having to re-derive it.\n *\n * Precedence deliberately matches the relationship-FK sibling and NOT the retention hide: an\n * already-present path is left alone. A value at this key was put there by the context layer\n * from the addressed URL scope, which the authorization layer has already reconciled against\n * the caller; overwriting it here would silently re-scope a request that was legitimately\n * addressed elsewhere.\n *\n * `isFieldPersisted` exists because PostgreSQL can be stricter than MongoDB: it knows which\n * columns are actually planned, and filtering on an unplanned one is a SQL error rather than a\n * no-op. MongoDB passes a predicate that is always true.\n */\nexport function assignInitiatorOrganizationConfinementToFilter<TFilter extends object>(params: {\n  readonly filter: TFilter;\n  readonly executionContext: InitiatorOrganizationConfinementSignal;\n  readonly blacklistedFields: ReadonlySet<string>;\n  readonly mainSchema: unknown;\n  readonly schemaPaths: InitiatorOrganizationConfinementPathResolver;\n  readonly isFieldPersisted: (fieldName: string) => boolean;\n}): boolean {\n  const initiatorOrganizationId = params.executionContext.initiatorIds?.organizationId;\n  if (!initiatorOrganizationId) {\n    return false;\n  }\n\n  // A DECLARED crossing is the whole point of the opt-in: the authorization layer has already\n  // admitted this operation across the tenant boundary, and re-confining it here would undo a\n  // decision that was made deliberately, with an audit record, one layer up.\n  if (params.executionContext.operation?.admitsCrossTenantPlatformAdministration === true) {\n    return false;\n  }\n\n  if (\n    params.blacklistedFields.has(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n    || !params.isFieldPersisted(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n  ) {\n    return false;\n  }\n\n  const organizationPaths = params.schemaPaths.findNestedFieldPathsFromZodSchema(\n    params.mainSchema,\n    INITIATOR_ORGANIZATION_CONFINEMENT_FIELD,\n  );\n\n  let applied = false;\n  organizationPaths.forEach((fullPath) => {\n    if (!params.schemaPaths.hasNestedPath(params.filter, fullPath)) {\n      params.schemaPaths.setNestedValue(params.filter, fullPath, initiatorOrganizationId);\n      applied = true;\n    }\n  });\n\n  return applied;\n}\n"]}
+{"version":3,"file":"initiator-organization-confinement.backend.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/initiator-organization-confinement.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAoBH,sFAAsF;AACtF,MAAM,CAAC,MAAM,wCAAwC,GAAG,gBAAgB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8CAA8C,CAAyB,MAOtF;IACC,MAAM,uBAAuB,GAAG,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,cAAc,CAAC;IACrF,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IAC5F,4FAA4F;IAC5F,2EAA2E;IAC3E,IAAI,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,uCAAuC,KAAK,IAAI,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,wCAAwC,CAAC;WACnE,CAAC,MAAM,CAAC,gBAAgB,CAAC,wCAAwC,CAAC,EACrE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,iCAAiC,CAC5E,MAAM,CAAC,UAAU,EACjB,wCAAwC,CACzC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACrC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YACpF,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["/**\n * Initiator-organization confinement — ONE definition, compiled by both adapters (D3).\n *\n * assurance-control: WILDO.ACCESS.SCOPE_CONFINEMENT — confines a query to the tenant the\n * caller is acting in.\n *\n * A caller's `initiatorIds.organizationId` is not a value they can choose: the execution-context\n * creator validates a requested organization against their MEMBERSHIPS and refuses one they do\n * not belong to. So it is a trustworthy statement of \"the tenant this request is acting in\", and\n * rows of other tenants are not part of what was asked for.\n *\n * **Why this exists as an authority rather than a repository branch.** PostgreSQL applied this\n * confinement and MongoDB did not — divergence D3, and the only measured divergence where the\n * two adapters disagreed about WHO CAN SEE WHOSE ROWS. Under the layering principle that\n * tenancy is a resource-system rule and adapters carry dialect only, a predicate about who may\n * read what has no business being written twice, or once.\n *\n * **The crossing is the part that was missing, and it is why the PostgreSQL version was wrong.**\n * The platform declares deliberate, reviewed cross-tenant doors per operation variant\n * (`admitsCrossTenantPlatformAdministration`) — `organizationMembers.grantOwnership`, the\n * owner-floor repair door, is one. Those are admitted at the AUTHORIZATION layer, before any\n * repository runs. A confinement that does not know about them lets authorization admit the\n * crossing and then silently filters the query to the operator's own tenant — so the repair door\n * reports success and repairs nothing, which is precisely the failure mode\n * `.claude/rules/administrative-continuity-floors.md` warns about.\n *\n * So: confine by default, and step aside ONLY for an operation that has declared the crossing.\n */\n\n/** What this authority needs from the execution context. Deliberately narrow, like its siblings. */\nexport interface InitiatorOrganizationConfinementSignal {\n  readonly initiatorIds?: { readonly organizationId?: string | null } | null;\n  /**\n   * The operation being executed. Only its crossing declaration is read — an operation that\n   * did NOT declare one is confined, which is what makes the opt-in enumerable rather than a\n   * privilege-based bypass.\n   */\n  readonly operation?: { readonly admitsCrossTenantPlatformAdministration?: boolean } | null;\n}\n\n/** The schema-path operations this rule performs, supplied by the resource layer. */\nexport interface InitiatorOrganizationConfinementPathResolver {\n  findNestedFieldPathsFromZodSchema(mainSchema: any, fieldIdentifier: string): string[];\n  hasNestedPath(target: object, path: string): boolean;\n  setNestedValue(target: object, path: string, value: unknown): void;\n}\n\n/** The field this confinement is keyed on. Named once so no call site can typo it. */\nexport const INITIATOR_ORGANIZATION_CONFINEMENT_FIELD = 'organizationId';\n\n/**\n * Confine `filter` to the caller's organization, unless the operation declares a crossing.\n *\n * Returns whether the confinement was applied, so a caller can report or pin the decision\n * rather than having to re-derive it.\n *\n * Precedence deliberately matches the relationship-FK sibling and NOT the retention hide: an\n * already-present path is left alone. A value at this key was put there by the context layer\n * from the addressed URL scope, which the authorization layer has already reconciled against\n * the caller; overwriting it here would silently re-scope a request that was legitimately\n * addressed elsewhere.\n *\n * `isFieldPersisted` exists because PostgreSQL can be stricter than MongoDB: it knows which\n * columns are actually planned, and filtering on an unplanned one is a SQL error rather than a\n * no-op. MongoDB passes a predicate that is always true.\n */\nexport function assignInitiatorOrganizationConfinementToFilter<TFilter extends object>(params: {\n  readonly filter: TFilter;\n  readonly executionContext: InitiatorOrganizationConfinementSignal;\n  readonly blacklistedFields: ReadonlySet<string>;\n  readonly mainSchema: unknown;\n  readonly schemaPaths: InitiatorOrganizationConfinementPathResolver;\n  readonly isFieldPersisted: (fieldName: string) => boolean;\n}): boolean {\n  const initiatorOrganizationId = params.executionContext.initiatorIds?.organizationId;\n  if (!initiatorOrganizationId) {\n    return false;\n  }\n\n  // A DECLARED crossing is the whole point of the opt-in: the authorization layer has already\n  // admitted this operation across the tenant boundary, and re-confining it here would undo a\n  // decision that was made deliberately, with an audit record, one layer up.\n  if (params.executionContext.operation?.admitsCrossTenantPlatformAdministration === true) {\n    return false;\n  }\n\n  if (\n    params.blacklistedFields.has(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n    || !params.isFieldPersisted(INITIATOR_ORGANIZATION_CONFINEMENT_FIELD)\n  ) {\n    return false;\n  }\n\n  /*\n   * TOP-LEVEL PATHS ONLY — a correction measured on 2026-09-01, in both directions at once.\n   *\n   * `findNestedFieldPathsFromZodSchema` returns EVERY schema path ending in `organizationId`,\n   * and the first control-plane resource to reach this rule over HTTP\n   * (`wildoApplicationActorTasks`) models one NESTED occurrence:\n   * `errorStates.errorItems.initiatorIds.organizationId` — a RECORDED FACT about a past error's\n   * initiator, not a tenancy column. Confining on it failed differently per adapter, and the loud\n   * failure was the harmless one:\n   *\n   * - PostgreSQL: `invalid column reference errorStates.errorItems.initiatorIds.organizationId`\n   *   — a 400 on every LIST. Visible, kind.\n   * - MongoDB: `{ \"errorStates…organizationId\": org }` matches only rows where a nested error\n   *   item CARRIES that value — so every row with no recorded errors would silently vanish from\n   *   its OWN tenant's listings. Invisible, and the dangerous direction\n   *   (`negative-results-require-a-positive-probe.md`: under-reporting reads as truth).\n   *\n   * Top-level is not an approximation of the rule — it IS the rule. The write path's own\n   * invariant (documented at the contextual-filter builder beside\n   * `enrichDataWithContextFields`) is that a scoped resource always carries its scope FK as a\n   * top-level column; tenancy never lives only inside a nested value. A deeper occurrence of the\n   * field NAME is data about something else and was never this confinement's subject.\n   */\n  const organizationPaths = params.schemaPaths.findNestedFieldPathsFromZodSchema(\n    params.mainSchema,\n    INITIATOR_ORGANIZATION_CONFINEMENT_FIELD,\n  ).filter((fullPath) => !fullPath.includes('.'));\n\n  let applied = false;\n  organizationPaths.forEach((fullPath) => {\n    if (!params.schemaPaths.hasNestedPath(params.filter, fullPath)) {\n      params.schemaPaths.setNestedValue(params.filter, fullPath, initiatorOrganizationId);\n      applied = true;\n    }\n  });\n\n  return applied;\n}\n"]}

package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts

@@ -177,21 +177,16 @@ export type OrganizationOwnerConferralResolver = () => string[];
  * Every ORGANIZATIONS-scope role key whose `inheritFrom` chain reaches `ORG_OWNER` — i.e. every role
  * whose holder passes an owner gate.
  *
- * Mirrors the authorization layer's own test: `authorize` admits a caller when
- * `getRoleHierarchy(heldRole, scope).includes(requiredRole)`. Deriving the set the same way is what
- * keeps the floor counting exactly the principals the gates would let through — an independently
- * written membership test is how the two would drift.
- *
- * `ORG_OWNER` itself is seeded unconditionally rather than being discovered by the walk. If an
- * application's role table somehow omitted the key, `getRoleHierarchy` would return an empty chain,
- * the conferring set would be empty, and the floor would then measure a population that is empty by
- * construction — refusing every removal forever while protecting nothing.
- *
- * APPLICATION-scope roles are never consulted: membership `roles` is the ORGANIZATIONS authority
- * axis, and `getRoleHierarchy` partitions the two tables precisely so an app-scoped role string that
- * happens to appear on a membership row confers nothing. The role-ceiling gate relies on the same
- * partition (see its `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker
- * link.
+ * This floor's BINDING of the shared conferral derivation. The derivation itself — and the reasoning
+ * that used to be restated here and in the super-admin floor in two different sets of words — lives
+ * in {@link resolveRolesConferringAnchor}, including why the anchor is seeded unconditionally.
+ *
+ * Membership `roles` is the ORGANIZATIONS authority axis, so APPLICATION-scope roles are never
+ * consulted. That safety comes from RESOLUTION rather than from the field's type: membership `roles`
+ * is a free-form string on purpose (an application declares its own org roles), and what makes an
+ * app-scoped string written onto a membership row confer nothing is that `getRoleHierarchy` reads it
+ * against the ORGANIZATIONS table only. The role-ceiling gate relies on the same partition (see its
+ * `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker link.
  */
 export declare function resolveOrganizationOwnerConferringRoles(authorizationsService: Pick<AuthorizationsBackendService, 'getOrgRoles' | 'getRoleHierarchy'>): string[];
 /**
@@ -524,11 +519,16 @@ export declare function readOwnerMembershipsForSubjects(params: {
  * *with management oversight*, and AC-2(7) requires privileged changes to be monitored — an audited,
  * per-request, non-default override is precisely that, and precisely not a standing bypass.
  *
- * ⚠️ The escape is only half a remedy while the tenant cannot be repaired afterwards. The industry
- * pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an Enterprise
- * owner re-owns the org; otherwise Support). Wildo has the block and not yet the repair door; see
- * O6 in `.claude/plans/last-organization-owner-floor.md`. Until that lands, an acknowledged breach
- * leaves a tenant that only an out-of-band write can rescue, which is why the default stays refuse.
+ * The industry pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an
+ * Enterprise owner re-owns the org; otherwise Support). Wildo has BOTH halves: the block is here, and
+ * the repair door is `organizationMembers.grantOwnership`, a platform-tier verb that promotes an
+ * existing member, writes only `roles`, additively, and is audited at CRITICAL with a mandatory
+ * justification. An acknowledged breach therefore leaves a tenant that cannot administer ITSELF, and
+ * that a platform operator can repair without an out-of-band write.
+ *
+ * ⚠️ The default still stays refuse. A repair door is an escalation someone has to notice and
+ * perform; it is not a reason to strand a tenant casually, and the tenant-tier answer remains
+ * "transfer ownership first".
  */
 export declare function assertOrganizationOwnerFloorForSubjectErasure(params: {
     subjectUserIds: readonly string[];

package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-owner-floor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/organization-owner-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAML,wBAAwB,EACxB,kBAAkB,EAElB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAGrK;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD,EAAE,SAAS,wBAAwB,EAEnG,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2CAA2C,EAAE,SAAS,UAAU,EAAwB,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,kBAAkB,CAGpF,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,sGACyD,CAAC;AAEtG;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,kCAAkC,CAAC;AAEvF;;;GAGG;AACH,oBAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,YAAY,iBAAiB;IAC7B,0EAA0E;IAC1E,wBAAwB,6BAA6B;IACrD,6CAA6C;IAC7C,kBAAkB,uBAAuB;IACzC,mGAAmG;IACnG,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kCAAkC,GAAG,MAAM,MAAM,EAAE,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,uCAAuC,CACrD,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,EAAE,aAAa,GAAG,kBAAkB,CAAC,GAC5F,MAAM,EAAE,CAWV;AAED;;;;;;;;;GASG;AACH,wBAAgB,wCAAwC,CAAC,SAAS,EAAE,SAAS,GAAG,kCAAkC,CAMjH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,6CAA6C,CACjE,2BAA2B,EAAE,yCAAyC,GACrE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAIhC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIxG;AAED,wHAAwH;AACxH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEjF;AAED,6HAA6H;AAC7H,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEhF;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,EACvE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAIT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,qBAAqB,CAAC,GAAG,SAAS,GAAG,IAAI,GACpF,OAAO,CAST;AAED,6CAA6C;AAC7C,KAAK,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,QAAQ,GAAG,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC;AA+B7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoCpB;AAED,yDAAyD;AACzD,MAAM,MAAM,4BAA4B,GAAG;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CA2DpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IACzD,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAClD,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,KAAK,CAmCR;AAED;;;GAGG;AACH,wBAAsB,qCAAqC,CAAC,MAAM,EAAE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CASV;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kDAAkD,CAAC,MAAM,EAAE;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,+CAA+C,CAAC,MAAM,EAAE;IAC5E,WAAW,EAAE,SAAS,CAAC,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IAChE,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wDAAwD,EAAE,SAAS,MAAM,EAGrF,CAAC;AAEF,oGAAoG;AACpG,wBAAgB,+CAA+C,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE9F;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yDAAyD,EAAE,SAAS,MAAM,EAEtF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gDAAgD,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAchC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,mGAAmG;IACnG,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACvF,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;GAKG;AACH,eAAO,MAAM,8CAA8C,EAAE,MAAmC,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzE,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAsB1C;AA6CD,wBAAsB,sCAAsC,CAAC,MAAM,EAAE;IACnE;;;;;OAKG;IACH,2BAA2B,EAAE,yCAAyC,CAAC;IACvE,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC;IACV,0BAA0B,EAAE,MAAM,CAAC;IACnC,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;IAChD,2FAA2F;IAC3F,wBAAwB,EAAE,qBAAqB,EAAE,CAAC;CACnD,CAAC,CA+FD"}
+{"version":3,"file":"organization-owner-floor.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/organization-owner-floor.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAML,wBAAwB,EACxB,kBAAkB,EAElB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,kBAAkB,EAExB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oFAAoF,CAAC;AACvI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAIrK;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oDAAoD,EAAE,SAAS,wBAAwB,EAEnG,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2CAA2C,EAAE,SAAS,UAAU,EAAwB,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,yCAAyC,EAAE,WAAW,CAAC,kBAAkB,CAGpF,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,sGACyD,CAAC;AAEtG;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,kCAAkC,CAAC;AAEvF;;;GAGG;AACH,oBAAY,oCAAoC;IAC9C,6DAA6D;IAC7D,YAAY,iBAAiB;IAC7B,0EAA0E;IAC1E,wBAAwB,6BAA6B;IACrD,6CAA6C;IAC7C,kBAAkB,uBAAuB;IACzC,mGAAmG;IACnG,eAAe,oBAAoB;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kCAAkC,GAAG,MAAM,MAAM,EAAE,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uCAAuC,CACrD,qBAAqB,EAAE,IAAI,CAAC,4BAA4B,EAAE,aAAa,GAAG,kBAAkB,CAAC,GAC5F,MAAM,EAAE,CAOV;AAED;;;;;;;;;GASG;AACH,wBAAgB,wCAAwC,CAAC,SAAS,EAAE,SAAS,GAAG,kCAAkC,CAMjH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,6CAA6C,CACjE,2BAA2B,EAAE,yCAAyC,GACrE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAIhC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAIxG;AAED,wHAAwH;AACxH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEjF;AAED,6HAA6H;AAC7H,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEhF;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,SAAS,GAAG,IAAI,EACvE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,OAAO,CAIT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,qBAAqB,CAAC,GAAG,SAAS,GAAG,IAAI,GACpF,OAAO,CAST;AAED,6CAA6C;AAC7C,KAAK,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,EAAE,KAAK,GAAG,QAAQ,GAAG,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC,CAAC;AA+B7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoCpB;AAED,yDAAyD;AACzD,MAAM,MAAM,4BAA4B,GAAG;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CA2DpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE;IACzD,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAClD,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,KAAK,CAmCR;AAED;;;GAGG;AACH,wBAAsB,qCAAqC,CAAC,MAAM,EAAE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qCAAqC,CAAC,MAAM,EAAE;IAC5D,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CASV;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kDAAkD,CAAC,MAAM,EAAE;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,+CAA+C,CAAC,MAAM,EAAE;IAC5E,WAAW,EAAE,SAAS,CAAC,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC;IAChE,KAAK,EAAE,oCAAoC,CAAC;IAC5C,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wDAAwD,EAAE,SAAS,MAAM,EAGrF,CAAC;AAEF,oGAAoG;AACpG,wBAAgB,+CAA+C,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE9F;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yDAAyD,EAAE,SAAS,MAAM,EAEtF,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gDAAgD,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,CAE/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAchC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,mGAAmG;IACnG,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACvF,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED;;;;;GAKG;AACH,eAAO,MAAM,8CAA8C,EAAE,MAAmC,CAAC;AAEjG,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,6CAA6C,CAAC,MAAM,EAAE;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,oGAAoG;IACpG,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,4BAA4B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzE,GAAG,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAsB1C;AA6CD,wBAAsB,sCAAsC,CAAC,MAAM,EAAE;IACnE;;;;;OAKG;IACH,2BAA2B,EAAE,yCAAyC,CAAC;IACvE,oBAAoB,EAAE,yCAAyC,CAAC;IAChE,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC;IACV,0BAA0B,EAAE,MAAM,CAAC;IACnC,sBAAsB,EAAE,qBAAqB,EAAE,CAAC;IAChD,2FAA2F;IAC3F,wBAAwB,EAAE,qBAAqB,EAAE,CAAC;CACnD,CAAC,CA+FD"}

package/dist/esm/security/authorizations/organization-owner-floor.backend.utils.js

@@ -68,6 +68,7 @@
  */
 import { AdministrativeContinuityErrorCode, CORE_ORG_ROLES, CoreResourceOperation, CoreResourceType, ErrorType, OrganizationMemberStatus, OrganizationStatus, ResourcePrimaryScope, UserStatus, } from '@wildo-ai/saas-models';
 import { SAAS_SERVICE_TYPES } from '../../inject/models/service-types.js';
+import { resolveRolesConferringAnchor } from '../../security/authorizations/role-conferral.backend.utils.js';
 /**
  * The minimum number of administratively usable owners a protected organization must retain.
  *
@@ -170,31 +171,24 @@ export var OrganizationOwnerFloorReductionCause;
  * Every ORGANIZATIONS-scope role key whose `inheritFrom` chain reaches `ORG_OWNER` — i.e. every role
  * whose holder passes an owner gate.
  *
- * Mirrors the authorization layer's own test: `authorize` admits a caller when
- * `getRoleHierarchy(heldRole, scope).includes(requiredRole)`. Deriving the set the same way is what
- * keeps the floor counting exactly the principals the gates would let through — an independently
- * written membership test is how the two would drift.
- *
- * `ORG_OWNER` itself is seeded unconditionally rather than being discovered by the walk. If an
- * application's role table somehow omitted the key, `getRoleHierarchy` would return an empty chain,
- * the conferring set would be empty, and the floor would then measure a population that is empty by
- * construction — refusing every removal forever while protecting nothing.
- *
- * APPLICATION-scope roles are never consulted: membership `roles` is the ORGANIZATIONS authority
- * axis, and `getRoleHierarchy` partitions the two tables precisely so an app-scoped role string that
- * happens to appear on a membership row confers nothing. The role-ceiling gate relies on the same
- * partition (see its `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker
- * link.
+ * This floor's BINDING of the shared conferral derivation. The derivation itself — and the reasoning
+ * that used to be restated here and in the super-admin floor in two different sets of words — lives
+ * in {@link resolveRolesConferringAnchor}, including why the anchor is seeded unconditionally.
+ *
+ * Membership `roles` is the ORGANIZATIONS authority axis, so APPLICATION-scope roles are never
+ * consulted. That safety comes from RESOLUTION rather than from the field's type: membership `roles`
+ * is a free-form string on purpose (an application declares its own org roles), and what makes an
+ * app-scoped string written onto a membership row confer nothing is that `getRoleHierarchy` reads it
+ * against the ORGANIZATIONS table only. The role-ceiling gate relies on the same partition (see its
+ * `holdsPlatformSuperAdmin` scope qualifier); this module must not be the weaker link.
  */
 export function resolveOrganizationOwnerConferringRoles(authorizationsService) {
-    const conferringRoles = new Set([CORE_ORG_ROLES.ORG_OWNER]);
-    for (const roleKey of Object.keys(authorizationsService.getOrgRoles() ?? {})) {
-        const conferred = authorizationsService.getRoleHierarchy(roleKey, ResourcePrimaryScope.ORGANIZATIONS);
-        if (conferred.includes(CORE_ORG_ROLES.ORG_OWNER)) {
-            conferringRoles.add(roleKey);
-        }
-    }
-    return [...conferringRoles];
+    return resolveRolesConferringAnchor({
+        anchorRole: CORE_ORG_ROLES.ORG_OWNER,
+        scope: ResourcePrimaryScope.ORGANIZATIONS,
+        declaredRoleKeys: Object.keys(authorizationsService.getOrgRoles() ?? {}),
+        roleHierarchyResolver: (roleKey, scope) => authorizationsService.getRoleHierarchy(roleKey, scope),
+    });
 }
 /**
  * Bind an {@link OrganizationOwnerConferralResolver} to the container's live
@@ -680,11 +674,16 @@ export async function readOwnerMembershipsForSubjects(params) {
  * *with management oversight*, and AC-2(7) requires privileged changes to be monitored — an audited,
  * per-request, non-default override is precisely that, and precisely not a standing bypass.
  *
- * ⚠️ The escape is only half a remedy while the tenant cannot be repaired afterwards. The industry
- * pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an Enterprise
- * owner re-owns the org; otherwise Support). Wildo has the block and not yet the repair door; see
- * O6 in `.claude/plans/last-organization-owner-floor.md`. Until that lands, an acknowledged breach
- * leaves a tenant that only an out-of-band write can rescue, which is why the default stays refuse.
+ * The industry pattern is two-part — block at the tenant tier, repair from a higher one (GitHub: an
+ * Enterprise owner re-owns the org; otherwise Support). Wildo has BOTH halves: the block is here, and
+ * the repair door is `organizationMembers.grantOwnership`, a platform-tier verb that promotes an
+ * existing member, writes only `roles`, additively, and is audited at CRITICAL with a mandatory
+ * justification. An acknowledged breach therefore leaves a tenant that cannot administer ITSELF, and
+ * that a platform operator can repair without an out-of-band write.
+ *
+ * ⚠️ The default still stays refuse. A repair door is an escalation someone has to notice and
+ * perform; it is not a reason to strand a tenant casually, and the tenant-tier answer remains
+ * "transfer ownership first".
  */
 export async function assertOrganizationOwnerFloorForSubjectErasure(params) {
     const memberships = await readOwnerMembershipsForSubjects(params);