@astram/guard 0.5.1 → 0.6.0

package/dist/auth/account.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAI9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAWjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA4DjE,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAM/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBA1CX,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAMxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA;IAGrD;;;;;;OAMG;YACW,mBAAmB;IAqBjC;;;;OAIG;YACW,aAAa;IAS3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;;;;;;OAYG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAsChB;;;;;OAKG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;OAiBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,kBAAkB,CAAC;IA+C9B;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;OAIG;YACW,sBAAsB;IAYpC;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;OAOG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBpE;;;;;;;;;OASG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAyDxC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAmChB;;;;;;;OAOG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAgCxC"}
+{"version":3,"file":"account.controller.d.ts","sourceRoot":"","sources":["../../src/auth/account.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAa,MAAM,cAAc,CAAC;AAI9E,OAAO,KAAK,EAEV,kBAAkB,EACnB,MAAM,yCAAyC,CAAC;AAWjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA4DjE,qBACa,iBAAiB;IAO1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAMxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAKzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAM/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBA1CX,MAAM,CAAC,EAAE,kBAAkB,YAAA,EAI3B,MAAM,CAAC,EAAE,cAAc,YAAA,EAIvB,MAAM,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAMhC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAK/B,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAMxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAKxC,aAAa,CAAC,GAAE,aAAa,GAAG,IAAI,aAAA,EAKpC,UAAU,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA;IAGrD;;;;;;OAMG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,aAAa;IAS3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,eAAe;IAMvB;;;;;;;;;;;;OAYG;IAIG,cAAc,CACQ,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/D,OAAO,CAAC,IAAI,CAAC;IAsChB;;;;;OAKG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;OAiBG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,kBAAkB,CAAC;IA+C9B;;;;;OAKG;YACW,oBAAoB;IAWlC;;;;OAIG;YACW,sBAAsB;IAYpC;;;;;;;;OAQG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,GAC1D,OAAO,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAUzD;;;;;;;OAOG;IAIG,WAAW,CACW,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmBpE;;;;;;;;;OASG;IAIG,aAAa,CACS,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAyDxC;;;;;;;OAOG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;OASG;IAIG,YAAY,CACU,aAAa,EAAE,MAAM,GAAG,SAAS,EAC9C,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,IAAI,CAAC;IAmChB;;;;;;;OAOG;IAIG,uBAAuB,CACD,aAAa,EAAE,MAAM,GAAG,SAAS,EACnD,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAgCxC"}

package/dist/auth/account.controller.js

@@ -147,6 +147,9 @@ let AccountController = class AccountController {
         try {
             const profile = await this.profileResolver.resolve({
                 id: claims.id,
+                // Scope (ADR-0027) — INTERIM self-node default (Task 2.1): non-widening, = today's isolation.
+                activeScopeNodeId: claims.tenantId,
+                scopeSubtreeNodeIds: [claims.tenantId],
                 tenantId: claims.tenantId,
                 roleIds: [...claims.roleIds],
                 kind: 'user',

package/dist/auth/auth.controller.d.ts

@@ -51,6 +51,8 @@
  */
 import type { Authenticator, PasswordHasher, SessionAuthority } from '@astram/core';
 import type { SessionFactsProjector } from './ports/session-facts-projector.js';
+import type { ScopeSubtreeResolver } from './ports/scope-subtree-resolver.js';
+import type { MembershipChecker } from './ports/membership-checker.js';
 import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
 import { PendingMfaStore } from './pending-mfa-store.js';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
@@ -62,6 +64,7 @@ import type { CredentialWriter } from './ports/credential-writer.js';
 import type { SessionSweeper } from './ports/session-sweeper.js';
 import type { RecoveryCodeStore } from './ports/recovery-code-store.js';
 import type { AuditSink } from './ports/audit-sink.js';
+import type { MariaDbPermissionFactsAdapter } from '../identity/permission-facts.adapter.js';
 import type { LoginRequest, LoginResponse, LogoutRequest, MfaRequest, RefreshRequest, SessionSuccess } from './dto.js';
 /**
  * The framework-owned auth endpoints. Registered into `AuthModule`'s `controllers`
@@ -90,7 +93,10 @@ export declare class AuthController {
     private readonly resetLimiter?;
     private readonly auditSink?;
     private readonly sessionFactsProjector?;
-    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined);
+    private readonly scopeSubtreeResolver?;
+    private readonly membershipChecker?;
+    private readonly permissionFacts?;
+    constructor(authenticator: Authenticator, sessionAuthority: SessionAuthority, pendingMfa: PendingMfaStore, tokenBinder?: SessionTokenBinder | undefined, profileResolver?: ProfileResolver | undefined, credentialResolver?: (CredentialResolver | null) | undefined, resetTokenStore?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, credentialWriter?: (CredentialWriter | null) | undefined, sessionSweeper?: (SessionSweeper | null) | undefined, passwordHasher?: PasswordHasher | undefined, resetLinkBaseUrl?: string | undefined, recoveryCodes?: (RecoveryCodeStore | null) | undefined, loginLimiter?: (AttemptLimiter | null) | undefined, recoveryLimiter?: (AttemptLimiter | null) | undefined, forgotLimiter?: (AttemptLimiter | null) | undefined, forgotHintLimiter?: (AttemptLimiter | null) | undefined, resetLimiter?: (AttemptLimiter | null) | undefined, auditSink?: (AuditSink | null) | undefined, sessionFactsProjector?: (SessionFactsProjector | null) | undefined, scopeSubtreeResolver?: (ScopeSubtreeResolver | null) | undefined, membershipChecker?: (MembershipChecker | null) | undefined, permissionFacts?: (MariaDbPermissionFactsAdapter | null) | undefined);
     /**
      * Bind the established session's access token to the principal's claims (the
      * request-auth layer). The access-token TTL is `expiresAtMs - issuedAtMs` from the
@@ -119,6 +125,52 @@ export declare class AuthController {
      * never a fabricated grant.
      */
     private projectFactsFor;
+    /**
+     * Resolve the principal's ACTIVE-SCOPE SUBTREE for the session binding (Task 2.2, ADR-0027 /
+     * ADR-0024), via the OPTIONAL {@link ScopeSubtreeResolver} seam. Returns the closure-resolved
+     * node-id set (self node + descendants) to cache, or `undefined` when there is no resolver,
+     * the resolution yielded an EMPTY set, OR it threw — every "no subtree" path collapses to
+     * `undefined` so the caller omits `scopeSubtreeNodeIds` and the per-request path falls back to
+     * the self-node `[tenantId]` (today's flat isolation).
+     *
+     * FAIL-SAFE + NON-WIDENING: a resolution failure NEVER fails the login and NEVER fabricates or
+     * widens a subtree — it degrades to today's self-tenant isolation. The active scope node is the
+     * principal's tenant (its `activeScopeNodeId` today); resolving the same way for every principal
+     * keeps root's extra cross-tree span in the `isRoot` tenant-gate path (authoritative), not here.
+     */
+    private resolveScopeSubtree;
+    /**
+     * Re-resolve the active-scope subtree by node id — used at REFRESH (where only the session's
+     * principal id + tenant are in hand, not a full Principal). Same fail-safe/non-widening
+     * contract as {@link resolveScopeSubtree}: undefined on no-resolver / empty / throw. This is a
+     * SINGLE indexed closure query at refresh time (NOT per request — the hot path stays zero-DB),
+     * so a session whose node was RE-PARENTED / had a subtree change (its permission version was
+     * bumped by moveNode/deleteNode) re-derives its CORRECT subtree here, closing the
+     * stale-subtree-after-move window (bounded by the access-token lifetime — ADR-0011).
+     */
+    private resolveScopeSubtreeFor;
+    /**
+     * Compute the caller's OWN auth-facts projection to INLINE into a login/mfa success
+     * body — the SAME `projectFor()` the `GET /identity/auth-facts` endpoint uses (no
+     * duplicated fact logic). Returns the projection, or `undefined` when there is no
+     * projector wired OR the projection failed (a store outage etc.). BEST-EFFORT: a
+     * failure here NEVER fails the login — the body simply omits `authFacts` and the
+     * frontend falls back to its separate `/identity/auth-facts` fetch (graceful
+     * degradation, identical to an older server that never inlines facts). The projection
+     * carries `permissionsVersion`, so the SDK's version-staleness contract is preserved:
+     * a later poke that finds a newer version refetches before honoring a fact.
+     */
+    private projectAuthFacts;
+    /**
+     * Wrap {@link toSessionSuccess} and INLINE the caller's auth-facts projection when it
+     * can be computed. Every authenticated login/mfa success routes through here so the
+     * permission-gated nav is ready the instant the response lands — one round-trip. The
+     * `authFacts` key is included ONLY when a projection was produced (an absent projector
+     * / a projection failure leaves it off → frontend fallback fetch). Under
+     * exactOptionalPropertyTypes an explicit `undefined` is not assignable to the optional
+     * field, so a spread keeps it truly absent.
+     */
+    private sessionSuccessWithFacts;
     /**
      * Build a Principal directly from resolved internal claims (recovery/alt-factor
      * paths that don't run the full authenticate() loop). Equivalent to the identity
@@ -157,6 +209,43 @@ export declare class AuthController {
      * throws (store outage) → generic 500 (fail-closed, never a partial profile).
      */
     me(authorization?: string): Promise<CurrentUserProfile>;
+    /**
+     * `POST /auth/scope-switch { targetNodeId }` — a principal with bindings at multiple
+     * nodes acts under ONE active scope per session (the active-scope model, ADR-0027). This
+     * SWITCHES which node it acts under: it re-resolves the subtree for the new active node,
+     * re-projects/strips the facts, and RE-BINDS the current session so STALE authority from
+     * the previous scope does NOT carry over (the security point).
+     *
+     * ── GATED (fail-closed) ─────────────────────────────────────────────────────────────
+     * A principal may ONLY switch to a node it HOLDS an ACTIVE `company_membership` at,
+     * verified via the OPTIONAL {@link MembershipChecker} seam. `targetNodeId` from the
+     * client is NEVER trusted without this affirmative check — that would be the fail-open
+     * hole (a principal switching to a foreign node it isn't bound at, inheriting that node's
+     * subtree + authority). DENIED (403) when:
+     *   - the checker is UNWIRED (cannot verify → deny), OR
+     *   - the checker returns `false` (no active membership at the target), OR
+     *   - the checker THROWS (store outage → cannot verify → deny).
+     * On any of these the OLD binding STANDS — no re-bind runs.
+     *
+     * ── ROOT ────────────────────────────────────────────────────────────────────────────
+     * Root does NOT switch scope. Root is already UNBOUNDED — its cross-tree span comes from
+     * `isRoot` in the tenant gate (authoritative), independent of the active-node subtree, so
+     * "acting under a different node" is meaningless for it (it already reaches everything).
+     * A root scope-switch is a no-op-shaped 403 (`root_no_switch`): consistent + tested, and
+     * it keeps the membership gate the SINGLE path a NON-root uses to change reach. This
+     * avoids a root re-bind that could NARROW its subtree to one node's closure (a footgun).
+     *
+     * ── AUTH ────────────────────────────────────────────────────────────────────────────
+     * `@Public()` to the classification guard (not object-gated), but it self-authenticates:
+     * it resolves the bearer token → the caller's FULL claims (id + sessionId), exactly like
+     * the `/account/*` surface. No/invalid/expired/revoked token → 401.
+     */
+    scopeSwitch(body: {
+        targetNodeId?: string;
+    }, authorization?: string): Promise<{
+        activeScopeNodeId: string;
+        scopeSubtreeNodeIds: readonly string[];
+    }>;
     /**
      * `POST /auth/forgot-password` — request a password-reset link. ALWAYS returns 204
      * with an identical (empty) body whether or not the hint matches a principal

package/dist/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AAsBtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA6FlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAS/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAI9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBAvGtB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EASxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAIpC,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA;IAGvE;;;;;OAKG;YACW,WAAW;IAsCzB;;;;;;;OAOG;YACW,YAAY;IAQ1B;;;;;;;;;;OAUG;YACW,eAAe;IAc7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;;;OAIG;IAIG,KAAK,CAAS,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAyE/D;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4CvF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAIjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA+FhB;;;;;;OAMG;YACW,gBAAgB;IAyC9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;;;;;;;;OAeG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IAyC5D;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAoFrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAiC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;OAMG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAmCpE;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAeH,OAAO,KAAK,EACV,aAAa,EAIb,cAAc,EAGd,gBAAgB,EAEjB,MAAM,cAAc,CAAC;AAyBtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAC7F,OAAO,KAAK,EAEV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,cAAc,EAEf,MAAM,UAAU,CAAC;AA6FlB;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO3B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAO7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAOjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAIpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAIlC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAIhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAKhC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAOlC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAS/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAI9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAQjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IAK/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAKnC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAO9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAS3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IAWvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IAStC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAYnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAvIhB,aAAa,EAAE,aAAa,EAE5B,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,eAAe,EAO3B,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAOhC,eAAe,CAAC,EAAE,eAAe,YAAA,EAOjC,kBAAkB,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAI9C,eAAe,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAIxC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAIhC,gBAAgB,CAAC,GAAE,gBAAgB,GAAG,IAAI,aAAA,EAI1C,cAAc,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAItC,cAAc,CAAC,EAAE,cAAc,YAAA,EAK/B,gBAAgB,CAAC,EAAE,MAAM,YAAA,EAOzB,aAAa,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EASxC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAIpC,eAAe,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAQvC,aAAa,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKrC,iBAAiB,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKzC,YAAY,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAOpC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAS5B,qBAAqB,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAWpD,oBAAoB,CAAC,GAAE,oBAAoB,GAAG,IAAI,aAAA,EASlD,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA,EAY5C,eAAe,CAAC,GAAE,6BAA6B,GAAG,IAAI,aAAA;IAGzE;;;;;OAKG;YACW,WAAW;IAiDzB;;;;;;;OAOG;YACW,YAAY;IAQ1B;;;;;;;;;;OAUG;YACW,eAAe;IAc7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAMjC;;;;;;;;OAQG;YACW,sBAAsB;IAgBpC;;;;;;;;;;OAUG;YACW,gBAAgB;IAY9B;;;;;;;;OAQG;YACW,uBAAuB;IAarC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;OAIG;IAIG,KAAK,CAAS,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IA2E/D;;;;;;;;;;;;;;;;;;OAkBG;IAIG,EAAE,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4CvF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IAIG,WAAW,CACP,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACb,aAAa,CAAC,EAAE,MAAM,GAC/C,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IA2EjF;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,cAAc,CACV,IAAI,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAIjC,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IA+FhB;;;;;;OAMG;YACW,gBAAgB;IA4C9B;;;;;;;;;;;;OAYG;IAIG,aAAa,CACT,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAEhD,EAAE,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAuEhB;;;;;;;;;;;;;;;OAeG;IAIG,GAAG,CAAS,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;IA0C5D;;;;;;;;;;;;;;;OAeG;YACW,uBAAuB;IAwFrC;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAoC1B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;OAMG;IAIG,OAAO,CAAS,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IA2CpE;;;;OAIG;IAIG,MAAM,CAAS,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAexD;;;;;OAKG;YACW,iBAAiB;CAOhC"}

package/dist/auth/auth.controller.js

@@ -178,7 +178,10 @@ let AuthController = class AuthController {
     resetLimiter;
     auditSink;
     sessionFactsProjector;
-    constructor(authenticator, sessionAuthority, pendingMfa, tokenBinder, profileResolver, credentialResolver, resetTokenStore, emailSender, credentialWriter, sessionSweeper, passwordHasher, resetLinkBaseUrl, recoveryCodes, loginLimiter, recoveryLimiter, forgotLimiter, forgotHintLimiter, resetLimiter, auditSink, sessionFactsProjector) {
+    scopeSubtreeResolver;
+    membershipChecker;
+    permissionFacts;
+    constructor(authenticator, sessionAuthority, pendingMfa, tokenBinder, profileResolver, credentialResolver, resetTokenStore, emailSender, credentialWriter, sessionSweeper, passwordHasher, resetLinkBaseUrl, recoveryCodes, loginLimiter, recoveryLimiter, forgotLimiter, forgotHintLimiter, resetLimiter, auditSink, sessionFactsProjector, scopeSubtreeResolver, membershipChecker, permissionFacts) {
         this.authenticator = authenticator;
         this.sessionAuthority = sessionAuthority;
         this.pendingMfa = pendingMfa;
@@ -199,6 +202,9 @@ let AuthController = class AuthController {
         this.resetLimiter = resetLimiter;
         this.auditSink = auditSink;
         this.sessionFactsProjector = sessionFactsProjector;
+        this.scopeSubtreeResolver = scopeSubtreeResolver;
+        this.membershipChecker = membershipChecker;
+        this.permissionFacts = permissionFacts;
     }
     /**
      * Bind the established session's access token to the principal's claims (the
@@ -215,6 +221,13 @@ let AuthController = class AuthController {
         // / a null result → `cachedFacts` stays undefined → gate 5 DB-reloads (today's
         // behavior). Best-effort inside projectFacts (a failure → undefined, never throws).
         const cachedFacts = await this.projectFacts(principal);
+        // EAGER active-scope-subtree resolution (Task 2.2, ADR-0027 / ADR-0024): resolve the
+        // principal's closure subtree (self node + descendants) NOW so the per-request tenant gate
+        // reads it from the binding with zero DB (the parity guarantee — the closure query happens
+        // ONLY here, at login). Absent resolver / empty result / a thrown resolver → undefined →
+        // `scopeSubtreeNodeIds` stays absent → the per-request path falls back to the self-node.
+        // Best-effort inside resolveScopeSubtree (a failure → undefined, never throws).
+        const scopeSubtreeNodeIds = await this.resolveScopeSubtree(principal);
         try {
             await this.tokenBinder.bind(est.tokens.accessToken, {
                 id: principal.id,
@@ -230,6 +243,10 @@ let AuthController = class AuthController {
                 // exactOptionalPropertyTypes an explicit `undefined` is not assignable to the
                 // optional field; a spread keeps it truly absent (→ gate 5 DB-reloads).
                 ...(cachedFacts ? { cachedFacts } : {}),
+                // Same spread discipline for the resolved subtree: present only when the resolver
+                // produced a non-empty set (→ the per-request tenant gate reads the real subtree);
+                // absent otherwise (→ the per-request path falls back to the self-node, non-widening).
+                ...(scopeSubtreeNodeIds ? { scopeSubtreeNodeIds } : {}),
             }, ttlMs);
         }
         catch {
@@ -275,6 +292,87 @@ let AuthController = class AuthController {
             return null;
         }
     }
+    /**
+     * Resolve the principal's ACTIVE-SCOPE SUBTREE for the session binding (Task 2.2, ADR-0027 /
+     * ADR-0024), via the OPTIONAL {@link ScopeSubtreeResolver} seam. Returns the closure-resolved
+     * node-id set (self node + descendants) to cache, or `undefined` when there is no resolver,
+     * the resolution yielded an EMPTY set, OR it threw — every "no subtree" path collapses to
+     * `undefined` so the caller omits `scopeSubtreeNodeIds` and the per-request path falls back to
+     * the self-node `[tenantId]` (today's flat isolation).
+     *
+     * FAIL-SAFE + NON-WIDENING: a resolution failure NEVER fails the login and NEVER fabricates or
+     * widens a subtree — it degrades to today's self-tenant isolation. The active scope node is the
+     * principal's tenant (its `activeScopeNodeId` today); resolving the same way for every principal
+     * keeps root's extra cross-tree span in the `isRoot` tenant-gate path (authoritative), not here.
+     */
+    async resolveScopeSubtree(principal) {
+        return this.resolveScopeSubtreeFor(principal.tenantId);
+    }
+    /**
+     * Re-resolve the active-scope subtree by node id — used at REFRESH (where only the session's
+     * principal id + tenant are in hand, not a full Principal). Same fail-safe/non-widening
+     * contract as {@link resolveScopeSubtree}: undefined on no-resolver / empty / throw. This is a
+     * SINGLE indexed closure query at refresh time (NOT per request — the hot path stays zero-DB),
+     * so a session whose node was RE-PARENTED / had a subtree change (its permission version was
+     * bumped by moveNode/deleteNode) re-derives its CORRECT subtree here, closing the
+     * stale-subtree-after-move window (bounded by the access-token lifetime — ADR-0011).
+     */
+    async resolveScopeSubtreeFor(tenantId) {
+        const resolver = this.scopeSubtreeResolver;
+        if (resolver === undefined || resolver === null)
+            return undefined;
+        try {
+            const subtree = await resolver.resolveSubtree(tenantId);
+            // A non-array / empty result → omit (→ self-node fallback, non-widening).
+            return Array.isArray(subtree) && subtree.length > 0 ? [...subtree] : undefined;
+        }
+        catch {
+            // Best-effort: a closure outage NEVER fails the operation → omit the subtree → the
+            // per-request path falls back to the self-node (today's isolation, non-widening).
+            return undefined;
+        }
+    }
+    /**
+     * Compute the caller's OWN auth-facts projection to INLINE into a login/mfa success
+     * body — the SAME `projectFor()` the `GET /identity/auth-facts` endpoint uses (no
+     * duplicated fact logic). Returns the projection, or `undefined` when there is no
+     * projector wired OR the projection failed (a store outage etc.). BEST-EFFORT: a
+     * failure here NEVER fails the login — the body simply omits `authFacts` and the
+     * frontend falls back to its separate `/identity/auth-facts` fetch (graceful
+     * degradation, identical to an older server that never inlines facts). The projection
+     * carries `permissionsVersion`, so the SDK's version-staleness contract is preserved:
+     * a later poke that finds a newer version refetches before honoring a fact.
+     */
+    async projectAuthFacts(principal) {
+        const adapter = this.permissionFacts;
+        if (adapter === undefined || adapter === null)
+            return undefined;
+        try {
+            return await adapter.projectFor(principal.id, principal.tenantId, principal.isRoot === true);
+        }
+        catch {
+            // Fail-closed → omit `authFacts`; the frontend fetches it separately. Never a
+            // login failure, never a fabricated grant.
+            return undefined;
+        }
+    }
+    /**
+     * Wrap {@link toSessionSuccess} and INLINE the caller's auth-facts projection when it
+     * can be computed. Every authenticated login/mfa success routes through here so the
+     * permission-gated nav is ready the instant the response lands — one round-trip. The
+     * `authFacts` key is included ONLY when a projection was produced (an absent projector
+     * / a projection failure leaves it off → frontend fallback fetch). Under
+     * exactOptionalPropertyTypes an explicit `undefined` is not assignable to the optional
+     * field, so a spread keeps it truly absent.
+     */
+    async sessionSuccessWithFacts(est, principal, extra) {
+        const authFacts = await this.projectAuthFacts(principal);
+        return {
+            ...toSessionSuccess(est),
+            ...(extra?.mfaRecoveryUsed ? { mfaRecoveryUsed: true } : {}),
+            ...(authFacts ? { authFacts } : {}),
+        };
+    }
     /**
      * Build a Principal directly from resolved internal claims (recovery/alt-factor
      * paths that don't run the full authenticate() loop). Equivalent to the identity
@@ -294,7 +392,16 @@ let AuthController = class AuthController {
         const roleIds = Array.isArray(claims.roleIds)
             ? claims.roleIds.filter((r) => typeof r === 'string')
             : [];
-        return { kind: 'user', id, tenantId, roleIds, isRoot: false };
+        // Scope (ADR-0027) — INTERIM self-node default (Task 2.1): non-widening, = today's isolation.
+        return {
+            kind: 'user',
+            id,
+            activeScopeNodeId: tenantId,
+            scopeSubtreeNodeIds: [tenantId],
+            tenantId,
+            roleIds,
+            isRoot: false,
+        };
     }
     /**
      * `POST /auth/login` — verify a password credential and either establish a
@@ -325,7 +432,9 @@ let AuthController = class AuthController {
             const principal = requirePrincipal(result);
             const est = await this.establishOrReject(principal);
             await this.bindSession(est, principal);
-            return toSessionSuccess(est);
+            // Inline the caller's auth-facts so the permission-gated nav is ready the instant
+            // login returns (one round-trip). Best-effort — omitted on any projection failure.
+            return this.sessionSuccessWithFacts(est, principal);
         }
         if (result.outcome === 'mfa_required') {
             // Password verified, a second factor is outstanding. The PASSWORD was correct,
@@ -417,6 +526,101 @@ let AuthController = class AuthController {
         }
         return profile;
     }
+    /**
+     * `POST /auth/scope-switch { targetNodeId }` — a principal with bindings at multiple
+     * nodes acts under ONE active scope per session (the active-scope model, ADR-0027). This
+     * SWITCHES which node it acts under: it re-resolves the subtree for the new active node,
+     * re-projects/strips the facts, and RE-BINDS the current session so STALE authority from
+     * the previous scope does NOT carry over (the security point).
+     *
+     * ── GATED (fail-closed) ─────────────────────────────────────────────────────────────
+     * A principal may ONLY switch to a node it HOLDS an ACTIVE `company_membership` at,
+     * verified via the OPTIONAL {@link MembershipChecker} seam. `targetNodeId` from the
+     * client is NEVER trusted without this affirmative check — that would be the fail-open
+     * hole (a principal switching to a foreign node it isn't bound at, inheriting that node's
+     * subtree + authority). DENIED (403) when:
+     *   - the checker is UNWIRED (cannot verify → deny), OR
+     *   - the checker returns `false` (no active membership at the target), OR
+     *   - the checker THROWS (store outage → cannot verify → deny).
+     * On any of these the OLD binding STANDS — no re-bind runs.
+     *
+     * ── ROOT ────────────────────────────────────────────────────────────────────────────
+     * Root does NOT switch scope. Root is already UNBOUNDED — its cross-tree span comes from
+     * `isRoot` in the tenant gate (authoritative), independent of the active-node subtree, so
+     * "acting under a different node" is meaningless for it (it already reaches everything).
+     * A root scope-switch is a no-op-shaped 403 (`root_no_switch`): consistent + tested, and
+     * it keeps the membership gate the SINGLE path a NON-root uses to change reach. This
+     * avoids a root re-bind that could NARROW its subtree to one node's closure (a footgun).
+     *
+     * ── AUTH ────────────────────────────────────────────────────────────────────────────
+     * `@Public()` to the classification guard (not object-gated), but it self-authenticates:
+     * it resolves the bearer token → the caller's FULL claims (id + sessionId), exactly like
+     * the `/account/*` surface. No/invalid/expired/revoked token → 401.
+     */
+    async scopeSwitch(body, authorization) {
+        // 1) Authenticate: resolve the bearer token → the caller's FULL claims (need the raw
+        //    access token + sessionId for the in-place re-bind). Fail-closed on any miss.
+        if (this.tokenBinder === undefined) {
+            throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
+        }
+        const token = (0, request_principal_js_1.extractBearerToken)(authorization);
+        if (token === null) {
+            throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
+        }
+        const claims = await this.tokenBinder.resolve(token);
+        if (claims === null) {
+            throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
+        }
+        const targetNodeId = typeof body?.targetNodeId === 'string' ? body.targetNodeId : '';
+        if (targetNodeId === '') {
+            throw new common_1.HttpException({ error: 'invalid_target' }, common_1.HttpStatus.BAD_REQUEST);
+        }
+        // 2) ROOT does not switch (already unbounded; a switch could only NARROW its reach).
+        if (claims.isRoot === true) {
+            throw new common_1.HttpException({ error: 'root_no_switch' }, common_1.HttpStatus.FORBIDDEN);
+        }
+        // 3) THE GATE (fail-closed): the principal must hold an ACTIVE membership at the target.
+        //    Unwired checker → deny (cannot verify). A throw → deny (cannot verify). `false` →
+        //    deny (no binding). Only an affirmative `true` proceeds. NEVER trust targetNodeId
+        //    without this check.
+        const checker = this.membershipChecker;
+        if (checker === undefined || checker === null) {
+            throw new common_1.HttpException({ error: 'scope_switch_denied' }, common_1.HttpStatus.FORBIDDEN);
+        }
+        let bound;
+        try {
+            bound = await checker.hasActiveMembership(claims.id, targetNodeId);
+        }
+        catch {
+            // Cannot verify the binding (store outage) → fail closed. No re-bind.
+            throw new common_1.HttpException({ error: 'scope_switch_denied' }, common_1.HttpStatus.FORBIDDEN);
+        }
+        if (bound !== true) {
+            throw new common_1.HttpException({ error: 'scope_switch_denied' }, common_1.HttpStatus.FORBIDDEN);
+        }
+        // 4) Re-resolve the subtree for the NEW active node (self-node fallback if unwired /
+        //    empty / thrown — non-widening, mirrors login). The new subtree REPLACES the old.
+        const resolved = await this.resolveScopeSubtree({
+            kind: 'user',
+            id: claims.id,
+            activeScopeNodeId: targetNodeId,
+            scopeSubtreeNodeIds: [targetNodeId],
+            tenantId: targetNodeId,
+            roleIds: [...claims.roleIds],
+            isRoot: false,
+        });
+        const subtree = resolved ?? [targetNodeId];
+        // 5) RE-BIND the current session in place (same token — no rotate). The bound tenantId
+        //    becomes targetNodeId (→ activeScopeNodeId) + scopeSubtreeNodeIds becomes the NEW
+        //    subtree; the OLD node's subtree + cachedFacts are DROPPED (stale authority gone).
+        //    A failed re-bind (session gone / Redis down) → deny (fail-closed, the old binding
+        //    already effectively dead).
+        const ok = await this.tokenBinder.rebindActiveScope(token, claims.sessionId, targetNodeId, subtree);
+        if (!ok) {
+            throw new common_1.HttpException({ error: 'scope_switch_denied' }, common_1.HttpStatus.FORBIDDEN);
+        }
+        return { activeScopeNodeId: targetNodeId, scopeSubtreeNodeIds: subtree };
+    }
     /**
      * `POST /auth/forgot-password` — request a password-reset link. ALWAYS returns 204
      * with an identical (empty) body whether or not the hint matches a principal
@@ -551,6 +755,9 @@ let AuthController = class AuthController {
             return;
         const profile = await this.profileResolver.resolve({
             id: principalId,
+            // Scope (ADR-0027) — INTERIM self-node default (Task 2.1): non-widening, = today's isolation.
+            activeScopeNodeId: tenantId,
+            scopeSubtreeNodeIds: [tenantId],
             tenantId,
             roleIds: [],
             kind: 'user',
@@ -685,7 +892,8 @@ let AuthController = class AuthController {
             const principal = requirePrincipal(result);
             const est = await this.establishOrReject(principal);
             await this.bindSession(est, principal);
-            return toSessionSuccess(est);
+            // Same inline-facts enrichment as the password-login success (one round-trip).
+            return this.sessionSuccessWithFacts(est, principal);
         }
         // Anything else (wrong code → rejected; still-outstanding → mfa_required) is a
         // failure. A transient blip is retryable; everything else is a generic 401.
@@ -785,7 +993,11 @@ let AuthController = class AuthController {
             tenantId: principal.tenantId,
             notify: true,
         });
-        return { ...toSessionSuccess(est), mfaRecoveryUsed: true };
+        // Inline auth-facts here too (one round-trip), alongside the recovery-used flag. The
+        // session is enforced-re-enroll-restricted, but the frontend still seeds its facts
+        // from this projection (fail-closed: `principalFromClaims` forced isRoot:false, so no
+        // control-plane keys leak into a recovery session).
+        return this.sessionSuccessWithFacts(est, principal, { mfaRecoveryUsed: true });
     }
     /**
      * Fire-and-forget security notice for a recovery-code login (spec §6.1). Resolves the
@@ -805,6 +1017,9 @@ let AuthController = class AuthController {
         void (async () => {
             const profile = await resolver.resolve({
                 id: principalId,
+                // Scope (ADR-0027) — INTERIM self-node default (Task 2.1): non-widening, = today's isolation.
+                activeScopeNodeId: tenantId,
+                scopeSubtreeNodeIds: [tenantId],
                 tenantId,
                 roleIds: [],
                 kind: 'user',
@@ -923,7 +1138,14 @@ let AuthController = class AuthController {
                 // behavior); a fresh CoarseGrants → replaces it; `null` (projection yielded
                 // nothing) → strips it (→ next request DB-reloads; fail-closed).
                 const freshFacts = await this.projectFactsFor(est.session.principalId, est.session.tenantId);
-                await this.tokenBinder.rebindOnRotate(est.tokens.accessToken, est.session.sessionId, ttlMs, freshFacts);
+                // EAGER subtree RE-RESOLUTION at REFRESH (the stale-subtree-after-move fix): re-read the
+                // principal's closure subtree so a session whose node was re-parented (moveNode/deleteNode
+                // bumped its version) gets its CORRECT, possibly-smaller subtree — REPLACING the stale one
+                // carried from login. One indexed closure query at refresh (NOT per request — parity
+                // preserved). `undefined` (no resolver / empty / threw) → rebindOnRotate carries the
+                // existing subtree forward (fail-safe, non-widening — never fails the refresh).
+                const freshSubtree = await this.resolveScopeSubtreeFor(est.session.tenantId);
+                await this.tokenBinder.rebindOnRotate(est.tokens.accessToken, est.session.sessionId, ttlMs, freshFacts, freshSubtree);
             }
             return toSessionSuccess(est);
         }
@@ -989,6 +1211,16 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "me", null);
+__decorate([
+    (0, classification_decorator_js_1.Public)(),
+    (0, common_1.Post)('scope-switch'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Headers)('authorization')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "scopeSwitch", null);
 __decorate([
     (0, classification_decorator_js_1.Public)(),
     (0, common_1.Post)('forgot-password'),
@@ -1074,7 +1306,13 @@ exports.AuthController = AuthController = __decorate([
     __param(18, (0, common_1.Inject)(tokens_js_1.SHIELD_AUDIT_SINK)),
     __param(19, (0, common_2.Optional)()),
     __param(19, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_FACTS_PROJECTOR)),
-    __metadata("design:paramtypes", [Object, Object, pending_mfa_store_js_1.PendingMfaStore, Function, Object, Object, Object, Object, Object, Object, Object, String, Object, Object, Object, Object, Object, Object, Object, Object])
+    __param(20, (0, common_2.Optional)()),
+    __param(20, (0, common_1.Inject)(tokens_js_1.SHIELD_SCOPE_SUBTREE_RESOLVER)),
+    __param(21, (0, common_2.Optional)()),
+    __param(21, (0, common_1.Inject)(tokens_js_1.SHIELD_MEMBERSHIP_CHECKER)),
+    __param(22, (0, common_2.Optional)()),
+    __param(22, (0, common_1.Inject)(tokens_js_1.SHIELD_PERMISSION_FACTS)),
+    __metadata("design:paramtypes", [Object, Object, pending_mfa_store_js_1.PendingMfaStore, Function, Object, Object, Object, Object, Object, Object, Object, String, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object, Object])
 ], AuthController);
 /**
  * Narrow an `authenticated` result to its guaranteed principal. The core engine

package/dist/auth/auth.module.d.ts

@@ -65,6 +65,8 @@
 import { type DynamicModule } from '@nestjs/common';
 import type { CredentialResolver, HmacSha1, FactorVerifier } from '@astram/core';
 import type { SessionFactsProjector } from './ports/session-facts-projector.js';
+import type { ScopeSubtreeResolver } from './ports/scope-subtree-resolver.js';
+import type { MembershipChecker } from './ports/membership-checker.js';
 import type { ProfileResolver } from './profile-resolver.js';
 import type { CredentialWriter } from './ports/credential-writer.js';
 import type { ResetTokenStore } from './ports/reset-token-store.js';
@@ -188,6 +190,25 @@ export interface AuthModuleOptions {
      * gate 5 serves them from the request's `cachedFacts`. Only meaningful under `auth: true`.
      */
     readonly sessionFactsProjector?: SessionFactsProjector;
+    /**
+     * OPTIONAL active-scope-subtree resolver (Task 2.2, ADR-0027 / ADR-0024, the
+     * {@link ScopeSubtreeResolver} port). Threaded exactly like the facts projector:
+     * supplied → bound app-wide under {@link SHIELD_SCOPE_SUBTREE_RESOLVER}; omitted → bound
+     * `null`, so the auth controller omits `scopeSubtreeNodeIds` and the per-request path
+     * falls back to the self-node `[tenantId]` (today's flat isolation). When supplied, login
+     * resolves the principal's closure subtree ONCE and caches it on the session binding so the
+     * per-request tenant gate reads it with zero DB. Only meaningful under `auth: true`.
+     */
+    readonly scopeSubtreeResolver?: ScopeSubtreeResolver;
+    /**
+     * OPTIONAL scope-switch membership checker (Task 5.2, ADR-0027 / ADR-0024, the
+     * {@link MembershipChecker} port). Threaded exactly like the subtree resolver: supplied →
+     * bound app-wide under {@link SHIELD_MEMBERSHIP_CHECKER}; omitted → bound `null`, so
+     * `POST /auth/scope-switch` fails CLOSED (cannot verify the target binding → deny). When
+     * supplied, the scope-switch gate confirms the principal holds an active membership at the
+     * target node before re-binding the session. Only meaningful under `auth: true`.
+     */
+    readonly membershipChecker?: MembershipChecker;
 }
 /**
  * The auth composition module. Imports {@link PersistenceModule} (the live

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AA8DtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAiVD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAuHD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAkH/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AAgEtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAiVD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AA4ID;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA0H/D"}

package/dist/auth/auth.module.js

@@ -556,6 +556,26 @@ function makeAuditSinkProvider(override) {
 function makeSessionFactsProjectorProvider(override) {
     return { provide: tokens_js_1.SHIELD_SESSION_FACTS_PROJECTOR, useValue: override ?? null };
 }
+/**
+ * Bind the OPTIONAL active-scope-subtree resolver (Task 2.2). Same value-provider pattern
+ * as {@link makeSessionFactsProjectorProvider}: the supplied impl when present, else `null`
+ * so the auth controller's `@Optional()` injection resolves cleanly to "no resolver" (→ it
+ * omits `scopeSubtreeNodeIds` → the per-request path falls back to the self-node). Always
+ * provided so the DI token exists.
+ */
+function makeScopeSubtreeResolverProvider(override) {
+    return { provide: tokens_js_1.SHIELD_SCOPE_SUBTREE_RESOLVER, useValue: override ?? null };
+}
+/**
+ * Bind the OPTIONAL scope-switch membership checker (Task 5.2). Same value-provider pattern
+ * as {@link makeScopeSubtreeResolverProvider}: the supplied impl when present, else `null` so
+ * the auth controller's `@Optional()` injection resolves to "no checker" (→ `POST
+ * /auth/scope-switch` fails closed, denying every switch — cannot verify the binding). Always
+ * provided so the DI token exists.
+ */
+function makeMembershipCheckerProvider(override) {
+    return { provide: tokens_js_1.SHIELD_MEMBERSHIP_CHECKER, useValue: override ?? null };
+}
 /**
  * The reset-link base URL the forgot-password handler builds the emailed link from
  * (`${base}?token=<rawToken>`). A plain string VALUE (not a seam) resolved from the
@@ -625,6 +645,14 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // The eager session-facts projector (ADR-0011; null when absent → the auth
                 // controller omits cachedFacts → gate 5 DB-reloads). Consumed by AuthController.
                 makeSessionFactsProjectorProvider(options.sessionFactsProjector),
+                // The active-scope-subtree resolver (Task 2.2; null when absent → the auth controller
+                // omits scopeSubtreeNodeIds → the per-request path falls back to the self-node).
+                // Consumed by AuthController at login.
+                makeScopeSubtreeResolverProvider(options.scopeSubtreeResolver),
+                // The scope-switch membership gate (Task 5.2; null when absent → POST /auth/scope-switch
+                // fails closed, denying every switch — cannot verify the target binding). Consumed by
+                // AuthController's scopeSwitch handler.
+                makeMembershipCheckerProvider(options.membershipChecker),
                 // The framework-DEFAULT permission-facts adapter backing AuthFactsController
                 // (`/identity/auth-facts` + `/identity/permissions-version`). Reads role grants +
                 // per-tenant version from the pool; expands `identity:*` wildcards against the