@astram/guard 0.1.1 → 0.3.0

package/dist/enforcement/reenroll-allowlist.d.ts

@@ -0,0 +1,49 @@
+/**
+ * REENROLL_ALLOWED — the enforced-re-enroll allowlist (spec §4.2).
+ *
+ * A session established via a recovery-code login carries `mustReenroll: true` in its
+ * bound claims (see {@link import('../request-auth/session-token-binder.js').BoundPrincipalClaims}).
+ * The {@link import('./global-enforcement.guard.js').GlobalEnforcementGuard} restricts
+ * such a session to ONLY the routes below — the minimal set needed to RE-SECURE the
+ * account (add a fresh authenticator device + refresh recovery codes) and to observe
+ * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
+ * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
+ *
+ * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
+ * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
+ * that a re-enrolling user must reach means adding it HERE, deliberately.
+ *
+ * NOTE — allowlisted ≠ gate-clearing (spec §4.3): being on this list only lets the
+ * request THROUGH the gate; it does NOT clear `mustReenroll`. ONLY a successful
+ * `POST /account/mfa/devices/confirm` clears the flag (the account controller calls
+ * `binder.clearReenroll`). Regenerating codes is allowed but does not re-secure.
+ */
+/** One allowlisted route: an HTTP method + the path SUFFIX it must end with. */
+export interface ReenrollAllowedRoute {
+    readonly method: string;
+    /** The route path (no query string, no trailing slash), matched by suffix. */
+    readonly path: string;
+}
+/**
+ * The allowlist (spec §4.2). Paths are the framework-owned route paths; matched
+ * robustly by method + normalized-path suffix (see {@link isReenrollAllowed}) so a
+ * future global prefix, a trailing slash, or a query string never defeats the match.
+ */
+export declare const REENROLL_ALLOWED: readonly ReenrollAllowedRoute[];
+/**
+ * Normalize a raw request path for matching: drop the query string and any fragment,
+ * collapse a trailing slash (except the root). Never throws.
+ */
+export declare function normalizeRequestPath(rawUrl: unknown): string;
+/**
+ * True iff the (method, path) is on the enforced-re-enroll allowlist. Matching is
+ * case-insensitive on the method and SUFFIX-based on the normalized path — so
+ * `/api/account/mfa/devices/confirm` (a prefixed mount) still matches
+ * `/account/mfa/devices/confirm`. The path boundary is inherent: every `route.path`
+ * BEGINS with `/`, so `endsWith(route.path)` cannot spuriously match a longer segment
+ * name (`/evilaccount/...` does NOT end with `/account/...` — there is no `/` before
+ * `account`). `/account/mfa/devices/confirm-evil` also fails (its suffix is `confirm-evil`,
+ * not `/confirm`).
+ */
+export declare function isReenrollAllowed(method: unknown, rawUrl: unknown): boolean;
+//# sourceMappingURL=reenroll-allowlist.d.ts.map

package/dist/enforcement/reenroll-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reenroll-allowlist.d.ts","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAO1D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAO5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAU3E"}

package/dist/enforcement/reenroll-allowlist.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * REENROLL_ALLOWED — the enforced-re-enroll allowlist (spec §4.2).
+ *
+ * A session established via a recovery-code login carries `mustReenroll: true` in its
+ * bound claims (see {@link import('../request-auth/session-token-binder.js').BoundPrincipalClaims}).
+ * The {@link import('./global-enforcement.guard.js').GlobalEnforcementGuard} restricts
+ * such a session to ONLY the routes below — the minimal set needed to RE-SECURE the
+ * account (add a fresh authenticator device + refresh recovery codes) and to observe
+ * the restricted state (`/auth/me`, list devices) or leave it (`/auth/logout`). EVERY
+ * other authenticated route returns 403 `{ error: 'reenrollment_required' }`.
+ *
+ * FAIL-CLOSED: this is an allowlist, not a denylist — a route NOT listed here (incl. an
+ * unclassified/unknown route) is DENIED for a `mustReenroll` session. Adding a route
+ * that a re-enrolling user must reach means adding it HERE, deliberately.
+ *
+ * NOTE — allowlisted ≠ gate-clearing (spec §4.3): being on this list only lets the
+ * request THROUGH the gate; it does NOT clear `mustReenroll`. ONLY a successful
+ * `POST /account/mfa/devices/confirm` clears the flag (the account controller calls
+ * `binder.clearReenroll`). Regenerating codes is allowed but does not re-secure.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REENROLL_ALLOWED = void 0;
+exports.normalizeRequestPath = normalizeRequestPath;
+exports.isReenrollAllowed = isReenrollAllowed;
+/**
+ * The allowlist (spec §4.2). Paths are the framework-owned route paths; matched
+ * robustly by method + normalized-path suffix (see {@link isReenrollAllowed}) so a
+ * future global prefix, a trailing slash, or a query string never defeats the match.
+ */
+exports.REENROLL_ALLOWED = Object.freeze([
+    { method: 'POST', path: '/account/mfa/devices/begin' },
+    { method: 'POST', path: '/account/mfa/devices/confirm' },
+    { method: 'POST', path: '/account/mfa/recovery-codes/regenerate' },
+    { method: 'GET', path: '/account/mfa/devices' },
+    { method: 'GET', path: '/auth/me' },
+    { method: 'POST', path: '/auth/logout' },
+]);
+/**
+ * Normalize a raw request path for matching: drop the query string and any fragment,
+ * collapse a trailing slash (except the root). Never throws.
+ */
+function normalizeRequestPath(rawUrl) {
+    if (typeof rawUrl !== 'string' || rawUrl.length === 0)
+        return '';
+    // Strip query (?...) and fragment (#...).
+    let path = rawUrl.split('?', 1)[0].split('#', 1)[0];
+    // Collapse a single trailing slash (but keep the root "/").
+    if (path.length > 1 && path.endsWith('/'))
+        path = path.slice(0, -1);
+    return path;
+}
+/**
+ * True iff the (method, path) is on the enforced-re-enroll allowlist. Matching is
+ * case-insensitive on the method and SUFFIX-based on the normalized path — so
+ * `/api/account/mfa/devices/confirm` (a prefixed mount) still matches
+ * `/account/mfa/devices/confirm`. The path boundary is inherent: every `route.path`
+ * BEGINS with `/`, so `endsWith(route.path)` cannot spuriously match a longer segment
+ * name (`/evilaccount/...` does NOT end with `/account/...` — there is no `/` before
+ * `account`). `/account/mfa/devices/confirm-evil` also fails (its suffix is `confirm-evil`,
+ * not `/confirm`).
+ */
+function isReenrollAllowed(method, rawUrl) {
+    if (typeof method !== 'string')
+        return false;
+    const m = method.toUpperCase();
+    const path = normalizeRequestPath(rawUrl);
+    if (path === '')
+        return false;
+    for (const route of exports.REENROLL_ALLOWED) {
+        if (route.method !== m)
+            continue;
+        if (path === route.path || path.endsWith(route.path))
+            return true;
+    }
+    return false;
+}

package/dist/enforcement/reenroll-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reenroll-allowlist.js","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AA2BH,oDAOC;AAYD,8CAUC;AA/CD;;;;GAIG;AACU,QAAA,gBAAgB,GAAoC,MAAM,CAAC,MAAM,CAAC;IAC7E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE;IAClE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC/C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;IACnC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;CACzC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,MAAe;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,0CAA0C;IAC1C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACtD,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,MAAe,EAAE,MAAe;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,wBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -14,13 +14,53 @@
  * Depends on `@astram/core` (workspace); PEER-depends on `@nestjs/common`,
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
-export { ShieldModule, SHIELD_DECISION_AUTHORITY, type ShieldModuleOptions, type ShieldModuleAsyncOptions, } from './module/shield.module.js';
-export { Public, Classified, CLASSIFICATION_METADATA, } from './enforcement/classification.decorator.js';
+export { ShieldModule, SHIELD_DECISION_AUTHORITY, type ShieldModuleOptions, type ShieldModuleAsyncOptions, type RecordAuthorizationInputs, } from './module/shield.module.js';
+export { Public, Classified, CLASSIFICATION_METADATA, DEFAULT_CLASSIFIED_ACTION, normalizeClassification, } from './enforcement/classification.decorator.js';
+export type { Classification } from './enforcement/classification.decorator.js';
+export { OperationInventoryScanner } from './completeness/operation-inventory-scanner.js';
+export { CatalogReconciler, CatalogGatabilityError } from './completeness/catalog-reconciler.js';
+export type { CatalogStore, CatalogPermissionRow, ReconcileReport, } from './completeness/ports/catalog-store.js';
+export { SHIELD_SESSION_TOKEN_BINDER } from './request-auth/tokens.js';
+export { SessionTokenBinder } from './request-auth/session-token-binder.js';
+export type { BoundPrincipalClaims } from './request-auth/session-token-binder.js';
+export { resolveRequestPrincipal, principalFromClaims, extractBearerToken, } from './request-auth/request-principal.js';
+export { SHIELD_SESSION_FACTS_ALS, NO_SESSION_FACTS, type SessionFactsStore, } from './request-auth/session-facts-als.js';
 export { GlobalEnforcementGuard } from './enforcement/global-enforcement.guard.js';
 export { stubDecisionAuthority, type Effect, type CoreDecisionAuthority, type CoreDecision, type Principal, } from './enforcement/core-seam.js';
 export { Argon2idPasswordHasher, argon2idHasherProvider, SHIELD_PASSWORD_HASHER, type Argon2idParams, } from './authentication/argon2id-password-hasher.js';
 export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, } from './session/index.js';
+export { MariaDbRecordPermissionRuleAdapter, SHIELD_RECORD_RULE_PORT, type RuleQueryable, } from './authz/mariadb-record-rule-adapter.js';
+export { MariaDbRecordShareAdapter, SHIELD_RECORD_SHARE_PORT, type ShareQueryable, } from './authz/mariadb-record-share-adapter.js';
+export { RecordShareWriter, SHIELD_RECORD_SHARE_WRITER, ShareNotPermittedError, ShareStoreUnavailableError, type ShareInput, type ShareGranteeKind, type ShareTypeInfo, type ShareTypeResolver, type ShareAuditEvent, type ShareAuditSink, } from './authz/record-share-writer.js';
+export { makeShareDeleteCascade, type RecordDeletedHook, type ShareQueryFn, } from './authz/record-share-cascade.js';
+export { MariaDbCrossTenantGrantAdapter, SHIELD_CROSS_TENANT_GRANT_PORT, type GrantQueryable, } from './authz/mariadb-cross-tenant-grant-adapter.js';
+export { CrossTenantGrantWriter, SHIELD_CROSS_TENANT_GRANT_WRITER, GrantNotPermittedError, InvalidGrantError, GrantStoreUnavailableError, type GrantAuthorizeFn, type GrantAuditEvent, type GrantAuditSink, type GrantGranteeKind, type GrantScope, type OfferGrantInput, type AcceptGrantInput, type RevokeGrantInput, } from './authz/cross-tenant-grant-writer.js';
+export { ManifestOperationAuthorityAdapter, SHIELD_OPERATION_AUTHORITY_PORT, type OperationManifestEntry, } from './authz/manifest-operation-authority-adapter.js';
+export { buildRecordAuthorization } from './authz/wire-record-authorization.js';
 export { BootSequence, assertPoolBudget } from './boot/boot-sequence.js';
 export { APP_CONFIG } from './config/config.module.js';
-export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, } from './config/app-config.js';
+export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, } from './config/app-config.js';
+export { SHIELD_DB_POOL, SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
+export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
+export type { SessionView, SessionTokensView, SessionSuccess, LoginRequest, MfaChallengeResponse, LoginResponse, MfaRequest, MfaResponse, RefreshRequest, RefreshResponse, LogoutRequest, LogoutAck, } from './auth/dto.js';
+export { PersistenceModule } from './auth/persistence.module.js';
+export { AuthModule, type AuthModuleOptions } from './auth/auth.module.js';
+export { makeDefaultTotpVerifier, resolveTotpVerifier, hmacSha1 } from './auth/auth.module.js';
+export type { CredentialResolver, ResolvedCredential, RequiredFactor, } from '@astram/core';
+export type { FactorVerifier, FactorVerdict, Credential } from '@astram/core';
+export type { ProfileResolver, CurrentUserProfile, ProfileRole, ProfileTenant, } from './auth/profile-resolver.js';
+export type { CredentialWriter } from './auth/ports/credential-writer.js';
+export type { ResetTokenStore } from './auth/ports/reset-token-store.js';
+export type { EmailSender, EmailMessage } from './auth/ports/email-sender.js';
+export type { RecoveryCodeStore } from './auth/ports/recovery-code-store.js';
+export type { ProfileWriter } from './auth/ports/profile-writer.js';
+export type { SessionSweeper } from './auth/ports/session-sweeper.js';
+export type { MfaDeviceStore, MfaDevice } from './auth/ports/mfa-device-store.js';
+export type { AuditSink, AuthAuditEvent } from './auth/ports/audit-sink.js';
+export type { SessionFactsProjector } from './auth/ports/session-facts-projector.js';
+export { SHIELD_SESSION_FACTS_PROJECTOR } from './auth/tokens.js';
+export { AuthController } from './auth/auth.controller.js';
+export { PendingMfaStore } from './auth/pending-mfa-store.js';
+export { generateTotpSecret, buildOtpauthUri, generateRecoveryCodes, } from './auth/totp-enrollment.js';
+export { AccountController } from './auth/account.controller.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AAUnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAMhD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -16,7 +16,8 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = void 0;
+exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = void 0;
+exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = void 0;
 // The single registration seam.
 var shield_module_js_1 = require("./module/shield.module.js");
 Object.defineProperty(exports, "ShieldModule", { enumerable: true, get: function () { return shield_module_js_1.ShieldModule; } });
@@ -26,6 +27,38 @@ var classification_decorator_js_1 = require("./enforcement/classification.decora
 Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return classification_decorator_js_1.Public; } });
 Object.defineProperty(exports, "Classified", { enumerable: true, get: function () { return classification_decorator_js_1.Classified; } });
 Object.defineProperty(exports, "CLASSIFICATION_METADATA", { enumerable: true, get: function () { return classification_decorator_js_1.CLASSIFICATION_METADATA; } });
+Object.defineProperty(exports, "DEFAULT_CLASSIFIED_ACTION", { enumerable: true, get: function () { return classification_decorator_js_1.DEFAULT_CLASSIFIED_ACTION; } });
+Object.defineProperty(exports, "normalizeClassification", { enumerable: true, get: function () { return classification_decorator_js_1.normalizeClassification; } });
+// Auto-catalog: boot-time route reflection + catalog reconcile (register a @Classified
+// route → its permission auto-appears; route-less permissions orphaned). The consumer
+// supplies the CatalogStore DB impl (ADR-0003 — guard does no DB).
+var operation_inventory_scanner_js_1 = require("./completeness/operation-inventory-scanner.js");
+Object.defineProperty(exports, "OperationInventoryScanner", { enumerable: true, get: function () { return operation_inventory_scanner_js_1.OperationInventoryScanner; } });
+var catalog_reconciler_js_1 = require("./completeness/catalog-reconciler.js");
+Object.defineProperty(exports, "CatalogReconciler", { enumerable: true, get: function () { return catalog_reconciler_js_1.CatalogReconciler; } });
+Object.defineProperty(exports, "CatalogGatabilityError", { enumerable: true, get: function () { return catalog_reconciler_js_1.CatalogGatabilityError; } });
+// The request-auth layer (access token → Principal → decide()). The binder token is
+// exported so advanced consumers can inspect/override it; `SessionTokenBinder` +
+// `resolveRequestPrincipal` are exported for testing + reuse. The guard wires these
+// internally — a consumer does NOT hand-wire request auth.
+var tokens_js_1 = require("./request-auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_TOKEN_BINDER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SESSION_TOKEN_BINDER; } });
+var session_token_binder_js_1 = require("./request-auth/session-token-binder.js");
+Object.defineProperty(exports, "SessionTokenBinder", { enumerable: true, get: function () { return session_token_binder_js_1.SessionTokenBinder; } });
+var request_principal_js_1 = require("./request-auth/request-principal.js");
+Object.defineProperty(exports, "resolveRequestPrincipal", { enumerable: true, get: function () { return request_principal_js_1.resolveRequestPrincipal; } });
+Object.defineProperty(exports, "principalFromClaims", { enumerable: true, get: function () { return request_principal_js_1.principalFromClaims; } });
+Object.defineProperty(exports, "extractBearerToken", { enumerable: true, get: function () { return request_principal_js_1.extractBearerToken; } });
+// The per-request session-facts hot path (ADR-0011): the SINGLE shared
+// `AsyncLocalStorage` the enforcement guard ENTERS around decide() and the consumer's
+// app-owned `SessionFactsReader` READS. The consumer imports THIS exact singleton to
+// build an ALS-backed reader (swapping the null-facts slot in its authz wiring), so
+// both sides share one instance — the guard writes THIS request's cached grants, the
+// reader serves them to gate 5. `SessionFactsStore` is the store shape (mirrors core's
+// SessionFactsReader 1:1); `NO_SESSION_FACTS` is the fail-closed empty store.
+var session_facts_als_js_1 = require("./request-auth/session-facts-als.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_ALS", { enumerable: true, get: function () { return session_facts_als_js_1.SHIELD_SESSION_FACTS_ALS; } });
+Object.defineProperty(exports, "NO_SESSION_FACTS", { enumerable: true, get: function () { return session_facts_als_js_1.NO_SESSION_FACTS; } });
 // The global enforcement guard (framework-owned; exported so the enforcement
 // point is inspectable/testable, not so consumers re-wire it).
 //
@@ -68,6 +101,83 @@ Object.defineProperty(exports, "systemClockProvider", { enumerable: true, get: f
 Object.defineProperty(exports, "SHIELD_TOKEN_GENERATOR", { enumerable: true, get: function () { return index_js_1.SHIELD_TOKEN_GENERATOR; } });
 Object.defineProperty(exports, "SHIELD_REFRESH_HASHER", { enumerable: true, get: function () { return index_js_1.SHIELD_REFRESH_HASHER; } });
 Object.defineProperty(exports, "SHIELD_CLOCK", { enumerable: true, get: function () { return index_js_1.SHIELD_CLOCK; } });
+// The record-permit ADMIN-rule adapter (ADR-0003 / design §5.1): the concrete
+// `RecordPermissionRulePort` over the `record_permission_rule` table. Reads ADMIN
+// rules only; the framework-owned OWNER baseline is core's job (not a row here). An
+// empty table ⇒ owner-only access (core baseline), NOT a lockout. Injected into core's
+// wired decision authority by the consumer's authz wiring.
+var mariadb_record_rule_adapter_js_1 = require("./authz/mariadb-record-rule-adapter.js");
+Object.defineProperty(exports, "MariaDbRecordPermissionRuleAdapter", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_RULE_PORT", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.SHIELD_RECORD_RULE_PORT; } });
+// The per-record SHARE adapter (ADR-0003 / design §6): the concrete `RecordSharePort` over
+// the `record_share` table. Answers `hasShare` (user- OR role-granted shares, exact-or-`*`
+// action). No share ⇒ false; store outage ⇒ AuthorizationUnavailableError. Injected into
+// core's wired decision authority by the consumer's authz wiring.
+var mariadb_record_share_adapter_js_1 = require("./authz/mariadb-record-share-adapter.js");
+Object.defineProperty(exports, "MariaDbRecordShareAdapter", { enumerable: true, get: function () { return mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_SHARE_PORT", { enumerable: true, get: function () { return mariadb_record_share_adapter_js_1.SHIELD_RECORD_SHARE_PORT; } });
+// The WHO-MAY-SHARE write path (design §6.2, the Phase-3 invariant): share CREATION is
+// framework-bounded — only the record's OWNER (fetched tenant-scoped, never trusted from
+// input) may share an `owned`-type record; non-owners + grantees are rejected by
+// construction. Idempotent INSERT, DELETE on unshare, best-effort audit. Exposed as a
+// provider the consumer's share/unshare surface calls. The consumer supplies a
+// `ShareTypeResolver` (over the engine registry) + an optional `ShareAuditSink` — keeping
+// guard decoupled from `@astram/engine`.
+var record_share_writer_js_1 = require("./authz/record-share-writer.js");
+Object.defineProperty(exports, "RecordShareWriter", { enumerable: true, get: function () { return record_share_writer_js_1.RecordShareWriter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_SHARE_WRITER", { enumerable: true, get: function () { return record_share_writer_js_1.SHIELD_RECORD_SHARE_WRITER; } });
+Object.defineProperty(exports, "ShareNotPermittedError", { enumerable: true, get: function () { return record_share_writer_js_1.ShareNotPermittedError; } });
+Object.defineProperty(exports, "ShareStoreUnavailableError", { enumerable: true, get: function () { return record_share_writer_js_1.ShareStoreUnavailableError; } });
+// The delete-cascade (design §6.2 orphan-share cleanup): builds the guard-owned
+// `(typeKey, recordId, tenantId) => Promise<void>` the consumer wires into the engine's
+// OPTIONAL `onRecordDeleted` hook (the engine never imports guard — ADR-0003). Removes a
+// deleted record's `record_share` rows, tenant-scoped.
+var record_share_cascade_js_1 = require("./authz/record-share-cascade.js");
+Object.defineProperty(exports, "makeShareDeleteCascade", { enumerable: true, get: function () { return record_share_cascade_js_1.makeShareDeleteCascade; } });
+// The CROSS-TENANT GRANT adapter (ADR-0009 / Phase 4): the concrete `CrossTenantGrantPort` over
+// the `cross_tenant_grant` table. Answers `findActiveGrant` — the ONE active (accepted, unexpired,
+// unrevoked) consented grant matching (owning tenant, type, grantee user/role, scope+record). No
+// active grant ⇒ null; store outage ⇒ AuthorizationUnavailableError. Injected into core's wired
+// decision authority by the consumer's authz wiring.
+var mariadb_cross_tenant_grant_adapter_js_1 = require("./authz/mariadb-cross-tenant-grant-adapter.js");
+Object.defineProperty(exports, "MariaDbCrossTenantGrantAdapter", { enumerable: true, get: function () { return mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter; } });
+Object.defineProperty(exports, "SHIELD_CROSS_TENANT_GRANT_PORT", { enumerable: true, get: function () { return mariadb_cross_tenant_grant_adapter_js_1.SHIELD_CROSS_TENANT_GRANT_PORT; } });
+// The WHO-MAY-GRANT lifecycle write path (ADR-0009, the Phase-4 invariant): grant offer/accept/
+// revoke is framework-bounded — only an OWNING-tenant admin may OFFER (the grantee's own tenant
+// can NEVER mint a grant), only a GRANTEE-tenant member may ACCEPT, EITHER side may REVOKE. Hard
+// non-wildcard/non-empty action ceiling + mandatory future expiry enforced at offer. Audit on
+// BOTH tenants (both tenant ids in structured fields, no raw uuid in a message). Exposed as a
+// provider the consumer's grant surface calls. The consumer supplies a `GrantAuthorizeFn`
+// (may this principal perform share/accept/revoke in this tenant? — resolved via the app's own
+// `decide()`) + an optional `GrantAuditSink` — keeping guard decoupled from `@astram/engine` +
+// the app.
+var cross_tenant_grant_writer_js_1 = require("./authz/cross-tenant-grant-writer.js");
+Object.defineProperty(exports, "CrossTenantGrantWriter", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.CrossTenantGrantWriter; } });
+Object.defineProperty(exports, "SHIELD_CROSS_TENANT_GRANT_WRITER", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.SHIELD_CROSS_TENANT_GRANT_WRITER; } });
+Object.defineProperty(exports, "GrantNotPermittedError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.GrantNotPermittedError; } });
+Object.defineProperty(exports, "InvalidGrantError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.InvalidGrantError; } });
+Object.defineProperty(exports, "GrantStoreUnavailableError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.GrantStoreUnavailableError; } });
+// The DELEGATION / trusted-operation authority adapter (ADR-0008 / Phase 4): the concrete
+// `OperationAuthorityPort` over a DECLARED operation manifest (no DB — declared metadata). Answers
+// `resolveDelegatedAuthority` — a scoped, non-wildcard authority for a trusted operation's step,
+// or undefined (pass-through, the common case). A malformed / wildcard declared entry is dropped
+// (fail-closed ⇒ undefined). An EMPTY manifest ⇒ every lookup undefined = pass-through. Injected
+// into core's wired decision authority by the consumer's authz wiring.
+var manifest_operation_authority_adapter_js_1 = require("./authz/manifest-operation-authority-adapter.js");
+Object.defineProperty(exports, "ManifestOperationAuthorityAdapter", { enumerable: true, get: function () { return manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter; } });
+Object.defineProperty(exports, "SHIELD_OPERATION_AUTHORITY_PORT", { enumerable: true, get: function () { return manifest_operation_authority_adapter_js_1.SHIELD_OPERATION_AUTHORITY_PORT; } });
+// The framework-owned record-tier WIRING (design §9, Phase 5): constructs the four
+// record-tier adapters over a supplied pool + manifest and returns the fully-wired core
+// DecisionAuthority. `ShieldModule.forRoot({ recordAuthorization })` uses this internally
+// (the preferred path — the app never touches the adapters). Exported so a consumer's
+// TESTS can build the same wired authority directly from the app-owned inputs WITHOUT
+// re-implementing the adapter construction (the app still cannot substitute a record
+// adapter — it supplies only `RecordAuthorizationInputs`, which is re-exported from the
+// ShieldModule seam above). NOTE: this value-imports `@astram/core` + the adapters;
+// `ShieldModule` itself does NOT import it statically (it lazy-loads it) to keep the
+// enforcement-only path core-free.
+var wire_record_authorization_js_1 = require("./authz/wire-record-authorization.js");
+Object.defineProperty(exports, "buildRecordAuthorization", { enumerable: true, get: function () { return wire_record_authorization_js_1.buildRecordAuthorization; } });
 // Boot infrastructure (ADR-0018 connection-pool budget assertion). `BootModule`
 // itself is NOT exported — it is composed internally by `ShieldModule.forRoot()`.
 var boot_sequence_js_1 = require("./boot/boot-sequence.js");
@@ -86,3 +196,90 @@ Object.defineProperty(exports, "loadPoolBudget", { enumerable: true, get: functi
 Object.defineProperty(exports, "evaluatePoolBudget", { enumerable: true, get: function () { return app_config_js_1.evaluatePoolBudget; } });
 Object.defineProperty(exports, "DEFAULT_POOL_BUDGET", { enumerable: true, get: function () { return app_config_js_1.DEFAULT_POOL_BUDGET; } });
 Object.defineProperty(exports, "SCHEMA_SVC_POOL_HARD_CAP", { enumerable: true, get: function () { return app_config_js_1.SCHEMA_SVC_POOL_HARD_CAP; } });
+// Phase 0b Auth-surface config (additive): the DB/Redis/lifetime loaders + the
+// required-secret resolver/gate + the new config shapes.
+Object.defineProperty(exports, "loadDbConfig", { enumerable: true, get: function () { return app_config_js_1.loadDbConfig; } });
+Object.defineProperty(exports, "loadRedisConfig", { enumerable: true, get: function () { return app_config_js_1.loadRedisConfig; } });
+Object.defineProperty(exports, "loadSessionLifetimes", { enumerable: true, get: function () { return app_config_js_1.loadSessionLifetimes; } });
+Object.defineProperty(exports, "loadRefreshHmacKey", { enumerable: true, get: function () { return app_config_js_1.loadRefreshHmacKey; } });
+Object.defineProperty(exports, "assertRefreshHmacKey", { enumerable: true, get: function () { return app_config_js_1.assertRefreshHmacKey; } });
+Object.defineProperty(exports, "DEFAULT_DB_CONFIG", { enumerable: true, get: function () { return app_config_js_1.DEFAULT_DB_CONFIG; } });
+Object.defineProperty(exports, "DEFAULT_REDIS_URL", { enumerable: true, get: function () { return app_config_js_1.DEFAULT_REDIS_URL; } });
+// ---------------------------------------------------------------------------
+// Phase 0b Auth surface (framework-owned login → session, spec §2/§3/§4).
+//
+// PRELUDE CONTRACT (this commit): the frozen DI tokens, endpoint DTO shapes, the
+// credential-resolver skeleton (Team A fills), and the composition module
+// skeletons (Team B fills). Team C's `/auth/*` controllers consume
+// SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY. All ADDITIVE — the enforcement
+// path is untouched; ShieldModule wiring is deferred to the integration owner.
+// ---------------------------------------------------------------------------
+// Shared DI provider tokens (the seams the teams bind/consume — see tokens.ts for
+// who provides/consumes each).
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_2.SHIELD_DB_POOL; } });
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUTHENTICATOR; } });
+Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_AUTHORITY; } });
+// Account & credential-surface seams (forgot/reset, change-password, MFA
+// enrollment, profile edit) — all OPTIONAL, consumer-plugged through
+// ShieldModule.forRoot. See tokens.ts for who provides/consumes each.
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_WRITER; } });
+Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RESET_TOKEN_STORE; } });
+Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_EMAIL_SENDER; } });
+Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RECOVERY_CODE_STORE; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_WRITER; } });
+Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_SWEEPER; } });
+// The auth-surface audit sink seam (the first auth audit event — recovery login).
+Object.defineProperty(exports, "SHIELD_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUDIT_SINK; } });
+// The multi-device MFA store seam (multiple independent authenticator devices).
+Object.defineProperty(exports, "SHIELD_MFA_DEVICE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_MFA_DEVICE_STORE; } });
+// The login totp-verifier OVERRIDE seam (Phase 2 — plug an OR-matching verifier).
+Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_TOTP_VERIFIER_OVERRIDE; } });
+// The credential-store contract (skeleton — Team A implements the SELECT).
+var mariadb_credential_resolver_js_1 = require("./authentication/mariadb-credential-resolver.js");
+Object.defineProperty(exports, "MariaDbCredentialResolver", { enumerable: true, get: function () { return mariadb_credential_resolver_js_1.MariaDbCredentialResolver; } });
+// The composition module skeletons (Team B fills the factory bodies; the
+// integration owner imports AuthModule into ShieldModule — see auth.module.ts /
+// DONE.md).
+var persistence_module_js_1 = require("./auth/persistence.module.js");
+Object.defineProperty(exports, "PersistenceModule", { enumerable: true, get: function () { return persistence_module_js_1.PersistenceModule; } });
+var auth_module_js_1 = require("./auth/auth.module.js");
+Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_js_1.AuthModule; } });
+// Phase-2 verifier-seam helpers. `makeDefaultTotpVerifier()` builds the framework's
+// DEFAULT single-secret TOTP FactorVerifier (loading the ESM-only core factory lazily,
+// the CJS↔ESM invariant) so a CONSUMER can WRAP it (e.g. an OR-matching multi-device
+// verifier delegates to it per device secret) WITHOUT importing `@astram/core`
+// directly. `resolveTotpVerifier(override, default)` is the pure `override ?? default`
+// decision the authenticator composition uses (exported for unit testing the seam).
+// `hmacSha1` is the node:crypto HMAC-SHA1 primitive the core TOTP verifier needs.
+var auth_module_js_2 = require("./auth/auth.module.js");
+Object.defineProperty(exports, "makeDefaultTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.makeDefaultTotpVerifier; } });
+Object.defineProperty(exports, "resolveTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.resolveTotpVerifier; } });
+Object.defineProperty(exports, "hmacSha1", { enumerable: true, get: function () { return auth_module_js_2.hmacSha1; } });
+var tokens_js_3 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_3.SHIELD_SESSION_FACTS_PROJECTOR; } });
+// The framework-owned `/auth/*` HTTP controller (Team C) + its pending-MFA store.
+// The controller CONSUMES SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY and the
+// PendingMfaStore. It is EXPORTED so AuthModule (Team B) / the integration owner
+// registers it in the module's `controllers` and provides `PendingMfaStore` — this
+// file (Team C) does NOT edit auth.module.ts. See auth.controller.ts header.
+var auth_controller_js_1 = require("./auth/auth.controller.js");
+Object.defineProperty(exports, "AuthController", { enumerable: true, get: function () { return auth_controller_js_1.AuthController; } });
+var pending_mfa_store_js_1 = require("./auth/pending-mfa-store.js");
+Object.defineProperty(exports, "PendingMfaStore", { enumerable: true, get: function () { return pending_mfa_store_js_1.PendingMfaStore; } });
+// The pure TOTP-enrollment helpers (Phase 4 MFA). Re-exported for consumers/tests
+// that need them; the multi-device MFA routes (Phase 3) reuse them to mint a device
+// secret + provisioning URI + recovery codes. (The old in-memory
+// PendingEnrollmentStore is gone — a pending device is now a row in the MfaDeviceStore.)
+var totp_enrollment_js_1 = require("./auth/totp-enrollment.js");
+Object.defineProperty(exports, "generateTotpSecret", { enumerable: true, get: function () { return totp_enrollment_js_1.generateTotpSecret; } });
+Object.defineProperty(exports, "buildOtpauthUri", { enumerable: true, get: function () { return totp_enrollment_js_1.buildOtpauthUri; } });
+Object.defineProperty(exports, "generateRecoveryCodes", { enumerable: true, get: function () { return totp_enrollment_js_1.generateRecoveryCodes; } });
+// The framework-owned `/account/*` self-scoped HTTP controller — the authenticated
+// user acting on THEIR OWN credential/profile (change-password today; MFA/profile
+// later). Registered by AuthModule alongside AuthController under `auth: true`.
+var account_controller_js_1 = require("./auth/account.controller.js");
+Object.defineProperty(exports, "AccountController", { enumerable: true, get: function () { return account_controller_js_1.AccountController; } });

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;AAEH,gCAAgC;AAChC,8DASmC;AARjC,gHAAA,YAAY,OAAA;AACZ,6HAAA,yBAAyB,OAAA;AAS3B,wEAAwE;AACxE,yFAMmD;AALjD,qHAAA,MAAM,OAAA;AACN,yHAAA,UAAU,OAAA;AACV,sIAAA,uBAAuB,OAAA;AACvB,wIAAA,yBAAyB,OAAA;AACzB,sIAAA,uBAAuB,OAAA;AAIzB,uFAAuF;AACvF,sFAAsF;AACtF,mEAAmE;AACnE,gGAA0F;AAAjF,2IAAA,yBAAyB,OAAA;AAClC,8EAAiG;AAAxF,0HAAA,iBAAiB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AAOlD,oFAAoF;AACpF,iFAAiF;AACjF,oFAAoF;AACpF,2DAA2D;AAC3D,sDAAuE;AAA9D,wHAAA,2BAA2B,OAAA;AACpC,kFAA4E;AAAnE,6HAAA,kBAAkB,OAAA;AAE3B,4EAI6C;AAH3C,+HAAA,uBAAuB,OAAA;AACvB,2HAAA,mBAAmB,OAAA;AACnB,0HAAA,kBAAkB,OAAA;AAGpB,uEAAuE;AACvE,sFAAsF;AACtF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,uFAAuF;AACvF,8EAA8E;AAC9E,4EAI6C;AAH3C,gIAAA,wBAAwB,OAAA;AACxB,wHAAA,gBAAgB,OAAA;AAIlB,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,+EAA+E;AAC/E,yFAAmF;AAA1E,qIAAA,sBAAsB,OAAA;AAE/B,6EAA6E;AAC7E,gFAAgF;AAChF,2CAA2C;AAC3C,2DAMoC;AALlC,qHAAA,qBAAqB,OAAA;AAOvB,sEAAsE;AACtE,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,4FAKsD;AAJpD,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AAIxB,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,wDAAwD;AACxD,+CAc4B;AAb1B,qHAAA,yBAAyB,OAAA;AACzB,uHAAA,2BAA2B,OAAA;AAC3B,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,uGAAA,WAAW,OAAA;AACX,wHAAA,4BAA4B,OAAA;AAC5B,iHAAA,qBAAqB,OAAA;AACrB,+GAAA,mBAAmB,OAAA;AACnB,kHAAA,sBAAsB,OAAA;AACtB,iHAAA,qBAAqB,OAAA;AACrB,wGAAA,YAAY,OAAA;AAGd,8EAA8E;AAC9E,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,2DAA2D;AAC3D,yFAIgD;AAH9C,oJAAA,kCAAkC,OAAA;AAClC,yIAAA,uBAAuB,OAAA;AAIzB,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,kEAAkE;AAClE,2FAIiD;AAH/C,4IAAA,yBAAyB,OAAA;AACzB,2IAAA,wBAAwB,OAAA;AAI1B,uFAAuF;AACvF,yFAAyF;AACzF,iFAAiF;AACjF,sFAAsF;AACtF,+EAA+E;AAC/E,0FAA0F;AAC1F,yCAAyC;AACzC,yEAWwC;AAVtC,2HAAA,iBAAiB,OAAA;AACjB,oIAAA,0BAA0B,OAAA;AAC1B,gIAAA,sBAAsB,OAAA;AACtB,oIAAA,0BAA0B,OAAA;AAS5B,gFAAgF;AAChF,wFAAwF;AACxF,yFAAyF;AACzF,uDAAuD;AACvD,2EAIyC;AAHvC,iIAAA,sBAAsB,OAAA;AAKxB,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,gGAAgG;AAChG,qDAAqD;AACrD,uGAIuD;AAHrD,uJAAA,8BAA8B,OAAA;AAC9B,uJAAA,8BAA8B,OAAA;AAIhC,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,8FAA8F;AAC9F,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,WAAW;AACX,qFAc8C;AAb5C,sIAAA,sBAAsB,OAAA;AACtB,gJAAA,gCAAgC,OAAA;AAChC,sIAAA,sBAAsB,OAAA;AACtB,iIAAA,iBAAiB,OAAA;AACjB,0IAAA,0BAA0B,OAAA;AAW5B,0FAA0F;AAC1F,mGAAmG;AACnG,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,uEAAuE;AACvE,2GAIyD;AAHvD,4JAAA,iCAAiC,OAAA;AACjC,0JAAA,+BAA+B,OAAA;AAIjC,mFAAmF;AACnF,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,wFAAwF;AACxF,oFAAoF;AACpF,qFAAqF;AACrF,mCAAmC;AACnC,qFAAgF;AAAvE,wIAAA,wBAAwB,OAAA;AAEjC,gFAAgF;AAChF,kFAAkF;AAClF,4DAAyE;AAAhE,gHAAA,YAAY,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAEvC,8EAA8E;AAC9E,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,iDAAiD;AACjD,8DAAuD;AAA9C,8GAAA,UAAU,OAAA;AACnB,wDAsBgC;AArB9B,8GAAA,aAAa,OAAA;AACb,+GAAA,cAAc,OAAA;AACd,mHAAA,kBAAkB,OAAA;AAClB,oHAAA,mBAAmB,OAAA;AACnB,yHAAA,wBAAwB,OAAA;AAKxB,+EAA+E;AAC/E,yDAAyD;AACzD,6GAAA,YAAY,OAAA;AACZ,gHAAA,eAAe,OAAA;AACf,qHAAA,oBAAoB,OAAA;AACpB,mHAAA,kBAAkB,OAAA;AAClB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AACjB,kHAAA,iBAAiB,OAAA;AAMnB,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,iFAAiF;AACjF,0EAA0E;AAC1E,mEAAmE;AACnE,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAE9E,kFAAkF;AAClF,+BAA+B;AAC/B,8CAsB0B;AArBxB,2GAAA,cAAc,OAAA;AACd,yGAAA,YAAY,OAAA;AACZ,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,qHAAA,wBAAwB,OAAA;AACxB,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,gHAAA,mBAAmB,OAAA;AACnB,uHAAA,0BAA0B,OAAA;AAC1B,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,kFAAkF;AAClF,8GAAA,iBAAiB,OAAA;AACjB,uEAAuE;AACvE,oHAAA,uBAAuB,OAAA;AACvB,kFAAkF;AAClF,0HAAA,6BAA6B,OAAA;AAG/B,2EAA2E;AAC3E,kGAA4F;AAAnF,2IAAA,yBAAyB,OAAA;AAmBlC,yEAAyE;AACzE,gFAAgF;AAChF,YAAY;AACZ,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA;AAC1B,wDAA2E;AAAlE,4GAAA,UAAU,OAAA;AACnB,oFAAoF;AACpF,uFAAuF;AACvF,qFAAqF;AACrF,+EAA+E;AAC/E,uFAAuF;AACvF,oFAAoF;AACpF,kFAAkF;AAClF,wDAA+F;AAAtF,yHAAA,uBAAuB,OAAA;AAAE,qHAAA,mBAAmB,OAAA;AAAE,0GAAA,QAAQ,OAAA;AAmD/D,8CAAkE;AAAzD,2HAAA,8BAA8B,OAAA;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,mFAAmF;AACnF,6EAA6E;AAC7E,gEAA2D;AAAlD,oHAAA,cAAc,OAAA;AACvB,oEAA8D;AAArD,uHAAA,eAAe,OAAA;AACxB,kFAAkF;AAClF,oFAAoF;AACpF,iEAAiE;AACjE,yFAAyF;AACzF,gEAImC;AAHjC,wHAAA,kBAAkB,OAAA;AAClB,qHAAA,eAAe,OAAA;AACf,2HAAA,qBAAqB,OAAA;AAGvB,mFAAmF;AACnF,kFAAkF;AAClF,gFAAgF;AAChF,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA"}

package/dist/module/shield-tokens.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Framework DI tokens that must be importable WITHOUT pulling in `ShieldModule`
+ * itself (which would create import cycles: `ShieldModule` → `EnforcementModule` →
+ * the guard → back to a token declared in `ShieldModule`). Declaring the shared
+ * tokens here lets both `shield.module.ts` and the enforcement guard depend on them
+ * with no cycle. `shield.module.ts` re-exports these for the public barrel.
+ */
+/**
+ * The Core decision authority (`@astram/core`'s `DecisionAuthority`) — the single
+ * ADR-0001 decision entry both the global enforcement guard and the engine's
+ * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
+ * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ */
+export declare const SHIELD_DECISION_AUTHORITY: unique symbol;
+//# sourceMappingURL=shield-tokens.d.ts.map

package/dist/module/shield-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-tokens.d.ts","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC"}

package/dist/module/shield-tokens.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Framework DI tokens that must be importable WITHOUT pulling in `ShieldModule`
+ * itself (which would create import cycles: `ShieldModule` → `EnforcementModule` →
+ * the guard → back to a token declared in `ShieldModule`). Declaring the shared
+ * tokens here lets both `shield.module.ts` and the enforcement guard depend on them
+ * with no cycle. `shield.module.ts` re-exports these for the public barrel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHIELD_DECISION_AUTHORITY = void 0;
+/**
+ * The Core decision authority (`@astram/core`'s `DecisionAuthority`) — the single
+ * ADR-0001 decision entry both the global enforcement guard and the engine's
+ * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
+ * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ */
+exports.SHIELD_DECISION_AUTHORITY = Symbol('SHIELD_DECISION_AUTHORITY');

package/dist/module/shield-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-tokens.js","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH;;;;;GAKG;AACU,QAAA,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC"}