@astram/identity 0.2.1 → 0.3.0

package/dist/company-membership.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-membership.object.d.ts","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAOa,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,WAAW,EAAG,MAAM,CAAC;IAGrB,QAAQ,EAAG,OAAO,CAAC;IAGnB,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"company-membership.object.d.ts","sourceRoot":"","sources":["../src/company-membership.object.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,qBAca,iBAAiB;IAE5B,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,WAAW,EAAG,MAAM,CAAC;IAGrB,QAAQ,EAAG,OAAO,CAAC;IAGnB,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company-membership.object.js

@@ -58,6 +58,13 @@ exports.CompanyMembership = CompanyMembership = __decorate([
         table: 'company_membership',
         schema: schema_1.SCHEMA,
         access: { plane: 'data', system: true },
+        // Read-scope wall (ADR-0027, Task 4.1): a membership's company IS the tenant node
+        // (`cm_company_uuid`), so a non-root LIST/GET is bounded to memberships whose company is
+        // in the caller's reachable subtree. DECOUPLED from writes — NOT `trusted`, because
+        // marking `cm_company_uuid` trusted would force every new membership's company to the
+        // admin's OWN node, breaking adding a user to a SUB-company (a legit hierarchy op). This
+        // filters reads only. Root spans all.
+        readScope: { kind: 'nodeColumn', column: 'cm_company_uuid' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'cm_uuid' })
 ], CompanyMembership);

package/dist/company.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company.object.d.ts","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,qBAca,OAAO;IAElB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,IAAI,EAAG,MAAM,CAAC;IAGd,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"company.object.d.ts","sourceRoot":"","sources":["../src/company.object.ts"],"names":[],"mappings":"AAGA,kFAAkF;AAClF,qBAmBa,OAAO;IAElB,IAAI,EAAG,MAAM,CAAC;IAGd,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,IAAI,EAAG,MAAM,CAAC;IAGd,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/company.object.js

@@ -59,6 +59,11 @@ exports.Company = Company = __decorate([
         // `company` row carries no business data. Consistent with company_department/company_branch,
         // which are already control (managing a company's org structure is administration too).
         access: { plane: 'control', system: true },
+        // Read-scope wall (ADR-0027, Task 4.1): a company IS a tenant node — its own row carries
+        // the node (`c_uuid`), so a non-root LIST/GET is bounded to the caller's reachable subtree
+        // (`c_uuid` IN my subtree). DECOUPLED from writes (no `trusted` change) — this filters
+        // reads only. Root spans all.
+        readScope: { kind: 'nodeColumn', column: 'c_uuid' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'c_uuid' })
 ], Company);

package/dist/features/authz/catalog-bootstrap.provider.d.ts

@@ -3,6 +3,7 @@ import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
 import type { ObjectType } from '@astram/engine';
 import { CatalogReconcileJob } from './catalog-reconcile.job.js';
 import { AccessBundleReconcileJob } from './access-bundle-reconcile.job.js';
+import { ScopeClosureService } from '../scope/scope-closure.service.js';
 /**
  * Boot: read-only verifyGatable (fail-closed — a stranded/unclassified route aborts
  * boot). Post-boot: kick the mutating reconcile once, then on an interval (single
@@ -20,9 +21,13 @@ export declare class CatalogBootstrapProvider implements OnApplicationBootstrap
     private readonly reflector;
     private readonly job;
     private readonly accessBundleJob;
+    private readonly scopeClosure;
     private readonly registrations;
     private timer;
-    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, job: CatalogReconcileJob, accessBundleJob: AccessBundleReconcileJob, registrations: readonly ObjectType[]);
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, job: CatalogReconcileJob, accessBundleJob: AccessBundleReconcileJob, scopeClosure: ScopeClosureService, registrations: readonly ObjectType[]);
     onApplicationBootstrap(): Promise<void>;
+    /** Rebuild the scope closure; a failure is logged loudly (never silently swallowed) but does
+     *  not abort boot or a cron tick — the reconcile is idempotent and retried next interval. */
+    private reconcileScopeClosure;
 }
 //# sourceMappingURL=catalog-bootstrap.provider.d.ts.map

package/dist/features/authz/catalog-bootstrap.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAK5E;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB;IAInE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAThC,OAAO,CAAC,KAAK,CAA+B;gBAGzB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EAEzC,aAAa,EAAE,SAAS,UAAU,EAAE;IAGjD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;CA2B9C"}
+{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB;IAInE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAVhC,OAAO,CAAC,KAAK,CAA+B;gBAGzB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EACzC,YAAY,EAAE,mBAAmB,EAEjC,aAAa,EAAE,SAAS,UAAU,EAAE;IAGjD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC7C;iGAC6F;YAC/E,qBAAqB;CAOpC"}

package/dist/features/authz/catalog-bootstrap.provider.js

@@ -23,6 +23,7 @@ const guard_1 = require("@astram/guard");
 const engine_1 = require("@astram/engine");
 const catalog_reconcile_job_js_1 = require("./catalog-reconcile.job.js");
 const access_bundle_reconcile_job_js_1 = require("./access-bundle-reconcile.job.js");
+const scope_closure_service_js_1 = require("../scope/scope-closure.service.js");
 const MODULE_KEY = 'identity';
 const RECONCILE_INTERVAL_MS = 60 * 60 * 1000; // hourly; honors DISABLE_ALL_CRONS below
 /**
@@ -42,14 +43,16 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
     reflector;
     job;
     accessBundleJob;
+    scopeClosure;
     registrations;
     timer = null;
-    constructor(discovery, scanner, reflector, job, accessBundleJob, registrations) {
+    constructor(discovery, scanner, reflector, job, accessBundleJob, scopeClosure, registrations) {
         this.discovery = discovery;
         this.scanner = scanner;
         this.reflector = reflector;
         this.job = job;
         this.accessBundleJob = accessBundleJob;
+        this.scopeClosure = scopeClosure;
         this.registrations = registrations;
     }
     async onApplicationBootstrap() {
@@ -64,22 +67,43 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
         // Bundles reconcile AFTER permissions (same post-boot pass): a bundle validates
         // its keys against the live permission catalog, so permissions must reconcile first.
         await this.accessBundleJob.runOnce(nowIso);
+        // Scope-closure reconcile (Task 1.2): rebuild `scope_closure` from the live company tree so
+        // it is consistent with `companies.c_parent_uuid` at boot (mirrors the catalog reconcile).
+        // Independent of the catalog/bundles (it derives from the node tree, not the permission
+        // catalog). Fail-loud but NON-blocking: a corrupt tree (cycle/orphan) surfaces here as a
+        // logged error rather than aborting boot — the reconcile is idempotent and retried on the
+        // interval below once the data is fixed.
+        await this.reconcileScopeClosure();
         if (process.env.DISABLE_ALL_CRONS !== 'true') {
             this.timer = setInterval(() => {
                 const tickIso = new Date().toISOString();
-                void this.job.runOnce(tickIso).then(() => this.accessBundleJob.runOnce(tickIso));
+                void this.job
+                    .runOnce(tickIso)
+                    .then(() => this.accessBundleJob.runOnce(tickIso))
+                    .then(() => this.reconcileScopeClosure());
             }, RECONCILE_INTERVAL_MS);
             this.timer.unref?.();
         }
     }
+    /** Rebuild the scope closure; a failure is logged loudly (never silently swallowed) but does
+     *  not abort boot or a cron tick — the reconcile is idempotent and retried next interval. */
+    async reconcileScopeClosure() {
+        try {
+            await this.scopeClosure.reconcileClosure();
+        }
+        catch (cause) {
+            console.error('[scope] closure reconcile FAILED (tree may be corrupt):', cause);
+        }
+    }
 };
 exports.CatalogBootstrapProvider = CatalogBootstrapProvider;
 exports.CatalogBootstrapProvider = CatalogBootstrapProvider = __decorate([
     (0, common_1.Injectable)(),
-    __param(5, (0, common_1.Inject)(engine_1.ENGINE_ALL_REGISTRATIONS)),
+    __param(6, (0, common_1.Inject)(engine_1.ENGINE_ALL_REGISTRATIONS)),
     __metadata("design:paramtypes", [core_1.DiscoveryService,
         core_1.MetadataScanner,
         core_1.Reflector,
         catalog_reconcile_job_js_1.CatalogReconcileJob,
-        access_bundle_reconcile_job_js_1.AccessBundleReconcileJob, Array])
+        access_bundle_reconcile_job_js_1.AccessBundleReconcileJob,
+        scope_closure_service_js_1.ScopeClosureService, Array])
 ], CatalogBootstrapProvider);

package/dist/features/authz/grant-admin.controller.d.ts

@@ -28,7 +28,7 @@ export declare class GrantAdminController {
      * would be captured by IdentityController's `@Get('roles/:uuid')` (registered first),
      * routing this to getRole('role-grants') → a 500. Keep it off the `roles/:uuid` shape.
      */
-    grantsSummary(query: {
+    grantsSummary(req: AuthedRequest, query: {
         page?: string;
         limit?: string;
         search?: string;
@@ -51,8 +51,9 @@ export declare class GrantAdminController {
         }[];
         wildcards: string[];
     }>;
-    /** List a role's current grants. */
-    list(uuid: string): Promise<{
+    /** List a role's current grants. Subtree-guarded (Task 4.2): a non-root caller reads a role's
+     *  grants only if the role is bound within their reachable subtree, else `{ grants: [] }`. */
+    list(req: AuthedRequest, uuid: string): Promise<{
         grants: string[];
     }>;
     /** Grant one permission key to a role. */

package/dist/features/authz/grant-admin.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAE1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CAEjB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb,oCAAoC;IAG9B,IAAI,CAAgB,IAAI,EAAE,MAAM;;;IAItC,0CAA0C;IAGpC,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYlG,mFAAmF;IAG7E,MAAM,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAOnE;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYxG;;;;OAIG;IAGG,YAAY,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;CAS1E"}
+{"version":3,"file":"grant-admin.controller.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.controller.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAe,MAAM,0BAA0B,CAAC;AAG1E,qFAAqF;AACrF,UAAU,aAAa;IACrB,SAAS,EAAE,SAAS,CAAC;CACtB;AAaD;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,iBAAiB;IAEtD;;;;;;;;OAQG;IAGG,aAAa,CACV,GAAG,EAAE,aAAa,EAEzB,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB;;;;;;IAcH,sDAAsD;IAGhD,OAAO;;;;;;;;;;IAIb;kGAC8F;IAGxF,IAAI,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM;;;IAIjE,0CAA0C;IAGpC,KAAK,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYlG,mFAAmF;IAG7E,MAAM,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;IAOnE;;;;OAIG;IAGG,OAAO;;;IAIb;;;;OAIG;IAGG,WAAW,CAAQ,GAAG,EAAE,aAAa,EAAiB,IAAI,EAAE,MAAM,EAAU,IAAI,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAYxG;;;;OAIG;IAGG,YAAY,CAAgB,IAAI,EAAE,MAAM,EAAgB,GAAG,EAAE,MAAM;;;CAS1E"}

package/dist/features/authz/grant-admin.controller.js

@@ -19,6 +19,16 @@ exports.GrantAdminController = void 0;
 const common_1 = require("@nestjs/common");
 const guard_1 = require("@astram/guard");
 const grant_admin_service_js_1 = require("./grant-admin.service.js");
+/**
+ * Derive the caller's subtree scope from the resolved principal (Task 4.2). Uses the SAME cached
+ * `scopeSubtreeNodeIds` the RecordEngine's list-scope uses (one source of truth). Fail-safe to the
+ * active node `[tenantId]` if the subtree is absent (self-node, non-widening — never a leak).
+ */
+function subtreeScopeOf(req) {
+    const p = req.principal;
+    const nodeIds = p.scopeSubtreeNodeIds?.length ? p.scopeSubtreeNodeIds : [p.tenantId];
+    return { nodeIds, isRoot: p.isRoot === true };
+}
 /**
  * Grant administration — list/grant/revoke a role's permission keys. Gated purely on
  * `@Classified({ typeKey: 'role', ... })` + `decide()` (G1: no handler-level root
@@ -45,7 +55,7 @@ let GrantAdminController = class GrantAdminController {
      * would be captured by IdentityController's `@Get('roles/:uuid')` (registered first),
      * routing this to getRole('role-grants') → a 500. Keep it off the `roles/:uuid` shape.
      */
-    async grantsSummary(query) {
+    async grantsSummary(req, query) {
         const page = Number.parseInt(query?.page ?? '', 10);
         const limit = Number.parseInt(query?.limit ?? '', 10);
         const params = {
@@ -59,15 +69,16 @@ let GrantAdminController = class GrantAdminController {
             params.search = query.search;
         if (typeof query?.sortBy === 'string')
             params.sortBy = query.sortBy;
-        return this.grants.listGrantsSummary(params);
+        return this.grants.listGrantsSummary(params, subtreeScopeOf(req));
     }
     /** List all grantable permission keys + wildcards. */
     async catalog() {
         return this.grants.listCatalog();
     }
-    /** List a role's current grants. */
-    async list(uuid) {
-        return this.grants.listRoleGrants(uuid);
+    /** List a role's current grants. Subtree-guarded (Task 4.2): a non-root caller reads a role's
+     *  grants only if the role is bound within their reachable subtree, else `{ grants: [] }`. */
+    async list(req, uuid) {
+        return this.grants.listRoleGrants(uuid, subtreeScopeOf(req));
     }
     /** Grant one permission key to a role. */
     async grant(req, uuid, body) {
@@ -138,9 +149,10 @@ exports.GrantAdminController = GrantAdminController;
 __decorate([
     (0, common_1.Get)('access/role-grants'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),
-    __param(0, (0, common_1.Query)()),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Query)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], GrantAdminController.prototype, "grantsSummary", null);
 __decorate([
@@ -153,9 +165,10 @@ __decorate([
 __decorate([
     (0, common_1.Get)('roles/:uuid/permissions'),
     (0, guard_1.Classified)({ typeKey: 'role', action: 'read' }),
-    __param(0, (0, common_1.Param)('uuid')),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('uuid')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String]),
+    __metadata("design:paramtypes", [Object, String]),
     __metadata("design:returntype", Promise)
 ], GrantAdminController.prototype, "list", null);
 __decorate([

package/dist/features/authz/grant-admin.service.d.ts

@@ -1,6 +1,17 @@
 import type { Pool } from 'mariadb';
 import { PermissionVersionBumper } from './permission-version.bumper.js';
 import { AccessBundleStore } from './access-bundle-store.js';
+/**
+ * The caller's reachable subtree, threaded from `req.principal` (Task 4.2). It scopes the
+ * grant-admin reads so a caller sees ONLY roles bound within their subtree — the SAME cached
+ * `scopeSubtreeNodeIds` the RecordEngine's list-scope uses (one source of truth for "a node's
+ * subtree"). `isRoot` spans all tenants (the tenant registry is root's scope) → NO predicate.
+ * A non-root with an EMPTY `nodeIds` matches nothing → an empty list (fail-closed, not a leak).
+ */
+export interface SubtreeScope {
+    readonly nodeIds: readonly string[];
+    readonly isRoot: boolean;
+}
 /** A granted key was not in the catalog and is not a recognized wildcard. The
  *  controller maps this to HTTP 400 (distinct from a store outage → 503). */
 export declare class BadKeyError extends Error {
@@ -45,7 +56,12 @@ export declare class GrantAdminService {
         catalog: CatalogRow[];
         wildcards: string[];
     }>;
-    listRoleGrants(roleUuid: string): Promise<{
+    /**
+     * A role's current grants. Task 4.2: subtree-guarded — a non-root caller may read a role's
+     * grants ONLY IF that role is bound within their reachable subtree; otherwise `{ grants: [] }`
+     * (fail-closed — never leak another tenant's role's permissions by uuid). Root skips the guard.
+     */
+    listRoleGrants(roleUuid: string, subtreeScope: SubtreeScope): Promise<{
         grants: string[];
     }>;
     /** Validate the key against the catalog + wildcard set. Throws BadKeyError if unknown. */
@@ -90,13 +106,13 @@ export declare class GrantAdminService {
      * page (a per-role aggregate not cheaply sortable in SQL). Defaults: page 1, limit 25,
      * sort name asc.
      */
-    listGrantsSummary(params?: {
+    listGrantsSummary(params: {
         page?: number;
         limit?: number;
         search?: string;
         sortBy?: string;
         sortOrder?: 'asc' | 'desc';
-    }): Promise<{
+    } | undefined, subtreeScope: SubtreeScope): Promise<{
         rows: RoleGrantSummary[];
         total: number;
         page: number;

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAK7D;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAI1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB;IAKjC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BtE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAYrE,0FAA0F;YAC5E,cAAc;IAM5B;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B7E,iFAAiF;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB1D,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;OAIG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BzF;;;;;OAKG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtE,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CAAC,MAAM,CAAC,EAAE;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAsHtF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAM7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAmBD;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAI1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB;IAKjC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0B5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B7E,iFAAiF;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB1D,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;OAIG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BzF;;;;;OAKG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBtE,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EAAE;QACN,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GAAG,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CA4HrF"}

package/dist/features/authz/grant-admin.service.js

@@ -5,6 +5,22 @@ const core_1 = require("@astram/core");
 const access_bundle_store_js_1 = require("./access-bundle-store.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const AUTHZ = 'shield_authz';
+const APP = 'shield_app';
+/**
+ * Build the shared EXISTS-subtree fragment for a non-root caller. A role qualifies only if it
+ * is bound (`membership_posting → company_membership`) to a node in the caller's subtree. All
+ * node ids are `?`-bound (never interpolated → injection-free); the caller splices the returned
+ * `params` at the position where `sql` sits in the surrounding query. Root / empty scope callers
+ * are handled by the caller (root ⇒ no fragment; the engine guarantees non-empty subtrees).
+ */
+function subtreeExists(nodeIds) {
+    const ph = nodeIds.map(() => '?').join(', ');
+    const sql = ` AND EXISTS (` +
+        `SELECT 1 FROM \`${APP}\`.\`membership_posting\` mp` +
+        ` JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid` +
+        ` WHERE mp.mp_role_uuid = r.r_uuid AND cm.cm_company_uuid IN (${ph}))`;
+    return { sql, params: [...nodeIds] };
+}
 /** A granted key was not in the catalog and is not a recognized wildcard. The
  *  controller maps this to HTTP 400 (distinct from a store outage → 503). */
 class BadKeyError extends Error {
@@ -48,8 +64,25 @@ class GrantAdminService {
         ];
         return { catalog, wildcards };
     }
-    async listRoleGrants(roleUuid) {
+    /**
+     * A role's current grants. Task 4.2: subtree-guarded — a non-root caller may read a role's
+     * grants ONLY IF that role is bound within their reachable subtree; otherwise `{ grants: [] }`
+     * (fail-closed — never leak another tenant's role's permissions by uuid). Root skips the guard.
+     */
+    async listRoleGrants(roleUuid, subtreeScope) {
         try {
+            if (!subtreeScope.isRoot) {
+                const ph = subtreeScope.nodeIds.map(() => '?').join(', ');
+                // Empty subtree → no placeholders → the check can't match → fail-closed empty.
+                const bound = subtreeScope.nodeIds.length
+                    ? (await this.pool.query(`SELECT 1 FROM \`${APP}\`.\`membership_posting\` mp
+                 JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+                WHERE mp.mp_role_uuid = ? AND cm.cm_company_uuid IN (${ph})
+                LIMIT 1`, [roleUuid, ...subtreeScope.nodeIds]))
+                    : [];
+                if (bound.length === 0)
+                    return { grants: [] };
+            }
             const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid]));
             return { grants: rows.map((r) => r.rp_perm_key) };
         }
@@ -203,7 +236,7 @@ class GrantAdminService {
      * page (a per-role aggregate not cheaply sortable in SQL). Defaults: page 1, limit 25,
      * sort name asc.
      */
-    async listGrantsSummary(params) {
+    async listGrantsSummary(params, subtreeScope) {
         const page = Math.max(1, Math.trunc(params?.page ?? 1));
         const limit = Math.min(200, Math.max(1, Math.trunc(params?.limit ?? 25)));
         const offset = (page - 1) * limit;
@@ -214,6 +247,11 @@ class GrantAdminService {
             const { catalog } = await this.listCatalog();
             const allKeys = catalog.map((c) => c.key);
             const { bundles } = await this.listBundles();
+            // Task 4.2 subtree scope: a non-root caller sees ONLY roles bound within their reachable
+            // subtree (the EXISTS predicate); root spans all tenants (no predicate). The scope clause
+            // sits FIRST in the WHERE (before the LIKE), so its ?-bound node params lead the arg list —
+            // identical on BOTH the count and page queries so they can never disagree.
+            const scope = subtreeScope.isRoot ? { sql: '', params: [] } : subtreeExists(subtreeScope.nodeIds);
             // Distinct granted roles (a role appears iff it has ≥1 role_permission row), filtered
             // by name search. Bind the LIKE term as a param (wildcards escaped).
             const likeClause = search ? `AND r.r_name LIKE ?` : '';
@@ -221,7 +259,7 @@ class GrantAdminService {
             const [{ total = 0 } = {}] = (await this.pool.query(`SELECT COUNT(DISTINCT rp.rp_role_uuid) AS total
            FROM \`${AUTHZ}\`.\`role_permission\` rp
            JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
-          WHERE 1 = 1 ${likeClause}`, likeArgs));
+          WHERE 1 = 1${scope.sql} ${likeClause}`, [...scope.params, ...likeArgs]));
             // The page of role uuids + name + latest-grant metadata. name/grantedAt sort in SQL;
             // permCount falls back to a stable name sort here (re-sorted after aggregation).
             const orderCol = sortBy === 'grantedAt' ? 'latest_at' : 'r.r_name';
@@ -230,10 +268,10 @@ class GrantAdminService {
                 MAX(rp.rp_granted_at) AS latest_at
            FROM \`${AUTHZ}\`.\`role_permission\` rp
            JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
-          WHERE 1 = 1 ${likeClause}
+          WHERE 1 = 1${scope.sql} ${likeClause}
           GROUP BY rp.rp_role_uuid, r.r_name
           ORDER BY ${orderCol} ${dir}, r.r_name ASC
-          LIMIT ? OFFSET ?`, [...likeArgs, limit, offset]));
+          LIMIT ? OFFSET ?`, [...scope.params, ...likeArgs, limit, offset]));
             if (pageRoles.length === 0) {
                 return { rows: [], total: Number(total), page, limit };
             }

package/dist/features/authz/record-authorization.d.ts

@@ -11,6 +11,7 @@
  */
 import { type Pool } from 'mariadb';
 import { type RecordAuthorizationInputs } from '@astram/guard';
+import type { ObjectTypeInput } from '@astram/engine';
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
@@ -24,8 +25,16 @@ export declare function createIdentityAuthzPool(): Pool;
  *   - `permissionFacts` — coarse grants over `shield_authz.role_permission` +
  *     `company_membership`/`membership_posting`,
  *   - `sessionFacts` — the ADR-0011 ALS-backed per-request reader,
- *   - `registry` — bridged from `identityObjects`,
+ *   - `registry` — bridged from `identityObjects` PLUS any consumer-supplied `extraObjects`,
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
+ *
+ * `extraObjects` (optional): a CONSUMER app that registers its OWN gated object types via
+ * `EngineModule.forFeature([...])` must ALSO pass those types here, so their actions enter the
+ * coarse-grant permission-facts registry (gate 5). Without this, a custom type's routes boot
+ * and list-scope correctly (gate 6) but their `<module>:<type>:<action>` permission keys are
+ * never projected into a principal's grants — so gate 5 denies them (deny-by-default). Passing
+ * the same object types the app registered with the engine closes that gap: the app's grants on
+ * those keys now project, and the framework still owns the four record-tier adapters + scope fn.
  */
-export declare function buildIdentityRecordAuthorization(pool: Pool): RecordAuthorizationInputs;
+export declare function buildIdentityRecordAuthorization(pool: Pool, extraObjects?: readonly ObjectTypeInput[]): RecordAuthorizationInputs;
 //# sourceMappingURL=record-authorization.d.ts.map

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAA6C,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAK1G;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,IAAI,GAAG,yBAAyB,CAStF"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAA6C,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAS3B"}

package/dist/features/authz/record-authorization.js

@@ -44,11 +44,19 @@ function createIdentityAuthzPool() {
  *   - `permissionFacts` — coarse grants over `shield_authz.role_permission` +
  *     `company_membership`/`membership_posting`,
  *   - `sessionFacts` — the ADR-0011 ALS-backed per-request reader,
- *   - `registry` — bridged from `identityObjects`,
+ *   - `registry` — bridged from `identityObjects` PLUS any consumer-supplied `extraObjects`,
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
+ *
+ * `extraObjects` (optional): a CONSUMER app that registers its OWN gated object types via
+ * `EngineModule.forFeature([...])` must ALSO pass those types here, so their actions enter the
+ * coarse-grant permission-facts registry (gate 5). Without this, a custom type's routes boot
+ * and list-scope correctly (gate 6) but their `<module>:<type>:<action>` permission keys are
+ * never projected into a principal's grants — so gate 5 denies them (deny-by-default). Passing
+ * the same object types the app registered with the engine closes that gap: the app's grants on
+ * those keys now project, and the framework still owns the four record-tier adapters + scope fn.
  */
-function buildIdentityRecordAuthorization(pool) {
-    const registry = (0, guard_1.buildIdentityModuleRegistry)(objects_js_1.identityObjects);
+function buildIdentityRecordAuthorization(pool, extraObjects = []) {
+    const registry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
     return {
         pool,
         permissionFacts: new db_permission_facts_adapter_js_1.DbPermissionFactsAdapter(pool, registry),

package/dist/features/cross-tenant/grant-authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-authorize.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/grant-authorize.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,iCAAiC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACtD,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF;0DACsD;IACtD,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;CACnD;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,iCAAiC,GACtC,gBAAgB,CAkBlB"}
+{"version":3,"file":"grant-authorize.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/grant-authorize.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,WAAW,iCAAiC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACtD,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF;0DACsD;IACtD,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;CACnD;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,iCAAiC,GACtC,gBAAgB,CAqBlB"}

package/dist/features/cross-tenant/grant-authorize.js

@@ -7,6 +7,9 @@ function makeAuthorizeCrossTenantGrant(deps) {
         const principal = {
             kind: 'user',
             id: principalId,
+            // Scope (ADR-0027) — INTERIM self-node default (Task 2.1): non-widening, = today's isolation.
+            activeScopeNodeId: tenantId,
+            scopeSubtreeNodeIds: [tenantId],
             tenantId,
             roleIds,
             isRoot: deps.isRoot(principalId),

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAoE5D;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAE;QAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,aAAa;CAkLjF"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAqF5D;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAE;QAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,aAAa;CAoTjF"}