@astram/guard 0.5.1 → 0.6.0

package/dist/authz/mariadb-record-rule-adapter.js

@@ -35,9 +35,13 @@
  * ── SAFETY: every rule row is matched on `(tenant, type_key, action)` with all values
  *    BOUND as `?` params (no interpolation). The action match is exact OR the rule's
  *    wildcard `*`. Field conditions are evaluated in JS against the record attributes
- *    core supplies (design §11.1 builder shape) — the operator set is a fixed
- *    allow-list; an unknown operator makes the rule NOT match (fail-closed, never a
- *    spurious allow).
+ *    core supplies (design §11.1 builder shape) — the operator set is the FULL
+ *    14-operator {@link import('@astram/core').PolicyOperator} model (unified with
+ *    the guided policy builder, Task 0.2): `eq/ne` (dual-accept legacy
+ *    `equals`/`not_equals`), `in/not_in`, `gt/lt/gte/lte`, `contains/not_contains`,
+ *    `is_null/is_not_null`, `is_owner/is_not_owner`. An unknown operator makes the
+ *    rule NOT match (fail-closed, never a spurious allow) — see `conditionHolds`
+ *    below for the exact per-operator semantics and the documented edge-case choices.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_RECORD_RULE_PORT = void 0;
@@ -69,10 +73,76 @@ function resolveValue(raw, input) {
 function fieldValue(field, input) {
     return input.attributes?.[field];
 }
+/** Whether a record attribute value counts as "present" — not absent, not null. */
+function isPresent(value) {
+    return value !== undefined && value !== null;
+}
+/**
+ * Ordered compare of the record attribute vs. the resolved rule value (for
+ * `gt`/`lt`/`gte`/`lte`). RULE (documented, design §Task-0.2): if BOTH sides
+ * parse as finite numbers → NUMERIC compare; otherwise → LEXICAL (string)
+ * compare. Returns `null` when the attribute is absent/null — the condition
+ * does NOT hold for any ordered operator in that case (fail-closed; no
+ * comparison against a missing value).
+ */
+function orderedCompare(actual, expected) {
+    if (!isPresent(actual))
+        return null;
+    const actualNum = Number(actual);
+    const expectedNum = Number(expected);
+    const bothNumeric = actual !== '' &&
+        expected !== '' &&
+        Number.isFinite(actualNum) &&
+        Number.isFinite(expectedNum);
+    if (bothNumeric) {
+        return actualNum < expectedNum ? -1 : actualNum > expectedNum ? 1 : 0;
+    }
+    const actualStr = String(actual);
+    const expectedStr = String(expected);
+    return actualStr < expectedStr ? -1 : actualStr > expectedStr ? 1 : 0;
+}
 /**
  * Evaluate a rule's field condition. A rule with NO field (`rpr_field` null) is
  * UNCONDITIONAL (applies whenever subject+action match). The operator set is a fixed
- * allow-list; an unknown operator → the condition does NOT hold (fail-closed).
+ * allow-list covering the full 14-operator {@link import('@astram/core').PolicyOperator}
+ * model — unifying this enforcement path with the guided policy builder. An unknown
+ * operator → the condition does NOT hold (fail-closed).
+ *
+ * ── DUAL-ACCEPT (back-compat): this table may hold either the core canonical
+ *    operator names (`eq`/`ne`, as the Task-0.3 policy store persists) or the
+ *    legacy astram3 names (`equals`/`not_equals`) from any pre-existing row —
+ *    both are accepted and behave identically. `in`/`not_in` are shared by both
+ *    naming schemes already.
+ * ── `in`/`not_in`: comma-separated token-set membership. `in` on an
+ *    absent/null attribute already does NOT hold (its stringified form is
+ *    never in a real authored set). `not_in` is the MIRROR of `ne` — an
+ *    absent/null attribute must NOT be treated as "not in the set" (that
+ *    would trivially hold via `!set.includes('undefined')` and WIDEN the
+ *    policy for every record missing the attribute); guarded the same way:
+ *    does NOT hold unless the attribute is present.
+ * ── `eq`/`equals`: absent/null attribute never equals a resolved value (an
+ *    absent attribute simply is not `===` to anything) — already fail-closed.
+ * ── `ne`/`not_equals`: the MIRROR of `eq` — an absent/null attribute must
+ *    NOT be treated as "not equal" (that would trivially hold via
+ *    `undefined !== expected` and WIDEN the policy for every record missing
+ *    the attribute). Guarded symmetrically with every other operator: does
+ *    NOT hold unless the attribute is present.
+ * ── `gt`/`lt`/`gte`/`lte`: numeric compare when both sides parse as finite
+ *    numbers, else lexical (string) compare. An absent/null attribute never
+ *    holds for any ordered operator (fail-closed — no comparison against
+ *    nothing).
+ * ── `contains`/`not_contains`: substring match on the string form. An
+ *    absent/null attribute means the record has no such value to test — the
+ *    SAFER choice is taken: the condition does NOT hold for EITHER `contains`
+ *    OR `not_contains` when the attribute is absent (no accidental widen via
+ *    "it doesn't contain what's missing").
+ * ── `is_null`/`is_not_null`: take no operand (the rule's value is ignored);
+ *    test only whether the attribute is absent/null vs. present-and-non-null.
+ * ── `is_owner`/`is_not_owner`: the OWNERSHIP predicate — the field's value
+ *    (a reference/owner-id attribute) compared to `input.principal.id`; the
+ *    rule's value operand is ignored. An absent/null OR EMPTY-STRING attribute
+ *    → does NOT hold for either (fail-closed — no owner to compare, and an
+ *    empty attribute must never "match" an empty `principal.id`).
  */
 function conditionHolds(row, input) {
     if (row.rpr_field === null)
@@ -81,10 +151,15 @@ function conditionHolds(row, input) {
     const expectedRaw = row.rpr_value ?? '';
     const expected = resolveValue(expectedRaw, input);
     switch (row.rpr_operator) {
+        case 'eq':
         case 'equals':
             return actual === expected;
+        case 'ne':
         case 'not_equals':
-            return actual !== expected;
+            // absent attribute → does NOT hold (fail-closed; consistent with every
+            // other operator — `undefined !== expected` would otherwise be trivially
+            // true and WIDEN the policy for every record missing this attribute).
+            return isPresent(actual) && actual !== expected;
         case 'in': {
             // comma-separated token list; membership by string comparison.
             const set = String(expectedRaw)
@@ -93,11 +168,50 @@ function conditionHolds(row, input) {
             return set.includes(String(actual));
         }
         case 'not_in': {
+            // absent attribute → does NOT hold (fail-closed; consistent with `ne`/
+            // `not_contains`/`is_not_owner` — otherwise `!set.includes('undefined')`
+            // would trivially hold and WIDEN the policy for every record missing the field).
+            if (!isPresent(actual))
+                return false;
             const set = String(expectedRaw)
                 .split(',')
                 .map((s) => s.trim());
             return !set.includes(String(actual));
         }
+        case 'gt': {
+            const cmp = orderedCompare(actual, expected);
+            return cmp !== null && cmp > 0;
+        }
+        case 'gte': {
+            const cmp = orderedCompare(actual, expected);
+            return cmp !== null && cmp >= 0;
+        }
+        case 'lt': {
+            const cmp = orderedCompare(actual, expected);
+            return cmp !== null && cmp < 0;
+        }
+        case 'lte': {
+            const cmp = orderedCompare(actual, expected);
+            return cmp !== null && cmp <= 0;
+        }
+        case 'contains':
+            // absent attribute → does NOT hold (no accidental widen).
+            return isPresent(actual) && String(actual).includes(String(expected));
+        case 'not_contains':
+            // absent attribute → does NOT hold either (the safer, non-widening choice).
+            return isPresent(actual) && !String(actual).includes(String(expected));
+        case 'is_null':
+            return !isPresent(actual);
+        case 'is_not_null':
+            return isPresent(actual);
+        case 'is_owner':
+            // absent OR empty-string → does NOT hold (fail-closed; an empty attribute
+            // must never "match" an empty principal.id).
+            return isPresent(actual) && actual !== '' && actual === input.principal.id;
+        case 'is_not_owner':
+            // absent OR empty-string → does NOT hold (fail-closed; same hardening,
+            // mirrored for the negative ownership operator).
+            return isPresent(actual) && actual !== '' && actual !== input.principal.id;
         default:
             return false; // unknown operator → fail-closed (rule does not apply)
     }
@@ -119,7 +233,7 @@ class MariaDbRecordPermissionRuleAdapter {
         const tenantId = input.resource.tenantId ?? input.principal.tenantId;
         let rows;
         try {
-            rows = (await this.db.query(`SELECT rpr_effect, rpr_subject_kind, rpr_subject_value, rpr_field, rpr_operator, rpr_value
+            rows = (await this.db.query(`SELECT rpr_policy_uuid, rpr_effect, rpr_subject_kind, rpr_subject_value, rpr_field, rpr_operator, rpr_value
            FROM \`${this.schema}\`.\`record_permission_rule\`
           WHERE rpr_type_key = ?
             AND (rpr_tenant_uuid = ? OR rpr_tenant_uuid IS NULL)
@@ -130,18 +244,47 @@ class MariaDbRecordPermissionRuleAdapter {
             throw new core_1.AuthorizationUnavailableError(`record_permission_rule store unavailable for ` +
                 `${input.resource.typeKey}:${input.action.key}: ${err.message}`);
         }
+        // ── AND-GROUPING BY rpr_policy_uuid (author-what-enforces, Task 0.3) ──────────
+        // A guided policy has N AND-composed conditions persisted as N rows sharing one
+        // `rpr_policy_uuid`. A group (policy) APPLIES iff EVERY row in it subject-matches
+        // AND its condition holds — the AND. A legacy single-row rule (`rpr_policy_uuid`
+        // NULL) keeps the historical INDEPENDENT-row behavior: each such row is its OWN
+        // singleton group. This prevents the over-widening a naive per-row OR fold would
+        // cause on a multi-condition policy (allow when EITHER holds).
+        //
+        // Grouping: rows sharing a non-null policy uuid form ONE group; every NULL-policy
+        // row is a distinct singleton group (keyed by a unique sentinel per row).
+        const groups = new Map();
+        let nullGroupSeq = 0;
+        for (const row of rows) {
+            const key = row.rpr_policy_uuid != null // null OR undefined ⇒ legacy single-row rule
+                ? `p:${row.rpr_policy_uuid}`
+                : `n:${nullGroupSeq++}`; // each legacy row → its own singleton group
+            const bucket = groups.get(key);
+            if (bucket)
+                bucket.push(row);
+            else
+                groups.set(key, [row]);
+        }
         let allow = false;
         let explicitDeny = false;
-        for (const row of rows) {
-            if (!subjectMatches(row, input))
-                continue;
-            if (!conditionHolds(row, input))
+        for (const groupRows of groups.values()) {
+            const head = groupRows[0];
+            if (head === undefined)
+                continue; // a group always has ≥1 row; guard for the type
+            // The group (policy) applies IFF every row subject-matches AND its condition holds.
+            // Its effect is consistent across rows (the store writes one effect per policy);
+            // we take the group's effect from its first row and ignore any anomalous mix
+            // fail-closed (a non-'allow'/'deny' effect contributes nothing).
+            const applies = groupRows.every((row) => subjectMatches(row, input) && conditionHolds(row, input));
+            if (!applies)
                 continue;
-            if (row.rpr_effect === 'deny') {
-                // Deny-wins — one matching deny is final for this tier.
+            const effect = head.rpr_effect;
+            if (effect === 'deny') {
+                // Deny-wins — one applying deny group is final for this tier.
                 explicitDeny = true;
             }
-            else if (row.rpr_effect === 'allow') {
+            else if (effect === 'allow') {
                 allow = true;
             }
             // any other effect string is ignored (fail-closed — no permit inferred).

package/dist/authz/record-share-writer.d.ts

@@ -156,6 +156,28 @@ export declare class RecordShareWriter {
      * row(s); a no-match delete is a benign no-op. Emits `share.removed` on success.
      */
     unshare(input: ShareInput): Promise<void>;
+    /**
+     * List the shares CURRENTLY on a record — the owner-facing "who can see this" view. The SAME
+     * §6.2 owner bound applies: only the record's owner (in the sharer's tenant) may list its
+     * shares (a grantee cannot enumerate a record they don't own). Returns the raw share rows
+     * (grantee kind + uuid + action + sharer); the CALLER resolves grantee uuids → names before
+     * they reach the UI (no raw uuid rule — the identity module wires the DirectoryLabelResolver).
+     *
+     * @throws {@link ShareNotPermittedError} if the caller is not the record's owner (or the type
+     *   is not owned / the record is not in their tenant) — same fail-closed bound as share().
+     * @throws {@link ShareStoreUnavailableError} on a transient store failure.
+     */
+    listSharesForRecord(input: {
+        tenantId: string;
+        typeKey: string;
+        recordId: string;
+        sharerId: string;
+    }): Promise<ReadonlyArray<{
+        granteeKind: ShareGranteeKind;
+        granteeUuid: string;
+        action: string;
+        grantedBy: string;
+    }>>;
     /**
      * Enforce the §6.2 who-may-share bound (steps 1–3) and return the resolved type info.
      * Fetches the record owner tenant-scoped and proves `sharerId` owns it. Throws

package/dist/authz/record-share-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-share-writer.d.ts","sourceRoot":"","sources":["../../src/authz/record-share-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKxE,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;CACrD;AAED,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC;IACnD,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oCAAoC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAOD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB,KAAK,EAAE,iBAAiB,CAAC;QACzB,kFAAkF;QAClF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAQD;;;;;;;;OAQG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B7C;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B/C;;;;OAIG;YACW,cAAc;IAoC5B;;;;OAIG;YACW,sBAAsB;IA6BpC,OAAO,CAAC,cAAc;IAItB,sFAAsF;YACxE,IAAI;CAsBnB"}
+{"version":3,"file":"record-share-writer.d.ts","sourceRoot":"","sources":["../../src/authz/record-share-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKxE,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;CACrD;AAED,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC;IACnD,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oCAAoC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAOD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB,KAAK,EAAE,iBAAiB,CAAC;QACzB,kFAAkF;QAClF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAQD;;;;;;;;OAQG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B7C;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B/C;;;;;;;;;;OAUG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IA0CD;;;;OAIG;YACW,cAAc;IAoC5B;;;;OAIG;YACW,sBAAsB;IA6BpC,OAAO,CAAC,cAAc;IAItB,sFAAsF;YACxE,IAAI;CAsBnB"}

package/dist/authz/record-share-writer.js

@@ -137,6 +137,47 @@ class RecordShareWriter {
         }
         await this.emit('share.removed', input);
     }
+    /**
+     * List the shares CURRENTLY on a record — the owner-facing "who can see this" view. The SAME
+     * §6.2 owner bound applies: only the record's owner (in the sharer's tenant) may list its
+     * shares (a grantee cannot enumerate a record they don't own). Returns the raw share rows
+     * (grantee kind + uuid + action + sharer); the CALLER resolves grantee uuids → names before
+     * they reach the UI (no raw uuid rule — the identity module wires the DirectoryLabelResolver).
+     *
+     * @throws {@link ShareNotPermittedError} if the caller is not the record's owner (or the type
+     *   is not owned / the record is not in their tenant) — same fail-closed bound as share().
+     * @throws {@link ShareStoreUnavailableError} on a transient store failure.
+     */
+    async listSharesForRecord(input) {
+        // Reuse the owner bound (steps 1–3) — a non-owner NEVER sees a record's share list.
+        await this.assertMayShare({
+            tenantId: input.tenantId,
+            typeKey: input.typeKey,
+            recordId: input.recordId,
+            sharerId: input.sharerId,
+            // grantee/action are irrelevant to the owner check; supply inert placeholders that the
+            // bound ignores (it reads only type/record/tenant/sharer).
+            granteeKind: 'user',
+            granteeUuid: '',
+            action: '',
+        });
+        let rows;
+        try {
+            rows = (await this.db.query(`SELECT rs_grantee_kind, rs_grantee_uuid, rs_action, rs_granted_by` +
+                ` FROM \`${this.schema}\`.\`record_share\`` +
+                ` WHERE rs_tenant_uuid = ? AND rs_type_key = ? AND rs_record_uuid = ?` +
+                ` ORDER BY rs_created_at`, [input.tenantId, input.typeKey, input.recordId]));
+        }
+        catch (err) {
+            throw new ShareStoreUnavailableError(`record_share list failed for ${input.typeKey}: ${err.message}`);
+        }
+        return rows.map((r) => ({
+            granteeKind: r.rs_grantee_kind === 'role' ? 'role' : 'user',
+            granteeUuid: r.rs_grantee_uuid,
+            action: r.rs_action,
+            grantedBy: r.rs_granted_by,
+        }));
+    }
     // --- the bound -------------------------------------------------------------
     /**
      * Enforce the §6.2 who-may-share bound (steps 1–3) and return the resolved type info.

package/dist/authz/wire-record-authorization.d.ts

@@ -23,7 +23,8 @@
  *    import inside the `SHIELD_DECISION_AUTHORITY` async factory — which runs ONLY when a
  *    consumer opts into `recordAuthorization`. This file (and thus core) loads only then.
  */
-import type { DecisionAuthority, ModuleRegistry, PermissionFactsPort, SessionFactsReader } from '@astram/core';
+import type { DecisionAuthority, ModuleRegistry, PermissionFactsPort, Principal, SessionFactsReader } from '@astram/core';
+import type { ObjectType } from '@astram/engine';
 import { type RuleQueryable } from './mariadb-record-rule-adapter.js';
 import { type OperationManifestEntry } from './manifest-operation-authority-adapter.js';
 /**
@@ -63,4 +64,37 @@ export interface RecordAuthorizationInputs {
  * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
  */
 export declare function buildRecordAuthorization(inputs: RecordAuthorizationInputs): DecisionAuthority;
+/**
+ * The engine-facing list-scope fn (Task 2.2). Given the engine's registered
+ * {@link ObjectType}, the requesting {@link Principal}, and the list action key, it returns
+ * the SAFE, parameterized WHERE fragment describing the visible set. The engine's `list()`
+ * (Task 3.1) ANDs `sql` into its WHERE and appends `params`.
+ *
+ * A transient store outage (an `AuthorizationUnavailableError` from the list-scope port)
+ * PROPAGATES through the returned promise — the engine's `list()` fails rather than falling
+ * open to an unbounded set (Invariant #8 / ADR-0016).
+ */
+export type ListScopeFn = (reg: ObjectType, actor: Principal, action: string) => Promise<{
+    sql: string;
+    params: unknown[];
+}>;
+/**
+ * Construct the engine-facing {@link ListScopeFn} — the LIST-form sibling to
+ * `buildRecordAuthorization`'s per-record authority. It is a SEPARATE exported factory
+ * (Option A in the task report) that the module wiring calls ALONGSIDE
+ * `buildRecordAuthorization`: both take {@link RecordAuthorizationInputs} and both construct
+ * their adapters over the SAME un-overridable `inputs.pool`. This keeps
+ * `buildRecordAuthorization`'s `DecisionAuthority` return type unchanged (least blast radius).
+ *
+ * ── THE UN-OVERRIDABLE SEAM (the SECURITY POINT). The {@link MariaDbListScopeAdapter} is
+ *    constructed HERE, over `inputs.pool` — the SAME pool the four record-tier read adapters
+ *    use — and is DELIBERATELY NOT a field of {@link RecordAuthorizationInputs}. A consumer
+ *    supplies ONLY the pool; it can NOT inject a fail-OPEN scope port (the exact hole this
+ *    closes, mirroring the four record-tier adapters).
+ *
+ * ── FAIL-CLOSED. Nothing in the returned fn catches or swallows: a transient throw at ANY
+ *    step (the port's store outage → `AuthorizationUnavailableError`, or the translator's
+ *    unknown-field rejection) PROPAGATES so the read fails, NEVER falls open to unbounded.
+ */
+export declare function buildListScopeFn(inputs: RecordAuthorizationInputs): ListScopeFn;
 //# sourceMappingURL=wire-record-authorization.d.ts.map

package/dist/authz/wire-record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,yBAAyB,GAAG,iBAAiB,CAmB7F"}
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,yBAAyB,GAAG,iBAAiB,CAmB7F;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAkE/E"}

package/dist/authz/wire-record-authorization.js

@@ -1,10 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildRecordAuthorization = buildRecordAuthorization;
+exports.buildListScopeFn = buildListScopeFn;
 const core_1 = require("@astram/core");
 const mariadb_record_rule_adapter_js_1 = require("./mariadb-record-rule-adapter.js");
 const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapter.js");
 const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
+const mariadb_list_scope_adapter_js_1 = require("./mariadb-list-scope-adapter.js");
+const list_scope_sql_js_1 = require("./list-scope-sql.js");
 const manifest_operation_authority_adapter_js_1 = require("./manifest-operation-authority-adapter.js");
 /**
  * Construct the four framework-owned record-tier adapters over the supplied pool +
@@ -32,3 +35,75 @@ function buildRecordAuthorization(inputs) {
         operationAuthority: new manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter(inputs.operationManifest ?? []),
     });
 }
+/**
+ * Construct the engine-facing {@link ListScopeFn} — the LIST-form sibling to
+ * `buildRecordAuthorization`'s per-record authority. It is a SEPARATE exported factory
+ * (Option A in the task report) that the module wiring calls ALONGSIDE
+ * `buildRecordAuthorization`: both take {@link RecordAuthorizationInputs} and both construct
+ * their adapters over the SAME un-overridable `inputs.pool`. This keeps
+ * `buildRecordAuthorization`'s `DecisionAuthority` return type unchanged (least blast radius).
+ *
+ * ── THE UN-OVERRIDABLE SEAM (the SECURITY POINT). The {@link MariaDbListScopeAdapter} is
+ *    constructed HERE, over `inputs.pool` — the SAME pool the four record-tier read adapters
+ *    use — and is DELIBERATELY NOT a field of {@link RecordAuthorizationInputs}. A consumer
+ *    supplies ONLY the pool; it can NOT inject a fail-OPEN scope port (the exact hole this
+ *    closes, mirroring the four record-tier adapters).
+ *
+ * ── FAIL-CLOSED. Nothing in the returned fn catches or swallows: a transient throw at ANY
+ *    step (the port's store outage → `AuthorizationUnavailableError`, or the translator's
+ *    unknown-field rejection) PROPAGATES so the read fails, NEVER falls open to unbounded.
+ */
+function buildListScopeFn(inputs) {
+    // Framework-constructed over `inputs.pool` — UN-overridable (not a field of the inputs).
+    const listScopePort = new mariadb_list_scope_adapter_js_1.MariaDbListScopeAdapter(inputs.pool);
+    // The cross-tenant grant adapter — reused HERE to resolve the OWNING tenants a grantee
+    // reaches, so the list can apply the OWNING tenant's deny rules to the cross-tenant branch
+    // (deny-wins per the resource's tenant — the fail-open leak the Phase-4 review found). Same
+    // un-overridable `inputs.pool`.
+    const crossTenantAdapter = new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool);
+    return async (reg, actor, action) => {
+        // Bridge the engine `ObjectType` → the core `ComputeListScopeDeps.registry` shape.
+        // `computeListScope` reads ONLY `descriptor.access` for the owner-baseline posture
+        // (see list-scope.ts `ownerBaselineFor`), so `label`/`fields` are inert — the engine's
+        // `reg.access` (`AccessDeclaration`) is structurally core's `RecordAccessPosture`.
+        const registry = {
+            resolveObjectType(typeKey) {
+                return typeKey === reg.typeKey
+                    ? { typeKey: reg.typeKey, label: reg.typeKey, fields: [], access: reg.access }
+                    : undefined;
+            },
+        };
+        // A transient throw here PROPAGATES (fail-closed — NOT caught).
+        const spec = await (0, core_1.computeListScope)({ registry, listScope: listScopePort }, { principal: actor, action, typeKey: reg.typeKey, tenantId: actor.tenantId });
+        // ── OWNING-TENANT DENY (Task 4.2 — the fail-open leak fix) ────────────────────────────
+        // A cross-tenant grant reaches the OWNING tenant's records; `decide()` evaluates those at
+        // the RESOURCE's (owning) tenant, so the owning tenant's DENY rules apply (deny-wins,
+        // ADR-0005). The same-tenant deny (in `spec.policyDeny`) does NOT cover them — it is scoped
+        // to the actor's own subtree. So resolve the active grants' owning tenants and fetch THEIR
+        // deny groups, to be applied ONLY to the cross-tenant branch (per-branch deny scoping — a
+        // global deny would over-restrict the same-tenant set). Fires ONLY for a NON-ROOT grantee
+        // with `crossTenant.kind === 'granted'`; root has no cross-tenant branch. A transient throw
+        // PROPAGATES (fail-closed — never drop the owning-tenant deny). Global (NULL-tenant) deny
+        // rules come back in BOTH fetches, so they apply to both branches (as `decide()` does).
+        let owningTenantDeny = [];
+        if (spec.crossTenant.kind === 'granted') {
+            const owningTenants = await crossTenantAdapter.listActiveOwningTenants({
+                grantee: actor.id,
+                roleIds: actor.roleIds,
+                typeKey: reg.typeKey,
+                action,
+            });
+            if (owningTenants.length > 0) {
+                const owningPolicy = await listScopePort.listPolicyConditions(reg.typeKey, owningTenants, action, {
+                    principalId: actor.id,
+                    roleIds: actor.roleIds,
+                });
+                owningTenantDeny = owningPolicy.deny; // ONLY the deny — the GRANT is the permit source
+            }
+        }
+        // Translate the abstract spec → SAFE parameterized WHERE fragment. An unknown-field
+        // rejection here also PROPAGATES (fail-closed).
+        const translated = (0, list_scope_sql_js_1.translateListScope)(spec, reg, { principalId: actor.id, principalTenantId: actor.tenantId }, { owningTenantDeny });
+        return { sql: translated.sql, params: translated.params };
+    };
+}

package/dist/identity/identity-actions.d.ts

@@ -17,6 +17,13 @@ export type IdentityAction = (typeof IDENTITY_ACTIONS)[number];
  */
 export declare const CROSS_TENANT_GRANT_ACTIONS: readonly ["share", "accept", "revoke"];
 export type CrossTenantGrantAction = (typeof CROSS_TENANT_GRANT_ACTIONS)[number];
+/**
+ * `record_share`'s action vocabulary (list-scoping engine Phase 6, §9.2) — NOT the CRUD verbs.
+ * `share` gates the create/revoke routes (a per-record owner action; the writer's owner-bound is
+ * the real wall), `read` gates the list-a-record's-shares route.
+ */
+export declare const RECORD_SHARE_ACTIONS: readonly ["share", "read"];
+export type RecordShareAction = (typeof RECORD_SHARE_ACTIONS)[number];
 /** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
 export declare function actionsFor(typeKey: string): readonly string[];
 //# sourceMappingURL=identity-actions.d.ts.map

package/dist/identity/identity-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAUjF,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAWtE,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}

package/dist/identity/identity-actions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
+exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
 exports.actionsFor = actionsFor;
 /**
  * The fixed action vocabulary + module key for the framework's @astram/identity objects.
@@ -19,12 +19,19 @@ exports.IDENTITY_ACTIONS = ['read', 'create', 'update', 'delete'];
  * revoke -> 'revoke'). Mirrors astram3's `authz/actions.ts`'s `CROSS_TENANT_GRANT_ACTIONS`.
  */
 exports.CROSS_TENANT_GRANT_ACTIONS = ['share', 'accept', 'revoke'];
+/**
+ * `record_share`'s action vocabulary (list-scoping engine Phase 6, §9.2) — NOT the CRUD verbs.
+ * `share` gates the create/revoke routes (a per-record owner action; the writer's owner-bound is
+ * the real wall), `read` gates the list-a-record's-shares route.
+ */
+exports.RECORD_SHARE_ACTIONS = ['share', 'read'];
 /**
  * Per-type action-vocabulary override. Every type not listed here defaults to
  * {@link IDENTITY_ACTIONS} (the CRUD verbs).
  */
 const ACTIONS_BY_TYPE = {
     cross_tenant_grant: exports.CROSS_TENANT_GRANT_ACTIONS,
+    record_share: exports.RECORD_SHARE_ACTIONS,
 };
 /** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
 function actionsFor(typeKey) {

package/dist/index.d.ts

@@ -33,6 +33,9 @@ export { stubDecisionAuthority, type Effect, type CoreDecisionAuthority, type Co
 export { Argon2idPasswordHasher, argon2idHasherProvider, SHIELD_PASSWORD_HASHER, type Argon2idParams, } from './authentication/argon2id-password-hasher.js';
 export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, } from './session/index.js';
 export { MariaDbRecordPermissionRuleAdapter, SHIELD_RECORD_RULE_PORT, type RuleQueryable, } from './authz/mariadb-record-rule-adapter.js';
+export { MariaDbPolicyStore, SHIELD_POLICY_STORE, type RuleQueryable as PolicyStoreQueryable, } from './authz/mariadb-policy-store.js';
+export { MariaDbListScopeAdapter, SHIELD_LIST_SCOPE_PORT, type ListScopeQueryable, } from './authz/mariadb-list-scope-adapter.js';
+export { translateListScope, UnknownScopeFieldError, type TranslatedListScope, type ListScopePrincipal, } from './authz/list-scope-sql.js';
 export { MariaDbRecordShareAdapter, SHIELD_RECORD_SHARE_PORT, type ShareQueryable, } from './authz/mariadb-record-share-adapter.js';
 export { RecordShareWriter, SHIELD_RECORD_SHARE_WRITER, ShareNotPermittedError, ShareStoreUnavailableError, type ShareInput, type ShareGranteeKind, type ShareTypeInfo, type ShareTypeResolver, type ShareAuditEvent, type ShareAuditSink, } from './authz/record-share-writer.js';
 export { makeShareDeleteCascade, type RecordDeletedHook, type ShareQueryFn, } from './authz/record-share-cascade.js';
@@ -40,6 +43,7 @@ export { MariaDbCrossTenantGrantAdapter, SHIELD_CROSS_TENANT_GRANT_PORT, type Gr
 export { CrossTenantGrantWriter, SHIELD_CROSS_TENANT_GRANT_WRITER, GrantNotPermittedError, InvalidGrantError, GrantStoreUnavailableError, type GrantAuthorizeFn, type GrantAuditEvent, type GrantAuditSink, type GrantGranteeKind, type GrantScope, type OfferGrantInput, type AcceptGrantInput, type RevokeGrantInput, } from './authz/cross-tenant-grant-writer.js';
 export { ManifestOperationAuthorityAdapter, SHIELD_OPERATION_AUTHORITY_PORT, type OperationManifestEntry, } from './authz/manifest-operation-authority-adapter.js';
 export { buildRecordAuthorization } from './authz/wire-record-authorization.js';
+export { buildListScopeFn, type ListScopeFn } from './authz/wire-record-authorization.js';
 export { BootSequence, assertPoolBudget } from './boot/boot-sequence.js';
 export { APP_CONFIG } from './config/config.module.js';
 export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, } from './config/app-config.js';
@@ -62,8 +66,11 @@ export type { MfaDeviceStore, MfaDevice } from './auth/ports/mfa-device-store.js
 export type { AuditSink, AuthAuditEvent } from './auth/ports/audit-sink.js';
 export type { SessionFactsProjector } from './auth/ports/session-facts-projector.js';
 export { SHIELD_SESSION_FACTS_PROJECTOR } from './auth/tokens.js';
+export type { ScopeSubtreeResolver } from './auth/ports/scope-subtree-resolver.js';
+export { SHIELD_SCOPE_SUBTREE_RESOLVER } from './auth/tokens.js';
 export { AuthController } from './auth/auth.controller.js';
 export { PendingMfaStore } from './auth/pending-mfa-store.js';
 export { generateTotpSecret, buildOtpauthUri, generateRecoveryCodes, } from './auth/totp-enrollment.js';
 export { AccountController } from './auth/account.controller.js';
+export { buildClosureRows, ScopeCycleError, ScopeDepthError, ScopeUnknownParentError, type ScopeEdge, type ClosureRow, } from './scope/closure-builder.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAMhD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAQjE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}