@astram/identity 0.2.0 → 0.3.0

package/dist/features/share/share.controller.js

@@ -0,0 +1,143 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShareController = void 0;
+/**
+ * `ShareController` — the OWNER-SHARE API (§9.2 / list-scoping engine Phase 6).
+ *
+ * Three routes over {@link ShareService}, gated `@Classified({ typeKey: 'record_share', ... })`
+ * (a fixed control-plane meta-type, mirroring `cross_tenant_grant`): `share` gates create/revoke,
+ * `read` gates the list. The route gate is COARSE ("may you use the share surface"); the REAL
+ * per-record authority — only the LITERAL owner may share/unshare/list — is enforced inside the
+ * `RecordShareWriter`'s fetch-then-gate owner-bound (a grantee can never re-share).
+ *
+ * ⛔ The sharer + tenant are ALWAYS `req.principal` (the enforcement guard attached it), NEVER a
+ * body field — a forged owner/tenant cannot reach the writer. ⛔ The list returns grantee NAMES
+ * (resolved server-side); a uuid rides only as the revoke API key.
+ */
+const common_1 = require("@nestjs/common");
+const guard_1 = require("@astram/guard");
+const share_service_js_1 = require("./share.service.js");
+/** Validate + narrow a share/unshare body to a {@link ShareRequest} (grantee + action only). */
+function toShareRequest(body) {
+    const b = (body ?? {});
+    if (!b.typeKey || typeof b.typeKey !== 'string')
+        throw new common_1.BadRequestException('typeKey required');
+    if (!b.recordId || typeof b.recordId !== 'string')
+        throw new common_1.BadRequestException('recordId required');
+    if (b.granteeKind !== 'user' && b.granteeKind !== 'role') {
+        throw new common_1.BadRequestException("granteeKind must be 'user' or 'role'");
+    }
+    if (!b.granteeUuid || typeof b.granteeUuid !== 'string')
+        throw new common_1.BadRequestException('granteeUuid required');
+    if (!b.action || typeof b.action !== 'string')
+        throw new common_1.BadRequestException('action required');
+    return {
+        typeKey: b.typeKey,
+        recordId: b.recordId,
+        granteeKind: b.granteeKind,
+        granteeUuid: b.granteeUuid,
+        action: b.action,
+    };
+}
+let ShareController = class ShareController {
+    shares;
+    constructor(shares) {
+        this.shares = shares;
+    }
+    /**
+     * List the shares on a record the caller owns — grantee NAMES resolved (no raw uuid).
+     * `GET /identity/record-shares?typeKey=&recordId=`. Gated `record_share:read`. Only the owner
+     * sees a record's shares (the writer's owner-bound); a non-owner → 403.
+     */
+    async list(req, typeKey, recordId) {
+        if (!typeKey || !recordId)
+            throw new common_1.BadRequestException('typeKey and recordId required');
+        try {
+            const shares = await this.shares.listShares(req.principal, typeKey, recordId);
+            return { shares };
+        }
+        catch (e) {
+            if (e instanceof guard_1.ShareNotPermittedError)
+                throw new common_1.ForbiddenException(e.message);
+            throw e; // ShareStoreUnavailableError → propagates → 503
+        }
+    }
+    /**
+     * Share a record the caller owns. `POST /identity/record-shares` with
+     * `{ typeKey, recordId, granteeKind, granteeUuid, action }`. Gated `record_share:share`. The
+     * writer proves the caller owns the record before writing (non-owner → 403).
+     */
+    async share(req, body) {
+        const request = toShareRequest(body);
+        try {
+            await this.shares.share(req.principal, request);
+            return { success: true };
+        }
+        catch (e) {
+            if (e instanceof guard_1.ShareNotPermittedError)
+                throw new common_1.ForbiddenException(e.message);
+            throw e;
+        }
+    }
+    /**
+     * Revoke a share the caller owns. `DELETE /identity/record-shares` with the same body shape
+     * (the exact tuple to remove). Gated `record_share:share`. Owner-only (the writer enforces it).
+     */
+    async unshare(req, body) {
+        const request = toShareRequest(body);
+        try {
+            await this.shares.unshare(req.principal, request);
+            return { success: true };
+        }
+        catch (e) {
+            if (e instanceof guard_1.ShareNotPermittedError)
+                throw new common_1.ForbiddenException(e.message);
+            throw e;
+        }
+    }
+};
+exports.ShareController = ShareController;
+__decorate([
+    (0, common_1.Get)('record-shares'),
+    (0, guard_1.Classified)({ typeKey: 'record_share', action: 'read' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Query)('typeKey')),
+    __param(2, (0, common_1.Query)('recordId')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, String]),
+    __metadata("design:returntype", Promise)
+], ShareController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)('record-shares'),
+    (0, guard_1.Classified)({ typeKey: 'record_share', action: 'share' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ShareController.prototype, "share", null);
+__decorate([
+    (0, common_1.Delete)('record-shares'),
+    (0, guard_1.Classified)({ typeKey: 'record_share', action: 'share' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], ShareController.prototype, "unshare", null);
+exports.ShareController = ShareController = __decorate([
+    (0, common_1.Controller)('identity'),
+    __metadata("design:paramtypes", [share_service_js_1.ShareService])
+], ShareController);

package/dist/features/share/share.service.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `ShareService` — the backend of the OWNER-SHARE surface (§9.2 / list-scoping engine Phase 6).
+ *
+ * A thin surface over the framework-owned {@link RecordShareWriter} (the who-may-share write path)
+ * + a name resolver (no raw uuid reaches the UI). The writer already enforces the §6.2 owner
+ * bound (fetch-then-gate, tenant-scoped, only the LITERAL owner may share/unshare/list; a grantee
+ * can never re-share), so this service NEVER re-implements it. It:
+ *   • builds the {@link ShareInput} from the SERVER-resolved principal — the tenant + sharer are
+ *     ALWAYS from `req.principal`, NEVER a body field (a forged owner/tenant is impossible);
+ *   • RESOLVES grantee uuids → human names for the list (a share row carries a uuid only as an
+ *     API key; the UI sees a name, ADR-0012 / no-raw-uuid);
+ *   • maps the writer's typed errors to HTTP-shaped errors (not-permitted → 403, outage → 503).
+ *
+ * Once a share is written, it is honored in the grantee's LIST automatically — the list-scoping
+ * engine's `share` term (Phase 3) unions it in; there is NO separate read path (one authority).
+ */
+import type { Principal } from '@astram/core';
+import type { RecordShareWriter, ShareGranteeKind } from '@astram/guard';
+/** A resolver from a grantee id → its display name (the identity DirectoryLabelResolver). */
+export interface ShareLabelResolver {
+    resolve(kind: 'principal' | 'role', id: string, tenantId?: string): Promise<string>;
+}
+/** The minimal writer surface the service uses (the concrete guard writer satisfies it). */
+export interface ShareWriterLike {
+    share(input: {
+        tenantId: string;
+        typeKey: string;
+        recordId: string;
+        granteeKind: ShareGranteeKind;
+        granteeUuid: string;
+        action: string;
+        sharerId: string;
+    }): Promise<void>;
+    unshare(input: {
+        tenantId: string;
+        typeKey: string;
+        recordId: string;
+        granteeKind: ShareGranteeKind;
+        granteeUuid: string;
+        action: string;
+        sharerId: string;
+    }): Promise<void>;
+    listSharesForRecord(input: {
+        tenantId: string;
+        typeKey: string;
+        recordId: string;
+        sharerId: string;
+    }): Promise<ReadonlyArray<{
+        granteeKind: ShareGranteeKind;
+        granteeUuid: string;
+        action: string;
+        grantedBy: string;
+    }>>;
+}
+/** A share as the UI sees it — a resolved NAME (never a raw uuid) + the API key. */
+export interface ShareView {
+    /** The grantee's display name (resolved server-side). */
+    readonly granteeName: string;
+    readonly granteeKind: ShareGranteeKind;
+    /** The grantee uuid — an API key only (for revoke); the UI renders the NAME. */
+    readonly granteeUuid: string;
+    readonly action: string;
+}
+/** The share/unshare request body — grantee + action ONLY (never a tenant/sharer/owner field). */
+export interface ShareRequest {
+    readonly typeKey: string;
+    readonly recordId: string;
+    readonly granteeKind: ShareGranteeKind;
+    readonly granteeUuid: string;
+    readonly action: string;
+}
+export declare class ShareService {
+    private readonly writer;
+    private readonly labels;
+    constructor(writer: RecordShareWriter | ShareWriterLike, labels: ShareLabelResolver);
+    /**
+     * Share a record the caller owns with a user/role for an action. The tenant + sharer are the
+     * caller's own (from `actor`), NEVER the body — a forged owner/tenant cannot reach the writer.
+     * The writer proves `actor.id` owns the record before writing (fail-closed).
+     */
+    share(actor: Principal, req: ShareRequest): Promise<void>;
+    /** Revoke a share the caller owns. Same owner bound (only the owner may unshare). */
+    unshare(actor: Principal, req: ShareRequest): Promise<void>;
+    /**
+     * List the shares on a record the caller owns — grantee NAMES resolved (no raw uuid). Only the
+     * owner may list (the writer enforces it). A deleted grantee resolves to a fallback label.
+     */
+    listShares(actor: Principal, typeKey: string, recordId: string): Promise<readonly ShareView[]>;
+}
+//# sourceMappingURL=share.service.d.ts.map

package/dist/features/share/share.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,eAAe,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}

package/dist/features/share/share.service.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShareService = void 0;
+class ShareService {
+    writer;
+    labels;
+    constructor(writer, labels) {
+        this.writer = writer;
+        this.labels = labels;
+    }
+    /**
+     * Share a record the caller owns with a user/role for an action. The tenant + sharer are the
+     * caller's own (from `actor`), NEVER the body — a forged owner/tenant cannot reach the writer.
+     * The writer proves `actor.id` owns the record before writing (fail-closed).
+     */
+    async share(actor, req) {
+        await this.writer.share({
+            tenantId: actor.tenantId, // SERVER-resolved
+            typeKey: req.typeKey,
+            recordId: req.recordId,
+            granteeKind: req.granteeKind,
+            granteeUuid: req.granteeUuid,
+            action: req.action,
+            sharerId: actor.id, // SERVER-resolved — the writer verifies ownership
+        });
+    }
+    /** Revoke a share the caller owns. Same owner bound (only the owner may unshare). */
+    async unshare(actor, req) {
+        await this.writer.unshare({
+            tenantId: actor.tenantId,
+            typeKey: req.typeKey,
+            recordId: req.recordId,
+            granteeKind: req.granteeKind,
+            granteeUuid: req.granteeUuid,
+            action: req.action,
+            sharerId: actor.id,
+        });
+    }
+    /**
+     * List the shares on a record the caller owns — grantee NAMES resolved (no raw uuid). Only the
+     * owner may list (the writer enforces it). A deleted grantee resolves to a fallback label.
+     */
+    async listShares(actor, typeKey, recordId) {
+        const rows = await this.writer.listSharesForRecord({
+            tenantId: actor.tenantId,
+            typeKey,
+            recordId,
+            sharerId: actor.id,
+        });
+        return Promise.all(rows.map(async (r) => ({
+            granteeName: await this.labels.resolve(r.granteeKind === 'role' ? 'role' : 'principal', r.granteeUuid, actor.tenantId),
+            granteeKind: r.granteeKind,
+            granteeUuid: r.granteeUuid,
+            action: r.action,
+        })));
+    }
+}
+exports.ShareService = ShareService;

package/dist/index.d.ts

@@ -48,4 +48,21 @@ export { createIdentityAuthzPool, buildIdentityRecordAuthorization, } from './fe
  * can do so.
  */
 export { AlsSessionFactsReader } from './features/authz/session-facts.reader.js';
+/**
+ * The Task 2.2 (ADR-0027 / ADR-0024) active-scope-subtree resolver — the identity-side impl of
+ * guard's `ScopeSubtreeResolver` port. Reads `shield_authz.scope_closure` (built + kept live by
+ * `ScopeClosureService`) to resolve a principal's subtree (self node + descendants) ONCE at login.
+ * The consumer wires it via `ShieldModule.forRoot({ scopeSubtreeResolver: new DbScopeSubtreeResolver(authzPool) })`
+ * so the per-request tenant gate reads the real subtree from the session binding with zero DB.
+ */
+export { DbScopeSubtreeResolver } from './features/scope/scope-subtree.resolver.js';
+/**
+ * The Task 5.2 (ADR-0027 / ADR-0024) scope-switch membership checker — the identity-side impl of
+ * guard's `MembershipChecker` port. A single existence read over `shield_app.company_membership`
+ * (`cm_is_active = 1 AND cm_status = 'active'`) that GATES `POST /auth/scope-switch`: a principal
+ * may only switch its active scope to a node it holds an active membership at. The consumer wires
+ * it via `ShieldModule.forRoot({ membershipChecker: new DbMembershipChecker(appPool) })`; absent →
+ * the switch fails closed (deny).
+ */
+export { DbMembershipChecker } from './features/membership/membership-checker.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,EACvB,gCAAgC,GACjC,MAAM,0CAA0C,CAAC;AAElD;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAExF;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAE9E;;;;;GAKG;AACH,OAAO,EACL,uBAAuB,EACvB,gCAAgC,GACjC,MAAM,0CAA0C,CAAC;AAElD;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AAEjF;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAEpF;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.createIdentityAuthzPool = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
+exports.DbMembershipChecker = exports.DbScopeSubtreeResolver = exports.AlsSessionFactsReader = exports.buildIdentityRecordAuthorization = exports.createIdentityAuthzPool = exports.IdentityFeatureModule = exports.identityControlPlaneKeys = exports.identityAuthActionKeys = exports.identityObjects = exports.identityMigrationsDir = exports.CompanyBranch = exports.CompanyDepartment = exports.MembershipPosting = exports.CompanyMembership = exports.Branch = exports.Department = exports.Role = exports.User = exports.Company = void 0;
 /**
  * @astram/identity — the framework-owned identity + tenancy model.
  * The 9 identity object classes (relocated from the consumer app in Sub-plan B) +
@@ -68,3 +68,22 @@ Object.defineProperty(exports, "buildIdentityRecordAuthorization", { enumerable:
  */
 var session_facts_reader_js_1 = require("./features/authz/session-facts.reader.js");
 Object.defineProperty(exports, "AlsSessionFactsReader", { enumerable: true, get: function () { return session_facts_reader_js_1.AlsSessionFactsReader; } });
+/**
+ * The Task 2.2 (ADR-0027 / ADR-0024) active-scope-subtree resolver — the identity-side impl of
+ * guard's `ScopeSubtreeResolver` port. Reads `shield_authz.scope_closure` (built + kept live by
+ * `ScopeClosureService`) to resolve a principal's subtree (self node + descendants) ONCE at login.
+ * The consumer wires it via `ShieldModule.forRoot({ scopeSubtreeResolver: new DbScopeSubtreeResolver(authzPool) })`
+ * so the per-request tenant gate reads the real subtree from the session binding with zero DB.
+ */
+var scope_subtree_resolver_js_1 = require("./features/scope/scope-subtree.resolver.js");
+Object.defineProperty(exports, "DbScopeSubtreeResolver", { enumerable: true, get: function () { return scope_subtree_resolver_js_1.DbScopeSubtreeResolver; } });
+/**
+ * The Task 5.2 (ADR-0027 / ADR-0024) scope-switch membership checker — the identity-side impl of
+ * guard's `MembershipChecker` port. A single existence read over `shield_app.company_membership`
+ * (`cm_is_active = 1 AND cm_status = 'active'`) that GATES `POST /auth/scope-switch`: a principal
+ * may only switch its active scope to a node it holds an active membership at. The consumer wires
+ * it via `ShieldModule.forRoot({ membershipChecker: new DbMembershipChecker(appPool) })`; absent →
+ * the switch fails closed (deny).
+ */
+var membership_checker_js_1 = require("./features/membership/membership-checker.js");
+Object.defineProperty(exports, "DbMembershipChecker", { enumerable: true, get: function () { return membership_checker_js_1.DbMembershipChecker; } });

package/dist/membership-posting.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership-posting.object.d.ts","sourceRoot":"","sources":["../src/membership-posting.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBAOa,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,cAAc,EAAG,MAAM,CAAC;IAGxB,QAAQ,EAAG,MAAM,CAAC;IAGlB,cAAc,EAAG,MAAM,CAAC;IAGxB,UAAU,EAAG,MAAM,CAAC;IAQpB,aAAa,EAAG,MAAM,CAAC;IAGvB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"membership-posting.object.d.ts","sourceRoot":"","sources":["../src/membership-posting.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBAiBa,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,cAAc,EAAG,MAAM,CAAC;IAGxB,QAAQ,EAAG,MAAM,CAAC;IAGlB,cAAc,EAAG,MAAM,CAAC;IAGxB,UAAU,EAAG,MAAM,CAAC;IAQpB,aAAa,EAAG,MAAM,CAAC;IAGvB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/membership-posting.object.js

@@ -71,6 +71,16 @@ exports.MembershipPosting = MembershipPosting = __decorate([
         table: 'membership_posting',
         schema: schema_1.SCHEMA,
         access: { plane: 'data', system: true },
+        // Read-scope wall (ADR-0027, Task 4.1): a posting has no company column of its own —
+        // it is in-scope iff its membership's company is in the caller's reachable subtree. The
+        // subquery is a FIXED framework template; the ONLY dynamic values are the `?`-bound
+        // subtree node ids (the `:nodes` placeholder the engine expands). DECOUPLED from writes.
+        // Root spans all.
+        readScope: {
+            kind: 'subtreeSubquery',
+            pkColumn: 'mp_membership_uuid',
+            subquerySql: `SELECT cm_uuid FROM \`${schema_1.SCHEMA}\`.\`company_membership\` WHERE cm_company_uuid IN (${engine_1.READ_SCOPE_NODES_TOKEN})`,
+        },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'mp_uuid' })
 ], MembershipPosting);

package/dist/objects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAatD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAIrD,CAAC"}
+{"version":3,"file":"objects.d.ts","sourceRoot":"","sources":["../src/objects.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AActD,6FAA6F;AAC7F,eAAO,MAAM,eAAe,EAAE,SAAS,eAAe,EAIrD,CAAC"}

package/dist/objects.js

@@ -11,10 +11,11 @@ const membership_posting_object_js_1 = require("./membership-posting.object.js")
 const company_department_object_js_1 = require("./company-department.object.js");
 const company_branch_object_js_1 = require("./company-branch.object.js");
 const cross_tenant_grant_object_js_1 = require("./cross-tenant-grant.object.js");
+const record_share_object_js_1 = require("./record-share.object.js");
 const shared_resource_object_js_1 = require("./shared-resource.object.js");
 /** All identity objects, registered with the engine at boot (same set + order as before). */
 exports.identityObjects = [
     company_object_js_1.Company, user_object_js_1.User, role_object_js_1.Role, department_object_js_1.Department, branch_object_js_1.Branch,
     company_membership_object_js_1.CompanyMembership, membership_posting_object_js_1.MembershipPosting, company_department_object_js_1.CompanyDepartment, company_branch_object_js_1.CompanyBranch,
-    cross_tenant_grant_object_js_1.CrossTenantGrant, shared_resource_object_js_1.SharedResource,
+    cross_tenant_grant_object_js_1.CrossTenantGrant, record_share_object_js_1.RecordShare, shared_resource_object_js_1.SharedResource,
 ];

package/dist/record-share.object.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `record_share` — an AUTHORITY-ONLY @ObjectType, never CRUD'd through the RecordEngine pipe
+ * (list-scoping engine Phase 6, §9.2). Its sole purpose is to give `record_share` an entry in the
+ * core `ModuleRegistry` (via `module-registry.bridge.ts`) so `decide()` can answer the coarse
+ * "may this principal use the owner-share surface?" gate the SAME way it answers every other
+ * object-type gate — no bespoke rule needed. The REAL per-record authority (only the LITERAL
+ * owner may share/unshare/list) is enforced by `RecordShareWriter`'s fetch-then-gate owner-bound,
+ * NOT by this coarse gate (mirrors how `cross_tenant_grant`'s writer enforces tenant isolation).
+ *
+ * `plane: 'control'` — the share surface is administration of who-may-see (root allowed), same
+ * posture as `cross_tenant_grant`/`role`. `system: true` (never `owned`/`tenantScoped`) — the
+ * table's own columns (`rs_tenant_uuid`, `rs_granted_by`) + the writer's owner-bound encode the
+ * isolation; the pipe's owner/tenant baseline is not involved. Action vocabulary is NOT the CRUD
+ * verbs — see `@astram/guard`'s `identity-actions.ts` `actionsFor('record_share')` →
+ * `RECORD_SHARE_ACTIONS` (`share`/`read`).
+ *
+ * Mirrors `cross-tenant-grant.object.ts`'s shape (system, PK only satisfies `validateAccess`).
+ */
+export declare class RecordShare {
+    uuid: string;
+    tenantUuid: string;
+    recordUuid: string;
+}
+//# sourceMappingURL=record-share.object.d.ts.map

package/dist/record-share.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-share.object.d.ts","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAOa,WAAW;IAEtB,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,UAAU,EAAG,MAAM,CAAC;CACrB"}

package/dist/record-share.object.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecordShare = void 0;
+const engine_1 = require("@astram/engine");
+/** The physical schema `record_share` lives in (migration 1710000000014). */
+const SCHEMA = 'shield_authz';
+/**
+ * `record_share` — an AUTHORITY-ONLY @ObjectType, never CRUD'd through the RecordEngine pipe
+ * (list-scoping engine Phase 6, §9.2). Its sole purpose is to give `record_share` an entry in the
+ * core `ModuleRegistry` (via `module-registry.bridge.ts`) so `decide()` can answer the coarse
+ * "may this principal use the owner-share surface?" gate the SAME way it answers every other
+ * object-type gate — no bespoke rule needed. The REAL per-record authority (only the LITERAL
+ * owner may share/unshare/list) is enforced by `RecordShareWriter`'s fetch-then-gate owner-bound,
+ * NOT by this coarse gate (mirrors how `cross_tenant_grant`'s writer enforces tenant isolation).
+ *
+ * `plane: 'control'` — the share surface is administration of who-may-see (root allowed), same
+ * posture as `cross_tenant_grant`/`role`. `system: true` (never `owned`/`tenantScoped`) — the
+ * table's own columns (`rs_tenant_uuid`, `rs_granted_by`) + the writer's owner-bound encode the
+ * isolation; the pipe's owner/tenant baseline is not involved. Action vocabulary is NOT the CRUD
+ * verbs — see `@astram/guard`'s `identity-actions.ts` `actionsFor('record_share')` →
+ * `RECORD_SHARE_ACTIONS` (`share`/`read`).
+ *
+ * Mirrors `cross-tenant-grant.object.ts`'s shape (system, PK only satisfies `validateAccess`).
+ */
+let RecordShare = class RecordShare {
+    uuid;
+    tenantUuid;
+    recordUuid;
+};
+exports.RecordShare = RecordShare;
+__decorate([
+    (0, engine_1.Field)({ column: 'rs_uuid', type: 'uuid' }),
+    __metadata("design:type", String)
+], RecordShare.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'rs_tenant_uuid', type: 'uuid' }),
+    __metadata("design:type", String)
+], RecordShare.prototype, "tenantUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'rs_record_uuid', type: 'uuid' }),
+    __metadata("design:type", String)
+], RecordShare.prototype, "recordUuid", void 0);
+exports.RecordShare = RecordShare = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'record_share',
+        table: 'record_share',
+        schema: SCHEMA,
+        access: { plane: 'control', system: true },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'rs_uuid' })
+], RecordShare);

package/dist/role.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAOa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"role.object.d.ts","sourceRoot":"","sources":["../src/role.object.ts"],"names":[],"mappings":"AAGA,8BAA8B;AAC9B,qBAiBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/role.object.js

@@ -37,6 +37,16 @@ exports.Role = Role = __decorate([
         table: 'roles',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
+        // Read-scope wall (ADR-0027, Task 4.1, OQ-2 v1 "bound-in-subtree"): a role is in-scope iff
+        // it is BOUND (via a membership_posting) within the caller's reachable subtree — the SAME
+        // "a role in my subtree" derivation the Task-4.2 grant-admin predicate uses (one consistent
+        // notion). FIXED framework template; the ONLY dynamic values are the `?`-bound subtree node
+        // ids. DECOUPLED from writes. Root spans all.
+        readScope: {
+            kind: 'subtreeSubquery',
+            pkColumn: 'r_uuid',
+            subquerySql: `SELECT mp.mp_role_uuid FROM \`${schema_1.SCHEMA}\`.\`membership_posting\` mp JOIN \`${schema_1.SCHEMA}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid WHERE cm.cm_company_uuid IN (${engine_1.READ_SCOPE_NODES_TOKEN})`,
+        },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'r_uuid' })
 ], Role);

package/dist/user.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBAUa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBAoBa,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/user.object.js

@@ -54,6 +54,16 @@ exports.User = User = __decorate([
         // capped root, the identity administrator, may list/read AND create/update/delete users). Uniform
         // across all actions (read reclassified control 2026-07-16), so plane is per-type.
         access: { plane: 'control', system: true },
+        // Read-scope wall (ADR-0027, Task 4.1): a user has no company column (they belong to many
+        // companies via `company_membership`) — a user is in-scope iff they have a membership in
+        // the caller's reachable subtree. A multi-tenant user correctly appears for each subtree
+        // they're a member of. FIXED framework template; the ONLY dynamic values are the `?`-bound
+        // subtree node ids. DECOUPLED from writes. Root spans all.
+        readScope: {
+            kind: 'subtreeSubquery',
+            pkColumn: 'u_uuid',
+            subquerySql: `SELECT cm_user_uuid FROM \`${schema_1.SCHEMA}\`.\`company_membership\` WHERE cm_company_uuid IN (${engine_1.READ_SCOPE_NODES_TOKEN})`,
+        },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'u_uuid' })
 ], User);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -22,9 +22,9 @@
   },
   "dependencies": {
     "mariadb": "^3.4.0",
-    "@astram/core": "1.0.0",
-    "@astram/engine": "0.1.3",
-    "@astram/guard": "0.5.0"
+    "@astram/core": "1.2.0",
+    "@astram/guard": "0.6.0",
+    "@astram/engine": "0.2.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",