feat(access): let any member list their own grants (me access mine) (TNT-141)

[jgpruitt]

Summary

me access ls enumerates the whole space's grants and is therefore admin/owner-only. There was no way for a non-admin member to see the grants they hold. This adds me access mine — a self-view of the calling principal's own grants, usable by any member — mirroring the existing me group mine.

Closes TNT-141.

Changes

• server (packages/server/rpc/memory/grant.ts): grantList gains an ownSelf self-service branch — a caller may list grants where principalId === ctx.principalId without admin/owner rights. The principalId pins the SQL filter, so it can never reveal another principal's grants. No protocol/client/engine/SQL changes — grant.list and list_tree_access_grants already filter by principal.
• cli (packages/cli/commands/access.ts): createAccessMineCommand() mirrors me group mine — whoami → grant.list({ principalId: me.id }) → prints a tree_path | access table (principal omitted since it's always you), with an empty-state message. me access ls is unchanged (stays admin/owner-scoped, matching me group ls).
• tests (management.integration.test.ts): a non-admin member can list their own grants but is FORBIDDEN for another principal or the whole space; an agent owner can list its agent's grants while a stranger cannot.
• docs: docs/cli/me-access.md (new section + scoping note) and docs/typescript-client.md.

Design note

Picked ticket option 2 (dedicated me access mine) over making ls adaptive, to mirror me group mine (which is a separate command; me group ls has no self-view fallback). The server relaxation is the mechanism both options would share.

Verification

./bun run check:full — 0 failures (647 unit / 938 db / 26 e2e).

[Copilot]

Pull request overview

Adds a self-service way for non-admin space members to inspect their own tree-access grants, aligning access tooling with the existing “self-view” patterns (e.g. me group mine) while keeping whole-space grant enumeration restricted.

Changes:

• Server: relaxes grant.list authorization to allow listing grants for principalId === caller (and continues to allow listing grants for an owned agent) without admin/path-owner.
• CLI: introduces me access mine, which calls whoami then lists grants for the caller and prints a simplified table.
• Tests/docs: adds integration coverage for the new authorization behavior and documents the new command and scoping rules.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/server/rpc/memory/grant.ts	Adds a self-service authorization branch for listing the caller’s own grants.
packages/cli/commands/access.ts	Adds me access mine command to list and display the caller’s grants.
packages/server/rpc/memory/management.integration.test.ts	Adds integration tests covering self-service grant listing and permission denials.
docs/cli/me-access.md	Documents the new me access mine command and clarifies list scoping.
docs/typescript-client.md	Notes self-service behavior when grant.list is scoped to caller/owned agent.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.