@astram/identity 0.3.0 → 0.3.1

package/dist/features/identity-feature.module.d.ts

@@ -1,4 +1,5 @@
 import { type DynamicModule } from '@nestjs/common';
+import { type ObjectTypeInput } from '@astram/engine';
 /**
  * IdentityFeatureModule — the framework-owned identity FEATURE surface (company/user/role CRUD;
  * more in later phases) as thin controllers over the engine's RecordsService. The CONSUMER imports
@@ -18,9 +19,16 @@ export declare class IdentityFeatureModule {
      *   by the writer's own `decide()` (a route-allows/writer-denies split). Omitted ⇒
      *   `isRoot` is always false (a non-root consumer works; only a root offering
      *   cross-tenant grants needs it). See ADR-0026 + the template wiring.
+     * @param extraObjects the consumer's OWN registered object types — pass the SAME array
+     *   given to `buildIdentityRecordAuthorization(pool, extraObjects)`. Without them, the
+     *   guided rule-builder SCHEMA (Phase 5) and the OWNER-SHARE resolver (Phase 6) only know
+     *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
+     *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
+     *   Passing them here lets an owner share their own records + author policies over them.
      */
-    static forRoot({ rootIds }?: {
+    static forRoot({ rootIds, extraObjects, }?: {
         rootIds?: readonly string[];
+        extraObjects?: readonly ObjectTypeInput[];
     }): DynamicModule;
 }
 //# sourceMappingURL=identity-feature.module.d.ts.map

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAqF5D;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAE;QAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,aAAa;CAoTjF"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAsExB;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;KAAO,GAAG,aAAa;CAwTnG"}

package/dist/features/identity-feature.module.js

@@ -81,8 +81,14 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   by the writer's own `decide()` (a route-allows/writer-denies split). Omitted ⇒
      *   `isRoot` is always false (a non-root consumer works; only a root offering
      *   cross-tenant grants needs it). See ADR-0026 + the template wiring.
+     * @param extraObjects the consumer's OWN registered object types — pass the SAME array
+     *   given to `buildIdentityRecordAuthorization(pool, extraObjects)`. Without them, the
+     *   guided rule-builder SCHEMA (Phase 5) and the OWNER-SHARE resolver (Phase 6) only know
+     *   the framework identity types, so a consumer's own OWNED type (e.g. `note`) is NOT
+     *   policy-authorable and NOT shareable ("type '…' is not registered — cannot share").
+     *   Passing them here lets an owner share their own records + author policies over them.
      */
-    static forRoot({ rootIds } = {}) {
+    static forRoot({ rootIds, extraObjects = [], } = {}) {
         // ONE shared shield_authz pool for the whole grant-admin stack (ADR-0011): the
         // permission-version bumper, the AccessBundleStore, the GrantAdminService, and the two
         // reconcile jobs all run over this single pool (don't open several). Opened once at
@@ -212,7 +218,8 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // are meaningfully policy-authorable in v1; but we expose every registered type's fields and
         // let the delegated-admin ceiling + validateGuidedPolicy gate what a caller may actually
         // author. A consumer's own types (extraObjects) would extend this the same way (future).
-        const schemaSource = [...objects_js_1.identityObjects].map((input) => {
+        // Include the consumer's `extraObjects` so their OWNED types are policy-authorable too.
+        const schemaSource = [...objects_js_1.identityObjects, ...extraObjects].map((input) => {
             const reg = typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
             return {
                 typeKey: reg.typeKey,
@@ -235,8 +242,11 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // surfaces `owned`/table/schema/pk/owner/tenant columns via the engine helpers. The writer's
         // audit reuses the SAME shield_audit sink pattern (best-effort). The ShareService adds
         // name-resolution (no raw uuid) via the existing DirectoryLabelResolver (`auditLabels`).
+        // Include the consumer's `extraObjects` so their OWNED types are shareable (a `note` a user
+        // owns can be shared) — without them the resolver only knows the framework identity types
+        // and the writer rejects "type 'note' is not registered — cannot share." (Live-acceptance fix.)
         const shareTypeInfoByKey = new Map();
-        for (const input of objects_js_1.identityObjects) {
+        for (const input of [...objects_js_1.identityObjects, ...extraObjects]) {
             const reg = typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
             const owner = (0, engine_1.ownerColumn)(reg);
             const pk = reg.primaryKey.kind === 'uuid' ? (0, engine_1.uuidPkColumn)(reg.primaryKey) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",