@astram/identity 0.14.0 → 0.15.0

package/dist/user.object.js

@@ -54,6 +54,9 @@ exports.User = User = __decorate([
         // capped root, the identity administrator, may list/read AND create/update/delete users). Uniform
         // across all actions (read reclassified control 2026-07-16), so plane is per-type.
         access: { plane: 'control', system: true },
+        // G-010 R11 (ADR-0038): `invite` (`identity:user:invite`, POST /identity/users/:uuid/invite) next
+        // to CRUD. Roles holding `identity:*` or `identity:user:*` gain it on upgrade; exact keys do not.
+        actions: ['invite'],
         // Read-scope wall (ADR-0027, Task 4.1): a user has no company column (they belong to many
         // companies via `company_membership`) — a user is in-scope iff they have a membership in
         // the caller's reachable subtree. A multi-tenant user correctly appears for each subtree

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.8.0",
-    "@astram/engine": "0.10.0",
-    "@astram/guard": "0.17.0"
+    "@astram/core": "1.9.0",
+    "@astram/guard": "0.18.0",
+    "@astram/engine": "0.10.1"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",

package/dist/features/org-bootstrap/org-bootstrap-runner.harness.d.ts

@@ -1,259 +0,0 @@
-import type { Principal } from '@astram/core';
-import { current } from './org-bootstrap-runner.mocks.js';
-import type { OrgState } from './org-bootstrap-plan.js';
-export declare const SCHEMAS: {
-    readonly namespace: "zzns";
-    readonly app: "zzns_app";
-    readonly identity: "zzns_identity";
-    readonly authz: "zzns_authz";
-    readonly audit: "zzns_audit";
-    readonly isDefault: false;
-};
-export declare const PW = "Zq-root-pass-1";
-export declare const OPERATOR = "op.person@example.test";
-export declare const BASE = "https://app.example.test/reset-password";
-export declare const DEFAULT_DEV_BASE = "http://localhost:5173/reset-password";
-export declare const LOCK_NAME = "astram_org_bootstrap:zzns_app";
-export declare const ROOT_PW_VAR = "ASTRAM_BOOTSTRAP_ROOT_PASSWORD_ZROOT";
-/** Env of a development/test run that would pass every refusal. */
-export declare const TEST_ENV: Record<string, string>;
-/** Env of a production run; the root password must be secret-ref resolved (the spec adds ROOT_PW_VAR to its hoisted secretRefs set). */
-export declare const PROD_ENV: Record<string, string>;
-/** Fresh-database file: 1 root, 2 companies, 1 dept, 1 branch, 3 roles, 3 non-root users. */
-export declare const FILE_MAIN: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        departments: string[];
-        branches: string[];
-        roles: {
-            name: string;
-            permissions: string[];
-        }[];
-        users: ({
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-                department: string;
-                branch: string;
-            }[];
-        } | {
-            username: string;
-            email: string;
-            postings?: never;
-        })[];
-        children: {
-            name: string;
-            roles: {
-                name: string;
-                permissions: never[];
-            }[];
-            users: {
-                username: string;
-                email: string;
-                postings: {
-                    role: string;
-                }[];
-            }[];
-        }[];
-    }[];
-};
-/** Two tenants: used to prove `operationRoleIds` never reach across tenants. */
-export declare const FILE_TWO_TENANTS: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        roles: {
-            name: string;
-            permissions: never[];
-        }[];
-        users: {
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-            }[];
-        }[];
-    }[];
-};
-/** One tenant already holding everything: the state below makes every entry `unchanged`. */
-export declare const FILE_MINI: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        roles: {
-            name: string;
-            permissions: string[];
-        }[];
-        users: {
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-            }[];
-        }[];
-    }[];
-};
-/** A tenant with one user whose membership does not exist yet (for the "existing user" cases). */
-export declare const FILE_DAVE: {
-    version: number;
-    roots: {
-        username: string;
-        email: string;
-        homeCompany: string;
-    }[];
-    tenants: {
-        name: string;
-        roles: {
-            name: string;
-            permissions: never[];
-        }[];
-        users: {
-            username: string;
-            email: string;
-            postings: {
-                role: string;
-            }[];
-        }[];
-    }[];
-};
-export declare const emptyState: () => OrgState;
-type Cred = 'none' | 'locked' | 'usable';
-/** The state that makes FILE_MINI entirely `unchanged`, alice's credential as given. */
-export declare function stateMini(aliceCredential?: Cred): OrgState;
-export interface Call {
-    seq: number;
-    service: string;
-    method: string;
-    args: unknown[];
-    /** The principal registered on the resolve context (request-scoped services), if any. */
-    principal: Principal | undefined;
-    /** The bootstrap principal passed as an explicit argument, if any. */
-    actor: Principal | undefined;
-}
-export interface Query {
-    conn: string;
-    sql: string;
-    params: unknown[];
-}
-export type Row = Record<string, unknown>;
-export interface World {
-    app: FakeApp;
-    state: OrgState;
-    out: string[];
-    outFn: (line: string) => void;
-    events: string[];
-    calls: Call[];
-    queries: Query[];
-    transitions: unknown[][];
-    issued: {
-        principalId: string;
-        hash: string;
-        expiresAtMs: number;
-    }[];
-    invalidated: string[];
-    provisionedLocked: {
-        principalId: string;
-        hint: string;
-        tenantId: string;
-    }[];
-    provisionedPassword: {
-        principalId: string;
-        hint: string;
-        tenantId: string;
-        password: string;
-    }[];
-    conns: FakeConn[];
-    readerCalls: number;
-    lockMode: 'acquired' | 'busy';
-    failOn: ((service: string, method: string, args: unknown[]) => Error | undefined) | undefined;
-    failTransition: Error | undefined;
-    /** Throws for a matching statement (e.g. the audit INSERT), on whichever connection runs it. */
-    failQuery: ((connId: string, sql: string, params: unknown[]) => Error | undefined) | undefined;
-    /** Whether a posting outside the file's tenants holds the role being claimed (R1-8 re-check). */
-    roleHeldOutside: boolean;
-    id: (kind: string, name: string) => string;
-    tables: Record<string, Row[]>;
-}
-export interface FakeConn {
-    id: string;
-    released: boolean;
-    log: string[];
-    query: (sql: string, params?: unknown[]) => Promise<unknown>;
-    beginTransaction: () => Promise<void>;
-    commit: () => Promise<void>;
-    rollback: () => Promise<void>;
-    release: () => Promise<void>;
-    end: () => Promise<void>;
-}
-export { current };
-export declare class FakeApp {
-    private readonly singletons;
-    private readonly scoped;
-    initCalls: number;
-    readonly requests: Map<object, {
-        principal?: Principal;
-    }>;
-    readonly resolved: {
-        token: unknown;
-        principal: Principal | undefined;
-    }[];
-    constructor(singletons: Map<unknown, unknown>, scoped: Map<unknown, (principal: Principal | undefined) => object>);
-    init(): Promise<this>;
-    get(token: unknown, _options?: unknown): unknown;
-    registerRequestByContextId(request: {
-        principal?: Principal;
-    }, contextId: object): void;
-    resolve(token: unknown, contextId: object, _options?: unknown): Promise<unknown>;
-}
-export interface WorldOptions {
-    /** `IDENTITY_AUTHZ_POOL`, imported from `./org-bootstrap.tokens.js` by the spec. */
-    poolToken: unknown;
-    /** false = IdentityFeatureModule is not wired: `app.get` / `app.resolve` find nothing. */
-    wired?: boolean;
-    state?: OrgState;
-    tables?: Record<string, Row[]>;
-    lockMode?: 'acquired' | 'busy';
-    memberships?: {
-        id: string;
-        userUuid: string;
-        companyUuid: string;
-    }[];
-    failOn?: World['failOn'];
-}
-export declare function makeWorld(options: WorldOptions): World;
-export declare const sha256: (s: string) => string;
-export declare const isWriteCall: (c: Call) => boolean;
-export declare const writeCalls: (w: World) => Call[];
-export declare const callsOf: (w: World, service: string, method: string) => Call[];
-/** Every non-audit write the runner could make is absent. Lock and SELECT traffic is allowed. */
-export declare function noWritesAtAll(w: World): string[];
-/** Lock discipline: every GET_LOCK ran on a dedicated connection and was released on that one. */
-export declare function lockProblems(w: World): string[];
-/** Everything the run said or stored that must never carry a secret. Provisioner args excluded. */
-export declare function visibleText(w: World, extra?: unknown[]): string;
-/** The raw token of the link printed for `username` (a line with the name and `<base>?token=<hex>`). */
-export declare function linkFor(w: World, username: string): {
-    raw: string;
-    line: string;
-} | undefined;
-export declare const linkLines: (w: World) => string[];
-/** The audit rows (INSERTs into audit_log) naming `action`, from any connection. */
-export declare const auditRowsFor: (w: World, action: string) => Query[];
-//# sourceMappingURL=org-bootstrap-runner.harness.d.ts.map

package/dist/features/org-bootstrap/org-bootstrap-runner.harness.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"org-bootstrap-runner.harness.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/org-bootstrap-runner.harness.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAY9C,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAE1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAIxD,eAAO,MAAM,OAAO;;;;;;;CAOV,CAAC;AAEX,eAAO,MAAM,EAAE,mBAAmB,CAAC;AACnC,eAAO,MAAM,QAAQ,2BAA2B,CAAC;AACjD,eAAO,MAAM,IAAI,4CAA4C,CAAC;AAC9D,eAAO,MAAM,gBAAgB,yCAAyC,CAAC;AACvE,eAAO,MAAM,SAAS,kCAAkC,CAAC;AACzD,eAAO,MAAM,WAAW,yCAAyC,CAAC;AAElE,mEAAmE;AACnE,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK3C,CAAC;AAEF,wIAAwI;AACxI,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK3C,CAAC;AAIF,6FAA6F;AAC7F,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCrB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;CAiB5B,CAAC;AAEF,4FAA4F;AAC5F,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;CAYrB,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;CAYrB,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,QAQ5B,CAAC;AAEH,KAAK,IAAI,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEzC,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,eAAe,GAAE,IAAe,GAAG,QAAQ,CAqCpE;AAID,MAAM,WAAW,IAAI;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,yFAAyF;IACzF,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,sEAAsE;IACtE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,KAAK,EAAE,QAAQ,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,OAAO,EAAE,KAAK,EAAE,CAAC;IACjB,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;IACzB,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACrE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7E,mBAAmB,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,EAAE,CAAC;IACJ,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC9F,cAAc,EAAE,KAAK,GAAG,SAAS,CAAC;IAClC,gGAAgG;IAChG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,KAAK,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC/F,iGAAiG;IACjG,eAAe,EAAE,OAAO,CAAC;IACzB,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAOD,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnB,qBAAa,OAAO;IAKhB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,SAAS,SAAK;IACd,QAAQ,CAAC,QAAQ;oBAAiC,SAAS;OAAM;IACjE,QAAQ,CAAC,QAAQ,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,EAAE,CAAM;gBAE5D,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,KAAK,MAAM,CAAC;IAG/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO;IAShD,0BAA0B,CAAC,OAAO,EAAE;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAIjF,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAYvF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,SAAS,EAAE,OAAO,CAAC;IACnB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtE,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;CAC1B;AAID,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,CAgUtD;AAID,eAAO,MAAM,MAAM,GAAI,GAAG,MAAM,KAAG,MAAsD,CAAC;AAE1F,eAAO,MAAM,WAAW,GAAI,GAAG,IAAI,KAAG,OAAsC,CAAC;AAE7E,eAAO,MAAM,UAAU,GAAI,GAAG,KAAK,KAAG,IAAI,EAAiC,CAAC;AAE5E,eAAO,MAAM,OAAO,GAAI,GAAG,KAAK,EAAE,SAAS,MAAM,EAAE,QAAQ,MAAM,KAAG,IAAI,EACH,CAAC;AAEtE,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAgBhD;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAa/C;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,GAAE,OAAO,EAAO,GAAG,MAAM,CASnE;AAED,wGAAwG;AACxG,wBAAgB,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAO7F;AAED,eAAO,MAAM,SAAS,GAAI,GAAG,KAAK,KAAG,MAAM,EAA6C,CAAC;AAEzF,oFAAoF;AACpF,eAAO,MAAM,YAAY,GAAI,GAAG,KAAK,EAAE,QAAQ,MAAM,KAAG,KAAK,EAC4B,CAAC"}