@astram/identity 0.10.0 → 0.12.0

package/dist/features/user/user.service.js

@@ -22,6 +22,7 @@ const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const email_address_changer_token_js_1 = require("./email-address-changer.token.js");
+const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
 /**
  * KI #87: `users` has two unique keys besides the PK, `IDX_users_username` (migration 001) and
  * `uq_users_email` (021, `utf8mb4_unicode_ci`: folds case, accents, width, trailing spaces). The
@@ -77,9 +78,13 @@ let UserService = UserService_1 = class UserService {
     versionBump;
     emailAddresses;
     logger = new common_1.Logger(UserService_1.name);
-    /** The engine's audit sink, used on the email helper's transaction (no pool of its own). */
-    emailAudit = new engine_1.MariaDbAuditSink({});
-    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses) {
+    /**
+     * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
+     * audit database forRoot resolved (`IDENTITY_FRAMEWORK_SCHEMAS`); absent (a hand-built
+     * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
+     */
+    emailAudit;
+    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas) {
         this.records = records;
         this.ceiling = ceiling;
         this.resetTokens = resetTokens;
@@ -87,6 +92,7 @@ let UserService = UserService_1 = class UserService {
         this.sessions = sessions;
         this.versionBump = versionBump;
         this.emailAddresses = emailAddresses;
+        this.emailAudit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
     }
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
@@ -288,6 +294,8 @@ exports.UserService = UserService = UserService_1 = __decorate([
     __param(5, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
     __param(6, (0, common_1.Optional)()),
     __param(6, (0, common_1.Inject)(email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER)),
+    __param(7, (0, common_1.Optional)()),
+    __param(7, (0, common_1.Inject)(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object])
 ], UserService);

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export { MembershipPosting } from './membership-posting.object.js';
 export { CompanyDepartment } from './company-department.object.js';
 export { CompanyBranch } from './company-branch.object.js';
 export { ServiceAccount } from './service-account.object.js';
+export { StoredFile } from './stored-file.object.js';
 export { identityMigrationsDir } from './migrations-dir.js';
 /**
  * All identity objects, registered with the engine at boot (same set + order as before).
@@ -29,6 +30,9 @@ export { identityObjects } from './objects.js';
  * control-plane keys WITHOUT guard importing this package.
  */
 export { identityAuthActionKeys, identityControlPlaneKeys } from './auth-facts-keys.js';
+/** KI #70: the same key universe with the consumer's `extraObjects` (pass the SAME list to
+ *  `IdentityFeatureModule.forRoot({ extraObjects })`). */
+export { buildIdentityAuthKeys, type IdentityAuthKeys } from './auth-facts-keys.js';
 /**
  * The framework-owned identity FEATURE module (company/user/role CRUD). The consumer imports
  * `IdentityFeatureModule.forRoot()` in one line alongside `ShieldModule.forRoot(...)` (ADR-0026);
@@ -36,6 +40,11 @@ export { identityAuthActionKeys, identityControlPlaneKeys } from './auth-facts-k
  * `identityObjects`, and mounts the CRUD controllers — no separate engine setup needed.
  */
 export { IdentityFeatureModule } from './features/identity-feature.module.js';
+/**
+ * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
+ * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.
+ */
+export { FilesService, type StoreFileInput, type StoredFileSummary, type OpenedFile, } from './features/files/files.service.js';
 /**
  * The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
  * that wants to construct it directly can do so.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAU9E;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACxF;0DAC0D;AAC1D,OAAO,EAAE,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEpF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;GAGG;AACH,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,GAChB,MAAM,mCAAmC,CAAC;AAU3C;;;GAGG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.FilesService = exports.IdentityFeatureModule = exports.buildIdentityAuthKeys = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.StoredFile = exports.ServiceAccount = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -27,6 +27,8 @@ var company_branch_object_js_1 = require("./company-branch.object.js");
 Object.defineProperty(exports, "CompanyBranch", { enumerable: true, get: function () { return company_branch_object_js_1.CompanyBranch; } });
 var service_account_object_js_1 = require("./service-account.object.js");
 Object.defineProperty(exports, "ServiceAccount", { enumerable: true, get: function () { return service_account_object_js_1.ServiceAccount; } });
+var stored_file_object_js_1 = require("./stored-file.object.js");
+Object.defineProperty(exports, "StoredFile", { enumerable: true, get: function () { return stored_file_object_js_1.StoredFile; } });
 var migrations_dir_js_1 = require("./migrations-dir.js");
 Object.defineProperty(exports, "identityMigrationsDir", { enumerable: true, get: function () { return migrations_dir_js_1.identityMigrationsDir; } });
 /**
@@ -46,6 +48,10 @@ Object.defineProperty(exports, "identityObjects", { enumerable: true, get: funct
 var auth_facts_keys_js_1 = require("./auth-facts-keys.js");
 Object.defineProperty(exports, "identityAuthActionKeys", { enumerable: true, get: function () { return auth_facts_keys_js_1.identityAuthActionKeys; } });
 Object.defineProperty(exports, "identityControlPlaneKeys", { enumerable: true, get: function () { return auth_facts_keys_js_1.identityControlPlaneKeys; } });
+/** KI #70: the same key universe with the consumer's `extraObjects` (pass the SAME list to
+ *  `IdentityFeatureModule.forRoot({ extraObjects })`). */
+var auth_facts_keys_js_2 = require("./auth-facts-keys.js");
+Object.defineProperty(exports, "buildIdentityAuthKeys", { enumerable: true, get: function () { return auth_facts_keys_js_2.buildIdentityAuthKeys; } });
 /**
  * The framework-owned identity FEATURE module (company/user/role CRUD). The consumer imports
  * `IdentityFeatureModule.forRoot()` in one line alongside `ShieldModule.forRoot(...)` (ADR-0026);
@@ -54,6 +60,12 @@ Object.defineProperty(exports, "identityControlPlaneKeys", { enumerable: true, g
  */
 var identity_feature_module_js_1 = require("./features/identity-feature.module.js");
 Object.defineProperty(exports, "IdentityFeatureModule", { enumerable: true, get: function () { return identity_feature_module_js_1.IdentityFeatureModule; } });
+/**
+ * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
+ * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.
+ */
+var files_service_js_1 = require("./features/files/files.service.js");
+Object.defineProperty(exports, "FilesService", { enumerable: true, get: function () { return files_service_js_1.FilesService; } });
 /*
  * The record-tier authorization: since 0.7 (security hardening Phase 9 #7)
  * `IdentityFeatureModule.forRoot({ extraObjects })` builds it and provides it to `ShieldModule`

package/dist/objects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAetD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAcrD,CAAC"}
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAgBtD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAerD,CAAC"}

package/dist/objects.js

@@ -14,6 +14,7 @@ const cross_tenant_grant_object_js_1 = require("./cross-tenant-grant.object.js")
 const record_share_object_js_1 = require("./record-share.object.js");
 const shared_resource_object_js_1 = require("./shared-resource.object.js");
 const service_account_object_js_1 = require("./service-account.object.js");
+const stored_file_object_js_1 = require("./stored-file.object.js");
 /** All identity objects, registered with the engine at boot (same set + order as before). */
 exports.identityObjects = [
     company_object_js_1.Company,
@@ -29,4 +30,5 @@ exports.identityObjects = [
     record_share_object_js_1.RecordShare,
     shared_resource_object_js_1.SharedResource,
     service_account_object_js_1.ServiceAccount,
+    stored_file_object_js_1.StoredFile,
 ];

package/dist/record-share.object.d.ts

@@ -11,7 +11,7 @@
  * posture as `cross_tenant_grant`/`role`. `system: true` (never `owned`/`tenantScoped`) — the
  * table's own columns (`rs_tenant_uuid`, `rs_granted_by`) + the writer's owner-bound encode the
  * isolation; the pipe's owner/tenant baseline is not involved. Action vocabulary is NOT the CRUD
- * verbs — see `@astram/guard`'s `identity-actions.ts` `actionsFor('record_share')` →
+ * verbs: it opts out (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `RECORD_SHARE_ACTIONS` (`share`/`read`).
  *
  * Mirrors `cross-tenant-grant.object.ts`'s shape (system, PK only satisfies `validateAccess`).

package/dist/record-share.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-share.object.d.ts","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAOa,WAAW;IAEtB,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,UAAU,EAAG,MAAM,CAAC;CACrB"}
+{"version":3,"file":"record-share.object.d.ts","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBASa,WAAW;IAEtB,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,UAAU,EAAG,MAAM,CAAC;CACrB"}

package/dist/record-share.object.js

@@ -11,8 +11,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecordShare = void 0;
 const engine_1 = require("@astram/engine");
-/** The physical schema `record_share` lives in (migration 1710000000014). */
-const SCHEMA = 'shield_authz';
+const guard_1 = require("@astram/guard");
+/** The authz-database token `record_share` lives in (migration 1710000000014); the engine
+ *  resolves it at registration (ADR-0037). */
+const SCHEMA = engine_1.FRAMEWORK_SCHEMA.authz;
 /**
  * `record_share` — an AUTHORITY-ONLY @ObjectType, never CRUD'd through the RecordEngine pipe
  * (list-scoping engine Phase 6, §9.2). Its sole purpose is to give `record_share` an entry in the
@@ -26,7 +28,7 @@ const SCHEMA = 'shield_authz';
  * posture as `cross_tenant_grant`/`role`. `system: true` (never `owned`/`tenantScoped`) — the
  * table's own columns (`rs_tenant_uuid`, `rs_granted_by`) + the writer's owner-bound encode the
  * isolation; the pipe's owner/tenant baseline is not involved. Action vocabulary is NOT the CRUD
- * verbs — see `@astram/guard`'s `identity-actions.ts` `actionsFor('record_share')` →
+ * verbs: it opts out (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `RECORD_SHARE_ACTIONS` (`share`/`read`).
  *
  * Mirrors `cross-tenant-grant.object.ts`'s shape (system, PK only satisfies `validateAccess`).
@@ -55,6 +57,8 @@ exports.RecordShare = RecordShare = __decorate([
         table: 'record_share',
         schema: SCHEMA,
         access: { plane: 'control', system: true },
+        crudActions: false,
+        actions: guard_1.RECORD_SHARE_ACTIONS,
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'rs_uuid' })
 ], RecordShare);

package/dist/schema.d.ts

@@ -1,3 +1,16 @@
-/** The physical schema every identity table lives in (single-source). */
-export declare const SCHEMA = "shield_app";
+import { type FrameworkSchemas } from '@astram/core';
+/**
+ * The schema every identity table declares (single-source): the app-database token, resolved by
+ * the engine at registration to `<namespace>_app` (configurable-framework-db, ADR-0037). It is
+ * never a database name: SQL built outside the engine uses {@link IdentitySchemaNames}.
+ */
+export declare const SCHEMA: "{{framework_schema:app}}";
+/** The resolved framework database names identity SQL needs (`FrameworkSchemas` fits). */
+export type IdentitySchemaNames = Pick<FrameworkSchemas, 'app' | 'authz'>;
+/**
+ * The framework database names from `SHIELD_DB_NAMESPACE` (unset ⇒ `shield_*`), for a class built
+ * without explicit names. Call at construction (boot) only, never per request; an invalid
+ * namespace throws (fail closed). `IdentityFeatureModule.forRoot` always passes its names.
+ */
+export declare function frameworkSchemasFromEnv(): FrameworkSchemas;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,MAAM,eAAe,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG9E;;;;GAIG;AACH,eAAO,MAAM,MAAM,4BAAuB,CAAC;AAE3C,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,CAE1D"}

package/dist/schema.js

@@ -1,5 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SCHEMA = void 0;
-/** The physical schema every identity table lives in (single-source). */
-exports.SCHEMA = 'shield_app';
+exports.frameworkSchemasFromEnv = frameworkSchemasFromEnv;
+const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+/**
+ * The schema every identity table declares (single-source): the app-database token, resolved by
+ * the engine at registration to `<namespace>_app` (configurable-framework-db, ADR-0037). It is
+ * never a database name: SQL built outside the engine uses {@link IdentitySchemaNames}.
+ */
+exports.SCHEMA = engine_1.FRAMEWORK_SCHEMA.app;
+/**
+ * The framework database names from `SHIELD_DB_NAMESPACE` (unset ⇒ `shield_*`), for a class built
+ * without explicit names. Call at construction (boot) only, never per request; an invalid
+ * namespace throws (fail closed). `IdentityFeatureModule.forRoot` always passes its names.
+ */
+function frameworkSchemasFromEnv() {
+    return (0, core_1.resolveFrameworkSchemas)(process.env);
+}

package/dist/service-account.object.d.ts

@@ -18,8 +18,9 @@
  * is IN their reachable subtree (a cross-tenant id is invisible → 404, no existence leak). Root
  * spans all. This is the read/write wall that makes "own tenant only" structural, not handler-level.
  *
- * Action vocabulary is administration, not CRUD data ops — see `@astram/guard`'s
- * `identity-actions.ts` (`read`/`manage` for `service_account`).
+ * Action vocabulary (ADR-0038): the CRUD verbs administer the account row, plus the declared
+ * `manage_keys` (issue/rotate/revoke its `ask_…` keys), giving `read, create, update, delete,
+ * manage_keys` — the same set as `@astram/guard`'s `SERVICE_ACCOUNT_ACTIONS`.
  */
 export declare class ServiceAccount {
     id: string;

package/dist/service-account.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.object.d.ts","sourceRoot":"","sources":["../src/service-account.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAQa,cAAc;IAEzB,EAAE,EAAG,MAAM,CAAC;IAGZ,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,WAAW,EAAG,MAAM,CAAC;CACtB"}
+{"version":3,"file":"service-account.object.d.ts","sourceRoot":"","sources":["../src/service-account.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBASa,cAAc;IAEzB,EAAE,EAAG,MAAM,CAAC;IAGZ,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/service-account.object.js

@@ -32,8 +32,9 @@ const schema_1 = require("./schema");
  * is IN their reachable subtree (a cross-tenant id is invisible → 404, no existence leak). Root
  * spans all. This is the read/write wall that makes "own tenant only" structural, not handler-level.
  *
- * Action vocabulary is administration, not CRUD data ops — see `@astram/guard`'s
- * `identity-actions.ts` (`read`/`manage` for `service_account`).
+ * Action vocabulary (ADR-0038): the CRUD verbs administer the account row, plus the declared
+ * `manage_keys` (issue/rotate/revoke its `ask_…` keys), giving `read, create, update, delete,
+ * manage_keys` — the same set as `@astram/guard`'s `SERVICE_ACCOUNT_ACTIONS`.
  */
 let ServiceAccount = class ServiceAccount {
     id;
@@ -69,6 +70,7 @@ exports.ServiceAccount = ServiceAccount = __decorate([
         table: 'service_account',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
+        actions: ['manage_keys'],
         readScope: { kind: 'nodeColumn', column: 'sa_tenant_id' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'sa_id' })

package/dist/stored-file.object.d.ts

@@ -0,0 +1,35 @@
+/**
+ * stored_file — the metadata record of one uploaded file (file-storage SPEC §4).
+ *
+ * The bytes live in the object store under `storageKey` (`t/<tenantId>/<uuid>`, built by the
+ * server); this row is what the engine gates, audits and lists. Table DDL:
+ * `migrations/1710000000022-CreateStoredFile.cjs` (columns mirror the fields below exactly).
+ *
+ * ACCESS: `{ tenantScoped: true, owned: true, plane: 'data' }` — tenant business content, owned by
+ * the uploader. `plane: 'data'` keeps the capped root out by construction.
+ *
+ * SERVER-STAMPED: `tenantId` (`trusted: 'tenantId'`) and `ownerId` (`trusted: 'actorId'`) are
+ * overwritten from the session on create and never re-stamped on update; client input is ignored.
+ *
+ * CREATE-ONLY: the five content fields are `immutable` — a patch can never re-point a record at
+ * other bytes or change what the bytes claim to be.
+ */
+export declare class StoredFile {
+    uuid: string;
+    /** Server-stamped tenant boundary (engine overwrites from the session; never client). */
+    tenantId: string;
+    /** Server-stamped uploader (the owner; engine overwrites from the session; never client). */
+    ownerId: string;
+    /** `t/<tenantId>/<uuid>`, server-built; never returned to the client. */
+    storageKey: string;
+    /** Lower-case hex sha256 of the stored bytes. */
+    sha256: string;
+    /** Canonical type from the intake allowlist, never the client header. */
+    contentType: string;
+    sizeBytes: number;
+    /** Sanitized display name. */
+    originalName: string;
+    /** UTC epoch ms, set by the service. */
+    createdAt: number;
+}
+//# sourceMappingURL=stored-file.object.d.ts.map

package/dist/stored-file.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stored-file.object.d.ts","sourceRoot":"","sources":["../src/stored-file.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,qBAOa,UAAU;IAErB,IAAI,EAAG,MAAM,CAAC;IAEd,yFAAyF;IAEzF,QAAQ,EAAG,MAAM,CAAC;IAElB,6FAA6F;IAE7F,OAAO,EAAG,MAAM,CAAC;IAEjB,yEAAyE;IAEzE,UAAU,EAAG,MAAM,CAAC;IAEpB,iDAAiD;IAEjD,MAAM,EAAG,MAAM,CAAC;IAEhB,yEAAyE;IAEzE,WAAW,EAAG,MAAM,CAAC;IAGrB,SAAS,EAAG,MAAM,CAAC;IAEnB,8BAA8B;IAE9B,YAAY,EAAG,MAAM,CAAC;IAEtB,wCAAwC;IAExC,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/stored-file.object.js

@@ -0,0 +1,94 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoredFile = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * stored_file — the metadata record of one uploaded file (file-storage SPEC §4).
+ *
+ * The bytes live in the object store under `storageKey` (`t/<tenantId>/<uuid>`, built by the
+ * server); this row is what the engine gates, audits and lists. Table DDL:
+ * `migrations/1710000000022-CreateStoredFile.cjs` (columns mirror the fields below exactly).
+ *
+ * ACCESS: `{ tenantScoped: true, owned: true, plane: 'data' }` — tenant business content, owned by
+ * the uploader. `plane: 'data'` keeps the capped root out by construction.
+ *
+ * SERVER-STAMPED: `tenantId` (`trusted: 'tenantId'`) and `ownerId` (`trusted: 'actorId'`) are
+ * overwritten from the session on create and never re-stamped on update; client input is ignored.
+ *
+ * CREATE-ONLY: the five content fields are `immutable` — a patch can never re-point a record at
+ * other bytes or change what the bytes claim to be.
+ */
+let StoredFile = class StoredFile {
+    uuid;
+    /** Server-stamped tenant boundary (engine overwrites from the session; never client). */
+    tenantId;
+    /** Server-stamped uploader (the owner; engine overwrites from the session; never client). */
+    ownerId;
+    /** `t/<tenantId>/<uuid>`, server-built; never returned to the client. */
+    storageKey;
+    /** Lower-case hex sha256 of the stored bytes. */
+    sha256;
+    /** Canonical type from the intake allowlist, never the client header. */
+    contentType;
+    sizeBytes;
+    /** Sanitized display name. */
+    originalName;
+    /** UTC epoch ms, set by the service. */
+    createdAt;
+};
+exports.StoredFile = StoredFile;
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_tenant_id', type: 'uuid', trusted: 'tenantId' }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "tenantId", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_owner_id', type: 'uuid', trusted: 'actorId' }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "ownerId", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_storage_key', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "storageKey", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_sha256', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "sha256", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_content_type', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "contentType", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_size_bytes', type: 'number', required: true, immutable: true }),
+    __metadata("design:type", Number)
+], StoredFile.prototype, "sizeBytes", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_original_name', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], StoredFile.prototype, "originalName", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sf_created_at', type: 'number', required: true }),
+    __metadata("design:type", Number)
+], StoredFile.prototype, "createdAt", void 0);
+exports.StoredFile = StoredFile = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'stored_file',
+        table: 'stored_file',
+        schema: schema_1.SCHEMA,
+        access: { tenantScoped: true, owned: true, plane: 'data' },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'sf_uuid' })
+], StoredFile);

package/migrations/1710000000001-CreateIdentityOrgModel.cjs

@@ -14,8 +14,14 @@
  */
 const { Company, User, Role, Department, Branch } = require('@astram/identity');
 const { columnForRole, reflectObjectType } = require('@astram/engine');
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['027818f28b12088392ba5f2194a842ef36815aa34b9df7669683c9cdf24c316f'];
 
-const SCHEMA = 'shield_app';
 const TS = 'TIMESTAMP(0) NOT NULL DEFAULT CURRENT_TIMESTAMP';
 
 // Reflect the @ObjectType/@Field metadata off each decorated class into its registration
@@ -30,7 +36,9 @@ const BranchReg = reflectObjectType(Branch);
 // Resolve a column by role from a reflected object registration (single source of truth).
 const col = (reg, role) => columnForRole(reg, role);
 
-async function up({ query }) {
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).app;
   // companies (the tenant) — hierarchy + type + status.
   await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`${CompanyReg.table}\` (
     ${col(CompanyReg, 'primaryKey')} VARCHAR(36)  NOT NULL,
@@ -89,7 +97,9 @@ async function up({ query }) {
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).app;
   // Reverse dependency order — membership tables (1710000000002) drop first via their
   // own down(); here drop the catalogs + principal + tenant.
   for (const t of [BranchReg.table, DepartmentReg.table, RoleReg.table, UserReg.table, CompanyReg.table]) {
@@ -97,4 +107,4 @@ async function down({ query }) {
   }
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000002-CreateMembershipAndPostings.cjs

@@ -15,8 +15,14 @@ const {
   CompanyMembership, MembershipPosting, CompanyDepartment, CompanyBranch,
 } = require('@astram/identity');
 const { columnForRole, reflectObjectType } = require('@astram/engine');
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['a214c2b29d1b21093851d3644581b17757a78e2341b50c67c7b9b3846c5dfc9e'];
 
-const SCHEMA = 'shield_app';
 const TS = 'TIMESTAMP(0) NOT NULL DEFAULT CURRENT_TIMESTAMP';
 
 // The decorated classes carry NO static `.table` — @ObjectType/@Field metadata is read
@@ -34,7 +40,9 @@ const CompanyDepartmentReg = reflectObjectType(CompanyDepartment);
 const CompanyBranchReg = reflectObjectType(CompanyBranch);
 const col = (reg, role) => columnForRole(reg, role);
 
-async function up({ query }) {
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).app;
   // company_membership — first-class membership + active-tenant pointer.
   await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`${CompanyMembershipReg.table}\` (
     ${col(CompanyMembershipReg, 'primaryKey')} VARCHAR(36) NOT NULL,
@@ -102,10 +110,12 @@ async function up({ query }) {
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).app;
   for (const t of [MembershipPostingReg.table, CompanyBranchReg.table, CompanyDepartmentReg.table, CompanyMembershipReg.table]) {
     await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`${t}\``);
   }
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000003-CreateIdentityCredential.cjs

@@ -25,9 +25,17 @@
  * Idempotent (CREATE TABLE IF NOT EXISTS).
  */
 
-const SCHEMA = 'shield_identity';
+const { frameworkSchemasForMigration } = require('@astram/core');
 
-async function up({ query }) {
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['440923cce54f25764ca53fd68d3e18d7069207b22c3f2afb5551469a0279a1aa'];
+
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).identity;
   // identity_credential — one row per login principal. Resolved by
   // ic_identity_hint (username/email) at login. ic_password_hash is the
   // Argon2id encoded hash the engine verifies against. Whether the principal
@@ -51,8 +59,10 @@ async function up({ query }) {
   );
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).identity;
   await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`identity_credential\``);
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000004-CreateSessionTables.cjs

@@ -23,9 +23,17 @@
  * Idempotent (CREATE TABLE IF NOT EXISTS).
  */
 
-const SCHEMA = 'shield_identity';
+const { frameworkSchemasForMigration } = require('@astram/core');
 
-async function up({ query }) {
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['882c6700cb00a977a1dc5038de0a1e107a279a28312a44359f5c8f8efa595c83'];
+
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).identity;
   // session — the authoritative session record (written at login; read/updated
   // at refresh + revocation). s_absolute_expires_at_ms anchors the ADR-0015
   // absolute cap (from login, never reset). Status ∈ active|rotated|revoked|expired.
@@ -70,10 +78,12 @@ async function up({ query }) {
   );
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).identity;
   // Child before parent — refresh_token FK-references session.
   await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`refresh_token\``);
   await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`session\``);
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };

package/migrations/1710000000005-CreateMfaAndTokenSurface.cjs

@@ -39,9 +39,17 @@
  * Idempotent (CREATE TABLE IF NOT EXISTS).
  */
 
-const SCHEMA = 'shield_identity';
+const { frameworkSchemasForMigration } = require('@astram/core');
 
-async function up({ query }) {
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+// replacesChecksums: every checksum this file had in a published release (git release tags), so
+// an existing ledger row is accepted and updated, not reported as drift (ADR-0037).
+const replacesChecksums = ['47015938e94c86373d0947828f6cb5019aff90d414391eccb8c52b40c81d7612'];
+
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).identity;
   await query(
     `CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`mfa_device\` (
       md_id              VARCHAR(36)  NOT NULL,
@@ -79,10 +87,12 @@ async function up({ query }) {
   );
 }
 
-async function down({ query }) {
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).identity;
   for (const t of ['mfa_recovery_code', 'password_reset_token', 'mfa_device']) {
     await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`${t}\``);
   }
 }
 
-module.exports = { up, down };
+module.exports = { up, down, replacesChecksums };