refactor(auth): the organization standing-key list stays module-private; the guard reads the map's entry

Claude-Session: https://claude.ai/code/session_01A3vH4wwSVnJvvx5BcfUpPf
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/last-admin-guard.ts

@@ -751,8 +751,10 @@ export const ACTIVATION_LEDGER_STANDING_KEYS = ['metadata_type', 'name', 'active
  * platform standing under `single` (`slug = 'default'`, else the only
  * organization). Re-slugging it while several organizations exist moves the
  * anchor off its grant; a delete is judged on every row, like the other tables'.
+ * Module-private: the guard tests payloads against the map's entry
+ * ({@link STANDING_KEYS_BY_TABLE}), so the list the gate reads is the list used.
  */
-export const ORGANIZATION_STANDING_KEYS = ['slug'] as const;
+const ORGANIZATION_STANDING_KEYS = ['slug'] as const;
 
 /**
  * [commit f8eb73601] The three lists above, keyed by the table each one judges — the shape
@@ -1767,7 +1769,7 @@ export function registerLastAdminGuard(
     const ctx = ctxOf(rawCtx);
     if (ctx.object !== SystemObjectName.ORGANIZATION) return;
     const data = (ctx.input?.data ?? {}) as Record<string, unknown>;
-    if (!touchesAny(data, ORGANIZATION_STANDING_KEYS)) return;
+    if (!touchesAny(data, STANDING_KEYS_BY_TABLE[SystemObjectName.ORGANIZATION]!)) return;
     await enforceStanding('organization-update', SystemObjectName.ORGANIZATION, ctx.input, data);
   };
 

packages/plugins/plugin-auth/src/last-admin-standing-keys.test.ts

@@ -52,7 +52,6 @@ import {
   GRANT_STANDING_KEYS,
   MEMBER_STANDING_KEYS,
   ACTIVATION_LEDGER_STANDING_KEYS,
-  ORGANIZATION_STANDING_KEYS,
   STANDING_KEYS_BY_TABLE,
   STANDING_KEY_EXCLUSIONS,
 } from './last-admin-guard.js';
@@ -132,6 +131,7 @@ describe('[#8734] standing-key lists correspond to what resolveAuthzContext read
     // no longer from the `sys_permission_set` row, which the guard no longer judges.
     expect(STANDING_KEYS_BY_TABLE.sys_metadata_activation).toBe(ACTIVATION_LEDGER_STANDING_KEYS);
     // [ADR-0131 D5] The organization whose grant anchors standing under `single`.
-    expect(STANDING_KEYS_BY_TABLE.sys_organization).toBe(ORGANIZATION_STANDING_KEYS);
+    // The guard reads this entry of the map itself, so only its content is pinned.
+    expect(STANDING_KEYS_BY_TABLE.sys_organization).toEqual(['slug']);
   });
 });