@astram/identity 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Astram
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,16 @@
+# @astram/identity
+
+`@astram/identity` is the framework-owned home for Astram's identity and tenancy
+model — the user, company, membership, and posting objects that every tenant
+application is built on. It exists as its own package (rather than living inside
+`@astram/engine`) because only a package positioned **above** `@astram/engine` in
+the dependency graph can host `@ObjectType`/`@Field`-decorated classes without
+creating a circular dependency: `engine` defines those decorators, so anything
+that uses them to declare objects must depend on `engine`, not the other way
+around. `@astram/identity` depends on `@astram/engine` (for the object-declaration
+decorators) and on `@astram/guard` / `@astram/core` (for the authentication and
+authorization ports the identity model plugs into). This package is the intended
+destination for the identity model currently declared in consuming applications —
+once relocated, apps declare only role-maps, extra columns, and session
+extensions, while the canonical identity objects, migrations, and resolver live
+here in the framework.

package/dist/branch.object.d.ts

@@ -0,0 +1,6 @@
+/** branches — global catalog. */
+export declare class Branch {
+    uuid: string;
+    name: string;
+}
+//# sourceMappingURL=branch.object.d.ts.map

package/dist/branch.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch.object.d.ts","sourceRoot":"","sources":["../src/branch.object.ts"],"names":[],"mappings":"AAGA,iCAAiC;AACjC,qBAOa,MAAM;IAEjB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;CACf"}

package/dist/branch.object.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Branch = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/** branches — global catalog. */
+let Branch = class Branch {
+    uuid;
+    name;
+};
+exports.Branch = Branch;
+__decorate([
+    (0, engine_1.Field)({ column: 'b_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], Branch.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'b_name', type: 'string', required: true }),
+    __metadata("design:type", String)
+], Branch.prototype, "name", void 0);
+exports.Branch = Branch = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'branch',
+        table: 'branches',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'control', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'b_uuid' })
+], Branch);

package/dist/company-branch.object.d.ts

@@ -0,0 +1,11 @@
+/**
+ * company_branches — the per-company branch catalog junction (the branch dropdown's
+ * option source). Same shape/role as `company_department`: listed by `companyUuid`, each
+ * `branchUuid` resolved to a name server-side for the editor's company-scoped Branch
+ * dropdown.
+ */
+export declare class CompanyBranch {
+    companyUuid: string;
+    branchUuid: string;
+}
+//# sourceMappingURL=company-branch.object.d.ts.map

package/dist/company-branch.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-branch.object.d.ts","sourceRoot":"","sources":["../src/company-branch.object.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,qBAOa,aAAa;IAExB,WAAW,EAAG,MAAM,CAAC;IAGrB,UAAU,EAAG,MAAM,CAAC;CACrB"}

package/dist/company-branch.object.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompanyBranch = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * company_branches — the per-company branch catalog junction (the branch dropdown's
+ * option source). Same shape/role as `company_department`: listed by `companyUuid`, each
+ * `branchUuid` resolved to a name server-side for the editor's company-scoped Branch
+ * dropdown.
+ */
+let CompanyBranch = class CompanyBranch {
+    companyUuid;
+    branchUuid;
+};
+exports.CompanyBranch = CompanyBranch;
+__decorate([
+    (0, engine_1.Field)({ column: 'cb_company_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], CompanyBranch.prototype, "companyUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'cb_branch_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], CompanyBranch.prototype, "branchUuid", void 0);
+exports.CompanyBranch = CompanyBranch = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'company_branch',
+        table: 'company_branches',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'control', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'composite', columns: ['cb_company_uuid', 'cb_branch_uuid'] })
+], CompanyBranch);

package/dist/company-department.object.d.ts

@@ -0,0 +1,13 @@
+/**
+ * company_departments — the per-company department catalog junction (which departments a
+ * company offers). Registered (Phase 5, Task 14 seam) so the Assignments editor's
+ * company-scoped Department dropdown can be read THROUGH THE PIPE: list this junction by
+ * `companyUuid`, then resolve each `departmentUuid` → a display name via `engine.get`
+ * (never a raw uuid label). A composite-PK, read-only-through-the-engine catalog; the
+ * service only lists it — no create/update from this feature.
+ */
+export declare class CompanyDepartment {
+    companyUuid: string;
+    departmentUuid: string;
+}
+//# sourceMappingURL=company-department.object.d.ts.map

package/dist/company-department.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-department.object.d.ts","sourceRoot":"","sources":["../src/company-department.object.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,qBAOa,iBAAiB;IAE5B,WAAW,EAAG,MAAM,CAAC;IAGrB,cAAc,EAAG,MAAM,CAAC;CACzB"}

package/dist/company-department.object.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompanyDepartment = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * company_departments — the per-company department catalog junction (which departments a
+ * company offers). Registered (Phase 5, Task 14 seam) so the Assignments editor's
+ * company-scoped Department dropdown can be read THROUGH THE PIPE: list this junction by
+ * `companyUuid`, then resolve each `departmentUuid` → a display name via `engine.get`
+ * (never a raw uuid label). A composite-PK, read-only-through-the-engine catalog; the
+ * service only lists it — no create/update from this feature.
+ */
+let CompanyDepartment = class CompanyDepartment {
+    companyUuid;
+    departmentUuid;
+};
+exports.CompanyDepartment = CompanyDepartment;
+__decorate([
+    (0, engine_1.Field)({ column: 'cd_company_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], CompanyDepartment.prototype, "companyUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'cd_department_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], CompanyDepartment.prototype, "departmentUuid", void 0);
+exports.CompanyDepartment = CompanyDepartment = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'company_department',
+        table: 'company_departments',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'control', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'composite', columns: ['cd_company_uuid', 'cd_department_uuid'] })
+], CompanyDepartment);

package/dist/company-membership.object.d.ts

@@ -0,0 +1,16 @@
+/**
+ * company_membership — the first-class membership card: a `(user, company)` scope with
+ * `is_active` (exactly one active per user, enforced service-side) + `status`. Scoping
+ * is via the membership, not a tenant column; `createdBy` is server-derived (actorId-
+ * trusted, anti-forgery). Registered here (Phase 2, Task 4) so the membership service
+ * (Phase 3) CRUDs it through the pipe.
+ */
+export declare class CompanyMembership {
+    uuid: string;
+    userUuid: string;
+    companyUuid: string;
+    isActive: boolean;
+    status: string;
+    createdBy: string;
+}
+//# sourceMappingURL=company-membership.object.d.ts.map

package/dist/company-membership.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company-membership.object.d.ts","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAOa,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,WAAW,EAAG,MAAM,CAAC;IAGrB,QAAQ,EAAG,OAAO,CAAC;IAGnB,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company-membership.object.js

@@ -0,0 +1,63 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompanyMembership = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * company_membership — the first-class membership card: a `(user, company)` scope with
+ * `is_active` (exactly one active per user, enforced service-side) + `status`. Scoping
+ * is via the membership, not a tenant column; `createdBy` is server-derived (actorId-
+ * trusted, anti-forgery). Registered here (Phase 2, Task 4) so the membership service
+ * (Phase 3) CRUDs it through the pipe.
+ */
+let CompanyMembership = class CompanyMembership {
+    uuid;
+    userUuid;
+    companyUuid;
+    isActive;
+    status;
+    createdBy;
+};
+exports.CompanyMembership = CompanyMembership;
+__decorate([
+    (0, engine_1.Field)({ column: 'cm_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], CompanyMembership.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'cm_user_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], CompanyMembership.prototype, "userUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'cm_company_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], CompanyMembership.prototype, "companyUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'cm_is_active', type: 'boolean', role: 'active' }),
+    __metadata("design:type", Boolean)
+], CompanyMembership.prototype, "isActive", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'cm_status', type: 'string', role: 'status' }),
+    __metadata("design:type", String)
+], CompanyMembership.prototype, "status", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'cm_created_by', type: 'uuid', trusted: 'actorId' }),
+    __metadata("design:type", String)
+], CompanyMembership.prototype, "createdBy", void 0);
+exports.CompanyMembership = CompanyMembership = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'company_membership',
+        table: 'company_membership',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'data', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'cm_uuid' })
+], CompanyMembership);

package/dist/company.object.d.ts

@@ -0,0 +1,10 @@
+/** companies — the tenant. A company's own tenant boundary is itself (c_uuid). */
+export declare class Company {
+    uuid: string;
+    name: string;
+    parentUuid: string;
+    type: string;
+    status: string;
+    createdAt: string;
+}
+//# sourceMappingURL=company.object.d.ts.map

package/dist/company.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.object.d.ts","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,qBAca,OAAO;IAElB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,IAAI,EAAG,MAAM,CAAC;IAGd,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company.object.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Company = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/** companies — the tenant. A company's own tenant boundary is itself (c_uuid). */
+let Company = class Company {
+    uuid;
+    name;
+    parentUuid;
+    type;
+    status;
+    createdAt;
+};
+exports.Company = Company;
+__decorate([
+    (0, engine_1.Field)({ column: 'c_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], Company.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'c_name', type: 'string', required: true }),
+    __metadata("design:type", String)
+], Company.prototype, "name", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'c_parent_uuid', type: 'uuid' }),
+    __metadata("design:type", String)
+], Company.prototype, "parentUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'c_type', type: 'string' }),
+    __metadata("design:type", String)
+], Company.prototype, "type", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'c_status', type: 'string', role: 'status' }),
+    __metadata("design:type", String)
+], Company.prototype, "status", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'c_created_at', type: 'timestamp' }),
+    __metadata("design:type", String)
+], Company.prototype, "createdAt", void 0);
+exports.Company = Company = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'company',
+        table: 'companies',
+        schema: schema_1.SCHEMA,
+        // plane:'control' — a company IS a tenant (the org record: name/type/status/parent), and
+        // managing tenants (onboarding/renaming/deactivating an org) is PLATFORM ADMINISTRATION —
+        // creating/onboarding an organization is an operator action — so the capped root, the
+        // platform administrator, may do it. This is NOT a data-plane leak: a tenant's BUSINESS CONTENT lives on separate
+        // `tenantScoped` types (e.g. note) that stay plane:'data' and stay walled by tenantId; the
+        // `company` row carries no business data. Consistent with company_department/company_branch,
+        // which are already control (managing a company's org structure is administration too).
+        access: { plane: 'control', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'c_uuid' })
+], Company);

package/dist/department.object.d.ts

@@ -0,0 +1,6 @@
+/** departments — global catalog. */
+export declare class Department {
+    uuid: string;
+    name: string;
+}
+//# sourceMappingURL=department.object.d.ts.map

package/dist/department.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"department.object.d.ts","sourceRoot":"","sources":["../src/department.object.ts"],"names":[],"mappings":"AAGA,oCAAoC;AACpC,qBAOa,UAAU;IAErB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;CACf"}

package/dist/department.object.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Department = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/** departments — global catalog. */
+let Department = class Department {
+    uuid;
+    name;
+};
+exports.Department = Department;
+__decorate([
+    (0, engine_1.Field)({ column: 'd_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], Department.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'd_name', type: 'string', required: true }),
+    __metadata("design:type", String)
+], Department.prototype, "name", void 0);
+exports.Department = Department = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'department',
+        table: 'departments',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'control', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'd_uuid' })
+], Department);

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @astram/identity — the framework-owned identity + tenancy model.
+ * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
+ * the `identityObjects` array the engine registers. Physical names unchanged from the
+ * app's originals (rename is a later sub-plan).
+ */
+import type { ObjectTypeInput } from '@astram/engine';
+export { Company } from './company.object.js';
+export { User } from './user.object.js';
+export { Role } from './role.object.js';
+export { Department } from './department.object.js';
+export { Branch } from './branch.object.js';
+export { CompanyMembership } from './company-membership.object.js';
+export { MembershipPosting } from './membership-posting.object.js';
+export { CompanyDepartment } from './company-department.object.js';
+export { CompanyBranch } from './company-branch.object.js';
+export { identityMigrationsDir } from './migrations-dir.js';
+/** All identity objects, registered with the engine at boot (same set + order as before). */
+export declare const identityObjects: readonly ObjectTypeInput[];
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAWtD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAGrD,CAAC"}

package/dist/index.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityObjects = exports.identityMigrationsDir = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+const company_object_js_1 = require("./company.object.js");
+const user_object_js_1 = require("./user.object.js");
+const role_object_js_1 = require("./role.object.js");
+const department_object_js_1 = require("./department.object.js");
+const branch_object_js_1 = require("./branch.object.js");
+const company_membership_object_js_1 = require("./company-membership.object.js");
+const membership_posting_object_js_1 = require("./membership-posting.object.js");
+const company_department_object_js_1 = require("./company-department.object.js");
+const company_branch_object_js_1 = require("./company-branch.object.js");
+var company_object_js_2 = require("./company.object.js");
+Object.defineProperty(exports, "Company", { enumerable: true, get: function () { return company_object_js_2.Company; } });
+var user_object_js_2 = require("./user.object.js");
+Object.defineProperty(exports, "User", { enumerable: true, get: function () { return user_object_js_2.User; } });
+var role_object_js_2 = require("./role.object.js");
+Object.defineProperty(exports, "Role", { enumerable: true, get: function () { return role_object_js_2.Role; } });
+var department_object_js_2 = require("./department.object.js");
+Object.defineProperty(exports, "Department", { enumerable: true, get: function () { return department_object_js_2.Department; } });
+var branch_object_js_2 = require("./branch.object.js");
+Object.defineProperty(exports, "Branch", { enumerable: true, get: function () { return branch_object_js_2.Branch; } });
+var company_membership_object_js_2 = require("./company-membership.object.js");
+Object.defineProperty(exports, "CompanyMembership", { enumerable: true, get: function () { return company_membership_object_js_2.CompanyMembership; } });
+var membership_posting_object_js_2 = require("./membership-posting.object.js");
+Object.defineProperty(exports, "MembershipPosting", { enumerable: true, get: function () { return membership_posting_object_js_2.MembershipPosting; } });
+var company_department_object_js_2 = require("./company-department.object.js");
+Object.defineProperty(exports, "CompanyDepartment", { enumerable: true, get: function () { return company_department_object_js_2.CompanyDepartment; } });
+var company_branch_object_js_2 = require("./company-branch.object.js");
+Object.defineProperty(exports, "CompanyBranch", { enumerable: true, get: function () { return company_branch_object_js_2.CompanyBranch; } });
+var migrations_dir_js_1 = require("./migrations-dir.js");
+Object.defineProperty(exports, "identityMigrationsDir", { enumerable: true, get: function () { return migrations_dir_js_1.identityMigrationsDir; } });
+/** All identity objects, registered with the engine at boot (same set + order as before). */
+exports.identityObjects = [
+    company_object_js_1.Company, user_object_js_1.User, role_object_js_1.Role, department_object_js_1.Department, branch_object_js_1.Branch,
+    company_membership_object_js_1.CompanyMembership, membership_posting_object_js_1.MembershipPosting, company_department_object_js_1.CompanyDepartment, company_branch_object_js_1.CompanyBranch,
+];

package/dist/membership-posting.object.d.ts

@@ -0,0 +1,16 @@
+/**
+ * membership_posting — the bundled, time-bounded assignment on a membership: a role
+ * (+ optional department + optional branch) with an optional effective window. Postings
+ * are replace-set synced per membership (Phase 3). `createdBy` is actorId-trusted.
+ */
+export declare class MembershipPosting {
+    uuid: string;
+    membershipUuid: string;
+    roleUuid: string;
+    departmentUuid: string;
+    branchUuid: string;
+    effectiveFrom: number;
+    effectiveUntil: number;
+    createdBy: string;
+}
+//# sourceMappingURL=membership-posting.object.d.ts.map

package/dist/membership-posting.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-posting.object.d.ts","sourceRoot":"","sources":["../src/membership-posting.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBAOa,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,cAAc,EAAG,MAAM,CAAC;IAGxB,QAAQ,EAAG,MAAM,CAAC;IAGlB,cAAc,EAAG,MAAM,CAAC;IAGxB,UAAU,EAAG,MAAM,CAAC;IAQpB,aAAa,EAAG,MAAM,CAAC;IAGvB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/membership-posting.object.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MembershipPosting = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * membership_posting — the bundled, time-bounded assignment on a membership: a role
+ * (+ optional department + optional branch) with an optional effective window. Postings
+ * are replace-set synced per membership (Phase 3). `createdBy` is actorId-trusted.
+ */
+let MembershipPosting = class MembershipPosting {
+    uuid;
+    membershipUuid;
+    roleUuid;
+    departmentUuid;
+    branchUuid;
+    // Effective window as BIGINT epoch-ms (NOT timestamp): a `number` field binds an INTEGER
+    // to the driver, never a `Date`. A `Date` serialized to host-local wall-clock (the driver's
+    // `timezone:'Z'` pool) vs a UTC-compared `NOW()` was the fail-OPEN skew — epoch-ms is
+    // timezone-immune (mirrors reset-token `prt_expires_at_ms` / grant `ctg_expires_at_ms`).
+    // NULL = open-ended (PostingService omits the key so the column stays SQL NULL).
+    effectiveFrom;
+    effectiveUntil;
+    createdBy;
+};
+exports.MembershipPosting = MembershipPosting;
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], MembershipPosting.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_membership_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], MembershipPosting.prototype, "membershipUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_role_uuid', type: 'uuid', required: true }),
+    __metadata("design:type", String)
+], MembershipPosting.prototype, "roleUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_department_uuid', type: 'uuid' }),
+    __metadata("design:type", String)
+], MembershipPosting.prototype, "departmentUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_branch_uuid', type: 'uuid' }),
+    __metadata("design:type", String)
+], MembershipPosting.prototype, "branchUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_effective_from_ms', type: 'number', role: 'effectiveFrom' }),
+    __metadata("design:type", Number)
+], MembershipPosting.prototype, "effectiveFrom", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_effective_until_ms', type: 'number', role: 'effectiveUntil' }),
+    __metadata("design:type", Number)
+], MembershipPosting.prototype, "effectiveUntil", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'mp_created_by', type: 'uuid', trusted: 'actorId' }),
+    __metadata("design:type", String)
+], MembershipPosting.prototype, "createdBy", void 0);
+exports.MembershipPosting = MembershipPosting = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'membership_posting',
+        table: 'membership_posting',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'data', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'mp_uuid' })
+], MembershipPosting);

package/dist/migrations-dir.d.ts

@@ -0,0 +1,2 @@
+export declare const identityMigrationsDir: string;
+//# sourceMappingURL=migrations-dir.d.ts.map

package/dist/migrations-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations-dir.d.ts","sourceRoot":"","sources":["../src/migrations-dir.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,qBAAqB,EAAE,MAA4C,CAAC"}

package/dist/migrations-dir.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityMigrationsDir = void 0;
+/**
+ * Absolute path to the framework identity migration files (`packages/identity/migrations`).
+ *
+ * The consuming app resolves this to MERGE the framework's identity migrations with its
+ * own (via `@astram/migrate`'s `loadMigrationsFromDirs`), so it never hardcodes a path
+ * into the framework package. Resolved relative to THIS compiled module's directory:
+ * `dist/migrations-dir.js` → `../migrations` (the migrations dir sits beside `dist/`,
+ * at the package root, and is published via package.json `files`).
+ */
+const node_path_1 = require("node:path");
+exports.identityMigrationsDir = (0, node_path_1.join)(__dirname, '..', 'migrations');

package/dist/role.object.d.ts

@@ -0,0 +1,7 @@
+/** roles — global catalog. */
+export declare class Role {
+    uuid: string;
+    name: string;
+    createdAt: string;
+}
+//# sourceMappingURL=role.object.d.ts.map

package/dist/role.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAOa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,SAAS,EAAG,MAAM,CAAC;CACpB"}