@astram/guard 0.1.1 → 0.3.0

package/dist/config/app-config.js

@@ -1,7 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = void 0;
+exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = void 0;
 exports.loadPoolBudget = loadPoolBudget;
+exports.loadDbConfig = loadDbConfig;
+exports.loadRedisConfig = loadRedisConfig;
+exports.loadSessionLifetimes = loadSessionLifetimes;
+exports.loadRefreshHmacKey = loadRefreshHmacKey;
+exports.assertRefreshHmacKey = assertRefreshHmacKey;
 exports.loadAppConfig = loadAppConfig;
 exports.evaluatePoolBudget = evaluatePoolBudget;
 /** Documented MVP single-node defaults (see the class doc + my.cnf). */
@@ -61,15 +66,152 @@ function loadPoolBudget(env = process.env) {
         },
     };
 }
+// ---------------------------------------------------------------------------
+// Phase 0b Auth-surface config loaders (additive) — DB / Redis / secret /
+// lifetimes. All pure env-readers with documented defaults; the ONLY hard-
+// required value is the refresh HMAC key (fail-closed).
+// ---------------------------------------------------------------------------
+/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+exports.DEFAULT_DB_CONFIG = {
+    host: 'localhost',
+    port: 3306,
+    user: 'shield_core',
+    database: 'shield_identity',
+};
+/** Documented default Redis url (local docker substrate). */
+exports.DEFAULT_REDIS_URL = 'redis://localhost:6379';
+/** Read a string from env with a fallback (trims; blank ⇒ fallback). */
+function parseString(raw, fallback) {
+    if (raw === undefined || raw.trim() === '')
+        return fallback;
+    return raw.trim();
+}
+/**
+ * Read an OPTIONAL positive-int env override, or `undefined` when absent/blank/
+ * invalid — so an omitted lifetime falls through to the core default rather than
+ * being coerced to a bogus number. (Distinct from {@link parsePositiveInt}, which
+ * always returns a concrete fallback for the pool budget.)
+ */
+function parseOptionalPositiveInt(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const n = Number.parseInt(raw, 10);
+    return Number.isInteger(n) && n > 0 ? n : undefined;
+}
+/**
+ * Build the runtime {@link DbConfig} from env with documented defaults.
+ * Field ↔ env name:
+ *   host     ← SHIELD_DB_HOST      port     ← SHIELD_DB_PORT
+ *   user     ← SHIELD_DB_USER      password ← SHIELD_DB_PASSWORD (secret)
+ *   database ← SHIELD_DB_NAME
+ * The password defaults to '' when absent — a live connection then fails at
+ * connect time (loud), which is correct for a runtime that needs real creds; the
+ * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
+ * which is a fail-closed security invariant even for unit tests).
+ */
+function loadDbConfig(env = process.env) {
+    return {
+        host: parseString(env.SHIELD_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
+        port: parsePort(env.SHIELD_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
+        user: parseString(env.SHIELD_DB_USER, exports.DEFAULT_DB_CONFIG.user),
+        password: parseString(env.SHIELD_DB_PASSWORD, ''),
+        database: parseString(env.SHIELD_DB_NAME, exports.DEFAULT_DB_CONFIG.database),
+    };
+}
+/**
+ * Build the {@link RedisConfig} from env. Prefers `SHIELD_REDIS_URL`; falls back
+ * to composing `redis://host:port` from `SHIELD_REDIS_HOST`/`SHIELD_REDIS_PORT`,
+ * else the documented default.
+ */
+function loadRedisConfig(env = process.env) {
+    const explicit = env.SHIELD_REDIS_URL;
+    if (explicit !== undefined && explicit.trim() !== '') {
+        return { url: explicit.trim() };
+    }
+    const host = env.SHIELD_REDIS_HOST;
+    const port = env.SHIELD_REDIS_PORT;
+    if ((host !== undefined && host.trim() !== '') || (port !== undefined && port.trim() !== '')) {
+        const h = parseString(host, 'localhost');
+        const p = parsePort(port, 6379);
+        return { url: `redis://${h}:${p}` };
+    }
+    return { url: exports.DEFAULT_REDIS_URL };
+}
+/**
+ * Build the optional {@link SessionLifetimeOverrides} from env. Every field is
+ * optional (omitted ⇒ core ADR-0015 default). The bounds validation is the
+ * core's `resolveLifetimes` job (throws LOUD at composition) — this loader only
+ * reads the numbers.
+ * Field ↔ env name:
+ *   accessTtlMs          ← SHIELD_ACCESS_TTL_MS
+ *   refreshIdleMs        ← SHIELD_REFRESH_IDLE_MS
+ *   refreshAbsoluteCapMs ← SHIELD_REFRESH_ABSOLUTE_CAP_MS
+ */
+function loadSessionLifetimes(env = process.env) {
+    const overrides = {};
+    const access = parseOptionalPositiveInt(env.SHIELD_ACCESS_TTL_MS);
+    const idle = parseOptionalPositiveInt(env.SHIELD_REFRESH_IDLE_MS);
+    const cap = parseOptionalPositiveInt(env.SHIELD_REFRESH_ABSOLUTE_CAP_MS);
+    if (access !== undefined)
+        overrides.accessTtlMs = access;
+    if (idle !== undefined)
+        overrides.refreshIdleMs = idle;
+    if (cap !== undefined)
+        overrides.refreshAbsoluteCapMs = cap;
+    return overrides;
+}
+/**
+ * Read the refresh-token HMAC key from env (raw; `''` when absent/blank). Total —
+ * does NOT throw, so {@link loadAppConfig} stays boot-safe for a non-auth scaffold.
+ * The FAIL-CLOSED enforcement lives in {@link assertRefreshHmacKey}. Never logs
+ * the key's value.
+ */
+function loadRefreshHmacKey(env = process.env) {
+    return parseString(env.SHIELD_REFRESH_HMAC_KEY, '');
+}
+/**
+ * ⛔ FAIL-CLOSED GATE for the refresh-token HMAC key. Called by the auth
+ * composition (AuthModule / persistence factory) at the moment auth is wired:
+ * throws LOUD when the key is blank so the app can NEVER compose a working-looking
+ * authenticator/session-authority on an empty HMAC key (a leaked DB would then be
+ * offline-brute-forceable, and every refresh-token hash would be unkeyed). Mirrors
+ * `Sha256RefreshTokenHasher`'s constructor guard but surfaces a clear composition
+ * error. Returns the validated non-empty key. NEVER logs the key's value.
+ *
+ * WHY here and not in `loadAppConfig`: an enforcement-only app (example-backend, a
+ * freshly-scaffolded app with no auth wired) must still boot with no `.env`
+ * (`create-astram-app/template/_env.example` promises exactly this). Gating at the
+ * auth boundary keeps that promise while making auth fail closed the instant it is
+ * actually composed.
+ */
+function assertRefreshHmacKey(key) {
+    if (typeof key !== 'string' || key.trim() === '') {
+        throw new Error('Shield auth composition: SHIELD_REFRESH_HMAC_KEY is required and must be ' +
+            'non-empty (fail-closed — refusing to compose auth with a blank refresh-token ' +
+            'HMAC key). Set it from your secrets manager; never commit the value.');
+    }
+    return key;
+}
 /**
  * Build the {@link AppConfig} from `process.env` (or an injected env bag, for
- * testability). Pure + side-effect-free so it is trivially unit-testable.
+ * testability). Pure, total, and side-effect-free — trivially unit-testable and
+ * boot-safe with NO `.env`.
+ *
+ * Every Phase 0b field has a documented default (DB/Redis descriptors, lifetimes)
+ * and `refreshHmacKey` is read-but-not-required HERE, so existing callers
+ * (example-backend / template `main.ts`, which read only `.port`) are unaffected.
+ * The refresh-key fail-closed check is deferred to {@link assertRefreshHmacKey} at
+ * auth-composition time (see its doc).
  */
 function loadAppConfig(env = process.env) {
     return {
         port: parsePort(env.PORT, 3000),
         environment: parseEnvironment(env.NODE_ENV),
         pool: loadPoolBudget(env),
+        db: loadDbConfig(env),
+        redis: loadRedisConfig(env),
+        refreshHmacKey: loadRefreshHmacKey(env),
+        lifetimes: loadSessionLifetimes(env),
     };
 }
 /**

package/dist/config/app-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":";;;AAoMA,wCAuBC;AAgDD,oCAQC;AAOD,0CAaC;AAYD,oDAeC;AAQD,gDAEC;AAiBD,oDASC;AAaD,sCAUC;AA0BD,gDAgBC;AAlRD,wEAAwE;AAC3D,QAAA,mBAAmB,GAAqB;IACnD,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,GAAG;IACnB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE;QACb,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,CAAC;QAClB,iBAAiB,EAAE,CAAC;KACrB;CACF,CAAC;AAEF,gFAAgF;AACnE,QAAA,wBAAwB,GAAG,CAAC,CAAC;AAE1C,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAgB;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACvD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO;QACL,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,mBAAmB,EAAE,2BAAmB,CAAC,OAAO,CAAC;QAC/E,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,yBAAyB,EAC7B,2BAAmB,CAAC,cAAc,CACnC;QACD,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,oBAAoB,EAAE,2BAAmB,CAAC,QAAQ,CAAC;QAClF,aAAa,EAAE;YACb,WAAW,EAAE,gBAAgB,CAC3B,GAAG,CAAC,oBAAoB,EACxB,2BAAmB,CAAC,aAAa,CAAC,WAAW,CAC9C;YACD,eAAe,EAAE,gBAAgB,CAC/B,GAAG,CAAC,wBAAwB,EAC5B,2BAAmB,CAAC,aAAa,CAAC,eAAe,CAClD;YACD,iBAAiB,EAAE,gBAAgB,CACjC,GAAG,CAAC,0BAA0B,EAC9B,2BAAmB,CAAC,aAAa,CAAC,iBAAiB,CACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,8EAA8E;AAE9E,uFAAuF;AAC1E,QAAA,iBAAiB,GAA+B;IAC3D,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,iBAAiB;CAC5B,CAAC;AAEF,6DAA6D;AAChD,QAAA,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,wEAAwE;AACxE,SAAS,WAAW,CAAC,GAAuB,EAAE,QAAgB;IAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,GAAuB;IACvD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC7D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC3D,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC7D,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC;QACjD,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAiB,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACnC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,yBAAiB,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAIX,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACzE,IAAI,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,SAAS,CAAC,oBAAoB,GAAG,GAAG,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,WAAW,CAAC,GAAG,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,+EAA+E;YAC/E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC/B,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC;QACzB,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC;QACrB,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;QAC3B,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACvC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;KACrC,CAAC;AACJ,CAAC;AAsBD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAqB;IACtD,MAAM,oBAAoB,GACxB,GAAG,CAAC,aAAa,CAAC,WAAW;QAC7B,GAAG,CAAC,aAAa,CAAC,eAAe;QACjC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC;IACtC,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,GAAG,oBAAoB,CAAC;IAC9D,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,GAAG,mBAAmB,CAAC;IACvD,OAAO;QACL,oBAAoB;QACpB,kBAAkB;QAClB,mBAAmB;QACnB,KAAK;QACL,YAAY,EAAE,mBAAmB,IAAI,GAAG,CAAC,cAAc;QACvD,sBAAsB,EAAE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,gCAAwB;KACxF,CAAC;AACJ,CAAC"}

package/dist/config/config.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.module.js","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,mDAAgE;AAEhE,mDAAmD;AACtC,QAAA,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAE/C;;;;;;GAMG;AAWI,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAVxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,kBAAU;gBACnB,UAAU,EAAE,GAAc,EAAE,CAAC,IAAA,6BAAa,GAAE;aAC7C;SACF;QACD,OAAO,EAAE,CAAC,kBAAU,CAAC;KACtB,CAAC;GACW,YAAY,CAAG"}

package/dist/enforcement/classification.decorator.d.ts

@@ -4,22 +4,40 @@
  * Every HTTP handler in Shield must carry a classification. The global
  * enforcement guard (see {@link GlobalEnforcementGuard}) reads these keys and,
  * for any route WITHOUT one, denies the request (deny-by-default). This is the
- * structurally-unavoidable, fail-closed posture ADR-0002 mandates — present from
- * day one, even though the Scaffold stub does not yet consult a real decision
- * authority.
+ * structurally-unavoidable, fail-closed posture ADR-0002 mandates.
+ *
+ * The `@Classified(...)` value now carries the {@link Classification} the guard
+ * maps to a `decide(principal, action, resource, context)` call (the request-auth
+ * layer): `{ typeKey, action }`. A bare string is still accepted (deprecated
+ * back-compat) and treated as `typeKey` with a default `action` of `'access'`.
  */
 export declare const CLASSIFICATION_METADATA: {
     /** Marks a route as an explicit, code-reviewed public opt-out. */
     readonly PUBLIC: "shield:classification:public";
     /**
-     * Marks a route as classified against a permission/tier. In the Scaffold this
-     * is a placeholder value only — a LATER layer (ADR-0004 tiers, ADR-0012
-     * authoring) resolves it to a real decision. Its mere PRESENCE is what the
-     * stub guard checks: a classified route is "declared", an undeclared route is
-     * denied.
+     * Marks a route as classified. The value is a {@link Classification}
+     * (`{ typeKey, action }`) the guard uses to build the `decide()` request; a bare
+     * string is accepted for back-compat (→ `{ typeKey: <string>, action: 'access' }`).
      */
     readonly CLASSIFIED: "shield:classification:classified";
 };
+/**
+ * What a `@Classified` route gates on — the object-type key + the action the
+ * caller is attempting. The guard maps this to the Core `decide()` inputs:
+ * `Action = { key: action }`, `Resource = { level: 'object_type', typeKey,
+ * tenantId: <principal's tenant> }`. Stable keys (never route strings), matching
+ * the Core metadata contract (ADR-0004/ADR-0012).
+ */
+export interface Classification {
+    /** Stable object-type key the action operates on (e.g. `'company'`). */
+    readonly typeKey: string;
+    /** Stable action key (e.g. `'read'`, `'create'`, `'update'`, `'delete'`). */
+    readonly action: string;
+}
+/** Default action when a bare-string `@Classified('typeKey')` is used (back-compat). */
+export declare const DEFAULT_CLASSIFIED_ACTION = "access";
+/** Normalize either form of the decorator value to a {@link Classification}. */
+export declare function normalizeClassification(value: string | Classification | undefined): Classification | null;
 /**
  * `@Public()` — the explicit, deny-by-default opt-OUT (ADR-0002).
  *
@@ -30,12 +48,13 @@ export declare const CLASSIFICATION_METADATA: {
  */
 export declare const Public: () => MethodDecorator & ClassDecorator;
 /**
- * `@Classified(...)` — declare a route's permission/tier classification.
+ * `@Classified({ typeKey, action })` — declare what a route gates on.
  *
- * SCAFFOLD STUB: this only records that the route was classified; it does not
- * yet gate on a real permission. A later authorization layer replaces the stub
- * with an actual decision. Present here so business routes can be authored with
- * the final API shape from the start.
+ * The global enforcement guard reconstructs the caller's `Principal` from the
+ * request's bearer token, builds `Action`/`Resource` from this classification, and
+ * calls the Core `decide()` — allowing the request iff the decision is `allow`
+ * (deny-by-default otherwise). A bare string (`@Classified('company')`) is accepted
+ * for back-compat (→ action `'access'`), but the structured form is preferred.
  */
-export declare const Classified: (classification: string) => MethodDecorator & ClassDecorator;
+export declare const Classified: (classification: string | Classification) => MethodDecorator & ClassDecorator;
 //# sourceMappingURL=classification.decorator.d.ts.map

package/dist/enforcement/classification.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classification.decorator.d.ts","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB;IAClC,kEAAkE;;IAElE;;;;;;OAMG;;CAEK,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,QAAO,eAAe,GAAG,cACO,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,GAAI,gBAAgB,MAAM,KAAG,eAAe,GAAG,cACL,CAAC"}
+{"version":3,"file":"classification.decorator.d.ts","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;IAClC,kEAAkE;;IAElE;;;;OAIG;;CAEK,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,gFAAgF;AAChF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,GACzC,cAAc,GAAG,IAAI,CAcvB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,QAAO,eAAe,GAAG,cACO,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACrB,gBAAgB,MAAM,GAAG,cAAc,KACtC,eAAe,GAAG,cAC4C,CAAC"}

package/dist/enforcement/classification.decorator.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Classified = exports.Public = exports.CLASSIFICATION_METADATA = void 0;
+exports.Classified = exports.Public = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = void 0;
+exports.normalizeClassification = normalizeClassification;
 const common_1 = require("@nestjs/common");
 /**
  * Route-classification metadata keys (ADR-0002).
@@ -8,22 +9,40 @@ const common_1 = require("@nestjs/common");
  * Every HTTP handler in Shield must carry a classification. The global
  * enforcement guard (see {@link GlobalEnforcementGuard}) reads these keys and,
  * for any route WITHOUT one, denies the request (deny-by-default). This is the
- * structurally-unavoidable, fail-closed posture ADR-0002 mandates — present from
- * day one, even though the Scaffold stub does not yet consult a real decision
- * authority.
+ * structurally-unavoidable, fail-closed posture ADR-0002 mandates.
+ *
+ * The `@Classified(...)` value now carries the {@link Classification} the guard
+ * maps to a `decide(principal, action, resource, context)` call (the request-auth
+ * layer): `{ typeKey, action }`. A bare string is still accepted (deprecated
+ * back-compat) and treated as `typeKey` with a default `action` of `'access'`.
  */
 exports.CLASSIFICATION_METADATA = {
     /** Marks a route as an explicit, code-reviewed public opt-out. */
     PUBLIC: 'shield:classification:public',
     /**
-     * Marks a route as classified against a permission/tier. In the Scaffold this
-     * is a placeholder value only — a LATER layer (ADR-0004 tiers, ADR-0012
-     * authoring) resolves it to a real decision. Its mere PRESENCE is what the
-     * stub guard checks: a classified route is "declared", an undeclared route is
-     * denied.
+     * Marks a route as classified. The value is a {@link Classification}
+     * (`{ typeKey, action }`) the guard uses to build the `decide()` request; a bare
+     * string is accepted for back-compat (→ `{ typeKey: <string>, action: 'access' }`).
      */
     CLASSIFIED: 'shield:classification:classified',
 };
+/** Default action when a bare-string `@Classified('typeKey')` is used (back-compat). */
+exports.DEFAULT_CLASSIFIED_ACTION = 'access';
+/** Normalize either form of the decorator value to a {@link Classification}. */
+function normalizeClassification(value) {
+    if (value === undefined)
+        return null;
+    if (typeof value === 'string') {
+        return value.length > 0 ? { typeKey: value, action: exports.DEFAULT_CLASSIFIED_ACTION } : null;
+    }
+    if (typeof value.typeKey === 'string' &&
+        value.typeKey.length > 0 &&
+        typeof value.action === 'string' &&
+        value.action.length > 0) {
+        return { typeKey: value.typeKey, action: value.action };
+    }
+    return null;
+}
 /**
  * `@Public()` — the explicit, deny-by-default opt-OUT (ADR-0002).
  *
@@ -35,12 +54,13 @@ exports.CLASSIFICATION_METADATA = {
 const Public = () => (0, common_1.SetMetadata)(exports.CLASSIFICATION_METADATA.PUBLIC, true);
 exports.Public = Public;
 /**
- * `@Classified(...)` — declare a route's permission/tier classification.
+ * `@Classified({ typeKey, action })` — declare what a route gates on.
  *
- * SCAFFOLD STUB: this only records that the route was classified; it does not
- * yet gate on a real permission. A later authorization layer replaces the stub
- * with an actual decision. Present here so business routes can be authored with
- * the final API shape from the start.
+ * The global enforcement guard reconstructs the caller's `Principal` from the
+ * request's bearer token, builds `Action`/`Resource` from this classification, and
+ * calls the Core `decide()` — allowing the request iff the decision is `allow`
+ * (deny-by-default otherwise). A bare string (`@Classified('company')`) is accepted
+ * for back-compat (→ action `'access'`), but the structured form is preferred.
  */
 const Classified = (classification) => (0, common_1.SetMetadata)(exports.CLASSIFICATION_METADATA.CLASSIFIED, classification);
 exports.Classified = Classified;

package/dist/enforcement/classification.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.decorator.js","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":";;;AA4CA,0DAgBC;AA5DD,2CAA6C;AAE7C;;;;;;;;;;;;GAYG;AACU,QAAA,uBAAuB,GAAG;IACrC,kEAAkE;IAClE,MAAM,EAAE,8BAA8B;IACtC;;;;OAIG;IACH,UAAU,EAAE,kCAAkC;CACtC,CAAC;AAgBX,wFAAwF;AAC3E,QAAA,yBAAyB,GAAG,QAAQ,CAAC;AAElD,gFAAgF;AAChF,SAAgB,uBAAuB,CACrC,KAA0C;IAE1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IACD,IACE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,MAAM,MAAM,GAAG,GAAqC,EAAE,CAC3D,IAAA,oBAAW,EAAC,+BAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AADvC,QAAA,MAAM,UACiC;AAEpD;;;;;;;;GAQG;AACI,MAAM,UAAU,GAAG,CACxB,cAAuC,EACL,EAAE,CACpC,IAAA,oBAAW,EAAC,+BAAuB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;AAHrD,QAAA,UAAU,cAG2C"}

package/dist/enforcement/core-seam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-seam.js","sourceRoot":"","sources":["../../src/enforcement/core-seam.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAqBH;;;;;;;;;;;GAWG;AACU,QAAA,qBAAqB,GAA0B;IAC1D,MAAM;QACJ,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;CACF,CAAC"}

package/dist/enforcement/enforcement.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.module.js","sourceRoot":"","sources":["../../src/enforcement/enforcement.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,uCAAyC;AACzC,+EAAuE;AAEvE;;;;;;;;;;;;;;GAcG;AASI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IAR7B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,oDAAsB;aACjC;SACF;KACF,CAAC;GACW,iBAAiB,CAAG"}

package/dist/enforcement/global-enforcement.guard.d.ts

@@ -1,31 +1,41 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import type { CoreDecisionAuthority } from './core-seam.js';
+import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
 /**
- * Global, fail-closed enforcement guard (ADR-0002).
+ * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
+ * authorization for classified routes.
  *
  * This guard is the SINGLE, structurally-unavoidable point every request passes
- * through. It is bound as an `APP_GUARD` through the ONE registration seam,
- * `ShieldModule.forRoot()` (which composes the internal `EnforcementModule` that
- * holds the sole binding) — NOT opt-in per controller — so no endpoint can escape
- * it. Its posture is **deny-by-default**:
+ * through (bound as the sole `APP_GUARD` via `ShieldModule.forRoot()`). Posture is
+ * **deny-by-default**:
  *
- *   - A route marked `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
- *   - A route marked `@Classified()`  → allowed to PROCEED in the Scaffold stub
- *       (a LATER layer will consult the real Core `DecisionAuthority` here; see
- *       {@link ../enforcement/core-seam.ts}). Its presence proves the route was
- *       declared.
- *   - A route with NO classification  → DENIED (403). A forgotten declaration
- *       locks the door instead of opening it.
+ *   - `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
+ *   - `@Classified({typeKey, action})` → the request-auth path runs:
+ *       1. extract the bearer access token from `Authorization`,
+ *       2. resolve it to a `Principal` (via the {@link SessionTokenBinder}),
+ *       3. build `Action`/`Resource` from the classification,
+ *       4. call the Core `decide()` — ALLOW iff `effect === 'allow'`, else 403.
+ *       No/invalid token → 401 (fail-closed). This replaces the old scaffold stub
+ *       that let classified routes through unconditionally.
+ *   - No classification → DENIED (403). A forgotten declaration locks the door.
  *
- * SCAFFOLD SCOPE: this does not yet perform real authorization. It only proves
- * the fail-closed, globally-unavoidable, deny-by-default seam exists from day
- * one. When the Authorization layer lands, the `@Classified` branch calls the
- * Core decision authority (wired via the core-seam) — the deny-by-default
- * structure here does not change.
+ * OPT-IN / GRACEFUL DEGRADE: the request-auth dependencies (the token binder) exist
+ * only when `auth: true`. When they are ABSENT (enforcement-only, no-`.env` boot),
+ * the guard cannot authenticate a request — so a classified route with the
+ * request-auth path unavailable is DENIED (403), never allowed-through. This keeps
+ * the enforcement-only app booting AND fail-closed: an app that declares classified
+ * routes but hasn't enabled auth gets a clear deny, not a silent open door. (The
+ * decision authority defaults to the deny-by-default stub, so even a wired-but-
+ * unconfigured authority denies.)
  */
 export declare class GlobalEnforcementGuard implements CanActivate {
     private readonly reflector;
-    constructor(reflector: Reflector);
-    canActivate(context: ExecutionContext): boolean;
+    private readonly decisionAuthority?;
+    private readonly tokenBinder?;
+    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    /** The real authorization path for a classified route (fail-closed throughout). */
+    private authorizeClassified;
 }
 //# sourceMappingURL=global-enforcement.guard.d.ts.map

package/dist/enforcement/global-enforcement.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAkC,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAEjD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAsChD"}
+{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAQlF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBANZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAG7C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}

package/dist/enforcement/global-enforcement.guard.js

@@ -8,40 +8,56 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GlobalEnforcementGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const classification_decorator_js_1 = require("./classification.decorator.js");
+const shield_tokens_js_1 = require("../module/shield-tokens.js");
+const tokens_js_1 = require("../request-auth/tokens.js");
+const request_principal_js_1 = require("../request-auth/request-principal.js");
+const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
+const reenroll_allowlist_js_1 = require("./reenroll-allowlist.js");
 /**
- * Global, fail-closed enforcement guard (ADR-0002).
+ * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
+ * authorization for classified routes.
  *
  * This guard is the SINGLE, structurally-unavoidable point every request passes
- * through. It is bound as an `APP_GUARD` through the ONE registration seam,
- * `ShieldModule.forRoot()` (which composes the internal `EnforcementModule` that
- * holds the sole binding) — NOT opt-in per controller — so no endpoint can escape
- * it. Its posture is **deny-by-default**:
+ * through (bound as the sole `APP_GUARD` via `ShieldModule.forRoot()`). Posture is
+ * **deny-by-default**:
  *
- *   - A route marked `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
- *   - A route marked `@Classified()`  → allowed to PROCEED in the Scaffold stub
- *       (a LATER layer will consult the real Core `DecisionAuthority` here; see
- *       {@link ../enforcement/core-seam.ts}). Its presence proves the route was
- *       declared.
- *   - A route with NO classification  → DENIED (403). A forgotten declaration
- *       locks the door instead of opening it.
+ *   - `@Public()`      → ALLOWED (explicit, code-reviewed opt-out).
+ *   - `@Classified({typeKey, action})` → the request-auth path runs:
+ *       1. extract the bearer access token from `Authorization`,
+ *       2. resolve it to a `Principal` (via the {@link SessionTokenBinder}),
+ *       3. build `Action`/`Resource` from the classification,
+ *       4. call the Core `decide()` — ALLOW iff `effect === 'allow'`, else 403.
+ *       No/invalid token → 401 (fail-closed). This replaces the old scaffold stub
+ *       that let classified routes through unconditionally.
+ *   - No classification → DENIED (403). A forgotten declaration locks the door.
  *
- * SCAFFOLD SCOPE: this does not yet perform real authorization. It only proves
- * the fail-closed, globally-unavoidable, deny-by-default seam exists from day
- * one. When the Authorization layer lands, the `@Classified` branch calls the
- * Core decision authority (wired via the core-seam) — the deny-by-default
- * structure here does not change.
+ * OPT-IN / GRACEFUL DEGRADE: the request-auth dependencies (the token binder) exist
+ * only when `auth: true`. When they are ABSENT (enforcement-only, no-`.env` boot),
+ * the guard cannot authenticate a request — so a classified route with the
+ * request-auth path unavailable is DENIED (403), never allowed-through. This keeps
+ * the enforcement-only app booting AND fail-closed: an app that declares classified
+ * routes but hasn't enabled auth gets a clear deny, not a silent open door. (The
+ * decision authority defaults to the deny-by-default stub, so even a wired-but-
+ * unconfigured authority denies.)
  */
 let GlobalEnforcementGuard = class GlobalEnforcementGuard {
     reflector;
-    constructor(reflector) {
+    decisionAuthority;
+    tokenBinder;
+    constructor(reflector, decisionAuthority, tokenBinder) {
         this.reflector = reflector;
+        this.decisionAuthority = decisionAuthority;
+        this.tokenBinder = tokenBinder;
     }
-    canActivate(context) {
+    async canActivate(context) {
         // Only HTTP requests are classified here. Non-HTTP contexts (if ever added)
         // must be handled explicitly rather than silently allowed.
         if (context.getType() !== 'http') {
@@ -57,20 +73,87 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         if (isPublic === true) {
             return true;
         }
-        // 2. Classified route → declared. Scaffold stub lets it proceed (a real
-        //    decision authority is wired in a later layer via the core-seam).
-        const classification = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, controller]);
-        if (typeof classification === 'string' && classification.length > 0) {
-            return true;
+        // 2. Classified route → run the request-auth + decide() path.
+        const raw = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, controller]);
+        const classification = (0, classification_decorator_js_1.normalizeClassification)(raw);
+        if (classification !== null) {
+            return this.authorizeClassified(context, classification);
         }
         // 3. No classification at all → DENY (ADR-0002 deny-by-default / fail-closed).
         throw new common_1.ForbiddenException('Shield enforcement: this route carries no access classification. ' +
             'It is denied by default (ADR-0002). Mark it @Public() to opt out, or ' +
             '@Classified(...) to declare its permission.');
     }
+    /** The real authorization path for a classified route (fail-closed throughout). */
+    async authorizeClassified(context, classification) {
+        // Request-auth is only possible when the token binder is wired (auth: true).
+        // Absent → we cannot authenticate the caller → DENY (never allow-through).
+        if (this.tokenBinder === undefined || this.decisionAuthority === undefined) {
+            throw new common_1.ForbiddenException('Shield enforcement: this route is @Classified but request authentication is not ' +
+                "enabled (ShieldModule.forRoot({ auth: true })). It is denied by default.");
+        }
+        const req = context.switchToHttp().getRequest();
+        const authHeader = req?.headers?.['authorization'];
+        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authHeader, this.tokenBinder);
+        if (resolved === null) {
+            // No/invalid/expired token → not authenticated. 401 (distinct from a deny).
+            throw new common_1.UnauthorizedException('Shield enforcement: missing or invalid access token for a classified route.');
+        }
+        const { principal, claims } = resolved;
+        // ENFORCED-RE-ENROLL GATE (spec §4.2): a session established via a recovery-code
+        // login is restricted to the re-secure allowlist until a fresh device is confirmed.
+        // Checked AFTER authentication, BEFORE decide() — a marked session hitting any route
+        // NOT on REENROLL_ALLOWED is 403 `reenrollment_required` (a distinct code the
+        // frontend recognizes → forces the re-enroll screen). Fail-closed: this is an
+        // allowlist, so an unknown/unclassified route with a marked session also 403s. This
+        // runs only on @Classified routes (the @Public re-secure routes self-authenticate
+        // and check nothing here). The classified route being gated here is, by definition,
+        // NOT on the allowlist (the allowlist is @Public), so a marked session is always
+        // denied — the isReenrollAllowed check below is defense-in-depth for a future
+        // classified allowlisted route.
+        if (claims.mustReenroll === true) {
+            const method = req?.method;
+            const url = req?.originalUrl ?? req?.url;
+            if (!(0, reenroll_allowlist_js_1.isReenrollAllowed)(method, url)) {
+                throw new common_1.ForbiddenException({ error: 'reenrollment_required' });
+            }
+        }
+        // Attach the resolved principal so downstream handlers can act as this user.
+        req.principal = principal;
+        // ── ADR-0011 SESSION-FACTS HOT PATH ──────────────────────────────────────────
+        // Enter the per-request session-facts ALS scope with THIS request's cached grants
+        // (from the binding — same bearer token → same principal → same facts) around the
+        // decide() call. The app-owned `SessionFactsReader` (an ALS-backed reader wired into
+        // the decision authority) reads the SAME `SHIELD_SESSION_FACTS_ALS` store inside
+        // decide(), so gate 5 gets these facts and can serve the coarse decision from cache
+        // (no DB reload) when the cached version is still fresh.
+        //
+        // CROSS-PRINCIPAL ISOLATION: `als.run(store, cb)` binds `store` to this async
+        // context and everything decide() awaits, and ONLY that context — a concurrent
+        // request runs its own `run()` with its own store, so getStore() never returns
+        // another request's facts. The store is built HERE from THIS request's claims.
+        //
+        // FAIL-CLOSED: no projector wired / absent / malformed binding → `claims.cachedFacts`
+        // is undefined → the store carries `cachedFacts: null` → gate 5 DB-reloads (today's
+        // behavior). The cache is only ever consulted; it never fabricates a permit.
+        const factsStore = {
+            cachedFacts: claims.cachedFacts ?? null,
+            permissionsVersion: claims.cachedFacts?.permissionsVersion ?? 0,
+        };
+        const decision = await session_facts_als_js_1.SHIELD_SESSION_FACTS_ALS.run(factsStore, () => this.decisionAuthority.decide(principal, { key: classification.action }, { level: 'object_type', typeKey: classification.typeKey, tenantId: principal.tenantId }, { isAuthenticated: true }));
+        if (decision.effect === 'allow') {
+            return true;
+        }
+        // Deny (or any non-allow) → 403. Do NOT leak the reason detail to the caller.
+        throw new common_1.ForbiddenException(`Shield enforcement: access denied for ${classification.action} on ${classification.typeKey}.`);
+    }
 };
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard;
 exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [core_1.Reflector])
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(shield_tokens_js_1.SHIELD_DECISION_AUTHORITY)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object, Function])
 ], GlobalEnforcementGuard);

package/dist/enforcement/global-enforcement.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-enforcement.guard.js","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AACzC,+EAIuC;AACvC,iEAAuE;AAEvE,yDAAwE;AAExE,+EAA0E;AAC1E,+EAG8C;AAC9C,mEAA4D;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAEd;IAGA;IAGA;IAPnB,YACmB,SAAoB,EAGpB,iBAAyC,EAGzC,WAAgC;QANhC,cAAS,GAAT,SAAS,CAAW;QAGpB,sBAAiB,GAAjB,iBAAiB,CAAwB;QAGzC,gBAAW,GAAX,WAAW,CAAqB;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,4EAA4E;QAC5E,2DAA2D;QAC3D,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,2BAAkB,CAC1B,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAuB,CAAC,MAAM,EAAE;YACzF,OAAO;YACP,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8DAA8D;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,qDAAuB,CAAC,UAAU,EAClC,CAAC,OAAO,EAAE,UAAU,CAAC,CACtB,CAAC;QACF,MAAM,cAAc,GAAG,IAAA,qDAAuB,EAAC,GAAG,CAAC,CAAC;QACpD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,2BAAkB,CAC1B,mEAAmE;YACjE,uEAAuE;YACvE,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,mBAAmB,CAC/B,OAAyB,EACzB,cAA8B;QAE9B,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC3E,MAAM,IAAI,2BAAkB,CAC1B,kFAAkF;gBAChF,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAMzC,CAAC;QACL,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAkB,EAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,4EAA4E;YAC5E,MAAM,IAAI,8BAAqB,CAC7B,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAEvC,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,8EAA8E;QAC9E,8EAA8E;QAC9E,oFAAoF;QACpF,kFAAkF;QAClF,oFAAoF;QACpF,iFAAiF;QACjF,8EAA8E;QAC9E,gCAAgC;QAChC,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,GAAG,CAAC;YACzC,IAAI,CAAC,IAAA,yCAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,2BAAkB,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAE1B,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,qFAAqF;QACrF,iFAAiF;QACjF,oFAAoF;QACpF,yDAAyD;QACzD,EAAE;QACF,8EAA8E;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,EAAE;QACF,sFAAsF;QACtF,oFAAoF;QACpF,6EAA6E;QAC7E,MAAM,UAAU,GAAsB;YACpC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,kBAAkB,IAAI,CAAC;SAChE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,+CAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CACnE,IAAI,CAAC,iBAAkB,CAAC,MAAM,CAC5B,SAAS,EACT,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,EAC9B,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,EACvF,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8EAA8E;QAC9E,MAAM,IAAI,2BAAkB,CAC1B,yCAAyC,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,OAAO,GAAG,CAC/F,CAAC;IACJ,CAAC;CACF,CAAA;AA7IY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,4CAAyB,CAAC,CAAA;IAEjC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;qCALR,gBAAS;GAF5B,sBAAsB,CA6IlC"}