@astram/guard 0.1.1 → 0.3.0

package/dist/authz/wire-record-authorization.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `buildRecordAuthorization` — the ONE place the four framework-owned record-tier
+ * guard adapters are constructed and handed to core's `createWiredDecisionAuthority`
+ * (design §9, Phase 5 — "the framework pre-wires").
+ *
+ * ── WHY THIS FILE EXISTS (the record-tier ownership invariant, ADR-0003 / the
+ *    "framework-owns-the-data-layer" initiative): before Phase 5, the CONSUMER app
+ *    hand-constructed `MariaDbRecordPermissionRuleAdapter` / `MariaDbRecordShareAdapter`
+ *    / `MariaDbCrossTenantGrantAdapter` / `ManifestOperationAuthorityAdapter` and called
+ *    core's `createWiredDecisionAuthority` itself. That meant the app COULD swap in a
+ *    fail-OPEN record adapter — the exact hole the initiative closes. Phase 5 moves that
+ *    construction HERE, inside the framework: the app supplies ONLY the DB pool + the two
+ *    app-owned ports (`permissionFacts`, `sessionFacts`) + the module registry + the
+ *    operation-manifest DATA. The four record-tier read adapters are framework-built and
+ *    UN-overridable — a planted fail-open adapter is now impossible.
+ *
+ * ── WHY IT IS NOT STATICALLY IMPORTED BY shield.module.ts (the enforcement-only
+ *    invariant): this file value-imports `@astram/core` (`createWiredDecisionAuthority`)
+ *    and the adapter classes (which themselves value-import core). `shield.module.ts` is
+ *    deliberately kept core-free in its OWN compiled output (see its header) so the
+ *    enforcement-only path is provably free of a top-level `require('@astram/core')`.
+ *    So `shield.module.ts` reaches `buildRecordAuthorization` ONLY through a LAZY dynamic
+ *    import inside the `SHIELD_DECISION_AUTHORITY` async factory — which runs ONLY when a
+ *    consumer opts into `recordAuthorization`. This file (and thus core) loads only then.
+ */
+import type { DecisionAuthority, ModuleRegistry, PermissionFactsPort, SessionFactsReader } from '@astram/core';
+import { type RuleQueryable } from './mariadb-record-rule-adapter.js';
+import { type OperationManifestEntry } from './manifest-operation-authority-adapter.js';
+/**
+ * The pieces a consumer supplies for the framework to build the real record-tier
+ * DecisionAuthority. The app owns ONLY these — the pool, the two app-owned ports, the
+ * module registry, and the operation-manifest DATA. The four record-tier read adapters
+ * are framework-constructed from `pool` and are DELIBERATELY NOT part of this shape
+ * (they cannot be overridden — the Phase-5 acceptance criterion).
+ */
+export interface RecordAuthorizationInputs {
+    /**
+     * The MariaDB pool the three DB-backed record-tier adapters read through. Typed
+     * structurally (`RuleQueryable`: `{ query(sql, params?) }`) — a `mariadb` `Pool`
+     * satisfies it — so the guard module signature does not force a hard `mariadb` type
+     * on consumers that inject a custom queryable. The framework builds the adapters over
+     * THIS pool; the app never constructs them.
+     */
+    readonly pool: RuleQueryable;
+    /** APP-OWNED port: the principal's coarse grants for the object-type gate (gate 5). */
+    readonly permissionFacts: PermissionFactsPort;
+    /** APP-OWNED port: per-request cached session facts (null-slot until the Redis hot path). */
+    readonly sessionFacts: SessionFactsReader;
+    /** APP-OWNED: the module registry (object types + actions + tiers), bridged from the app's registrations. */
+    readonly registry: ModuleRegistry;
+    /**
+     * APP-SUPPLIED DATA (not an adapter): the declared trusted-operation manifest entries.
+     * The framework constructs the `ManifestOperationAuthorityAdapter` over them. Empty
+     * (default) ⇒ every delegation lookup is pass-through (undefined). The app supplies the
+     * ENTRIES; the framework owns the ADAPTER.
+     */
+    readonly operationManifest?: readonly OperationManifestEntry[];
+}
+/**
+ * Construct the four framework-owned record-tier adapters over the supplied pool +
+ * manifest, and return the fully-wired core {@link DecisionAuthority}. Behavior-identical
+ * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
+ * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
+ */
+export declare function buildRecordAuthorization(inputs: RecordAuthorizationInputs): DecisionAuthority;
+//# sourceMappingURL=wire-record-authorization.d.ts.map

package/dist/authz/wire-record-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,yBAAyB,GAAG,iBAAiB,CAmB7F"}

package/dist/authz/wire-record-authorization.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRecordAuthorization = buildRecordAuthorization;
+const core_1 = require("@astram/core");
+const mariadb_record_rule_adapter_js_1 = require("./mariadb-record-rule-adapter.js");
+const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapter.js");
+const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
+const manifest_operation_authority_adapter_js_1 = require("./manifest-operation-authority-adapter.js");
+/**
+ * Construct the four framework-owned record-tier adapters over the supplied pool +
+ * manifest, and return the fully-wired core {@link DecisionAuthority}. Behavior-identical
+ * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
+ * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
+ */
+function buildRecordAuthorization(inputs) {
+    return (0, core_1.createWiredDecisionAuthority)({
+        registry: inputs.registry,
+        permissionFacts: inputs.permissionFacts,
+        sessionFacts: inputs.sessionFacts,
+        // ── The FOUR framework-owned record-tier adapters — constructed HERE, and ONLY here.
+        // Record-permit ADMIN rules over `shield_authz.record_permission_rule` (widen the
+        // core-owned owner baseline, deny-wins). Empty table ⇒ owner-only (NOT a lockout).
+        recordRule: new mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter(inputs.pool),
+        // Per-record SHARE source over `shield_authz.record_share` (widening permit, union
+        // with baseline under deny-wins). No share ⇒ false (baseline still governs).
+        recordShare: new mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter(inputs.pool),
+        // Cross-tenant consented grants over `shield_authz.cross_tenant_grant`. No active
+        // grant ⇒ null (deny-by-default for the cross-tenant reach).
+        crossTenantGrant: new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool),
+        // Delegation / trusted-operation authority over the DECLARED manifest (no DB).
+        // Empty ⇒ pass-through. The app supplies the entries; the framework owns the adapter.
+        operationAuthority: new manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter(inputs.operationManifest ?? []),
+    });
+}

package/dist/authz/wire-record-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-record-authorization.js","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":";;AAgFA,4DAmBC;AApED,uCAA4D;AAC5D,qFAG0C;AAC1C,uFAA8E;AAC9E,mGAAyF;AACzF,uGAGmD;AAiCnD;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,MAAiC;IACxE,OAAO,IAAA,mCAA4B,EAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,sFAAsF;QACtF,kFAAkF;QAClF,mFAAmF;QACnF,UAAU,EAAE,IAAI,mEAAkC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC/D,mFAAmF;QACnF,6EAA6E;QAC7E,WAAW,EAAE,IAAI,2DAAyB,CAAC,MAAM,CAAC,IAAI,CAAC;QACvD,kFAAkF;QAClF,6DAA6D;QAC7D,gBAAgB,EAAE,IAAI,sEAA8B,CAAC,MAAM,CAAC,IAAI,CAAC;QACjE,+EAA+E;QAC/E,sFAAsF;QACtF,kBAAkB,EAAE,IAAI,2EAAiC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC"}

package/dist/boot/boot-sequence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-sequence.js","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAoDA,4CAuBC;AA3ED,2CAAiF;AACjF,iEAAwD;AACxD,2DAAoG;AAEpG;;;;;;;;;;;;;;GAcG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IAC0B;IAAjD,YAAiD,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAAG,CAAC;IAEtE,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACvC,8DAA8D;IAChE,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,yBAAyB;QACrC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAtBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,6BAAU,CAAC,CAAA;;GADpB,YAAY,CAsBxB;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,GAAqB;IACpD,MAAM,CAAC,GAAG,IAAA,kCAAkB,EAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,iCAAiC,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI;YACxE,uEAAuE;YACvE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,eAAe,CAAC,CAAC,mBAAmB,0BAA0B;YAC9D,GAAG,GAAG,CAAC,cAAc,sBAAsB,GAAG,CAAC,OAAO,MAAM;YAC5D,2BAA2B,CAAC,CAAC,oBAAoB,eAAe;YAChE,GAAG,GAAG,CAAC,QAAQ,OAAO,CAAC,CAAC,mBAAmB,MAAM,GAAG,CAAC,cAAc,IAAI;YACvE,4DAA4D;YAC5D,6DAA6D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/boot/boot.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.module.js","sourceRoot":"","sources":["../../src/boot/boot.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,yDAAkD;AAElD;;;;GAIG;AAII,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IAHtB,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,+BAAY,CAAC;KAC1B,CAAC;GACW,UAAU,CAAG"}

package/dist/completeness/catalog-reconciler.d.ts

@@ -0,0 +1,21 @@
+import type { OperationInventory, ModuleRegistry } from '@astram/core';
+import type { CatalogStore, ReconcileReport } from './ports/catalog-store.js';
+/** A @Classified route could not be gated (stranded or key-not-registered). Boot must
+ *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
+export declare class CatalogGatabilityError extends Error {
+    constructor(message: string);
+}
+export declare class CatalogReconciler {
+    /**
+     * BOOT — read-only, fail-closed. Throws if any non-public route is stranded (no key)
+     * or unclassified (declares a key the registry doesn't know). No DB, no writes.
+     */
+    verifyGatable(inventory: OperationInventory, registry: ModuleRegistry): void;
+    /**
+     * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
+     * marks orphaned any stored row with no registered action, reactivates revived ones.
+     * Idempotent. Returns a report for logging + /health/catalog.
+     */
+    reconcile(registry: ModuleRegistry, store: CatalogStore, nowIso: string): Promise<ReconcileReport>;
+}
+//# sourceMappingURL=catalog-reconciler.d.ts.map

package/dist/completeness/catalog-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-reconciler.d.ts","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E;iFACiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAgB5E;;;;OAIG;IACG,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAoCzG"}

package/dist/completeness/catalog-reconciler.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CatalogReconciler = exports.CatalogGatabilityError = void 0;
+// astram-framework/packages/guard/src/completeness/catalog-reconciler.ts
+const core_1 = require("@astram/core");
+/** A @Classified route could not be gated (stranded or key-not-registered). Boot must
+ *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
+class CatalogGatabilityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CatalogGatabilityError';
+    }
+}
+exports.CatalogGatabilityError = CatalogGatabilityError;
+class CatalogReconciler {
+    /**
+     * BOOT — read-only, fail-closed. Throws if any non-public route is stranded (no key)
+     * or unclassified (declares a key the registry doesn't know). No DB, no writes.
+     */
+    verifyGatable(inventory, registry) {
+        const result = (0, core_1.checkCompleteness)(inventory, registry);
+        if (result.strandedOperations.length > 0 || result.unclassifiedOperations.length > 0) {
+            const stranded = result.strandedOperations.map((o) => o.operationId);
+            const unclassified = result.unclassifiedOperations.map((o) => `${o.operationId}${o.declaredPermissionKey ? ` (${o.declaredPermissionKey})` : ''}`);
+            throw new CatalogGatabilityError(`Shield: ${stranded.length} stranded + ${unclassified.length} unclassified route(s) — cannot boot. ` +
+                `Stranded (no @Classified): ${stranded.join(', ') || 'none'}. ` +
+                `Unclassified (key not registered): ${unclassified.join(', ') || 'none'}. ` +
+                `Classify the route or register the action.`);
+        }
+    }
+    /**
+     * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
+     * marks orphaned any stored row with no registered action, reactivates revived ones.
+     * Idempotent. Returns a report for logging + /health/catalog.
+     */
+    async reconcile(registry, store, nowIso) {
+        const stored = await store.listPermissions();
+        const storedByKey = new Map(stored.map((r) => [r.permissionKey, r]));
+        const registered = registry.listActions().filter((a) => a.tier !== 'public');
+        const registeredKeys = new Set(registered.map((a) => a.permissionKey));
+        // code → catalog: add missing rows; revive orphaned-but-now-registered.
+        const added = [];
+        const reactivated = [];
+        for (const a of registered) {
+            const key = a.permissionKey;
+            const existing = storedByKey.get(key);
+            if (!existing) {
+                const inserted = await store.upsertPermission({
+                    permissionKey: key,
+                    moduleKey: a.moduleKey,
+                    typeKey: a.action.typeKey,
+                    action: a.action.actionKey,
+                    label: `${a.action.actionKey} ${a.action.typeKey}`,
+                    tier: a.tier,
+                });
+                if (inserted)
+                    added.push(key);
+            }
+            else if (existing.status === 'orphaned') {
+                reactivated.push(key);
+            }
+        }
+        if (reactivated.length)
+            await store.markActive(reactivated);
+        // catalog → code: mark orphaned any active stored row with no registered action.
+        const orphaned = stored
+            .filter((r) => r.status === 'active' && !registeredKeys.has(r.permissionKey))
+            .map((r) => r.permissionKey);
+        if (orphaned.length)
+            await store.markOrphaned(orphaned);
+        return { added, orphaned, reactivated, at: nowIso };
+    }
+}
+exports.CatalogReconciler = CatalogReconciler;

package/dist/completeness/catalog-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-reconciler.js","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":";;;AAAA,yEAAyE;AACzE,uCAAiD;AAIjD;iFACiF;AACjF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,MAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAA6B,EAAE,QAAwB;QACnE,MAAM,MAAM,GAAG,IAAA,wBAAiB,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACrE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3F,CAAC;YACF,MAAM,IAAI,sBAAsB,CAC9B,WAAW,QAAQ,CAAC,MAAM,eAAe,YAAY,CAAC,MAAM,wCAAwC;gBAClG,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;gBAC/D,sCAAsC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;gBAC3E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,QAAwB,EAAE,KAAmB,EAAE,MAAc;QAC3E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAuB,CAAC,CAAC,CAAC;QAEjF,wEAAwE;QACxE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,aAAuB,CAAC;YACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;oBAC5C,aAAa,EAAE,GAAG;oBAClB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;oBACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;oBAC1B,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClD,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE5D,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;aAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;CACF;AA9DD,8CA8DC"}

package/dist/completeness/operation-inventory-scanner.d.ts

@@ -0,0 +1,17 @@
+import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
+import type { OperationInventory } from '@astram/core';
+/**
+ * Reflects every controller handler at boot and emits an OperationInventory for core's
+ * checkCompleteness. operationId = `${ControllerClass.name}#${method}` (core's contract).
+ * A handler's permissionKey is `${moduleKey}:${typeKey}:${action}` from its @Classified;
+ * @Public handlers carry isPublic:true; an unclassified non-public handler carries no
+ * permissionKey (→ core reports it stranded).
+ */
+export declare class OperationInventoryScanner {
+    private readonly discovery;
+    private readonly scanner;
+    private readonly reflector;
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector);
+    scan(moduleKey: string): OperationInventory;
+}
+//# sourceMappingURL=operation-inventory-scanner.d.ts.map

package/dist/completeness/operation-inventory-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-inventory-scanner.d.ts","sourceRoot":"","sources":["../../src/completeness/operation-inventory-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,KAAK,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AAO5E;;;;;;GAMG;AACH,qBACa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS;IAGvC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB;CAyC5C"}

package/dist/completeness/operation-inventory-scanner.js

@@ -0,0 +1,79 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OperationInventoryScanner = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const core_1 = require("@nestjs/core");
+const core_2 = require("@astram/core");
+const classification_decorator_js_1 = require("../enforcement/classification.decorator.js");
+/**
+ * Reflects every controller handler at boot and emits an OperationInventory for core's
+ * checkCompleteness. operationId = `${ControllerClass.name}#${method}` (core's contract).
+ * A handler's permissionKey is `${moduleKey}:${typeKey}:${action}` from its @Classified;
+ * @Public handlers carry isPublic:true; an unclassified non-public handler carries no
+ * permissionKey (→ core reports it stranded).
+ */
+let OperationInventoryScanner = class OperationInventoryScanner {
+    discovery;
+    scanner;
+    reflector;
+    constructor(discovery, scanner, reflector) {
+        this.discovery = discovery;
+        this.scanner = scanner;
+        this.reflector = reflector;
+    }
+    scan(moduleKey) {
+        const operations = [];
+        for (const wrapper of this.discovery.getControllers()) {
+            const { instance, metatype } = wrapper;
+            if (!instance || !metatype)
+                continue;
+            const controllerName = metatype.name;
+            const prototype = Object.getPrototypeOf(instance);
+            for (const method of this.scanner.getAllMethodNames(prototype)) {
+                const handler = prototype[method];
+                // Only real HTTP route handlers carry route metadata (set by @Get/@Post/etc.).
+                // Private/helper methods (e.g. buildQuery()) are emitted by getAllMethodNames but
+                // carry no PATH_METADATA — skipping them prevents core from stranding them and
+                // aborting boot. This matches what the guard actually enforces at runtime, which
+                // only ever runs on mapped handlers via context.getHandler().
+                if (Reflect.getMetadata(constants_1.PATH_METADATA, handler) === undefined)
+                    continue;
+                // Mirror the guard's precedence: method metadata overrides class-level.
+                const isPublic = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.PUBLIC, [
+                    handler,
+                    metatype,
+                ]) === true;
+                const raw = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, metatype]);
+                const classification = (0, classification_decorator_js_1.normalizeClassification)(raw);
+                // Single-source the key format via core's derivePermissionKey (returns the
+                // branded PermissionKey) rather than a hand-built template string.
+                const permissionKey = !isPublic && classification
+                    ? (0, core_2.derivePermissionKey)(moduleKey, classification.typeKey, classification.action)
+                    : undefined;
+                operations.push({
+                    operationId: `${controllerName}#${method}`,
+                    isPublic,
+                    ...(permissionKey ? { permissionKey } : {}),
+                });
+            }
+        }
+        return { operations };
+    }
+};
+exports.OperationInventoryScanner = OperationInventoryScanner;
+exports.OperationInventoryScanner = OperationInventoryScanner = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.MetadataScanner,
+        core_1.Reflector])
+], OperationInventoryScanner);

package/dist/completeness/operation-inventory-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-inventory-scanner.js","sourceRoot":"","sources":["../../src/completeness/operation-inventory-scanner.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,wDAAyD;AACzD,uCAA4E;AAC5E,uCAAmD;AAEnD,4FAIoD;AAEpD;;;;;;GAMG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAEjB;IACA;IACA;IAHnB,YACmB,SAA2B,EAC3B,OAAwB,EACxB,SAAoB;QAFpB,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAiB;QACxB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,IAAI,CAAC,SAAiB;QACpB,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;YACtD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClC,+EAA+E;gBAC/E,kFAAkF;gBAClF,+EAA+E;gBAC/E,iFAAiF;gBACjF,8DAA8D;gBAC9D,IAAI,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,OAAO,CAAC,KAAK,SAAS;oBAAE,SAAS;gBACxE,wEAAwE;gBACxE,MAAM,QAAQ,GACZ,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAuB,CAAC,MAAM,EAAE;oBACxE,OAAO;oBACP,QAAQ;iBACT,CAAC,KAAK,IAAI,CAAC;gBACd,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,qDAAuB,CAAC,UAAU,EAClC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;gBACF,MAAM,cAAc,GAAG,IAAA,qDAAuB,EAAC,GAAG,CAAC,CAAC;gBACpD,2EAA2E;gBAC3E,mEAAmE;gBACnE,MAAM,aAAa,GACjB,CAAC,QAAQ,IAAI,cAAc;oBACzB,CAAC,CAAC,IAAA,0BAAmB,EAAC,SAAS,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;oBAC/E,CAAC,CAAC,SAAS,CAAC;gBAChB,UAAU,CAAC,IAAI,CAAC;oBACd,WAAW,EAAE,GAAG,cAAc,IAAI,MAAM,EAAE;oBAC1C,QAAQ;oBACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;CACF,CAAA;AAhDY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAGmB,uBAAgB;QAClB,sBAAe;QACb,gBAAS;GAJ5B,yBAAyB,CAgDrC"}

package/dist/completeness/ports/catalog-store.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The DB seam for the catalog reconciler. The framework defines the interface only;
+ * the consumer app supplies the implementation (ADR-0003 — guard does no DB). A row is
+ * keyed by its permission key (`moduleKey:typeKey:actionKey`); `status` is the soft
+ * active/orphaned marker (never hard-delete).
+ */
+export interface CatalogPermissionRow {
+    readonly permissionKey: string;
+    readonly moduleKey: string;
+    readonly typeKey: string;
+    readonly action: string;
+    readonly label: string;
+    readonly tier: string;
+    readonly status: 'active' | 'orphaned';
+}
+/** The result of one mutating reconcile pass — surfaced via /health/catalog + logged. */
+export interface ReconcileReport {
+    readonly added: readonly string[];
+    readonly orphaned: readonly string[];
+    readonly reactivated: readonly string[];
+    readonly at: string;
+}
+export interface CatalogStore {
+    /** All catalog rows (both active + orphaned). */
+    listPermissions(): Promise<CatalogPermissionRow[]>;
+    /** Idempotent insert of an ACTIVE row (no-op if the key already exists as active). */
+    upsertPermission(row: Omit<CatalogPermissionRow, 'status'>): Promise<boolean>;
+    /** Mark keys orphaned (soft). No-op for keys already orphaned. */
+    markOrphaned(keys: readonly string[]): Promise<void>;
+    /** Flip keys orphaned → active (a route returned). */
+    markActive(keys: readonly string[]): Promise<void>;
+}
+//# sourceMappingURL=catalog-store.d.ts.map

package/dist/completeness/ports/catalog-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-store.d.ts","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnD,sFAAsF;IACtF,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,sDAAsD;IACtD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/completeness/ports/catalog-store.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/completeness/ports/catalog-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-store.js","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":""}

package/dist/config/app-config.d.ts

@@ -30,6 +30,76 @@ export interface AppConfig {
     readonly environment: 'development' | 'test' | 'production';
     /** ADR-0018 connection-pool budget (validated at boot, fail-closed). */
     readonly pool: PoolBudgetConfig;
+    /**
+     * The runtime MariaDB connection descriptor (the `shield_core` account — DML on
+     * `shield_identity` where the session + credential tables live). Consumed by
+     * the Phase 0b persistence provider that creates the ONE live `mariadb` Pool.
+     */
+    readonly db: DbConfig;
+    /**
+     * The Redis (hot session tier, ADR-0013) connection descriptor. Consumed by the
+     * Phase 0b persistence provider that creates the ONE live `ioredis` client.
+     */
+    readonly redis: RedisConfig;
+    /**
+     * The keyed-HMAC secret for the refresh-token hasher (`SHIELD_REFRESH_HMAC_KEY`).
+     * ⛔ REQUIRED FOR AUTH — this is a SECRET (a leaked DB would be offline-brute-
+     * forceable without it). {@link loadAppConfig} reads it but does NOT throw when
+     * blank, so the ENFORCEMENT-ONLY scaffold (example-backend / a freshly-scaffolded
+     * app with no auth wired) still boots with no `.env`. The FAIL-CLOSED gate is
+     * {@link assertRefreshHmacKey}, invoked by the auth composition (AuthModule /
+     * persistence factory) at the moment auth is actually wired — so a blank key can
+     * never produce a working-looking authenticator, while a non-auth app is
+     * unaffected. Never logged, never returned to a client.
+     */
+    readonly refreshHmacKey: string;
+    /**
+     * Optional session/token lifetime overrides (ADR-0015). Any omitted field
+     * defaults in `@astram/core`'s `resolveLifetimes` to 15 min access / 14 d idle /
+     * 60 d absolute cap. `Partial` so the composition can hand it straight to
+     * `createSessionAuthority({ lifetimes })`.
+     */
+    readonly lifetimes: SessionLifetimeOverrides;
+}
+/**
+ * The runtime MariaDB connection descriptor. Non-secret host/port/user/database
+ * plus the account password (a secret — supplied via env/secrets-manager, NEVER
+ * committed). Maps 1:1 onto `mariadb`'s `createPool({ host, port, user, password,
+ * database, connectionLimit })`. The pool cap comes from the ADR-0018 budget
+ * (`pool.perAccountMax.shield_core`), NOT duplicated here.
+ */
+export interface DbConfig {
+    readonly host: string;
+    readonly port: number;
+    readonly user: string;
+    /** ⛔ Secret — resolved from env/secrets-manager; never logged. */
+    readonly password: string;
+    readonly database: string;
+}
+/**
+ * The Redis connection descriptor. A single `url` (e.g. `redis://host:6379`) is
+ * the canonical form `ioredis` accepts directly; host/port are provided as a
+ * convenience fallback the persistence provider composes into a url when `url` is
+ * absent.
+ */
+export interface RedisConfig {
+    /** Full connection url (`redis://[:password@]host:port[/db]`). Preferred. */
+    readonly url: string;
+}
+/**
+ * Optional per-deployment overrides for the three ADR-0015 session lifetimes.
+ * Shape mirrors `@astram/core`'s `Partial<SessionLifetimeConfig>` so it is passed
+ * straight into `createSessionAuthority({ lifetimes })` — omitted fields take the
+ * core defaults. Kept as a local shape (not a core import) so this config file
+ * stays a plain env-reader; the composition owns the core wiring.
+ */
+export interface SessionLifetimeOverrides {
+    /** Access-token TTL in ms (core default 15 min). Omitted ⇒ core default. */
+    readonly accessTtlMs?: number;
+    /** Sliding refresh idle window in ms (core default 14 days). */
+    readonly refreshIdleMs?: number;
+    /** Absolute session cap in ms (core default 60 days). */
+    readonly refreshAbsoluteCapMs?: number;
 }
 /**
  * The ADR-0018 connection-pool budget surface. Every field is configurable per
@@ -84,9 +154,72 @@ export declare const SCHEMA_SVC_POOL_HARD_CAP = 2;
  *   perAccountMax.shield_schema_svc ← SHIELD_POOL_MAX_SCHEMA_SVC
  */
 export declare function loadPoolBudget(env?: NodeJS.ProcessEnv): PoolBudgetConfig;
+/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+export declare const DEFAULT_DB_CONFIG: Omit<DbConfig, 'password'>;
+/** Documented default Redis url (local docker substrate). */
+export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
+/**
+ * Build the runtime {@link DbConfig} from env with documented defaults.
+ * Field ↔ env name:
+ *   host     ← SHIELD_DB_HOST      port     ← SHIELD_DB_PORT
+ *   user     ← SHIELD_DB_USER      password ← SHIELD_DB_PASSWORD (secret)
+ *   database ← SHIELD_DB_NAME
+ * The password defaults to '' when absent — a live connection then fails at
+ * connect time (loud), which is correct for a runtime that needs real creds; the
+ * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
+ * which is a fail-closed security invariant even for unit tests).
+ */
+export declare function loadDbConfig(env?: NodeJS.ProcessEnv): DbConfig;
+/**
+ * Build the {@link RedisConfig} from env. Prefers `SHIELD_REDIS_URL`; falls back
+ * to composing `redis://host:port` from `SHIELD_REDIS_HOST`/`SHIELD_REDIS_PORT`,
+ * else the documented default.
+ */
+export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
+/**
+ * Build the optional {@link SessionLifetimeOverrides} from env. Every field is
+ * optional (omitted ⇒ core ADR-0015 default). The bounds validation is the
+ * core's `resolveLifetimes` job (throws LOUD at composition) — this loader only
+ * reads the numbers.
+ * Field ↔ env name:
+ *   accessTtlMs          ← SHIELD_ACCESS_TTL_MS
+ *   refreshIdleMs        ← SHIELD_REFRESH_IDLE_MS
+ *   refreshAbsoluteCapMs ← SHIELD_REFRESH_ABSOLUTE_CAP_MS
+ */
+export declare function loadSessionLifetimes(env?: NodeJS.ProcessEnv): SessionLifetimeOverrides;
+/**
+ * Read the refresh-token HMAC key from env (raw; `''` when absent/blank). Total —
+ * does NOT throw, so {@link loadAppConfig} stays boot-safe for a non-auth scaffold.
+ * The FAIL-CLOSED enforcement lives in {@link assertRefreshHmacKey}. Never logs
+ * the key's value.
+ */
+export declare function loadRefreshHmacKey(env?: NodeJS.ProcessEnv): string;
+/**
+ * ⛔ FAIL-CLOSED GATE for the refresh-token HMAC key. Called by the auth
+ * composition (AuthModule / persistence factory) at the moment auth is wired:
+ * throws LOUD when the key is blank so the app can NEVER compose a working-looking
+ * authenticator/session-authority on an empty HMAC key (a leaked DB would then be
+ * offline-brute-forceable, and every refresh-token hash would be unkeyed). Mirrors
+ * `Sha256RefreshTokenHasher`'s constructor guard but surfaces a clear composition
+ * error. Returns the validated non-empty key. NEVER logs the key's value.
+ *
+ * WHY here and not in `loadAppConfig`: an enforcement-only app (example-backend, a
+ * freshly-scaffolded app with no auth wired) must still boot with no `.env`
+ * (`create-astram-app/template/_env.example` promises exactly this). Gating at the
+ * auth boundary keeps that promise while making auth fail closed the instant it is
+ * actually composed.
+ */
+export declare function assertRefreshHmacKey(key: string): string;
 /**
  * Build the {@link AppConfig} from `process.env` (or an injected env bag, for
- * testability). Pure + side-effect-free so it is trivially unit-testable.
+ * testability). Pure, total, and side-effect-free — trivially unit-testable and
+ * boot-safe with NO `.env`.
+ *
+ * Every Phase 0b field has a documented default (DB/Redis descriptors, lifetimes)
+ * and `refreshHmacKey` is read-but-not-required HERE, so existing callers
+ * (example-backend / template `main.ts`, which read only `.port`) are unaffected.
+ * The refresh-key fail-closed check is deferred to {@link assertRefreshHmacKey} at
+ * auth-composition time (see its doc).
  */
 export declare function loadAppConfig(env?: NodeJS.ProcessEnv): AppConfig;
 /** Result of evaluating a {@link PoolBudgetConfig} against the ADR-0018 budget. */

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAM7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}