@astram/identity 0.10.0 → 0.11.0

package/dist/auth-facts-keys.d.ts

@@ -1,3 +1,19 @@
+import type { ObjectTypeInput } from '@astram/engine';
+/** The auth-facts key universe for identity's objects plus a consumer's `extraObjects`. */
+export interface IdentityAuthKeys {
+    /** Every action key: pass as `ShieldModule.forRoot({ identityActionKeys })`. */
+    readonly actionKeys: string[];
+    /** The control-plane subset: pass as `ShieldModule.forRoot({ identityControlPlaneKeys })`. */
+    readonly controlPlaneKeys: string[];
+}
+/**
+ * Build the auth-facts key universe from identity's objects plus `extraObjects` (pass the same
+ * array as `IdentityFeatureModule.forRoot({ extraObjects })`). Same registry bridge as the record
+ * authorization, so the keys match decide() and the permission catalog exactly.
+ */
+export declare function buildIdentityAuthKeys(extraObjects?: readonly ObjectTypeInput[]): IdentityAuthKeys;
+/** Identity's own action keys (no consumer types; see {@link buildIdentityAuthKeys}). */
 export declare const identityAuthActionKeys: readonly string[];
+/** Identity's own control-plane keys (no consumer types; see {@link buildIdentityAuthKeys}). */
 export declare const identityControlPlaneKeys: readonly string[];
 //# sourceMappingURL=auth-facts-keys.d.ts.map

package/dist/auth-facts-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-facts-keys.d.ts","sourceRoot":"","sources":["../src/auth-facts-keys.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAEZ,CAAC;AAEzC,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGd,CAAC"}
+{"version":3,"file":"auth-facts-keys.d.ts","sourceRoot":"","sources":["../src/auth-facts-keys.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC9B,8FAA8F;IAC9F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,gBAAgB,CAQlB;AAID,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAA4B,CAAC;AAEjF,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAkC,CAAC"}

package/dist/auth-facts-keys.js

@@ -1,24 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.identityControlPlaneKeys = exports.identityAuthActionKeys = void 0;
+exports.buildIdentityAuthKeys = buildIdentityAuthKeys;
 /**
- * The framework identity permission-key universe, projected once from `identityObjects` via
+ * The framework identity permission-key universe, projected from `identityObjects` via
  * `@astram/guard`'s registry bridge. Exported for the consumer to pass into
  * `ShieldModule.forRoot({ auth: true, identityActionKeys, identityControlPlaneKeys })` — so the
  * auth-facts adapter (in guard) can expand `identity:*` grants + union root's control-plane keys
  * WITHOUT guard importing this package (the sanctioned graph is identity → guard).
  *
+ * A consumer that registers its own object types passes the SAME list it gives
+ * `IdentityFeatureModule.forRoot({ extraObjects })` to {@link buildIdentityAuthKeys} (KI #70), so
+ * `/auth/facts` covers the same key universe decide() and the permission catalog use.
+ *
  * ⚠ NO MODULE-INIT CYCLE: `identityObjects` is imported from the leaf `./objects.js` (NOT from
  * `./index.js`, which re-exports THIS file). So the array is fully initialized before the
- * `buildIdentityModuleRegistry(...)` call below runs at module-eval time.
+ * `buildIdentityAuthKeys()` call below runs at module-eval time.
  */
 const guard_1 = require("@astram/guard");
 const objects_js_1 = require("./objects.js");
-const registry = (0, guard_1.buildIdentityModuleRegistry)(objects_js_1.identityObjects);
-exports.identityAuthActionKeys = registry
-    .listActions()
-    .map((a) => a.permissionKey);
-exports.identityControlPlaneKeys = registry
-    .listActions()
-    .filter((a) => a.plane === 'control')
-    .map((a) => a.permissionKey);
+/**
+ * Build the auth-facts key universe from identity's objects plus `extraObjects` (pass the same
+ * array as `IdentityFeatureModule.forRoot({ extraObjects })`). Same registry bridge as the record
+ * authorization, so the keys match decide() and the permission catalog exactly.
+ */
+function buildIdentityAuthKeys(extraObjects = []) {
+    const actions = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]).listActions();
+    return {
+        actionKeys: actions.map((a) => a.permissionKey),
+        controlPlaneKeys: actions
+            .filter((a) => a.plane === 'control')
+            .map((a) => a.permissionKey),
+    };
+}
+const identityOnly = buildIdentityAuthKeys();
+/** Identity's own action keys (no consumer types; see {@link buildIdentityAuthKeys}). */
+exports.identityAuthActionKeys = identityOnly.actionKeys;
+/** Identity's own control-plane keys (no consumer types; see {@link buildIdentityAuthKeys}). */
+exports.identityControlPlaneKeys = identityOnly.controlPlaneKeys;

package/dist/cross-tenant-grant.object.d.ts

@@ -13,8 +13,8 @@
  *
  * Mirrors `membership-posting.object.ts`'s shape (system, no trusted columns needed
  * beyond the PK) — the engine's `validateAccess` requires `table` + at least one
- * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD `IDENTITY_ACTIONS`
- * — see `@astram/guard`'s `identity-actions.ts`'s `actionsFor('cross_tenant_grant')` ->
+ * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD verbs: it opts out
+ * (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `CROSS_TENANT_GRANT_ACTIONS` (`share`/`accept`/`revoke`).
  *
  * Ported from astram3's frozen

package/dist/cross-tenant-grant.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant.object.d.ts","sourceRoot":"","sources":["../src/cross-tenant-grant.object.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAOa,gBAAgB;IAE3B,IAAI,EAAG,MAAM,CAAC;IAGd,gBAAgB,EAAG,MAAM,CAAC;IAG1B,iBAAiB,EAAG,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"cross-tenant-grant.object.d.ts","sourceRoot":"","sources":["../src/cross-tenant-grant.object.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBASa,gBAAgB;IAE3B,IAAI,EAAG,MAAM,CAAC;IAGd,gBAAgB,EAAG,MAAM,CAAC;IAG1B,iBAAiB,EAAG,MAAM,CAAC;CAC5B"}

package/dist/cross-tenant-grant.object.js

@@ -11,6 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CrossTenantGrant = void 0;
 const engine_1 = require("@astram/engine");
+const guard_1 = require("@astram/guard");
 /** The physical schema `cross_tenant_grant` lives in (migration 1710000000011). */
 const SCHEMA = 'shield_authz';
 /**
@@ -28,8 +29,8 @@ const SCHEMA = 'shield_authz';
  *
  * Mirrors `membership-posting.object.ts`'s shape (system, no trusted columns needed
  * beyond the PK) — the engine's `validateAccess` requires `table` + at least one
- * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD `IDENTITY_ACTIONS`
- * — see `@astram/guard`'s `identity-actions.ts`'s `actionsFor('cross_tenant_grant')` ->
+ * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD verbs: it opts out
+ * (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `CROSS_TENANT_GRANT_ACTIONS` (`share`/`accept`/`revoke`).
  *
  * Ported from astram3's frozen
@@ -59,6 +60,8 @@ exports.CrossTenantGrant = CrossTenantGrant = __decorate([
         table: 'cross_tenant_grant',
         schema: SCHEMA,
         access: { plane: 'control', system: true },
+        crudActions: false,
+        actions: guard_1.CROSS_TENANT_GRANT_ACTIONS,
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'ctg_uuid' })
 ], CrossTenantGrant);

package/dist/features/authz/catalog-bootstrap.provider.d.ts

@@ -1,5 +1,6 @@
 import { type OnApplicationBootstrap } from '@nestjs/common';
 import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
+import { type RecordAuthorizationInputs } from '@astram/guard';
 import type { ObjectType } from '@astram/engine';
 import { CatalogReconcileJob } from './catalog-reconcile.job.js';
 import { AccessBundleReconcileJob } from './access-bundle-reconcile.job.js';
@@ -23,8 +24,10 @@ export declare class CatalogBootstrapProvider implements OnApplicationBootstrap
     private readonly accessBundleJob;
     private readonly scopeClosure;
     private readonly registrations;
+    private readonly recordAuthorization;
+    private readonly logger;
     private timer;
-    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, job: CatalogReconcileJob, accessBundleJob: AccessBundleReconcileJob, scopeClosure: ScopeClosureService, registrations: readonly ObjectType[]);
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, job: CatalogReconcileJob, accessBundleJob: AccessBundleReconcileJob, scopeClosure: ScopeClosureService, registrations: readonly ObjectType[], recordAuthorization: RecordAuthorizationInputs);
     onApplicationBootstrap(): Promise<void>;
     /** Rebuild the scope closure; a failure is logged loudly (never silently swallowed) but does
      *  not abort boot or a cron tick — the reconcile is idempotent and retried next interval. */

package/dist/features/authz/catalog-bootstrap.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB;IAInE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAVhC,OAAO,CAAC,KAAK,CAA+B;gBAGzB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EACzC,YAAY,EAAE,mBAAmB,EAEjC,aAAa,EAAE,SAAS,UAAU,EAAE;IAGjD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC7C;iGAC6F;YAC/E,qBAAqB;CAOpC"}
+{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB;IAKnE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAbtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,KAAK,CAA+B;gBAGzB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EACzC,YAAY,EAAE,mBAAmB,EAEjC,aAAa,EAAE,SAAS,UAAU,EAAE,EAEpC,mBAAmB,EAAE,yBAAyB;IAG3D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAyE7C;iGAC6F;YAC/E,qBAAqB;CAOpC"}

package/dist/features/authz/catalog-bootstrap.provider.js

@@ -11,6 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var CatalogBootstrapProvider_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CatalogBootstrapProvider = void 0;
 // Ported from astram3 `server/src/features/authz/catalog-bootstrap.provider.ts`.
@@ -37,7 +38,7 @@ const RECONCILE_INTERVAL_MS = 60 * 60 * 1000; // hourly; honors DISABLE_ALL_CRON
  * health controller injects — so verify, the post-boot pass, and the endpoint all share
  * one job. This provider owns only the boot verify + the schedule.
  */
-let CatalogBootstrapProvider = class CatalogBootstrapProvider {
+let CatalogBootstrapProvider = CatalogBootstrapProvider_1 = class CatalogBootstrapProvider {
     discovery;
     scanner;
     reflector;
@@ -45,8 +46,10 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
     accessBundleJob;
     scopeClosure;
     registrations;
+    recordAuthorization;
+    logger = new common_1.Logger(CatalogBootstrapProvider_1.name);
     timer = null;
-    constructor(discovery, scanner, reflector, job, accessBundleJob, scopeClosure, registrations) {
+    constructor(discovery, scanner, reflector, job, accessBundleJob, scopeClosure, registrations, recordAuthorization) {
         this.discovery = discovery;
         this.scanner = scanner;
         this.reflector = reflector;
@@ -54,11 +57,38 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
         this.accessBundleJob = accessBundleJob;
         this.scopeClosure = scopeClosure;
         this.registrations = registrations;
+        this.recordAuthorization = recordAuthorization;
     }
     async onApplicationBootstrap() {
-        const registry = (0, guard_1.buildIdentityModuleRegistry)(this.registrations);
+        // ONE key universe (KI #70): verify against the registry decide(), the grant ceiling and the
+        // catalog reconcile job all use (identity objects + the consumer's `extraObjects`).
+        const registry = this.recordAuthorization.registry;
         const inventoryScanner = new guard_1.OperationInventoryScanner(this.discovery, this.scanner, this.reflector);
-        const inventory = inventoryScanner.scan(MODULE_KEY);
+        const scanned = inventoryScanner.scan(MODULE_KEY);
+        // A type registered with `EngineModule.forFeature` but not passed as `extraObjects` is
+        // unknown to decide() (`resource_not_registered`), so every gated access to it is denied
+        // and its keys are not catalogued. Before KI #70 verify ran over the engine registrations,
+        // so such routes booted; keep them booting (no new boot failure for existing consumers) but
+        // say loudly that they can never be allowed.
+        const engineOnly = this.registrations.filter((r) => registry.resolveObjectType(r.typeKey) === undefined);
+        let inventory = scanned;
+        if (engineOnly.length > 0) {
+            const engineOnlyKeys = new Set((0, guard_1.buildIdentityModuleRegistry)(engineOnly)
+                .listActions()
+                .map((a) => a.permissionKey));
+            const denied = scanned.operations.filter((op) => op.permissionKey !== undefined && engineOnlyKeys.has(op.permissionKey));
+            this.logger.warn(`object type(s) ${engineOnly.map((r) => r.typeKey).join(', ')} are registered with ` +
+                'EngineModule.forFeature but not in IdentityFeatureModule.forRoot({ extraObjects }): ' +
+                'decide() denies every gated access to them and their keys are not catalogued' +
+                (denied.length > 0
+                    ? `; always-denied routes: ${denied.map((op) => op.operationId).join(', ')}`
+                    : '') +
+                '. Add them to extraObjects.');
+            inventory = {
+                ...scanned,
+                operations: scanned.operations.filter((op) => !denied.includes(op)),
+            };
+        }
         // Fail-closed (ADR-0002): a route that can't be gated aborts boot.
         new guard_1.CatalogReconciler().verifyGatable(inventory, registry);
         // Mutating reconcile runs AFTER boot (not blocking, not fail-closed).
@@ -97,13 +127,14 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
     }
 };
 exports.CatalogBootstrapProvider = CatalogBootstrapProvider;
-exports.CatalogBootstrapProvider = CatalogBootstrapProvider = __decorate([
+exports.CatalogBootstrapProvider = CatalogBootstrapProvider = CatalogBootstrapProvider_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(6, (0, common_1.Inject)(engine_1.ENGINE_ALL_REGISTRATIONS)),
+    __param(7, (0, common_1.Inject)(guard_1.SHIELD_RECORD_AUTHORIZATION)),
     __metadata("design:paramtypes", [core_1.DiscoveryService,
         core_1.MetadataScanner,
         core_1.Reflector,
         catalog_reconcile_job_js_1.CatalogReconcileJob,
         access_bundle_reconcile_job_js_1.AccessBundleReconcileJob,
-        scope_closure_service_js_1.ScopeClosureService, Array])
+        scope_closure_service_js_1.ScopeClosureService, Array, Object])
 ], CatalogBootstrapProvider);

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts

@@ -59,11 +59,12 @@ export declare class CrossTenantGrantReadService {
      *   surface uses, so a future tenantScoped type is picked up the same way it becomes
      *   shareable.
      * @param actionsByType per-typeKey action vocabulary for the offerable-types read
-     *   (decision 1: "the actions per type come from the type's own action set"). Callers
-     *   pass `actionsFor`, which defaults every type to the CRUD `IDENTITY_ACTIONS` except
-     *   a type with its own override (e.g. `cross_tenant_grant` -> share/accept/revoke) —
-     *   the single source every action-vocabulary consumer uses, so a per-type set can
-     *   never drift between callers.
+     *   (decision 1: "the actions per type come from the type's own action set"). The
+     *   module passes its registration-based lookup (`effectiveActions` over the same
+     *   `[...identityObjects, ...extraObjects]`, ADR-0038): CRUD plus a type's declared
+     *   extras, or exactly its declared list for `crudActions: false` (e.g.
+     *   `cross_tenant_grant` -> share/accept/revoke) — the single source every
+     *   action-vocabulary consumer uses, so a per-type set can never drift between callers.
      */
     constructor(pool: Pool, offerableTypeInputs: readonly ObjectTypeInput[], actionsByType: (typeKey: string) => readonly string[]);
     /**

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant-read.service.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+FD,qBACa,2BAA2B;IAiBpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAlBhC;;;;;;;;;;;;;;OAcG;gBAEgB,IAAI,EAAE,IAAI,EACV,mBAAmB,EAAE,SAAS,eAAe,EAAE,EAC/C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE;IAGxE;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA0B1E;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAyBzD;;;;;;;OAOG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyBjE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAWxD"}
+{"version":3,"file":"cross-tenant-grant-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant-read.service.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+FD,qBACa,2BAA2B;IAkBpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAnBhC;;;;;;;;;;;;;;;OAeG;gBAEgB,IAAI,EAAE,IAAI,EACV,mBAAmB,EAAE,SAAS,eAAe,EAAE,EAC/C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE;IAGxE;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA0B1E;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAyBzD;;;;;;;OAOG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyBjE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAWxD"}

package/dist/features/cross-tenant/cross-tenant-grant-read.service.js

@@ -120,11 +120,12 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
      *   surface uses, so a future tenantScoped type is picked up the same way it becomes
      *   shareable.
      * @param actionsByType per-typeKey action vocabulary for the offerable-types read
-     *   (decision 1: "the actions per type come from the type's own action set"). Callers
-     *   pass `actionsFor`, which defaults every type to the CRUD `IDENTITY_ACTIONS` except
-     *   a type with its own override (e.g. `cross_tenant_grant` -> share/accept/revoke) —
-     *   the single source every action-vocabulary consumer uses, so a per-type set can
-     *   never drift between callers.
+     *   (decision 1: "the actions per type come from the type's own action set"). The
+     *   module passes its registration-based lookup (`effectiveActions` over the same
+     *   `[...identityObjects, ...extraObjects]`, ADR-0038): CRUD plus a type's declared
+     *   extras, or exactly its declared list for `crudActions: false` (e.g.
+     *   `cross_tenant_grant` -> share/accept/revoke) — the single source every
+     *   action-vocabulary consumer uses, so a per-type set can never drift between callers.
      */
     constructor(pool, offerableTypeInputs, actionsByType) {
         this.pool = pool;

package/dist/features/files/files.controller.d.ts

@@ -0,0 +1,27 @@
+import { StreamableFile } from '@nestjs/common';
+import { FilesService } from './files.service.js';
+/**
+ * `filename*` value for a stored name: C0 controls and DEL dropped, the rest UTF-8 percent-encoded
+ * byte by byte (a lone surrogate becomes U+FFFD via `Buffer.from`, so this never throws). Quotes,
+ * CR, LF, `;` and spaces are always encoded, so the name cannot split or extend the header.
+ */
+export declare function rfc5987FileName(name: string): string;
+/**
+ * FilesController — the framework download route `GET /files/:uuid` (file-storage SPEC §3, §5 K2).
+ *
+ * - Gated on `stored_file:read` by the global guard (Shield #2/#3); `UuidPipe` answers 400 for a
+ *   non-uuid before any service call. Record-level decide, the tenant wall, the key-prefix and
+ *   sha256 checks and the `file_access` audit all happen in `FilesService.open`.
+ * - Errors map at source: 501/503/403 come from `FilesService` with fixed messages; an engine
+ *   deny is rethrown here as the same 403 a missing row gets (SPEC §13: same body). Never echoes
+ *   the storage key or the name in an error.
+ * - Success headers: `Cache-Control: no-store` and `nosniff` via `@Header`; `Content-Type` (from
+ *   the record), `Content-Disposition` (attachment, RFC 5987 `filename*` only) and `Content-Length`
+ *   via `StreamableFile`, all set before the body is written. No express types needed.
+ */
+export declare class FilesController {
+    private readonly files;
+    constructor(files: FilesService);
+    download(uuid: string): Promise<StreamableFile>;
+}
+//# sourceMappingURL=files.controller.d.ts.map

package/dist/features/files/files.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.controller.d.ts","sourceRoot":"","sources":["../../../src/features/files/files.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,cAAc,EAEf,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AAQnE;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYpD;AAED;;;;;;;;;;;;GAYG;AACH,qBAEa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,YAAY;IAM1C,QAAQ,CAA0B,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAc/E"}

package/dist/features/files/files.controller.js

@@ -0,0 +1,94 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FilesController = void 0;
+exports.rfc5987FileName = rfc5987FileName;
+const common_1 = require("@nestjs/common");
+const engine_1 = require("@astram/engine");
+const guard_1 = require("@astram/guard");
+const identity_error_interceptor_js_1 = require("../shared/identity-error.interceptor.js");
+const files_service_js_1 = require("./files.service.js");
+/** Same text as `FilesService`'s 403, so an engine deny and a missing row answer one body (§13). */
+const MSG_FORBIDDEN = 'Forbidden';
+/** RFC 5987 `attr-char` (RFC 8187 §3.2.1): every other UTF-8 byte is percent-encoded. */
+const ATTR_CHAR = /^[A-Za-z0-9!#$&+\-.^_`|~]$/;
+/**
+ * `filename*` value for a stored name: C0 controls and DEL dropped, the rest UTF-8 percent-encoded
+ * byte by byte (a lone surrogate becomes U+FFFD via `Buffer.from`, so this never throws). Quotes,
+ * CR, LF, `;` and spaces are always encoded, so the name cannot split or extend the header.
+ */
+function rfc5987FileName(name) {
+    // eslint-disable-next-line no-control-regex
+    const cleaned = name.replace(/[\u0000-\u001f\u007f]/g, '');
+    let out = '';
+    for (const byte of Buffer.from(cleaned.length > 0 ? cleaned : 'download', 'utf8')) {
+        const ch = String.fromCharCode(byte);
+        out +=
+            byte < 0x80 && ATTR_CHAR.test(ch)
+                ? ch
+                : `%${byte.toString(16).toUpperCase().padStart(2, '0')}`;
+    }
+    return out;
+}
+/**
+ * FilesController — the framework download route `GET /files/:uuid` (file-storage SPEC §3, §5 K2).
+ *
+ * - Gated on `stored_file:read` by the global guard (Shield #2/#3); `UuidPipe` answers 400 for a
+ *   non-uuid before any service call. Record-level decide, the tenant wall, the key-prefix and
+ *   sha256 checks and the `file_access` audit all happen in `FilesService.open`.
+ * - Errors map at source: 501/503/403 come from `FilesService` with fixed messages; an engine
+ *   deny is rethrown here as the same 403 a missing row gets (SPEC §13: same body). Never echoes
+ *   the storage key or the name in an error.
+ * - Success headers: `Cache-Control: no-store` and `nosniff` via `@Header`; `Content-Type` (from
+ *   the record), `Content-Disposition` (attachment, RFC 5987 `filename*` only) and `Content-Length`
+ *   via `StreamableFile`, all set before the body is written. No express types needed.
+ */
+let FilesController = class FilesController {
+    files;
+    constructor(files) {
+        this.files = files;
+    }
+    async download(uuid) {
+        let file;
+        try {
+            file = await this.files.open(uuid);
+        }
+        catch (cause) {
+            if (cause instanceof engine_1.AuthorizationDeniedError)
+                throw new common_1.ForbiddenException(MSG_FORBIDDEN);
+            throw cause;
+        }
+        return new common_1.StreamableFile(Buffer.from(file.bytes), {
+            type: file.contentType,
+            disposition: `attachment; filename*=UTF-8''${rfc5987FileName(file.originalName)}`,
+            length: file.bytes.byteLength,
+        });
+    }
+};
+exports.FilesController = FilesController;
+__decorate([
+    (0, common_1.Get)(':uuid'),
+    (0, guard_1.Classified)({ typeKey: 'stored_file', action: 'read' }),
+    (0, common_1.Header)('Cache-Control', 'no-store'),
+    (0, common_1.Header)('X-Content-Type-Options', 'nosniff'),
+    __param(0, (0, common_1.Param)('uuid', guard_1.UuidPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], FilesController.prototype, "download", null);
+exports.FilesController = FilesController = __decorate([
+    (0, common_1.Controller)('files'),
+    (0, common_1.UseInterceptors)(identity_error_interceptor_js_1.IdentityErrorInterceptor),
+    __metadata("design:paramtypes", [files_service_js_1.FilesService])
+], FilesController);

package/dist/features/files/files.service.d.ts

@@ -0,0 +1,87 @@
+import type { AuditSink, IngestedFile, ObjectStore } from '@astram/core';
+import { type RecordsService } from '@astram/engine';
+/**
+ * The canonical content types the intake allowlist can store: today the `xlsx` profile, the only
+ * profile `ShieldModule` registers on `SHIELD_FILE_INGEST`. Pass the app's own list when it
+ * registers more profiles.
+ */
+export declare const DEFAULT_SERVABLE_CONTENT_TYPES: readonly string[];
+/** What `store()` takes: the ingest result (server-built key, sha256, canonical type) plus bytes. */
+export interface StoreFileInput extends IngestedFile {
+    readonly bytes: Uint8Array;
+}
+/** What `store()` returns to the caller. Never carries the storage key (SPEC §5 I). */
+export interface StoredFileSummary {
+    readonly uuid: string;
+    readonly sha256: string;
+    readonly sizeBytes: number;
+    readonly contentType: string;
+    readonly originalName: string;
+}
+/** What `open()` returns (SPEC §5 J). Never carries the storage key. */
+export interface OpenedFile {
+    readonly bytes: Uint8Array;
+    readonly contentType: string;
+    readonly originalName: string;
+    readonly sizeBytes: number;
+}
+/**
+ * FilesService — stored files on the engine pipe (file-storage SPEC §5 I-K).
+ *
+ * - The `stored_file` row is written ONLY here (KI #4): the key comes from `FileIntake` (built from
+ *   the session tenant) and is re-checked against the actor's tenant before any put or create.
+ *   Tenant and owner are stamped by the pipe from the session (Shield #7), never sent from here.
+ * - Every row access goes through `RecordsService` (record gate, tenant wall, read scope, audit);
+ *   no DB pool, no bypass flag (Shield #3, #9). The bucket is read only in `open()`, after the gate.
+ * - Errors map at source: 501 when no store is bound, 503 (fixed message) for store failures and
+ *   integrity faults, 403 (fixed message) for missing, foreign or denied rows alike.
+ * - No actor argument (SPEC §5 I-K): the key tenant and the `file_access` audit actor come from
+ *   `RecordsService.requestPrincipal()`, the same principal the engine stamps and gates with, so
+ *   key tenant, row tenant/owner and audit actor cannot diverge. No principal ⇒ fail closed.
+ * - The engine does not audit its own denials, so a 403 from open/remove writes a `file_access`
+ *   failure event (`denied_or_missing`, no key, no name). Logs carry the storage key only.
+ */
+export declare class FilesService {
+    private readonly records;
+    private readonly objectStore;
+    private readonly audit;
+    private readonly logger;
+    private orphans;
+    constructor(records: RecordsService, objectStore: ObjectStore | null, audit: AuditSink, servableContentTypes?: readonly string[]);
+    /** Lower-cased allowlisted type -> its canonical spelling (what `open()` may serve). */
+    private readonly servable;
+    /**
+     * KI #13: the download Content-Type is re-checked against the intake allowlist, never taken
+     * from the row as-is. Anything else (a row written outside FileIntake, a profile since
+     * removed) is served as `application/octet-stream`.
+     */
+    private servableType;
+    /** Objects left behind by a failed compensating or post-commit delete since boot. */
+    get orphanedObjectCount(): number;
+    /** Put the bytes, then create the `stored_file` record; on create failure delete the object. */
+    store(intake: StoreFileInput): Promise<StoredFileSummary>;
+    /** Read a file under record-level decide, with the key and sha256 re-checked (SPEC §5 J). */
+    open(uuid: string): Promise<OpenedFile>;
+    /**
+     * Hard delete (team default): the record in a transaction (gated and audited by the pipe), the
+     * object after commit, then one `file_access` delete event (SPEC §5 K). A foreign key is never
+     * passed to the store.
+     */
+    remove(uuid: string): Promise<void>;
+    private requireStore;
+    /**
+     * Delete an object; true when the store confirmed it. On failure log the key only, count the
+     * orphan and answer false. Never throws.
+     */
+    private deleteObject;
+    /**
+     * A `file_access` failure event for a 403 (missing, foreign, malformed or engine-denied: one
+     * reason, since the caller may not learn which). Best effort; the 403 is thrown regardless.
+     */
+    private auditDenied;
+    /** A `file_access` failure event (best effort; the 503 is thrown regardless). */
+    private auditFailure;
+    /** `target` is the fetched row, or for a denial only the requested uuid (null if malformed). */
+    private event;
+}
+//# sourceMappingURL=files.service.d.ts.map

package/dist/features/files/files.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.service.d.ts","sourceRoot":"","sources":["../../../src/features/files/files.service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAc,SAAS,EAAE,YAAY,EAAE,WAAW,EAAa,MAAM,cAAc,CAAC;AAEhG,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAYxB;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAA8B,CAAC;AAE3F,qGAAqG;AACrG,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,qBACa,YAAY;IAKrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IANxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,OAAO,CAAK;gBAGD,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,KAAK,EAAE,SAAS,EACjC,oBAAoB,GAAE,SAAS,MAAM,EAAmC;IAK1E,wFAAwF;IACxF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IAEvD;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAKpB,qFAAqF;IACrF,IAAI,mBAAmB,IAAI,MAAM,CAEhC;IAED,gGAAgG;IAC1F,KAAK,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA4C/D,6FAA6F;IACvF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAyD7C;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCzC,OAAO,CAAC,YAAY;IAOpB;;;OAGG;YACW,YAAY;IAa1B;;;OAGG;YACW,WAAW;IAczB,iFAAiF;YACnE,YAAY;IAQ1B,gGAAgG;IAChG,OAAO,CAAC,KAAK;CAwBd"}