@astram/identity 0.1.2 → 0.2.0

package/dist/features/authz/record-authorization.js

@@ -0,0 +1,59 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createIdentityAuthzPool = createIdentityAuthzPool;
+exports.buildIdentityRecordAuthorization = buildIdentityRecordAuthorization;
+/**
+ * Assemble the record-tier authorization wiring for `@astram/identity`: the lean grant-read
+ * pool factory + the `recordAuthorization` inputs the consumer passes to
+ * `ShieldModule.forRoot({ recordAuthorization })`. Once wired, `decide()` becomes REAL (the
+ * framework's four record-tier adapters are built internally over the supplied pool) instead
+ * of the deny-everything stub.
+ *
+ * Modeled on astram3's `buildAuthorizationInputs` (`server/src/features/authz/authz.wiring.ts`),
+ * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix
+ * (`APP_DB_*`, per the Task-7 rename).
+ */
+const mariadb_1 = __importDefault(require("mariadb"));
+const guard_1 = require("@astram/guard");
+const objects_js_1 = require("../../objects.js");
+const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
+const session_facts_reader_js_1 = require("./session-facts.reader.js");
+/**
+ * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
+ * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
+ * Opens the pool at CALL time (never at import) — the consumer (app lifecycle) owns closing it.
+ */
+function createIdentityAuthzPool() {
+    const db = (0, guard_1.loadDbConfig)();
+    return mariadb_1.default.createPool({
+        host: db.host,
+        port: db.port,
+        user: db.user,
+        password: db.password,
+        database: db.database,
+        connectionLimit: Number(process.env.APP_AUTHZ_POOL_MAX ?? 4),
+    });
+}
+/**
+ * Build the `RecordAuthorizationInputs` the consumer passes to
+ * `ShieldModule.forRoot({ recordAuthorization })`. The framework owns the four record-tier
+ * adapters internally; `@astram/identity` supplies only the app-schema ports:
+ *   - `permissionFacts` — coarse grants over `shield_authz.role_permission` +
+ *     `company_membership`/`membership_posting`,
+ *   - `sessionFacts` — the ADR-0011 ALS-backed per-request reader,
+ *   - `registry` — bridged from `identityObjects`,
+ *   - `operationManifest` — empty (identity declares no trusted delegated operations).
+ */
+function buildIdentityRecordAuthorization(pool) {
+    const registry = (0, guard_1.buildIdentityModuleRegistry)(objects_js_1.identityObjects);
+    return {
+        pool,
+        permissionFacts: new db_permission_facts_adapter_js_1.DbPermissionFactsAdapter(pool, registry),
+        sessionFacts: new session_facts_reader_js_1.AlsSessionFactsReader(),
+        registry,
+        operationManifest: [],
+    };
+}

package/dist/features/authz/session-facts.reader.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The per-request session-facts reader (ADR-0011 hot path) — ported from astram3's
+ * `AlsSessionFactsReader` (`server/src/features/authz/empty-ports.ts`).
+ *
+ * Reads THIS request's cached coarse grants out of the framework's SHARED session-facts
+ * `AsyncLocalStorage` (`SHIELD_SESSION_FACTS_ALS`, exported from `@astram/guard`) — the SAME
+ * instance the enforcement guard ENTERS around its `decide()` call. When the guard entered
+ * with the request's projected `cachedFacts`, gate 5 can serve the coarse decision from the
+ * cache instead of a DB reload — provided the cached version is still fresh; a stale/absent
+ * cache still reloads (gate 5's version gate).
+ *
+ * ⛔ FAIL-CLOSED + CROSS-PRINCIPAL ISOLATION: the reader holds NO per-request state on `this`
+ * — only the shared ALS handle. `getStore()` returns the CURRENT async context's store (the
+ * guard's `als.run(...)` around decide() binds it to this request only), so a concurrent
+ * request never sees another's facts. Outside any scope, or when the guard entered with
+ * `cachedFacts: null` (no/malformed projection), `getStore()` is `undefined` → the reader
+ * returns `{ cachedFacts: null, permissionsVersion: 0 }` → gate 5 DB-reloads. A cache miss
+ * NEVER fabricates a permit.
+ */
+import type { SessionFactsReader } from '@astram/core';
+import { type SessionFactsStore } from '@astram/guard';
+/**
+ * A {@link SessionFactsReader} whose getters read the request's facts out of the framework's
+ * shared session-facts ALS. Constructed with that exact singleton by default (imported from
+ * `@astram/guard`, the SAME one the guard enters), so the reader and the guard share one
+ * store — no duplicate ALS.
+ */
+export declare class AlsSessionFactsReader implements SessionFactsReader {
+    /** The SHARED ALS the enforcement guard enters (default = the framework singleton). */
+    private readonly als;
+    constructor(
+    /** The SHARED ALS the enforcement guard enters (default = the framework singleton). */
+    als?: {
+        getStore(): SessionFactsStore | undefined;
+    });
+    /** THIS request's cached coarse grants, or `null` (no scope / no facts → gate 5 reloads). */
+    get cachedFacts(): unknown;
+    /** The version the cached facts were projected at (0 when absent → treated as stale). */
+    get permissionsVersion(): number;
+}
+//# sourceMappingURL=session-facts.reader.d.ts.map

package/dist/features/authz/session-facts.reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-facts.reader.d.ts","sourceRoot":"","sources":["../../../src/features/authz/session-facts.reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEnG;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,kBAAkB;IAE5D,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,GAAG;;IADpB,uFAAuF;IACtE,GAAG,GAAE;QACpB,QAAQ,IAAI,iBAAiB,GAAG,SAAS,CAAC;KAChB;IAG9B,6FAA6F;IAC7F,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,yFAAyF;IACzF,IAAI,kBAAkB,IAAI,MAAM,CAE/B;CACF"}

package/dist/features/authz/session-facts.reader.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AlsSessionFactsReader = void 0;
+const guard_1 = require("@astram/guard");
+/**
+ * A {@link SessionFactsReader} whose getters read the request's facts out of the framework's
+ * shared session-facts ALS. Constructed with that exact singleton by default (imported from
+ * `@astram/guard`, the SAME one the guard enters), so the reader and the guard share one
+ * store — no duplicate ALS.
+ */
+class AlsSessionFactsReader {
+    als;
+    constructor(
+    /** The SHARED ALS the enforcement guard enters (default = the framework singleton). */
+    als = guard_1.SHIELD_SESSION_FACTS_ALS) {
+        this.als = als;
+    }
+    /** THIS request's cached coarse grants, or `null` (no scope / no facts → gate 5 reloads). */
+    get cachedFacts() {
+        return (this.als.getStore() ?? guard_1.NO_SESSION_FACTS).cachedFacts;
+    }
+    /** The version the cached facts were projected at (0 when absent → treated as stale). */
+    get permissionsVersion() {
+        return (this.als.getStore() ?? guard_1.NO_SESSION_FACTS).permissionsVersion;
+    }
+}
+exports.AlsSessionFactsReader = AlsSessionFactsReader;

package/dist/features/company/company.controller.d.ts

@@ -0,0 +1,37 @@
+import { CompanyService } from './company.service.js';
+import { type ListQueryDto } from '../shared/list-query.js';
+export declare class CompanyController {
+    private readonly companies;
+    constructor(companies: CompanyService);
+    /**
+     * List companies — gated on `identity:company:read`. Server-side DataTable:
+     * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` —
+     * `total` reflects the FILTERED set so the client can page the true result count.
+     */
+    listCompanies(query: ListQueryDto): Promise<{
+        total: number;
+        rows: readonly import("packages/engine/dist/types.js").RecordView[];
+        page: number;
+        limit: number;
+    }>;
+    /** Create a company (a new tenant) — gated on `identity:company:create`. */
+    createCompany(body: {
+        name?: string;
+    }): Promise<{
+        id: import("packages/engine/dist/types.js").RecordId;
+    }>;
+    /** Read one company — gated on `identity:company:read`. */
+    getCompany(uuid: string): Promise<import("packages/engine/dist/types.js").RecordView | null>;
+    /** Update a company — gated on `identity:company:update`. */
+    updateCompany(uuid: string, body: {
+        name?: string;
+        status?: string;
+    }): Promise<{
+        success: boolean;
+    }>;
+    /** Delete a company — gated on `identity:company:delete`. */
+    deleteCompany(uuid: string): Promise<{
+        success: boolean;
+    }>;
+}
+//# sourceMappingURL=company.controller.d.ts.map

package/dist/features/company/company.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.controller.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5E,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,cAAc;IAEtD;;;;OAIG;IAGG,aAAa,CAAU,KAAK,EAAE,YAAY;;;;;;IAMhD,4EAA4E;IAGtE,aAAa,CAAS,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKnD,2DAA2D;IAG3D,UAAU,CAAgB,IAAI,EAAE,MAAM;IAItC,6DAA6D;IAGvD,aAAa,CAAgB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAKjG,6DAA6D;IAGvD,aAAa,CAAgB,IAAI,EAAE,MAAM;;;CAIhD"}

package/dist/features/company/company.controller.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompanyController = void 0;
+const common_1 = require("@nestjs/common");
+const guard_1 = require("@astram/guard");
+const company_service_js_1 = require("./company.service.js");
+const list_query_js_1 = require("../shared/list-query.js");
+let CompanyController = class CompanyController {
+    companies;
+    constructor(companies) {
+        this.companies = companies;
+    }
+    /**
+     * List companies — gated on `identity:company:read`. Server-side DataTable:
+     * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` —
+     * `total` reflects the FILTERED set so the client can page the true result count.
+     */
+    async listCompanies(query) {
+        const { page, limit, params } = (0, list_query_js_1.parseListQuery)(query);
+        const result = await this.companies.listCompanies(params);
+        return { total: result.total, rows: result.rows, page, limit };
+    }
+    /** Create a company (a new tenant) — gated on `identity:company:create`. */
+    async createCompany(body) {
+        const id = await this.companies.createCompany(body?.name ?? 'Untitled');
+        return { id };
+    }
+    /** Read one company — gated on `identity:company:read`. */
+    getCompany(uuid) {
+        return this.companies.getCompany(uuid);
+    }
+    /** Update a company — gated on `identity:company:update`. */
+    async updateCompany(uuid, body) {
+        await this.companies.updateCompany(uuid, body ?? {});
+        return { success: true };
+    }
+    /** Delete a company — gated on `identity:company:delete`. */
+    async deleteCompany(uuid) {
+        await this.companies.deleteCompany(uuid);
+        return { success: true };
+    }
+};
+exports.CompanyController = CompanyController;
+__decorate([
+    (0, common_1.Get)('companies'),
+    (0, guard_1.Classified)({ typeKey: 'company', action: 'read' }),
+    __param(0, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CompanyController.prototype, "listCompanies", null);
+__decorate([
+    (0, common_1.Post)('companies'),
+    (0, guard_1.Classified)({ typeKey: 'company', action: 'create' }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CompanyController.prototype, "createCompany", null);
+__decorate([
+    (0, common_1.Get)('companies/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'company', action: 'read' }),
+    __param(0, (0, common_1.Param)('uuid')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", void 0)
+], CompanyController.prototype, "getCompany", null);
+__decorate([
+    (0, common_1.Put)('companies/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'company', action: 'update' }),
+    __param(0, (0, common_1.Param)('uuid')),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], CompanyController.prototype, "updateCompany", null);
+__decorate([
+    (0, common_1.Delete)('companies/:uuid'),
+    (0, guard_1.Classified)({ typeKey: 'company', action: 'delete' }),
+    __param(0, (0, common_1.Param)('uuid')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], CompanyController.prototype, "deleteCompany", null);
+exports.CompanyController = CompanyController = __decorate([
+    (0, common_1.Controller)('identity'),
+    __metadata("design:paramtypes", [company_service_js_1.CompanyService])
+], CompanyController);

package/dist/features/company/company.service.d.ts

@@ -0,0 +1,25 @@
+import { RecordsService, type RecordId } from '@astram/engine';
+import { type ListParams } from '../shared/list-query.js';
+/**
+ * CompanyService — company (tenant) CRUD on the paved road, via the framework's
+ * RecordsService facade. The facade supplies the acting identity (the request
+ * principal) — this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ */
+export declare class CompanyService {
+    private readonly records;
+    constructor(records: RecordsService);
+    /** Create a company (tenant). */
+    createCompany(name: string): Promise<RecordId>;
+    /** List companies (tenant-scoped by the pipe), with paging/search/sort. */
+    listCompanies(params?: ListParams): Promise<import("@astram/engine").RecordPage>;
+    /** Read a single company. */
+    getCompany(uuid: string): Promise<import("@astram/engine").RecordView | null>;
+    /** Update a company. */
+    updateCompany(uuid: string, patch: {
+        name?: string;
+        status?: string;
+    }): Promise<void>;
+    /** Delete a company. */
+    deleteCompany(uuid: string): Promise<void>;
+}
+//# sourceMappingURL=company.service.d.ts.map

package/dist/features/company/company.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAK1E;;;;GAIG;AACH,qBACa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAEpD,iCAAiC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAI9C,2EAA2E;IAC3E,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU;IAIjC,6BAA6B;IAC7B,UAAU,CAAC,IAAI,EAAE,MAAM;IAIvB,wBAAwB;IACxB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,wBAAwB;IACxB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C"}

package/dist/features/company/company.service.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompanyService = void 0;
+const common_1 = require("@nestjs/common");
+const engine_1 = require("@astram/engine");
+const list_query_js_1 = require("../shared/list-query.js");
+const COMPANY_SEARCH_FIELDS = ['name'];
+const COMPANY_SORT_FIELDS = ['name', 'status', 'createdAt'];
+/**
+ * CompanyService — company (tenant) CRUD on the paved road, via the framework's
+ * RecordsService facade. The facade supplies the acting identity (the request
+ * principal) — this service never threads a Principal. No raw SQL, no RECORD_ENGINE.
+ */
+let CompanyService = class CompanyService {
+    records;
+    constructor(records) {
+        this.records = records;
+    }
+    /** Create a company (tenant). */
+    createCompany(name) {
+        return this.records.create('company', { fields: { name } });
+    }
+    /** List companies (tenant-scoped by the pipe), with paging/search/sort. */
+    listCompanies(params) {
+        return this.records.list('company', (0, list_query_js_1.buildListQuery)(params, COMPANY_SEARCH_FIELDS, COMPANY_SORT_FIELDS));
+    }
+    /** Read a single company. */
+    getCompany(uuid) {
+        return this.records.get('company', uuid);
+    }
+    /** Update a company. */
+    updateCompany(uuid, patch) {
+        return this.records.update('company', uuid, { fields: patch });
+    }
+    /** Delete a company. */
+    deleteCompany(uuid) {
+        return this.records.delete('company', uuid);
+    }
+};
+exports.CompanyService = CompanyService;
+exports.CompanyService = CompanyService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [engine_1.RecordsService])
+], CompanyService);

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts

@@ -0,0 +1,126 @@
+import type { Pool } from 'mariadb';
+import type { ObjectTypeInput } from '@astram/engine';
+/** One row in the grantee's pending-offers inbox. */
+export interface InboxGrantRow {
+    uuid: string;
+    owningTenantName: string;
+    granteeKind: 'user' | 'role';
+    granteeName: string;
+    typeKey: string;
+    typeLabel: string;
+    scope: string;
+    allowedActions: string[];
+    offeredByName: string;
+    expiresAtMs: number;
+}
+/** One row of a grant MY tenant owns (any status) — the "outgoing" list. */
+export interface MineGrantRow {
+    uuid: string;
+    granteeTenantName: string;
+    granteeKind: 'user' | 'role';
+    granteeName: string;
+    typeKey: string;
+    typeLabel: string;
+    scope: string;
+    allowedActions: string[];
+    status: string;
+    offeredByName: string;
+    expiresAtMs: number;
+}
+/** One row of a grant accepted INTO my tenant — the "incoming" (active) list. */
+export interface IncomingGrantRow {
+    uuid: string;
+    owningTenantName: string;
+    granteeKind: 'user' | 'role';
+    granteeName: string;
+    typeKey: string;
+    typeLabel: string;
+    scope: string;
+    allowedActions: string[];
+    offeredByName: string;
+    expiresAtMs: number;
+}
+/** One offerable object type for the offer form's picker (decision 1: tenantScoped only). */
+export interface OfferableTypeRow {
+    typeKey: string;
+    label: string;
+    actions: string[];
+}
+export declare class CrossTenantGrantReadService {
+    private readonly pool;
+    private readonly offerableTypeInputs;
+    private readonly actionsByType;
+    /**
+     * @param pool the shared resolver pool.
+     * @param offerableTypeInputs the ENGINE registrations to filter to `access.tenantScoped
+     *   === true` types for the offer form's picker (decision 1). Passed in (not imported
+     *   directly) so this service stays a plain constructor-arg class like its siblings —
+     *   the module supplies the same merged `[...identityObjects]` set the share-type
+     *   surface uses, so a future tenantScoped type is picked up the same way it becomes
+     *   shareable.
+     * @param actionsByType per-typeKey action vocabulary for the offerable-types read
+     *   (decision 1: "the actions per type come from the type's own action set"). Callers
+     *   pass `actionsFor`, which defaults every type to the CRUD `IDENTITY_ACTIONS` except
+     *   a type with its own override (e.g. `cross_tenant_grant` -> share/accept/revoke) —
+     *   the single source every action-vocabulary consumer uses, so a per-type set can
+     *   never drift between callers.
+     */
+    constructor(pool: Pool, offerableTypeInputs: readonly ObjectTypeInput[], actionsByType: (typeKey: string) => readonly string[]);
+    /**
+     * Pending offers sitting in the CALLER's tenant inbox: `ctg_grantee_tenant_uuid =
+     * tenantId AND ctg_status = 'offered' AND ctg_expires_at_ms > nowMs` (an expired
+     * offer is dead — never surfaced as actionable, mirroring the writer's own active-
+     * grant filter). Ordered soonest-expiring first (most urgent to act on).
+     */
+    listInbox(tenantId: string, nowMs: number): Promise<InboxGrantRow[]>;
+    /**
+     * Every grant MY tenant OWNS (`ctg_owning_tenant_uuid = tenantId`), ANY status — the
+     * "outgoing" list (what I've offered, whether still pending, accepted, or revoked).
+     * Ordered most-recently-offered first (`ctg_created_at DESC`) — the natural order
+     * for "what have I done lately" on an owner's own outgoing list.
+     */
+    listMine(tenantId: string): Promise<MineGrantRow[]>;
+    /**
+     * Grants ACCEPTED into my tenant (`ctg_grantee_tenant_uuid = tenantId AND ctg_status
+     * = 'accepted'`) — the "incoming" (currently-active reach-in) list, distinct from the
+     * pending inbox. Includes grants whose expiry has since passed (this reports status as
+     * stored — `CrossTenantGrantPort.findActiveGrant` is the ACTUAL enforcement of
+     * liveness; this is a read-model list, not a re-implementation of that check), so the
+     * UI can show "expired" via `expiresAtMs` if desired. Ordered soonest-expiring first.
+     */
+    listIncoming(tenantId: string): Promise<IncomingGrantRow[]>;
+    /**
+     * The ONE source of truth for "which typeKeys are offerable across tenants" (decision
+     * 1: `access.tenantScoped === true`). Reflects the SAME engine registrations the
+     * share surface merges (`[...identityObjects]`, passed in by the module) and returns
+     * the set of tenantScoped typeKeys. Both the picker read (`listOfferableTypes`) AND the
+     * offer-endpoint guard (`isOfferableType`) derive from this — so there is no way for
+     * the two to drift (a system type can never be BOTH shown in the picker AND accepted
+     * by the offer endpoint, or neither).
+     */
+    private offerableTypeKeys;
+    /**
+     * Is `typeKey` offerable across tenants (i.e. a registered tenantScoped type)? The
+     * offer controller calls this BEFORE `writer.offer()` so an un-offerable typeKey (any
+     * `system` type — e.g. `company`) is rejected with a 400 before any row is written.
+     *
+     * This closes the H3 defense-in-depth gap: the writer's `assertValidOffer` only checks
+     * `typeKey` is a non-empty string, so without this guard a legit own-tenant admin could
+     * mint a junk `offered` grant row for a `system` type. It's inert at evaluation TODAY
+     * only because no type is both `system` AND `tenantScoped` (system types have no
+     * `trusted:'tenantId'`, so the tenant gate never consults a cross-tenant grant for
+     * them) — but that safety is a coincidence, not an explicit rule. This makes it
+     * explicit, using the SAME tenantScoped filter as the picker (`offerableTypeKeys`).
+     */
+    isOfferableType(typeKey: string): boolean;
+    /**
+     * The object-type picker source for the offer form (decision 1): the tenantScoped
+     * registered types (from `offerableTypeKeys` — the same source `isOfferableType`
+     * uses) paired with each type's action vocabulary. No DB query — pure in-memory
+     * reflection, wrapped in a resolved promise so the controller's read-surface shape is
+     * uniform. The identity types are all `system` and are excluded by construction —
+     * only a tenantScoped type (e.g. `shared_resource`) qualifies.
+     */
+    listOfferableTypes(): Promise<OfferableTypeRow[]>;
+}
+//# sourceMappingURL=cross-tenant-grant-read.service.d.ts.map

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tenant-grant-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant-read.service.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+FD,qBACa,2BAA2B;IAiBpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAlBhC;;;;;;;;;;;;;;OAcG;gBAEgB,IAAI,EAAE,IAAI,EACV,mBAAmB,EAAE,SAAS,eAAe,EAAE,EAC/C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE;IAGxE;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA0B1E;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAyBzD;;;;;;;OAOG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyBjE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAWxD"}