@astram/identity 0.9.3 → 0.11.0

package/dist/features/files/files.service.js

@@ -0,0 +1,311 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var FilesService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FilesService = exports.DEFAULT_SERVABLE_CONTENT_TYPES = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+const TYPE_KEY = 'stored_file';
+/** Fixed messages: never a key, a name, bytes or a store detail (SPEC §11 secrets, §13). */
+const MSG_NOT_CONFIGURED = 'File storage is not configured';
+const MSG_UNAVAILABLE = 'File storage is unavailable';
+const MSG_FORBIDDEN = 'Forbidden';
+/** Served when a stored content type is not one the intake allowlist produces (KI #13). */
+const OCTET_STREAM = 'application/octet-stream';
+/**
+ * The canonical content types the intake allowlist can store: today the `xlsx` profile, the only
+ * profile `ShieldModule` registers on `SHIELD_FILE_INGEST`. Pass the app's own list when it
+ * registers more profiles.
+ */
+exports.DEFAULT_SERVABLE_CONTENT_TYPES = core_1.XLSX_PROFILE.contentTypes;
+/**
+ * True when `key` is exactly `t/<tenantId>/<uuid>` for this tenant (KI #4). Both segments must be
+ * canonical uuids, so a traversal (`..`), an extra segment or a shared string prefix
+ * (`t/<tenant>extra/…`) never matches.
+ */
+function keyBelongsTo(key, tenantId) {
+    const tenant = (0, engine_1.canonicalUuid)(tenantId);
+    if (tenant === null || typeof key !== 'string')
+        return false;
+    const parts = key.split('/');
+    return (parts.length === 3 &&
+        parts[0] === 't' &&
+        parts[1] === tenant &&
+        (0, engine_1.canonicalUuid)(parts[2]) === parts[2]);
+}
+const sha256Hex = (bytes) => (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex');
+/**
+ * FilesService — stored files on the engine pipe (file-storage SPEC §5 I-K).
+ *
+ * - The `stored_file` row is written ONLY here (KI #4): the key comes from `FileIntake` (built from
+ *   the session tenant) and is re-checked against the actor's tenant before any put or create.
+ *   Tenant and owner are stamped by the pipe from the session (Shield #7), never sent from here.
+ * - Every row access goes through `RecordsService` (record gate, tenant wall, read scope, audit);
+ *   no DB pool, no bypass flag (Shield #3, #9). The bucket is read only in `open()`, after the gate.
+ * - Errors map at source: 501 when no store is bound, 503 (fixed message) for store failures and
+ *   integrity faults, 403 (fixed message) for missing, foreign or denied rows alike.
+ * - No actor argument (SPEC §5 I-K): the key tenant and the `file_access` audit actor come from
+ *   `RecordsService.requestPrincipal()`, the same principal the engine stamps and gates with, so
+ *   key tenant, row tenant/owner and audit actor cannot diverge. No principal ⇒ fail closed.
+ * - The engine does not audit its own denials, so a 403 from open/remove writes a `file_access`
+ *   failure event (`denied_or_missing`, no key, no name). Logs carry the storage key only.
+ */
+let FilesService = FilesService_1 = class FilesService {
+    records;
+    objectStore;
+    audit;
+    logger = new common_1.Logger(FilesService_1.name);
+    orphans = 0;
+    constructor(records, objectStore, audit, servableContentTypes = exports.DEFAULT_SERVABLE_CONTENT_TYPES) {
+        this.records = records;
+        this.objectStore = objectStore;
+        this.audit = audit;
+        this.servable = new Map(servableContentTypes.map((t) => [t.toLowerCase(), t]));
+    }
+    /** Lower-cased allowlisted type -> its canonical spelling (what `open()` may serve). */
+    servable;
+    /**
+     * KI #13: the download Content-Type is re-checked against the intake allowlist, never taken
+     * from the row as-is. Anything else (a row written outside FileIntake, a profile since
+     * removed) is served as `application/octet-stream`.
+     */
+    servableType(stored) {
+        if (typeof stored !== 'string')
+            return OCTET_STREAM;
+        return this.servable.get(stored.toLowerCase()) ?? OCTET_STREAM;
+    }
+    /** Objects left behind by a failed compensating or post-commit delete since boot. */
+    get orphanedObjectCount() {
+        return this.orphans;
+    }
+    /** Put the bytes, then create the `stored_file` record; on create failure delete the object. */
+    async store(intake) {
+        const store = this.requireStore();
+        const actor = this.records.requestPrincipal();
+        if (!keyBelongsTo(intake.storageKey, actor.tenantId)) {
+            // A key outside the session tenant never reaches the bucket or the table (KI #4).
+            throw new common_1.ForbiddenException(MSG_FORBIDDEN);
+        }
+        const key = intake.storageKey;
+        try {
+            await store.put(key, intake.bytes, {
+                contentType: intake.contentType,
+                sha256: intake.sha256,
+            });
+        }
+        catch (cause) {
+            this.logger.error(`file put failed (${errorName(cause)}): ${key}`);
+            throw new common_1.ServiceUnavailableException(MSG_UNAVAILABLE);
+        }
+        let uuid;
+        try {
+            const id = await this.records.create(TYPE_KEY, {
+                fields: {
+                    storageKey: key,
+                    sha256: intake.sha256,
+                    contentType: intake.contentType,
+                    sizeBytes: intake.sizeBytes,
+                    originalName: intake.originalName,
+                    createdAt: Date.now(),
+                },
+            });
+            uuid = String(id);
+        }
+        catch (cause) {
+            await this.deleteObject(store, key, 'compensating');
+            throw cause;
+        }
+        return {
+            uuid,
+            sha256: intake.sha256,
+            sizeBytes: intake.sizeBytes,
+            contentType: intake.contentType,
+            originalName: intake.originalName,
+        };
+    }
+    /** Read a file under record-level decide, with the key and sha256 re-checked (SPEC §5 J). */
+    async open(uuid) {
+        const store = this.requireStore();
+        const actor = this.records.requestPrincipal();
+        const id = (0, engine_1.canonicalUuid)(uuid);
+        let row;
+        try {
+            if (id === null)
+                throw new common_1.ForbiddenException(MSG_FORBIDDEN);
+            row = await this.records.get(TYPE_KEY, id);
+            if (row === null)
+                throw new common_1.ForbiddenException(MSG_FORBIDDEN);
+        }
+        catch (cause) {
+            if (isDenial(cause))
+                await this.auditDenied(actor, 'read', id);
+            throw cause;
+        }
+        const f = row.fields;
+        const recordTenant = f.tenantId;
+        if (!keyBelongsTo(f.storageKey, recordTenant)) {
+            // The row points outside its own tenant: an integrity fault, never a cross-tenant read.
+            this.logger.error(`stored_file ${String(row.id)} key outside its tenant prefix; refused`);
+            await this.auditFailure(row, actor, 'key_prefix_mismatch');
+            throw new common_1.ServiceUnavailableException(MSG_UNAVAILABLE);
+        }
+        const key = f.storageKey;
+        let bytes;
+        try {
+            ({ bytes } = await store.get(key));
+        }
+        catch (cause) {
+            if (cause instanceof core_1.ObjectNotFoundError) {
+                this.logger.error(`stored object missing: ${key}`);
+                await this.auditFailure(row, actor, 'object_missing');
+            }
+            else {
+                this.logger.error(`file get failed (${errorName(cause)}): ${key}`);
+            }
+            throw new common_1.ServiceUnavailableException(MSG_UNAVAILABLE);
+        }
+        const sha = typeof f.sha256 === 'string' ? f.sha256.toLowerCase() : '';
+        if (sha.length !== 64 || sha256Hex(bytes) !== sha) {
+            this.logger.error(`stored object failed its sha256 check: ${key}`);
+            await this.auditFailure(row, actor, 'sha256_mismatch');
+            throw new common_1.ServiceUnavailableException(MSG_UNAVAILABLE);
+        }
+        const sizeBytes = Number(f.sizeBytes);
+        // Fail closed: no bytes leave without their read event (a sink error propagates).
+        await this.audit.record(this.event(actor, 'read', row, { sha256: sha, sizeBytes, outcome: 'success' }));
+        return {
+            bytes,
+            contentType: this.servableType(f.contentType),
+            originalName: String(f.originalName),
+            sizeBytes,
+        };
+    }
+    /**
+     * Hard delete (team default): the record in a transaction (gated and audited by the pipe), the
+     * object after commit, then one `file_access` delete event (SPEC §5 K). A foreign key is never
+     * passed to the store.
+     */
+    async remove(uuid) {
+        const store = this.requireStore();
+        const actor = this.records.requestPrincipal();
+        const id = (0, engine_1.canonicalUuid)(uuid);
+        let row;
+        let key;
+        try {
+            if (id === null)
+                throw new common_1.ForbiddenException(MSG_FORBIDDEN);
+            ({ row, key } = await this.records.transaction(async (tx) => {
+                const found = await tx.get(TYPE_KEY, id);
+                if (found === null)
+                    throw new common_1.ForbiddenException(MSG_FORBIDDEN);
+                await tx.delete(TYPE_KEY, id);
+                const k = found.fields.storageKey;
+                return { row: found, key: keyBelongsTo(k, found.fields.tenantId) ? k : null };
+            }));
+        }
+        catch (cause) {
+            if (isDenial(cause))
+                await this.auditDenied(actor, 'delete', id);
+            throw cause;
+        }
+        let objectDeleted = false;
+        if (key === null) {
+            this.logger.error(`stored_file ${String(row.id)} key outside its tenant prefix; object not deleted`);
+        }
+        else {
+            objectDeleted = await this.deleteObject(store, key, 'post-commit');
+        }
+        try {
+            await this.audit.record(this.event(actor, 'delete', row, { objectDeleted, outcome: 'success' }));
+        }
+        catch (cause) {
+            // The record delete is committed and audited by the pipe (`admin_action`); a failed
+            // file_access row must not invite a retry that now answers 403.
+            this.logger.error(`file_access delete audit failed (${errorName(cause)})`);
+        }
+    }
+    requireStore() {
+        if (this.objectStore === null || this.objectStore === undefined) {
+            throw new common_1.NotImplementedException(MSG_NOT_CONFIGURED);
+        }
+        return this.objectStore;
+    }
+    /**
+     * Delete an object; true when the store confirmed it. On failure log the key only, count the
+     * orphan and answer false. Never throws.
+     */
+    async deleteObject(store, key, phase) {
+        try {
+            await store.delete(key);
+            return true;
+        }
+        catch (cause) {
+            this.orphans += 1;
+            this.logger.error(`orphaned object after ${phase} delete failed (${errorName(cause)}): ${key}`);
+            return false;
+        }
+    }
+    /**
+     * A `file_access` failure event for a 403 (missing, foreign, malformed or engine-denied: one
+     * reason, since the caller may not learn which). Best effort; the 403 is thrown regardless.
+     */
+    async auditDenied(actor, action, id) {
+        try {
+            await this.audit.record(this.event(actor, action, id, { outcome: 'failure', reason: 'denied_or_missing' }));
+        }
+        catch (cause) {
+            this.logger.error(`file_access denial audit failed (${errorName(cause)})`);
+        }
+    }
+    /** A `file_access` failure event (best effort; the 503 is thrown regardless). */
+    async auditFailure(row, actor, reason) {
+        try {
+            await this.audit.record(this.event(actor, 'read', row, { outcome: 'failure', reason }));
+        }
+        catch (cause) {
+            this.logger.error(`file_access failure audit failed (${errorName(cause)})`);
+        }
+    }
+    /** `target` is the fetched row, or for a denial only the requested uuid (null if malformed). */
+    event(actor, action, target, attributes) {
+        const row = typeof target === 'string' || target === null ? null : target;
+        const recordId = row !== null ? String(row.id) : target;
+        const recordTenant = row !== null ? (0, engine_1.canonicalUuid)(row.fields.tenantId) : null;
+        return {
+            type: 'file_access',
+            occurredAtMs: Date.now(),
+            actorId: actor.id,
+            tenantId: actor.tenantId,
+            action: { key: action },
+            resource: {
+                level: 'record',
+                typeKey: TYPE_KEY,
+                ...(recordId !== null ? { recordId } : {}),
+                ...(recordTenant !== null ? { tenantId: recordTenant } : {}),
+            },
+            attributes,
+        };
+    }
+};
+exports.FilesService = FilesService;
+exports.FilesService = FilesService = FilesService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Function, Object, Object, Array])
+], FilesService);
+/** A 403-class outcome: our own missing/foreign/malformed refusal or an engine gate deny. */
+function isDenial(cause) {
+    return cause instanceof common_1.ForbiddenException || cause instanceof engine_1.AuthorizationDeniedError;
+}
+function errorName(cause) {
+    return cause instanceof Error ? cause.name : 'error';
+}

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAYL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA+FxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAiBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CAoevB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAcL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAiGxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAoBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CAigBvB"}

package/dist/features/identity-feature.module.js

@@ -56,6 +56,8 @@ const audit_controller_js_1 = require("./audit/audit.controller.js");
 const cross_tenant_grant_read_service_js_1 = require("./cross-tenant/cross-tenant-grant-read.service.js");
 const cross_tenant_grant_controller_js_1 = require("./cross-tenant/cross-tenant-grant.controller.js");
 const grant_authorize_js_1 = require("./cross-tenant/grant-authorize.js");
+const files_service_js_1 = require("./files/files.service.js");
+const files_controller_js_1 = require("./files/files.controller.js");
 /** DI token of the provider that links the guard's Redis version cache to the bumper (ADR-0035). */
 const IDENTITY_VERSION_PUBLISHER_LINK = Symbol('IDENTITY_VERSION_PUBLISHER_LINK');
 /** DI token of the boot check that warns when a user disable cannot revoke sessions. */
@@ -92,6 +94,7 @@ function assertRequestPathUsesIdentityAuthorization(authority) {
 /** Map guard's env DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). */
 function engineDbFromEnv() {
     const db = (0, guard_1.loadDbConfig)();
+    const ssl = (0, guard_1.mariadbSslOption)(db.tls);
     return {
         host: db.host,
         port: db.port,
@@ -101,6 +104,8 @@ function engineDbFromEnv() {
         // The engine's runtime CRUD pool cap. A conservative default; the app can raise it later via
         // an explicit EngineModule.forRoot if it needs more. (ADR-0018 budget lives app-side.)
         connectionLimit: Number(process.env.APP_DB_MAX_CONNECTIONS ?? 10),
+        // Phase 16: APP_DB_TLS / APP_DB_TLS_CA (production accounts are REQUIRE SSL).
+        ...(ssl ? { ssl } : {}),
     };
 }
 /**
@@ -152,10 +157,6 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             // A role delete (Phase 8 #2): its holder tenants, read before the delete cascades postings.
             tenantsForRole: (roleUuid) => bumper.tenantsForRole(roleUuid, authzPool),
         };
-        // The core ModuleRegistry the catalog reconcile job needs, built from the identity
-        // object registrations only (guard's bridge reflects decorated classes → registry): it
-        // catalogs the identity permissions. Authorities use the shared `recordAuthorization.registry`.
-        const identityRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects]);
         // The grant-admin collaborators built at forRoot() over the shared pool (mirrors the
         // postingVersionBump closure pattern above). GrantCeiling (ADR-0029) enforces the
         // self-escalation ceiling: a non-root grantor may only grant a key they themselves hold —
@@ -269,7 +270,15 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // The read side (inbox/mine/incoming/offerable-types) over the same pool + the merged object
         // set (offerable = tenantScoped types only, the consumer's included, KI #57) + the per-type
         // action vocabulary.
-        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], guard_1.actionsFor);
+        // The ONE registration-based action lookup (ADR-0038): typeKey → the type's declared
+        // vocabulary (`effectiveActions`, validated) over identity + the consumer's extraObjects.
+        // `undefined` for an unregistered type. Shared by every action-vocabulary consumer here.
+        const actionsByTypeKey = new Map([...objects_js_1.identityObjects, ...extraObjects].map((input) => {
+            const reg = typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
+            return [reg.typeKey, (0, engine_1.effectiveActions)(reg)];
+        }));
+        const actionsByType = (typeKey) => actionsByTypeKey.get(typeKey);
+        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], (typeKey) => actionsByType(typeKey) ?? []);
         // ── GUIDED RULE-BUILDER (list-scoping engine Phase 5, §9.1) ──────────────────────────────
         // The policy-authoring surface over the guard `MariaDbPolicyStore` + core `makeAuthorPolicy`.
         // Reuses the SAME shared registry + `crossTenantAuthority` (a DecisionAuthority over the
@@ -301,7 +310,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             return {
                 typeKey: reg.typeKey,
                 label: reg.typeKey,
-                actions: (0, guard_1.actionsFor)(reg.typeKey),
+                actions: actionsByType(reg.typeKey) ?? [],
                 fields: reg.fields.map((f) => ({ key: f.key, type: f.type })),
             };
         });
@@ -370,7 +379,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 },
             },
         });
-        const shareService = new share_service_js_1.ShareService(recordShareWriter, auditLabels);
+        const shareService = new share_service_js_1.ShareService(recordShareWriter, auditLabels, actionsByType);
         // ── SERVICE ACCOUNTS + API KEYS (ADR-0033, Phase 2) ──────────────────────────────────────
         // The machine-identity admin surface: create/scope service accounts + issue/rotate/revoke
         // their `ask_…` API keys. Self-wired here over the SAME shared authzPool (which reaches BOTH
@@ -415,6 +424,13 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // boundary made an identity-provided authenticator resolve to `undefined` → `ask_…` bearers
         // 401'd). This module owns only the ACCOUNT ADMIN surface (store + service + controller); the
         // guard owns authentication. (ADR-0033.)
+        // Stored files (file-storage SPEC §5 I-K): `file_access` events go to the SAME shield_audit
+        // sink over the shared authzPool. Not best-effort here: FilesService decides (a read event
+        // that cannot be written withholds the bytes).
+        const filesAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const filesAudit = {
+            record: (event) => filesAuditSink.record(event, (sql, params) => authzPool.query(sql, params)),
+        };
         return {
             module: IdentityFeatureModule_1,
             imports: [
@@ -466,6 +482,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Service accounts (ADR-0033) — `service-accounts/*` collides with nothing; its static
                 // sub-paths (/keys, /keys/rotate, /keys/revoke) sit under `:id` and are method-distinct.
                 service_account_controller_js_1.ServiceAccountController,
+                // Stored-file download (file-storage SPEC §3) — `files/:uuid` collides with nothing.
+                // Gated on `stored_file:read`; answers 501 when no object store is bound. Appended last.
+                files_controller_js_1.FilesController,
             ],
             providers: [
                 company_service_js_1.CompanyService,
@@ -538,10 +557,12 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // enforcement guard can authenticate `ask_…` bearers out-of-the-box. Both useValue.
                 { provide: service_account_service_js_1.ServiceAccountService, useValue: serviceAccountService },
                 // The mutating half of auto-catalog: a single CatalogReconcileJob (post-boot pass +
-                // cron), over the shared pool + the identity registry.
+                // cron), over the shared pool + the ONE record-authorization registry (identity objects +
+                // `extraObjects`, KI #70): the catalog holds exactly the keys decide() and the grant
+                // ceiling know, so a consumer type's keys are grantable and its rows are not orphaned.
                 {
                     provide: catalog_reconcile_job_js_1.CatalogReconcileJob,
-                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, identityRegistry),
+                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, recordAuthorization.registry),
                 },
                 // The bundle half: reconciles the merged AccessBundleSpec[] (ENGINE_ALL_ACCESS_BUNDLES,
                 // reflected by the engine from identityAccessBundles) into shield_authz.access_bundle.
@@ -557,10 +578,18 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Boot: read-only verifyGatable (fail-closed). Post-boot: kicks the jobs once (catalog
                 // THEN bundles, THEN the scope-closure reconcile) + schedules them (DISABLE_ALL_CRONS-
                 // gated). Injects DiscoveryService/MetadataScanner/Reflector (from DiscoveryModule
-                // above), the jobs, the ScopeClosureService, and ENGINE_ALL_REGISTRATIONS.
+                // above), the jobs, the ScopeClosureService, ENGINE_ALL_REGISTRATIONS and the record
+                // authorization (whose registry is the verify key universe, KI #70).
                 catalog_bootstrap_provider_js_1.CatalogBootstrapProvider,
+                // Stored files (file-storage Phase 5): the request-principal RecordsService + the guard's
+                // object store (`null`/absent ⇒ every method answers 501) + the file_access audit bridge.
+                {
+                    provide: files_service_js_1.FilesService,
+                    useFactory: (records, store) => new files_service_js_1.FilesService(records, store ?? null, filesAudit),
+                    inject: [engine_1.RecordsService, { token: guard_1.SHIELD_OBJECT_STORE, optional: true }],
+                },
             ],
-            exports: [company_service_js_1.CompanyService, role_service_js_1.RoleService, user_service_js_1.UserService],
+            exports: [company_service_js_1.CompanyService, role_service_js_1.RoleService, user_service_js_1.UserService, files_service_js_1.FilesService],
         };
     }
 };

package/dist/features/policy/policy.service.d.ts

@@ -91,7 +91,8 @@ export interface PolicyServiceDeps {
     /**
      * The authorable-type field/action metadata (built in the module from the reflected object
      * types). Drives `schema()` — the guided builder's field + operator dropdowns. A type absent
-     * here is NOT authorable via the builder (schema → NotFound).
+     * here is NOT authorable via the builder (schema → NotFound), and `author` rejects any non-`'*'`
+     * action for it (declared-action check, fail closed — SPEC v2 §5G).
      */
     readonly schemaSource?: readonly TypeSchemaSource[];
     readonly now?: () => number;

package/dist/features/policy/policy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.service.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,MAAM,EACN,SAAS,EACV,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,wFAAwF;AACxF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAA2B;CAI/C;AAED,kGAAkG;AAClG,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAoC;CAIxD;AAED,mGAAmG;AACnG,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAsB;CAI1C;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5E,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E;AAED,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;AAE5F,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,wFAAwF;IACxF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC1D;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC/C;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,IAAI,GACJ,KAAK,GACL,KAAK,GACL,UAAU,GACV,cAAc,GACd,SAAS,GACT,aAAa,CAAC;AAElB,+FAA+F;AAC/F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;CACtC;AAUD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,kBAAkB,EAAE,CAgB7F;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,GAAG,eAAe,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsC;IACnE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;gBAEzD,IAAI,EAAE,iBAAiB;IAanC;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB;IAmBzC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBrE,+FAA+F;IACzF,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIzE;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhE"}
+{"version":3,"file":"policy.service.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,MAAM,EACN,SAAS,EACV,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,wFAAwF;AACxF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAA2B;CAI/C;AAED,kGAAkG;AAClG,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAoC;CAIxD;AAED,mGAAmG;AACnG,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAsB;CAI1C;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5E,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E;AAED,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;AAE5F,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,wFAAwF;IACxF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC1D;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC/C;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,IAAI,GACJ,KAAK,GACL,KAAK,GACL,UAAU,GACV,cAAc,GACd,SAAS,GACT,aAAa,CAAC;AAElB,+FAA+F;AAC/F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;CACtC;AAUD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,kBAAkB,EAAE,CAgB7F;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,GAAG,eAAe,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsC;IACnE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;gBAEzD,IAAI,EAAE,iBAAiB;IAanC;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB;IAmBzC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAqCrE,+FAA+F;IACzF,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIzE;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhE"}

package/dist/features/policy/policy.service.js

@@ -106,6 +106,21 @@ class PolicyService {
      * reasons to typed errors; a transient throw PROPAGATES (→ 503).
      */
     async author(actor, policy) {
+        // Declared-action check (SPEC v2 §5G): before core `makeAuthorPolicy`, so an undeclared
+        // action saves nothing and audits nothing. `'*'` stays allowed. Fail closed: with no schema
+        // source (or no entry for the type) every non-'*' action is undeclared.
+        // SPEC v3 §11 rule 6: a record rule on `create` is rejected even when `create` is declared.
+        // Record rules are evaluated per record (core gate 6) and the create gate is type level, so
+        // such a rule would never take effect. `'*'` stays allowed (it applies to the other actions).
+        if (policy.action === 'create') {
+            throw new InvalidPolicyError("Record rules are evaluated per record and never apply at create; a rule on action 'create' would never take effect. Use the object-type create grant instead.");
+        }
+        if (policy.action !== '*') {
+            const declared = this.schemaByType.get(policy.typeKey)?.actions;
+            if (declared === undefined || !declared.includes(policy.action)) {
+                throw new InvalidPolicyError(`Action '${policy.action}' is not declared on type '${policy.typeKey}'.`);
+            }
+        }
         const mutation = {
             kind: 'author_policy',
             admin: actor,

package/dist/features/share/share.service.d.ts

@@ -69,17 +69,34 @@ export interface ShareRequest {
     readonly granteeUuid: string;
     readonly action: string;
 }
+/** typeKey → the type's declared action vocabulary (`effectiveActions`); `undefined` = unknown type. */
+export type ActionsByType = (typeKey: string) => readonly string[] | undefined;
 export declare class ShareService {
     private readonly writer;
     private readonly labels;
-    constructor(writer: RecordShareWriter | ShareWriterLike, labels: ShareLabelResolver);
+    private readonly actionsByType;
+    /**
+     * @param actionsByType the registration-based action lookup built in `forRoot` (SPEC v2 §5G).
+     *   Required: share rejects an unknown type or an action the type does not declare (`'*'`
+     *   stays allowed) with 400 BEFORE the writer is called; unshare rejects only an unknown type
+     *   (SPEC v3 §5G: revoking cannot grant).
+     */
+    constructor(writer: RecordShareWriter | ShareWriterLike, labels: ShareLabelResolver, actionsByType: ActionsByType);
+    /** 400 on an unknown type; returns the type's declared actions (§5G, §13). */
+    private assertKnownType;
+    /** 400 on an unknown type or an undeclared action — runs before any writer call (§5G). */
+    private assertDeclaredAction;
     /**
      * Share a record the caller owns with a user/role for an action. The tenant + sharer are the
      * caller's own (from `actor`), NEVER the body — a forged owner/tenant cannot reach the writer.
      * The writer proves `actor.id` owns the record before writing (fail-closed).
      */
     share(actor: Principal, req: ShareRequest): Promise<void>;
-    /** Revoke a share the caller owns. Same owner bound (only the owner may unshare). */
+    /**
+     * Revoke a share the caller owns. Same owner bound (only the owner may unshare).
+     * SPEC v3 §5G: NO declared-action check — revoking cannot grant, so a share for an action the
+     * type has since stopped declaring stays revocable. An unknown type still gets 400 (§13).
+     */
     unshare(actor: Principal, req: ShareRequest): Promise<void>;
     /**
      * List the shares on a record the caller owns — grantee NAMES resolved (no raw uuid). Only the

package/dist/features/share/share.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB;IAG7C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,qFAAqF;IAC/E,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}
+{"version":3,"file":"share.service.d.ts","sourceRoot":"","sources":["../../../src/features/share/share.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGzE,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrF;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,mBAAmB,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH,CAAC;CACH;AAED,oFAAoF;AACpF,MAAM,WAAW,SAAS;IACxB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wGAAwG;AACxG,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;AAE/E,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAThC;;;;;OAKG;gBAEgB,MAAM,EAAE,iBAAiB,GAAG,eAAe,EAC3C,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,aAAa;IAG/C,8EAA8E;IAC9E,OAAO,CAAC,eAAe;IAYvB,0FAA0F;IAC1F,OAAO,CAAC,oBAAoB;IAS5B;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/D;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAajE;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;CAoBjC"}

package/dist/features/share/share.service.js

@@ -1,12 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ShareService = void 0;
+const identity_errors_js_1 = require("../shared/identity-errors.js");
 class ShareService {
     writer;
     labels;
-    constructor(writer, labels) {
+    actionsByType;
+    /**
+     * @param actionsByType the registration-based action lookup built in `forRoot` (SPEC v2 §5G).
+     *   Required: share rejects an unknown type or an action the type does not declare (`'*'`
+     *   stays allowed) with 400 BEFORE the writer is called; unshare rejects only an unknown type
+     *   (SPEC v3 §5G: revoking cannot grant).
+     */
+    constructor(writer, labels, actionsByType) {
         this.writer = writer;
         this.labels = labels;
+        this.actionsByType = actionsByType;
+    }
+    /** 400 on an unknown type; returns the type's declared actions (§5G, §13). */
+    assertKnownType(req) {
+        // Fail closed: a missing lookup (an untyped JS caller) rejects rather than skipping the check.
+        if (typeof this.actionsByType !== 'function') {
+            throw new identity_errors_js_1.IdentityBadRequestError(`Type '${req.typeKey}' is not registered.`);
+        }
+        const declared = this.actionsByType(req.typeKey);
+        if (declared === undefined) {
+            throw new identity_errors_js_1.IdentityBadRequestError(`Type '${req.typeKey}' is not registered.`);
+        }
+        return declared;
+    }
+    /** 400 on an unknown type or an undeclared action — runs before any writer call (§5G). */
+    assertDeclaredAction(req) {
+        const declared = this.assertKnownType(req);
+        if (req.action !== '*' && !declared.includes(req.action)) {
+            throw new identity_errors_js_1.IdentityBadRequestError(`Action '${req.action}' is not declared on type '${req.typeKey}'.`);
+        }
     }
     /**
      * Share a record the caller owns with a user/role for an action. The tenant + sharer are the
@@ -14,6 +42,7 @@ class ShareService {
      * The writer proves `actor.id` owns the record before writing (fail-closed).
      */
     async share(actor, req) {
+        this.assertDeclaredAction(req);
         await this.writer.share({
             tenantId: actor.tenantId, // SERVER-resolved
             typeKey: req.typeKey,
@@ -24,8 +53,13 @@ class ShareService {
             sharerId: actor.id, // SERVER-resolved — the writer verifies ownership
         });
     }
-    /** Revoke a share the caller owns. Same owner bound (only the owner may unshare). */
+    /**
+     * Revoke a share the caller owns. Same owner bound (only the owner may unshare).
+     * SPEC v3 §5G: NO declared-action check — revoking cannot grant, so a share for an action the
+     * type has since stopped declaring stays revocable. An unknown type still gets 400 (§13).
+     */
     async unshare(actor, req) {
+        this.assertKnownType(req);
         await this.writer.unshare({
             tenantId: actor.tenantId,
             typeKey: req.typeKey,

package/dist/index.d.ts

@@ -14,6 +14,7 @@ export { MembershipPosting } from './membership-posting.object.js';
 export { CompanyDepartment } from './company-department.object.js';
 export { CompanyBranch } from './company-branch.object.js';
 export { ServiceAccount } from './service-account.object.js';
+export { StoredFile } from './stored-file.object.js';
 export { identityMigrationsDir } from './migrations-dir.js';
 /**
  * All identity objects, registered with the engine at boot (same set + order as before).
@@ -29,6 +30,9 @@ export { identityObjects } from './objects.js';
  * control-plane keys WITHOUT guard importing this package.
  */
 export { identityAuthActionKeys, identityControlPlaneKeys } from './auth-facts-keys.js';
+/** KI #70: the same key universe with the consumer's `extraObjects` (pass the SAME list to
+ *  `IdentityFeatureModule.forRoot({ extraObjects })`). */
+export { buildIdentityAuthKeys, type IdentityAuthKeys } from './auth-facts-keys.js';
 /**
  * The framework-owned identity FEATURE module (company/user/role CRUD). The consumer imports
  * `IdentityFeatureModule.forRoot()` in one line alongside `ShieldModule.forRoot(...)` (ADR-0026);
@@ -36,6 +40,11 @@ export { identityAuthActionKeys, identityControlPlaneKeys } from './auth-facts-k
  * `identityObjects`, and mounts the CRUD controllers — no separate engine setup needed.
  */
 export { IdentityFeatureModule } from './features/identity-feature.module.js';
+/**
+ * Stored files (file-storage SPEC §5 I-K): `store` / `open` / `remove` on the engine pipe, provided
+ * and exported by `IdentityFeatureModule`. Apps call it from their own `@Classified` routes.
+ */
+export { FilesService, type StoreFileInput, type StoredFileSummary, type OpenedFile, } from './features/files/files.service.js';
 /**
  * The ADR-0011 per-request session-facts reader (ALS hot path), re-exported so a consumer
  * that wants to construct it directly can do so.