@astram/guard 0.15.0 → 0.16.0

package/dist/auth/auth.module.d.ts

@@ -62,7 +62,7 @@
  * `createIdentityBroker`/`createTotpFactorVerifier`) are pure; the adapters + the
  * node:crypto HMAC live in guard. Core stays zero-dep + unchanged.
  */
-import { type DynamicModule } from '@nestjs/common';
+import { type DynamicModule, type Provider } from '@nestjs/common';
 import type { CredentialResolver, HmacSha1, FactorVerifier } from '@astram/core';
 import type { SessionFactsProjector } from './ports/session-facts-projector.js';
 import type { ScopeSubtreeResolver } from './ports/scope-subtree-resolver.js';
@@ -106,6 +106,13 @@ export declare function resolveTotpVerifier(override: FactorVerifier | null | un
  * consumer's built CJS dist. Async because of {@link loadCore}.
  */
 export declare function makeDefaultTotpVerifier(): Promise<FactorVerifier>;
+/** DI token for the single-layout privilege probe hook (a no-op in the four layout). */
+export declare const SHIELD_SINGLE_LAYOUT_PROBE: unique symbol;
+/**
+ * Single-database-layout spec §5.F (ADR-0041): the privilege probe runs once at bootstrap on this
+ * module's runtime pool, single layout only (four layout: a no-op hook). Never blocks boot.
+ */
+export declare const singleLayoutProbeProvider: Provider;
 /**
  * Options for {@link AuthModule.forRoot} — registration-time collaborators the
  * consumer plugs through {@link ShieldModule.forRoot}.

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAanF,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AA6GtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AA6jBD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA6ID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAmGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA+K/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAaxB,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AA8GtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAsPD,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAWvC,CAAC;AAyUF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA6ID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAmGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAgL/D"}

package/dist/auth/auth.module.js

@@ -104,7 +104,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 var AuthModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthModule = exports.hmacSha1 = void 0;
+exports.AuthModule = exports.singleLayoutProbeProvider = exports.SHIELD_SINGLE_LAYOUT_PROBE = exports.hmacSha1 = void 0;
 exports.resolveTotpVerifier = resolveTotpVerifier;
 exports.makeDefaultTotpVerifier = makeDefaultTotpVerifier;
 exports.resolveDefaultEmailSender = resolveDefaultEmailSender;
@@ -113,6 +113,7 @@ const node_crypto_1 = require("node:crypto");
 const app_config_js_1 = require("../config/app-config.js");
 const config_module_js_1 = require("../config/config.module.js");
 const migration_ledger_check_js_1 = require("../boot/migration-ledger-check.js");
+const single_layout_probe_js_1 = require("../boot/single-layout-probe.js");
 const migrations_dir_js_1 = require("../migrations-dir.js");
 const argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 const mariadb_credential_resolver_js_1 = require("../authentication/mariadb-credential-resolver.js");
@@ -387,6 +388,22 @@ const migrationLedgerCheckProvider = {
     registry ?? null),
     inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG, { token: migration_ledger_check_js_1.SHIELD_MIGRATION_LEDGER_REGISTRY, optional: true }],
 };
+/** DI token for the single-layout privilege probe hook (a no-op in the four layout). */
+exports.SHIELD_SINGLE_LAYOUT_PROBE = Symbol('SHIELD_SINGLE_LAYOUT_PROBE');
+/**
+ * Single-database-layout spec §5.F (ADR-0041): the privilege probe runs once at bootstrap on this
+ * module's runtime pool, single layout only (four layout: a no-op hook). Never blocks boot.
+ */
+exports.singleLayoutProbeProvider = {
+    provide: exports.SHIELD_SINGLE_LAYOUT_PROBE,
+    useFactory: (pool, config) => {
+        const schemas = (0, app_config_js_1.frameworkSchemasOf)(config);
+        if (schemas.layout !== 'single')
+            return { onApplicationBootstrap: () => undefined };
+        return new single_layout_probe_js_1.SingleLayoutProbeBoot(async (sql, params) => (await pool.query(sql, params)), schemas.app);
+    },
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+};
 /** Boot-time warnings from the auth composition (dev email logger, disabled email, …). */
 const authBootLogger = new common_1.Logger('ShieldAuth');
 /**
@@ -1029,6 +1046,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 resetLimiterProvider,
                 // spec 5.D: the guard migrations are in the ledger (once at bootstrap; production fails).
                 migrationLedgerCheckProvider,
+                exports.singleLayoutProbeProvider,
             ],
             exports: [
                 tokens_js_1.SHIELD_AUTHENTICATOR,

package/dist/boot/boot-sequence.d.ts

@@ -35,6 +35,12 @@ export declare class BootSequence implements OnApplicationBootstrap {
 }
 /** The boot log line naming the resolved framework databases (names only, spec 5.E). */
 export declare function frameworkDatabasesLogLine(s: FrameworkSchemas): string;
+/**
+ * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
+ * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
+ * variable only, never its value.
+ */
+export declare function shieldDbNameIgnoredWarning(env: NodeJS.ProcessEnv): string | undefined;
 /**
  * Validate a {@link PoolBudgetConfig} against the ADR-0018 budget. Exported so
  * unit tests can assert the throw/no-throw contract directly without booting

package/dist/boot/boot-sequence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAuB5D"}
+{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAKrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAsC5D"}

package/dist/boot/boot-sequence.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BootSequence = void 0;
 exports.frameworkDatabasesLogLine = frameworkDatabasesLogLine;
+exports.shieldDbNameIgnoredWarning = shieldDbNameIgnoredWarning;
 exports.assertPoolBudget = assertPoolBudget;
 const common_1 = require("@nestjs/common");
 const config_module_js_1 = require("../config/config.module.js");
@@ -43,6 +44,10 @@ let BootSequence = class BootSequence {
         // configurable-framework-db spec 5.E: the resolved database names, once per boot. Names
         // only — never a user, password, host or connection string.
         this.logger.log(frameworkDatabasesLogLine((0, app_config_js_1.frameworkSchemasOf)(this.config)));
+        // Spec 5.C/AC-1: SHIELD_DB_NAME is read only in the single layout; say so when it is ignored.
+        const ignored = shieldDbNameIgnoredWarning(process.env);
+        if (ignored !== undefined)
+            this.logger.warn(ignored);
         await this.assertConnectionPoolReady();
         // Future boot-time assertions attach here (each fail-closed). The migration ledger check
         // (spec 5.D) needs the runtime pool, so it runs from AuthModule (`auth: true`) and from
@@ -71,9 +76,24 @@ exports.BootSequence = BootSequence = __decorate([
 ], BootSequence);
 /** The boot log line naming the resolved framework databases (names only, spec 5.E). */
 function frameworkDatabasesLogLine(s) {
+    if (s.layout === 'single')
+        return `Shield databases: layout=single database=${s.app}`;
     return (`Shield databases: namespace=${s.namespace} app=${s.app} identity=${s.identity} ` +
         `authz=${s.authz} audit=${s.audit}`);
 }
+/**
+ * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
+ * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
+ * variable only, never its value.
+ */
+function shieldDbNameIgnoredWarning(env) {
+    if (env.SHIELD_DB_LAYOUT === 'single')
+        return undefined;
+    const v = env.SHIELD_DB_NAME;
+    if (v === undefined || v.trim() === '')
+        return undefined;
+    return 'SHIELD_DB_NAME is read only when SHIELD_DB_LAYOUT=single; ignored.';
+}
 /**
  * Validate a {@link PoolBudgetConfig} against the ADR-0018 budget. Exported so
  * unit tests can assert the throw/no-throw contract directly without booting
@@ -90,13 +110,25 @@ function assertPoolBudget(cfg) {
             'which exceeds the hard cap of 2. DDL is rare + serialized per tenant ' +
             '(ADR-0014 §7) — keep this pool tiny (1–2).');
     }
+    if (!e.withinUserBudget) {
+        throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): single layout needs ' +
+            `${e.requiredConnections} connections (workers(${cfg.workers}) × ` +
+            `${e.perWorkerConnections} + headroom(${cfg.headroom})) but the account allows ` +
+            `${cfg.maxUserConnections} (APP_DB_MAX_USER_CONNECTIONS). Reduce POOL_MAX_CORE, ` +
+            'POOL_MAX_ENGINE, APP_AUTHZ_POOL_MAX, POOL_WORKERS or POOL_HEADROOM, or raise ' +
+            'MAX_USER_CONNECTIONS on the account (ADR-0041).');
+    }
     if (!e.withinBudget) {
         throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): required ' +
             `connections ${e.requiredConnections} exceed max_connections ` +
             `${cfg.maxConnections}. Budget = workers(${cfg.workers}) × ` +
             `Σ(per-account pool max)(${e.perWorkerConnections}) + headroom(` +
             `${cfg.headroom}) = ${e.requiredConnections} > ${cfg.maxConnections}. ` +
-            'Reduce a per-account pool cap, the worker count, or raise ' +
-            'max_connections (and MariaDB my.cnf) to restore the budget.');
+            (cfg.layout === 'single'
+                ? 'Single layout: one account opens POOL_MAX_CORE + POOL_MAX_ENGINE (unset ⇒ ' +
+                    'APP_DB_MAX_CONNECTIONS, else 10) + APP_AUTHZ_POOL_MAX per worker; set POOL_MAX_ENGINE ' +
+                    'explicitly, lower a pool cap or the worker count, or raise max_connections.'
+                : 'Reduce a per-account pool cap, the worker count, or raise ' +
+                    'max_connections (and MariaDB my.cnf) to restore the budget.'));
     }
 }

package/dist/boot/single-layout-probe.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Single-database-layout boot privilege probe (single-database-layout spec §5.F, Req 7, AC-8,
+ * ADR-0041).
+ *
+ * With `SHIELD_DB_LAYOUT=single` the four framework modules share one database, so the isolation
+ * the four-database grant matrix gave is partly gone. Which protections are really lost depends on
+ * what the runtime account may do, so this reads (never writes) `information_schema`
+ * USER_PRIVILEGES / SCHEMA_PRIVILEGES / TABLE_PRIVILEGES / COLUMN_PRIVILEGES / APPLICABLE_ROLES for `CURRENT_USER()`, once at boot, and
+ * derives the five protections lost (spec §5.F). It does not look for `prune_audit`: MariaDB hides
+ * a routine from an account without EXECUTE on it, which the runtime account must not have (spec
+ * v3); `audit:prune` reports a missing routine itself.
+ *
+ * `GRANT ... TO PUBLIC` (MariaDB 10.11+) applies to every account but information_schema shows
+ * those rows only to privileged accounts (verified on 10.11 and 11.4: a plain account sees none).
+ * `SHOW GRANTS` for the current user needs no privilege and does list them, so its `TO PUBLIC`
+ * lines are parsed and merged with the information_schema rows. Its routine-level lines
+ * (`ON PROCEDURE|FUNCTION`) are the only view of routine privileges the account has: any such grant
+ * on the database loses the retention floor. An unparsable line of the account's own is ignored, an
+ * unparsable PUBLIC or routine line fails closed; a failing `SHOW GRANTS`
+ * fails closed like any other failed read.
+ *
+ * The probe never blocks boot (the operator's ack already accepted the risk) and is never on the
+ * request path (Shield #12). Warning lines carry no credential and no host (Shield #10): a failed
+ * query's driver message is dropped.
+ */
+import { Logger, type OnApplicationBootstrap } from '@nestjs/common';
+/** Runs one parameterized read on the runtime pool (a mariadb `Pool.query` fits). */
+export type ProbeQuery = (sql: string, params?: unknown[]) => Promise<unknown[]>;
+/** Id of a protection the single layout can lose. */
+export type LostProtectionId = 'append-only-audit' | 'no-runtime-ddl' | 'schema-separation' | 'retention-floor' | 'separate-ddl-account';
+/** One lost protection: id, the invariant it belongs to, and the operator-facing text. */
+export interface LostProtection {
+    readonly id: LostProtectionId;
+    /** The Shield invariant citation, e.g. `Shield #6`. */
+    readonly invariant: string;
+    readonly text: string;
+}
+/** The probe outcome. `readFailed` ⇒ the privileges could not be read (all five reported). */
+export interface SingleLayoutProbe {
+    readonly lost: readonly LostProtection[];
+    readonly readFailed: boolean;
+}
+/**
+ * Derive the protections the runtime account has lost. Never throws, and never reports the audit
+ * wall intact when it cannot see the grants: a failed query, a runtime account whose own
+ * SELECT+INSERT on the database is invisible, or an account with roles (not inspected) reports all
+ * five with `readFailed`.
+ */
+export declare function probeSingleLayoutPrivileges(query: ProbeQuery, database: string): Promise<SingleLayoutProbe>;
+/**
+ * The boot warning: a header naming the database and ADR-0041, then one line per lost protection
+ * citing its invariant. No credential, host or driver message.
+ */
+export declare function singleLayoutWarningLines(probe: SingleLayoutProbe, database: string): string[];
+/**
+ * Runs the probe once at application bootstrap on the runtime pool and logs the warning. Never
+ * throws, so boot is never blocked (spec §5.F).
+ */
+export declare class SingleLayoutProbeBoot implements OnApplicationBootstrap {
+    private readonly query;
+    private readonly database;
+    private readonly logger;
+    constructor(query: ProbeQuery, database: string, logger?: Pick<Logger, 'warn'>);
+    onApplicationBootstrap(): Promise<void>;
+}
+//# sourceMappingURL=single-layout-probe.d.ts.map

package/dist/boot/single-layout-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-layout-probe.d.ts","sourceRoot":"","sources":["../../src/boot/single-layout-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAErE,qFAAqF;AACrF,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAEjF,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAoMD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,CAAC,CAoG5B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB7F;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAwB;IAGhE,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;CAI9C"}

package/dist/boot/single-layout-probe.js

@@ -0,0 +1,334 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SingleLayoutProbeBoot = void 0;
+exports.probeSingleLayoutPrivileges = probeSingleLayoutPrivileges;
+exports.singleLayoutWarningLines = singleLayoutWarningLines;
+/**
+ * Single-database-layout boot privilege probe (single-database-layout spec §5.F, Req 7, AC-8,
+ * ADR-0041).
+ *
+ * With `SHIELD_DB_LAYOUT=single` the four framework modules share one database, so the isolation
+ * the four-database grant matrix gave is partly gone. Which protections are really lost depends on
+ * what the runtime account may do, so this reads (never writes) `information_schema`
+ * USER_PRIVILEGES / SCHEMA_PRIVILEGES / TABLE_PRIVILEGES / COLUMN_PRIVILEGES / APPLICABLE_ROLES for `CURRENT_USER()`, once at boot, and
+ * derives the five protections lost (spec §5.F). It does not look for `prune_audit`: MariaDB hides
+ * a routine from an account without EXECUTE on it, which the runtime account must not have (spec
+ * v3); `audit:prune` reports a missing routine itself.
+ *
+ * `GRANT ... TO PUBLIC` (MariaDB 10.11+) applies to every account but information_schema shows
+ * those rows only to privileged accounts (verified on 10.11 and 11.4: a plain account sees none).
+ * `SHOW GRANTS` for the current user needs no privilege and does list them, so its `TO PUBLIC`
+ * lines are parsed and merged with the information_schema rows. Its routine-level lines
+ * (`ON PROCEDURE|FUNCTION`) are the only view of routine privileges the account has: any such grant
+ * on the database loses the retention floor. An unparsable line of the account's own is ignored, an
+ * unparsable PUBLIC or routine line fails closed; a failing `SHOW GRANTS`
+ * fails closed like any other failed read.
+ *
+ * The probe never blocks boot (the operator's ack already accepted the risk) and is never on the
+ * request path (Shield #12). Warning lines carry no credential and no host (Shield #10): a failed
+ * query's driver message is dropped.
+ */
+const common_1 = require("@nestjs/common");
+const PROTECTIONS = {
+    'append-only-audit': {
+        id: 'append-only-audit',
+        invariant: 'Shield #6',
+        text: 'Append-only audit: the runtime account can UPDATE or DELETE audit_log.',
+    },
+    'no-runtime-ddl': {
+        id: 'no-runtime-ddl',
+        invariant: 'Shield #11',
+        text: 'No runtime DDL: the runtime account holds DDL privileges on the database.',
+    },
+    'schema-separation': {
+        id: 'schema-separation',
+        invariant: 'Shield #11 (ADR-0014)',
+        text: 'Schema separation: identity, authz and audit tables share one database with app tables ' +
+            '(always lost in the single layout).',
+    },
+    'retention-floor': {
+        id: 'retention-floor',
+        invariant: 'Shield #6',
+        text: 'DB-enforced retention floor: audit rows can be deleted directly, around prune_audit, or ' +
+            'the runtime account holds a grant on prune_audit.',
+    },
+    'separate-ddl-account': {
+        id: 'separate-ddl-account',
+        invariant: 'Shield #11',
+        text: 'Separate deploy-time DDL account: the runtime account can run migrations, so locking the ' +
+            'migrate account between deploys is not possible.',
+    },
+};
+const ALL_IDS = Object.keys(PROTECTIONS);
+/** Aligned with `scripts/db-grants/lib.mjs` DDL_PRIVS (GRANT OPTION is judged via IS_GRANTABLE too). */
+const DDL_PRIVILEGES = new Set([
+    'CREATE',
+    'ALTER',
+    'DROP',
+    'INDEX',
+    'CREATE VIEW',
+    'SHOW VIEW',
+    'TRIGGER',
+    'CREATE ROUTINE',
+    'ALTER ROUTINE',
+    'EVENT',
+    'REFERENCES',
+    'CREATE TEMPORARY TABLES',
+    'LOCK TABLES',
+    'DELETE HISTORY',
+    'GRANT OPTION',
+]);
+const AUDIT_TABLE = 'audit_log';
+/** `'user'@'host'` for CURRENT_USER(), built in SQL (never from env). */
+const GRANTEE_SQL = `CONCAT("'", SUBSTRING_INDEX(CURRENT_USER(),'@',1), "'@'", ` +
+    `SUBSTRING_INDEX(CURRENT_USER(),'@',-1), "'")`;
+/** Does a GRANT schema pattern (`\_` escaped, `_`/`%` wildcards) cover `database`? */
+function schemaCovers(pattern, database) {
+    let re = '';
+    for (let i = 0; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (c === '\\' && i + 1 < pattern.length) {
+            re += pattern[++i].replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        }
+        else if (c === '%')
+            re += '.*';
+        else if (c === '_')
+            re += '.';
+        else
+            re += c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(`^${re}$`, 'i').test(database);
+}
+/** Splits `a, b (c, d), e` at top-level commas, respecting backticks and parentheses. */
+function splitTopLevel(text) {
+    const out = [];
+    let cur = '';
+    let depth = 0;
+    let tick = false;
+    for (const c of text) {
+        if (c === '`')
+            tick = !tick;
+        else if (!tick && c === '(')
+            depth++;
+        else if (!tick && c === ')')
+            depth = Math.max(0, depth - 1);
+        if (c === ',' && depth === 0 && !tick) {
+            out.push(cur);
+            cur = '';
+        }
+        else
+            cur += c;
+    }
+    out.push(cur);
+    return out.map((x) => x.trim()).filter((x) => x.length > 0);
+}
+// `*`, backtick-quoted, ANSI_QUOTES double-quoted, or bare (sql_quote_show_create=0).
+const IDENT = '(\\*|`(?:[^`]|``)*`|"(?:[^"]|"")*"|[^\\s.`"]+)';
+const GRANT_LINE = /^GRANT\s+(.+?)\s+ON\s+(.+?)\s+TO\s+(.+?)(\s+WITH\s+GRANT\s+OPTION)?\s*$/is;
+const TARGET = new RegExp(`^(?:(PROCEDURE|FUNCTION|PACKAGE|PACKAGE BODY)\\s+)?${IDENT}\\.${IDENT}$`, 'i');
+const unquote = (id) => id.startsWith('`')
+    ? id.slice(1, -1).replace(/``/g, '`')
+    : id.startsWith('"')
+        ? id.slice(1, -1).replace(/""/g, '"')
+        : id;
+const ROUTINE_TARGET = /^(PROCEDURE|FUNCTION|PACKAGE)\b/i;
+/**
+ * Reads `TO PUBLIC` privileges and routine-level grants out of `SHOW GRANTS` lines. An
+ * unparsable `TO PUBLIC` or routine line sets `unreadable` (the probe then fails closed); any
+ * other unparsable line is the account's own and is skipped. Never throws.
+ */
+function parseShowGrants(lines) {
+    const out = {
+        user: [],
+        schema: [],
+        table: [],
+        column: [],
+        routineSchemas: [],
+        unreadable: false,
+    };
+    for (const line of lines) {
+        const m = GRANT_LINE.exec(line);
+        if (!m)
+            continue;
+        const rawTarget = m[2].trim();
+        const target = TARGET.exec(rawTarget);
+        if (!target) {
+            if (/^PUBLIC$/i.test(m[3].trim()) || ROUTINE_TARGET.test(rawTarget)) {
+                out.unreadable = true;
+            }
+            continue;
+        }
+        const kind = target[1];
+        const schema = unquote(target[2]);
+        const name = unquote(target[3]);
+        if (kind) {
+            out.routineSchemas.push(schema);
+            continue;
+        }
+        if (!/^PUBLIC$/i.test(m[3].trim()))
+            continue;
+        const is = m[4] ? 'YES' : 'NO';
+        for (const item of splitTopLevel(m[1])) {
+            const paren = item.indexOf('(');
+            const type = (paren < 0 ? item : item.slice(0, paren)).trim().toUpperCase();
+            if (!type)
+                continue;
+            if (paren >= 0) {
+                // Column-level: one row per column (the name only matters for the table).
+                out.column.push({
+                    TABLE_SCHEMA: schema,
+                    TABLE_NAME: name,
+                    PRIVILEGE_TYPE: type,
+                    IS_GRANTABLE: is,
+                });
+            }
+            else if (schema === '*') {
+                out.user.push({ PRIVILEGE_TYPE: type, IS_GRANTABLE: is });
+            }
+            else if (name === '*') {
+                out.schema.push({ TABLE_SCHEMA: schema, PRIVILEGE_TYPE: type, IS_GRANTABLE: is });
+            }
+            else {
+                out.table.push({
+                    TABLE_SCHEMA: schema,
+                    TABLE_NAME: name,
+                    PRIVILEGE_TYPE: type,
+                    IS_GRANTABLE: is,
+                });
+            }
+        }
+    }
+    return out;
+}
+const priv = (r) => String(r.PRIVILEGE_TYPE ?? '').toUpperCase();
+const grantable = (r) => String(r.IS_GRANTABLE ?? '').toUpperCase() === 'YES';
+const failed = () => ({
+    lost: ALL_IDS.map((id) => PROTECTIONS[id]),
+    readFailed: true,
+});
+/**
+ * Derive the protections the runtime account has lost. Never throws, and never reports the audit
+ * wall intact when it cannot see the grants: a failed query, a runtime account whose own
+ * SELECT+INSERT on the database is invisible, or an account with roles (not inspected) reports all
+ * five with `readFailed`.
+ */
+async function probeSingleLayoutPrivileges(query, database) {
+    try {
+        const userInfo = (await query(`SELECT PRIVILEGE_TYPE, IS_GRANTABLE FROM information_schema.USER_PRIVILEGES ` +
+            `WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const schemaInfo = (await query(`SELECT TABLE_SCHEMA, PRIVILEGE_TYPE, IS_GRANTABLE FROM information_schema.SCHEMA_PRIVILEGES ` +
+            `WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const tableInfo = (await query(`SELECT TABLE_SCHEMA, TABLE_NAME, PRIVILEGE_TYPE, IS_GRANTABLE ` +
+            `FROM information_schema.TABLE_PRIVILEGES WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const columnInfo = (await query(`SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME, PRIVILEGE_TYPE, IS_GRANTABLE ` +
+            `FROM information_schema.COLUMN_PRIVILEGES WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const roles = (await query(`SELECT ROLE_NAME FROM information_schema.APPLICABLE_ROLES WHERE GRANTEE = ${GRANTEE_SQL}`));
+        // Privileges granted through roles are not inspected: do not claim a wall we cannot see.
+        if (roles.length > 0)
+            return failed();
+        // PUBLIC grants and routine grants: invisible in information_schema to this account.
+        const shown = (await query('SHOW GRANTS'));
+        const pub = parseShowGrants(shown.map((row) => String(Object.values(row ?? {})[0] ?? '')).filter((l) => l.length > 0));
+        if (pub.unreadable)
+            return failed();
+        const user = [...userInfo, ...pub.user];
+        const schema = [...schemaInfo, ...pub.schema];
+        const table = [...tableInfo, ...pub.table];
+        const column = [...columnInfo, ...pub.column];
+        const inDb = (r) => schemaCovers(String(r.TABLE_SCHEMA ?? ''), database);
+        const schemaRows = schema.filter(inDb);
+        const tables = table.filter(inDb);
+        const columns = column.filter(inDb);
+        // Any routine-level grant on the database (EXECUTE, ALTER ROUTINE, ...): prune_audit is reachable.
+        const routineGrant = pub.routineSchemas.some((sch) => schemaCovers(sch, database));
+        // Privileges that reach the whole database: global plus matching schema grants.
+        const db = new Set([...user.map(priv), ...schemaRows.map(priv)]);
+        const all = db.has('ALL PRIVILEGES') || db.has('ALL');
+        // The account booted, so it holds SELECT and INSERT on the database. Not seeing them means
+        // the grants are invisible (restricted view, odd grantee form): fail closed.
+        if (!all && !(db.has('SELECT') && db.has('INSERT')))
+            return failed();
+        // WITH GRANT OPTION anywhere on the database: the account can give itself anything.
+        const selfGrant = [...user, ...schemaRows, ...tables, ...columns].some(grantable);
+        const auditWrite = selfGrant ||
+            all ||
+            db.has('UPDATE') ||
+            db.has('DELETE') ||
+            // DROP allows TRUNCATE and dropping audit_log; ALTER rewrites it.
+            db.has('DROP') ||
+            db.has('ALTER') ||
+            tables.some((r) => String(r.TABLE_NAME ?? '').toLowerCase() === AUDIT_TABLE &&
+                ['UPDATE', 'DELETE', 'DROP', 'ALTER', 'ALL PRIVILEGES'].includes(priv(r))) ||
+            // Column-level UPDATE rewrites audit rows (there is no column-level DELETE).
+            columns.some((r) => String(r.TABLE_NAME ?? '').toLowerCase() === AUDIT_TABLE && priv(r) === 'UPDATE');
+        const ddl = selfGrant ||
+            all ||
+            [...db].some((p) => DDL_PRIVILEGES.has(p)) ||
+            tables.some((r) => DDL_PRIVILEGES.has(priv(r)));
+        // Database-level or global EXECUTE reaches prune_audit.
+        const execute = db.has('EXECUTE');
+        const lost = new Set(['schema-separation']);
+        if (auditWrite || routineGrant || execute) {
+            // The floor lives in prune_audit; a direct write on audit_log, or any grant on a routine
+            // of the database (EXECUTE / ALTER ROUTINE on prune_audit), gets around or weakens it.
+            lost.add('retention-floor');
+        }
+        if (auditWrite)
+            lost.add('append-only-audit');
+        if (ddl) {
+            lost.add('no-runtime-ddl');
+            lost.add('separate-ddl-account');
+        }
+        return {
+            lost: ALL_IDS.filter((id) => lost.has(id)).map((id) => PROTECTIONS[id]),
+            readFailed: false,
+        };
+    }
+    catch {
+        return failed();
+    }
+}
+/**
+ * The boot warning: a header naming the database and ADR-0041, then one line per lost protection
+ * citing its invariant. No credential, host or driver message.
+ */
+function singleLayoutWarningLines(probe, database) {
+    const lines = [
+        `Shield single database layout on "${database}" (ADR-0041): reduced isolation accepted; ` +
+            `protections lost:`,
+    ];
+    if (probe.readFailed) {
+        lines.push('Runtime privileges could not be read; assuming all protections are lost.');
+    }
+    for (const p of probe.lost)
+        lines.push(`- ${p.text} (${p.invariant})`);
+    const ids = new Set(probe.lost.map((p) => p.id));
+    if (!probe.readFailed &&
+        !ids.has('append-only-audit') &&
+        !ids.has('no-runtime-ddl') &&
+        !ids.has('retention-floor')) {
+        lines.push('Two-account setup: audit wall intact (no direct UPDATE/DELETE/DDL/grant rights seen for ' +
+            'this account).');
+    }
+    return lines;
+}
+/**
+ * Runs the probe once at application bootstrap on the runtime pool and logs the warning. Never
+ * throws, so boot is never blocked (spec §5.F).
+ */
+class SingleLayoutProbeBoot {
+    query;
+    database;
+    logger;
+    constructor(query, database, logger = new common_1.Logger('Shield')) {
+        this.query = query;
+        this.database = database;
+        this.logger = logger;
+    }
+    async onApplicationBootstrap() {
+        const probe = await probeSingleLayoutPrivileges(this.query, this.database);
+        for (const line of singleLayoutWarningLines(probe, this.database))
+            this.logger.warn(line);
+    }
+}
+exports.SingleLayoutProbeBoot = SingleLayoutProbeBoot;

package/dist/config/app-config.d.ts

@@ -182,6 +182,18 @@ export interface PoolBudgetConfig {
     readonly headroom: number;
     /** Per-account RUNTIME pool caps (multiplied by `workers` in the budget). */
     readonly perAccountMax: RuntimeAccountPools;
+    /**
+     * `'single'` when `SHIELD_DB_LAYOUT=single` (single-database-layout spec §5.C, AC-12, ADR-0041):
+     * one account opens the core, engine and authz pools, so the budget sums those instead.
+     * Absent in the four layout (today's math, unchanged).
+     */
+    readonly layout?: 'single';
+    /** Single layout: the engine pool cap (`POOL_MAX_ENGINE ?? APP_DB_MAX_CONNECTIONS ?? 10`). */
+    readonly engineMax?: number;
+    /** Single layout: the identity authz pool cap (`APP_AUTHZ_POOL_MAX ?? 4`). */
+    readonly authzMax?: number;
+    /** Single layout: the account's `MAX_USER_CONNECTIONS` (`APP_DB_MAX_USER_CONNECTIONS`), if set. */
+    readonly maxUserConnections?: number;
 }
 /**
  * Per-account maximum pool sizes for the RUNTIME accounts (the ones each worker
@@ -393,6 +405,11 @@ export interface PoolBudgetEvaluation {
     readonly withinBudget: boolean;
     /** True iff shield_schema_svc pool ≤ {@link SCHEMA_SVC_POOL_HARD_CAP}. */
     readonly schemaSvcWithinHardCap: boolean;
+    /**
+     * True iff requiredConnections ≤ `maxUserConnections` (always true when unset or in the four
+     * layout). Single layout only (spec AC-12).
+     */
+    readonly withinUserBudget: boolean;
 }
 /**
  * Evaluate a pool budget. Pure: no throwing, no I/O — the caller decides how to

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAaD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CAiBV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAc7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA4CrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CA0BV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAc7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAyB9E"}

package/dist/config/app-config.js

@@ -84,6 +84,21 @@ function parsePositiveInt(raw, fallback) {
     const n = Number.parseInt(raw, 10);
     return Number.isInteger(n) && n > 0 ? n : fallback;
 }
+/**
+ * A pool-size variable: unset or blank gives `undefined`; otherwise a positive integer in plain
+ * digits (surrounding whitespace allowed) or it throws naming the variable (never the value; fail
+ * closed). Identity's engine and authz pools apply the same rule, so the budget counts exactly the
+ * pools that open.
+ */
+function strictOptionalPoolInt(raw, name) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const t = raw.trim();
+    const n = /^[0-9]+$/.test(t) ? Number(t) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < 1)
+        throw new Error(`${name} must be a positive integer`);
+    return n;
+}
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
@@ -95,7 +110,27 @@ function parsePositiveInt(raw, fallback) {
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
  */
 function loadPoolBudget(env = process.env) {
+    const single = env.SHIELD_DB_LAYOUT === 'single';
+    const maxUser = single
+        ? strictOptionalPoolInt(env.APP_DB_MAX_USER_CONNECTIONS, 'APP_DB_MAX_USER_CONNECTIONS')
+        : undefined;
     return {
+        ...(single
+            ? {
+                layout: 'single',
+                // Same rule as the engine pool identity opens (`engineDbFromEnv`): POOL_MAX_ENGINE, else
+                // today's APP_DB_MAX_CONNECTIONS fallback, else 10. The budget must count the pool that
+                // really opens, so an unset POOL_MAX_ENGINE with a large APP_DB_MAX_CONNECTIONS fails the
+                // budget instead of under-counting it (spec AC-12).
+                // The numbers are parsed exactly as identity's pools parse them (strict: a set but
+                // invalid value throws naming the variable, never a lenient fallback).
+                engineMax: strictOptionalPoolInt(env.POOL_MAX_ENGINE, 'POOL_MAX_ENGINE') ??
+                    strictOptionalPoolInt(env.APP_DB_MAX_CONNECTIONS, 'APP_DB_MAX_CONNECTIONS') ??
+                    10,
+                authzMax: strictOptionalPoolInt(env.APP_AUTHZ_POOL_MAX, 'APP_AUTHZ_POOL_MAX') ?? 4,
+                ...(maxUser !== undefined ? { maxUserConnections: maxUser } : {}),
+            }
+            : {}),
         workers: parsePositiveInt(env.POOL_WORKERS, exports.DEFAULT_POOL_BUDGET.workers),
         maxConnections: parsePositiveInt(env.APP_DB_MAX_CONNECTIONS, exports.DEFAULT_POOL_BUDGET.maxConnections),
         headroom: parsePositiveInt(env.POOL_HEADROOM, exports.DEFAULT_POOL_BUDGET.headroom),
@@ -166,6 +201,10 @@ function parseOptionalPositiveInt(raw) {
  */
 function loadDbConfig(env = process.env, schemas = (0, core_1.resolveFrameworkSchemas)(env)) {
     const database = parseString(env.APP_DB_NAME, schemas.identity);
+    // Single layout (spec §5.C): no `<ns>_core` account exists to default to; fail closed.
+    if (schemas.layout === 'single' && parseString(env.APP_DB_USER, '') === '') {
+        throw new core_1.FrameworkSchemaConfigError('APP_DB_USER is required when SHIELD_DB_LAYOUT=single (there is no default runtime account).');
+    }
     const allowed = [schemas.app, schemas.identity, schemas.authz, schemas.audit];
     if (!allowed.includes(database)) {
         throw new core_1.FrameworkSchemaConfigError(`APP_DB_NAME must be one of the framework databases for namespace ` +
@@ -174,7 +213,9 @@ function loadDbConfig(env = process.env, schemas = (0, core_1.resolveFrameworkSc
     return {
         host: parseString(env.APP_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
         port: parsePort(env.APP_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
-        user: parseString(env.APP_DB_USER, (0, core_1.frameworkAccountName)(schemas.namespace, 'core')),
+        user: schemas.layout === 'single'
+            ? parseString(env.APP_DB_USER, '')
+            : parseString(env.APP_DB_USER, (0, core_1.frameworkAccountName)(schemas.namespace, 'core')),
         password: parseString(env.APP_DB_PASSWORD, ''),
         database,
         tls: loadDbTlsConfig(env),
@@ -437,18 +478,25 @@ function parseStorageMaxBytes(raw) {
  * react (the boot assertion throws; tests inspect the fields).
  */
 function evaluatePoolBudget(cfg) {
-    const perWorkerConnections = cfg.perAccountMax.shield_core +
-        cfg.perAccountMax.shield_app_crud +
-        cfg.perAccountMax.shield_schema_svc;
+    // Single layout (AC-12): one account opens core + engine + authz; app_crud/schema_svc are never opened.
+    const perWorkerConnections = cfg.layout === 'single'
+        ? cfg.perAccountMax.shield_core + (cfg.engineMax ?? 10) + (cfg.authzMax ?? 4)
+        : cfg.perAccountMax.shield_core +
+            cfg.perAccountMax.shield_app_crud +
+            cfg.perAccountMax.shield_schema_svc;
     const runtimeConnections = cfg.workers * perWorkerConnections;
     const requiredConnections = runtimeConnections + cfg.headroom;
     const slack = cfg.maxConnections - requiredConnections;
+    const withinUserBudget = cfg.layout !== 'single' ||
+        cfg.maxUserConnections === undefined ||
+        requiredConnections <= cfg.maxUserConnections;
     return {
         perWorkerConnections,
         runtimeConnections,
         requiredConnections,
         slack,
-        withinBudget: requiredConnections <= cfg.maxConnections,
-        schemaSvcWithinHardCap: cfg.perAccountMax.shield_schema_svc <= exports.SCHEMA_SVC_POOL_HARD_CAP,
+        withinBudget: requiredConnections <= cfg.maxConnections && withinUserBudget,
+        schemaSvcWithinHardCap: cfg.layout === 'single' || cfg.perAccountMax.shield_schema_svc <= exports.SCHEMA_SVC_POOL_HARD_CAP,
+        withinUserBudget,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -36,8 +36,8 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.5.4",
-    "@astram/core": "1.7.0",
-    "@astram/engine": "0.8.0"
+    "@astram/core": "1.8.0",
+    "@astram/engine": "0.9.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",