@astram/guard 0.15.0 → 0.17.0

package/dist/auth/auth.module.d.ts

@@ -62,7 +62,7 @@
  * `createIdentityBroker`/`createTotpFactorVerifier`) are pure; the adapters + the
  * node:crypto HMAC live in guard. Core stays zero-dep + unchanged.
  */
-import { type DynamicModule } from '@nestjs/common';
+import { type DynamicModule, type Provider } from '@nestjs/common';
 import type { CredentialResolver, HmacSha1, FactorVerifier } from '@astram/core';
 import type { SessionFactsProjector } from './ports/session-facts-projector.js';
 import type { ScopeSubtreeResolver } from './ports/scope-subtree-resolver.js';
@@ -106,6 +106,13 @@ export declare function resolveTotpVerifier(override: FactorVerifier | null | un
  * consumer's built CJS dist. Async because of {@link loadCore}.
  */
 export declare function makeDefaultTotpVerifier(): Promise<FactorVerifier>;
+/** DI token for the single-layout privilege probe hook (a no-op in the four layout). */
+export declare const SHIELD_SINGLE_LAYOUT_PROBE: unique symbol;
+/**
+ * Single-database-layout spec §5.F (ADR-0041): the privilege probe runs once at bootstrap on this
+ * module's runtime pool, single layout only (four layout: a no-op hook). Never blocks boot.
+ */
+export declare const singleLayoutProbeProvider: Provider;
 /**
  * Options for {@link AuthModule.forRoot} — registration-time collaborators the
  * consumer plugs through {@link ShieldModule.forRoot}.

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAanF,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AA6GtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AA6jBD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA6ID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAmGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA+K/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAaxB,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AA8GtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAsPD,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAWvC,CAAC;AAyUF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA6ID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAmGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAgL/D"}

package/dist/auth/auth.module.js

@@ -104,7 +104,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 var AuthModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthModule = exports.hmacSha1 = void 0;
+exports.AuthModule = exports.singleLayoutProbeProvider = exports.SHIELD_SINGLE_LAYOUT_PROBE = exports.hmacSha1 = void 0;
 exports.resolveTotpVerifier = resolveTotpVerifier;
 exports.makeDefaultTotpVerifier = makeDefaultTotpVerifier;
 exports.resolveDefaultEmailSender = resolveDefaultEmailSender;
@@ -113,6 +113,7 @@ const node_crypto_1 = require("node:crypto");
 const app_config_js_1 = require("../config/app-config.js");
 const config_module_js_1 = require("../config/config.module.js");
 const migration_ledger_check_js_1 = require("../boot/migration-ledger-check.js");
+const single_layout_probe_js_1 = require("../boot/single-layout-probe.js");
 const migrations_dir_js_1 = require("../migrations-dir.js");
 const argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 const mariadb_credential_resolver_js_1 = require("../authentication/mariadb-credential-resolver.js");
@@ -387,6 +388,22 @@ const migrationLedgerCheckProvider = {
     registry ?? null),
     inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG, { token: migration_ledger_check_js_1.SHIELD_MIGRATION_LEDGER_REGISTRY, optional: true }],
 };
+/** DI token for the single-layout privilege probe hook (a no-op in the four layout). */
+exports.SHIELD_SINGLE_LAYOUT_PROBE = Symbol('SHIELD_SINGLE_LAYOUT_PROBE');
+/**
+ * Single-database-layout spec §5.F (ADR-0041): the privilege probe runs once at bootstrap on this
+ * module's runtime pool, single layout only (four layout: a no-op hook). Never blocks boot.
+ */
+exports.singleLayoutProbeProvider = {
+    provide: exports.SHIELD_SINGLE_LAYOUT_PROBE,
+    useFactory: (pool, config) => {
+        const schemas = (0, app_config_js_1.frameworkSchemasOf)(config);
+        if (schemas.layout !== 'single')
+            return { onApplicationBootstrap: () => undefined };
+        return new single_layout_probe_js_1.SingleLayoutProbeBoot(async (sql, params) => (await pool.query(sql, params)), schemas.app);
+    },
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+};
 /** Boot-time warnings from the auth composition (dev email logger, disabled email, …). */
 const authBootLogger = new common_1.Logger('ShieldAuth');
 /**
@@ -1029,6 +1046,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 resetLimiterProvider,
                 // spec 5.D: the guard migrations are in the ledger (once at bootstrap; production fails).
                 migrationLedgerCheckProvider,
+                exports.singleLayoutProbeProvider,
             ],
             exports: [
                 tokens_js_1.SHIELD_AUTHENTICATOR,

package/dist/authentication/argon2id-password-hasher.d.ts

@@ -29,6 +29,9 @@ export interface Argon2idParams {
     readonly timeCost?: number;
     readonly parallelism?: number;
 }
+/** `!locked:` + a real argon2id hash of 32 random bytes that are never kept. */
+export declare function lockedPasswordHash(): Promise<string>;
+export declare function isLockedHash(hash: string): boolean;
 /** The DI token consumers/ShieldModule bind the concrete hasher under. */
 export declare const SHIELD_PASSWORD_HASHER: unique symbol;
 /**

package/dist/authentication/argon2id-password-hasher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"argon2id-password-hasher.d.ts","sourceRoot":"","sources":["../../src/authentication/argon2id-password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,cAAc;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;gBAEnD,MAAM,GAAE,cAAmB;IASvC,8EAA8E;IACxE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAQhE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,cAAmB,GAAG;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CAClC,CAKA"}
+{"version":3,"file":"argon2id-password-hasher.d.ts","sourceRoot":"","sources":["../../src/authentication/argon2id-password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAWD,gFAAgF;AAChF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAM1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,cAAc;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;gBAEnD,MAAM,GAAE,cAAmB;IASvC,8EAA8E;IACxE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAahE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,cAAmB,GAAG;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CAClC,CAKA"}

package/dist/authentication/argon2id-password-hasher.js

@@ -49,13 +49,29 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Argon2idPasswordHasher = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.lockedPasswordHash = lockedPasswordHash;
+exports.isLockedHash = isLockedHash;
 exports.argon2idHasherProvider = argon2idHasherProvider;
+const node_crypto_1 = require("node:crypto");
 const argon2 = __importStar(require("argon2"));
 const DEFAULT_PARAMS = {
     memoryCost: 19_456,
     timeCost: 2,
     parallelism: 1,
 };
+/** Prefix marking a credential nobody can authenticate against (set later via reset). */
+const LOCKED_PREFIX = '!locked:';
+/** `!locked:` + a real argon2id hash of 32 random bytes that are never kept. */
+async function lockedPasswordHash() {
+    const hash = await argon2.hash((0, node_crypto_1.randomBytes)(32), {
+        type: argon2.argon2id,
+        ...DEFAULT_PARAMS,
+    });
+    return LOCKED_PREFIX + hash;
+}
+function isLockedHash(hash) {
+    return hash.startsWith(LOCKED_PREFIX);
+}
 /** The DI token consumers/ShieldModule bind the concrete hasher under. */
 exports.SHIELD_PASSWORD_HASHER = Symbol('SHIELD_PASSWORD_HASHER');
 /**
@@ -85,6 +101,11 @@ class Argon2idPasswordHasher {
      */
     async verify(hash, plaintext) {
         try {
+            if (isLockedHash(hash)) {
+                // Real verify (no timing shortcut) on the remainder, then false regardless of the outcome.
+                await argon2.verify(hash.slice(LOCKED_PREFIX.length), plaintext);
+                return false;
+            }
             return await argon2.verify(hash, plaintext);
         }
         catch {

package/dist/authentication/credential-provisioner.d.ts

@@ -0,0 +1,30 @@
+/**
+ * CredentialProvisioner — the INSERT-ONLY port that creates a login credential for a new principal
+ * (org bootstrap). It never updates or replaces an existing credential: a principal that already has
+ * one is refused with {@link CredentialExistsError}, so provisioning can never reset someone's password.
+ */
+/** Caller-supplied SQL runner (a transaction connection's `query`); absent ⇒ the pool. */
+export type CredentialQuery = (sql: string, params?: unknown[]) => Promise<unknown>;
+export interface CredentialProvisionInput {
+    readonly principalId: string;
+    /** Login key (`ic_identity_hint`, the canonical email). */
+    readonly hint: string;
+    readonly tenantId: string;
+}
+export interface PasswordCredentialProvisionInput extends CredentialProvisionInput {
+    readonly password: string;
+}
+/** `none` = no credential row; `locked` = unusable placeholder hash; `usable` = a real password hash. */
+export type CredentialState = 'none' | 'locked' | 'usable';
+export interface CredentialProvisioner {
+    /** Insert a credential no password verifies against (set later via reset). */
+    provisionLocked(input: CredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    /** Insert an Argon2id credential for `password` (≥ 8 chars). */
+    provisionPassword(input: PasswordCredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    stateOf(principalId: string, query?: CredentialQuery): Promise<CredentialState>;
+}
+/** The principal or login hint already has a credential. Fixed message: no hint, no driver text. */
+export declare class CredentialExistsError extends Error {
+    constructor();
+}
+//# sourceMappingURL=credential-provisioner.d.ts.map

package/dist/authentication/credential-provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,gEAAgE;IAChE,iBAAiB,CACf,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACjF;AAED,oGAAoG;AACpG,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C"}

package/dist/authentication/credential-provisioner.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * CredentialProvisioner — the INSERT-ONLY port that creates a login credential for a new principal
+ * (org bootstrap). It never updates or replaces an existing credential: a principal that already has
+ * one is refused with {@link CredentialExistsError}, so provisioning can never reset someone's password.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialExistsError = void 0;
+/** The principal or login hint already has a credential. Fixed message: no hint, no driver text. */
+class CredentialExistsError extends Error {
+    constructor() {
+        super('A credential already exists for this principal or login');
+        this.name = 'CredentialExistsError';
+    }
+}
+exports.CredentialExistsError = CredentialExistsError;

package/dist/authentication/mariadb-credential-provisioner.d.ts

@@ -0,0 +1,26 @@
+/**
+ * MariaDbCredentialProvisioner — the framework CredentialProvisioner over `identity_credential`.
+ * INSERT only (never UPDATE/upsert): an existing principal, or a duplicate login hint (PK), is a
+ * {@link CredentialExistsError}. Stores only an Argon2id hash (or the locked placeholder); never logs it.
+ * Pass `query` to run inside the caller's transaction connection.
+ */
+import type { Pool } from 'mariadb';
+import { type CredentialProvisioner, type CredentialProvisionInput, type CredentialQuery, type CredentialState, type PasswordCredentialProvisionInput } from './credential-provisioner.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
+export declare class MariaDbCredentialProvisioner implements CredentialProvisioner {
+    private readonly pool;
+    private readonly now;
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    private readonly table;
+    private readonly hasher;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
+    provisionLocked(input: CredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    provisionPassword(input: PasswordCredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    stateOf(principalId: string, query?: CredentialQuery): Promise<CredentialState>;
+    private validate;
+    private run;
+    private insert;
+}
+//# sourceMappingURL=mariadb-credential-provisioner.d.ts.map

package/dist/authentication/mariadb-credential-provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACtC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAW7C,qBAAa,4BAA6B,YAAW,qBAAqB;IAMtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,iBAAiB,CACrB,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAUrF,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,GAAG;YAIG,MAAM;CA0BrB"}

package/dist/authentication/mariadb-credential-provisioner.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbCredentialProvisioner = void 0;
+const credential_provisioner_js_1 = require("./credential-provisioner.js");
+const argon2id_password_hasher_js_1 = require("./argon2id-password-hasher.js");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
+const MIN_PASSWORD_LENGTH = 8;
+const ER_DUP_ENTRY = 1062;
+function requireText(value, name) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new TypeError(`${name} must be a non-empty string`);
+    }
+}
+class MariaDbCredentialProvisioner {
+    pool;
+    now;
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    table;
+    hasher = new argon2id_password_hasher_js_1.Argon2idPasswordHasher();
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
+        this.pool = pool;
+        this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'identity_credential');
+    }
+    async provisionLocked(input, query) {
+        this.validate(input);
+        await this.insert(input, await (0, argon2id_password_hasher_js_1.lockedPasswordHash)(), query);
+    }
+    async provisionPassword(input, query) {
+        this.validate(input);
+        if (typeof input.password !== 'string' || input.password.length < MIN_PASSWORD_LENGTH) {
+            throw new Error(`password must be at least ${MIN_PASSWORD_LENGTH} characters`);
+        }
+        await this.insert(input, await this.hasher.hash(input.password), query);
+    }
+    async stateOf(principalId, query) {
+        const rows = (await this.run(query)(`SELECT ic_password_hash FROM ${this.table} WHERE ic_principal_id = ? LIMIT 1`, [principalId]));
+        const row = rows[0];
+        if (!row)
+            return 'none';
+        return (0, argon2id_password_hasher_js_1.isLockedHash)(row.ic_password_hash) ? 'locked' : 'usable';
+    }
+    validate(input) {
+        requireText(input.principalId, 'principalId');
+        requireText(input.hint, 'hint');
+        requireText(input.tenantId, 'tenantId');
+    }
+    run(query) {
+        return query ?? ((sql, params) => this.pool.query(sql, params));
+    }
+    async insert(input, hash, query) {
+        const run = this.run(query);
+        const existing = (await run(`SELECT ic_identity_hint FROM ${this.table} WHERE ic_principal_id = ? LIMIT 1 FOR UPDATE`, [input.principalId]));
+        if (existing.length > 0)
+            throw new credential_provisioner_js_1.CredentialExistsError();
+        const nowMs = this.now();
+        try {
+            await run(`INSERT INTO ${this.table}
+           (ic_identity_hint, ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, ic_created_at_ms, ic_updated_at_ms)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`, [input.hint, hash, input.principalId, input.tenantId, '[]', nowMs, nowMs]);
+        }
+        catch (err) {
+            if (err?.errno === ER_DUP_ENTRY) {
+                throw new credential_provisioner_js_1.CredentialExistsError();
+            }
+            throw err;
+        }
+    }
+}
+exports.MariaDbCredentialProvisioner = MariaDbCredentialProvisioner;

package/dist/authz/operation-marker-check.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `withOperationMarkerCheck` — the guard-side seal on core gate 7's delegation marker (G-009 R1-2).
+ *
+ * Core's `decide()` reads `context.attributes['shield.delegation']` and delegates whatever the
+ * principal is. The marker therefore must come only from a principal the engine bound to that
+ * exact operation step (`operationOf`, an unforgeable WeakMap binding; the engine's
+ * `withDelegation` sets the matching marker). Here, every decision entry the authority exposes
+ * (`decide`) passes the attribute through ONLY when `operationOf(principal)` exists and its
+ * `operationKey` and `stepKey` equal the marker's; in every other case it is removed before the
+ * inner `decide()`, so the baseline decision stands (Shield #1, #9).
+ */
+import type { DecisionAuthority } from '@astram/core';
+export declare function withOperationMarkerCheck(inner: DecisionAuthority): DecisionAuthority;
+//# sourceMappingURL=operation-marker-check.d.ts.map

package/dist/authz/operation-marker-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-marker-check.d.ts","sourceRoot":"","sources":["../../src/authz/operation-marker-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,CAoBpF"}

package/dist/authz/operation-marker-check.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withOperationMarkerCheck = withOperationMarkerCheck;
+const engine_1 = require("@astram/engine");
+const MARKER = 'shield.delegation';
+function withOperationMarkerCheck(inner) {
+    return {
+        decide: (principal, action, resource, context) => {
+            const attributes = context.attributes;
+            if (attributes === undefined || !(MARKER in attributes)) {
+                return inner.decide(principal, action, resource, context);
+            }
+            const raw = attributes[MARKER];
+            const binding = (0, engine_1.operationOf)(principal);
+            const { operationKey, stepKey } = typeof raw === 'object' && raw !== null ? raw : {};
+            const genuine = binding !== undefined &&
+                binding.operationKey === operationKey &&
+                binding.stepKey === stepKey;
+            if (genuine)
+                return inner.decide(principal, action, resource, context);
+            const { [MARKER]: _forged, ...rest } = attributes;
+            return inner.decide(principal, action, resource, { ...context, attributes: rest });
+        },
+    };
+}

package/dist/authz/wire-record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAM1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAOD;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA4BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAyE/E"}
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAOD;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA8BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAyE/E"}

package/dist/authz/wire-record-authorization.js

@@ -8,6 +8,7 @@ const mariadb_record_rule_adapter_js_1 = require("./mariadb-record-rule-adapter.
 const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapter.js");
 const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
 const mariadb_list_scope_adapter_js_1 = require("./mariadb-list-scope-adapter.js");
+const operation_marker_check_js_1 = require("./operation-marker-check.js");
 const list_scope_sql_js_1 = require("./list-scope-sql.js");
 const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
 const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
@@ -71,7 +72,7 @@ function buildRecordAuthorization(inputs, options = {}) {
         ? withRedisPermissionVersion(inputs.permissionFacts, options.versionCache)
         : inputs.permissionFacts;
     const schema = authzSchemaOf(inputs);
-    return (0, core_1.createWiredDecisionAuthority)({
+    return (0, operation_marker_check_js_1.withOperationMarkerCheck)((0, core_1.createWiredDecisionAuthority)({
         registry: inputs.registry,
         // The app-owned port, wrapped so a gate-5 reload inside an enforcement request notifies the
         // guard (security hardening Phase 1C: a permission-version move re-derives the session's
@@ -92,7 +93,7 @@ function buildRecordAuthorization(inputs, options = {}) {
         // Delegation / trusted-operation authority over the DECLARED manifest (no DB).
         // Empty ⇒ pass-through. The app supplies the entries; the framework owns the adapter.
         operationAuthority: new manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter(inputs.operationManifest ?? []),
-    });
+    }));
 }
 /**
  * Construct the engine-facing {@link ListScopeFn} — the LIST-form sibling to

package/dist/boot/boot-sequence.d.ts

@@ -35,6 +35,12 @@ export declare class BootSequence implements OnApplicationBootstrap {
 }
 /** The boot log line naming the resolved framework databases (names only, spec 5.E). */
 export declare function frameworkDatabasesLogLine(s: FrameworkSchemas): string;
+/**
+ * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
+ * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
+ * variable only, never its value.
+ */
+export declare function shieldDbNameIgnoredWarning(env: NodeJS.ProcessEnv): string | undefined;
 /**
  * Validate a {@link PoolBudgetConfig} against the ADR-0018 budget. Exported so
  * unit tests can assert the throw/no-throw contract directly without booting

package/dist/boot/boot-sequence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAuB5D"}
+{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAKrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAsC5D"}

package/dist/boot/boot-sequence.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BootSequence = void 0;
 exports.frameworkDatabasesLogLine = frameworkDatabasesLogLine;
+exports.shieldDbNameIgnoredWarning = shieldDbNameIgnoredWarning;
 exports.assertPoolBudget = assertPoolBudget;
 const common_1 = require("@nestjs/common");
 const config_module_js_1 = require("../config/config.module.js");
@@ -43,6 +44,10 @@ let BootSequence = class BootSequence {
         // configurable-framework-db spec 5.E: the resolved database names, once per boot. Names
         // only — never a user, password, host or connection string.
         this.logger.log(frameworkDatabasesLogLine((0, app_config_js_1.frameworkSchemasOf)(this.config)));
+        // Spec 5.C/AC-1: SHIELD_DB_NAME is read only in the single layout; say so when it is ignored.
+        const ignored = shieldDbNameIgnoredWarning(process.env);
+        if (ignored !== undefined)
+            this.logger.warn(ignored);
         await this.assertConnectionPoolReady();
         // Future boot-time assertions attach here (each fail-closed). The migration ledger check
         // (spec 5.D) needs the runtime pool, so it runs from AuthModule (`auth: true`) and from
@@ -71,9 +76,24 @@ exports.BootSequence = BootSequence = __decorate([
 ], BootSequence);
 /** The boot log line naming the resolved framework databases (names only, spec 5.E). */
 function frameworkDatabasesLogLine(s) {
+    if (s.layout === 'single')
+        return `Shield databases: layout=single database=${s.app}`;
     return (`Shield databases: namespace=${s.namespace} app=${s.app} identity=${s.identity} ` +
         `authz=${s.authz} audit=${s.audit}`);
 }
+/**
+ * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
+ * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
+ * variable only, never its value.
+ */
+function shieldDbNameIgnoredWarning(env) {
+    if (env.SHIELD_DB_LAYOUT === 'single')
+        return undefined;
+    const v = env.SHIELD_DB_NAME;
+    if (v === undefined || v.trim() === '')
+        return undefined;
+    return 'SHIELD_DB_NAME is read only when SHIELD_DB_LAYOUT=single; ignored.';
+}
 /**
  * Validate a {@link PoolBudgetConfig} against the ADR-0018 budget. Exported so
  * unit tests can assert the throw/no-throw contract directly without booting
@@ -90,13 +110,25 @@ function assertPoolBudget(cfg) {
             'which exceeds the hard cap of 2. DDL is rare + serialized per tenant ' +
             '(ADR-0014 §7) — keep this pool tiny (1–2).');
     }
+    if (!e.withinUserBudget) {
+        throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): single layout needs ' +
+            `${e.requiredConnections} connections (workers(${cfg.workers}) × ` +
+            `${e.perWorkerConnections} + headroom(${cfg.headroom})) but the account allows ` +
+            `${cfg.maxUserConnections} (APP_DB_MAX_USER_CONNECTIONS). Reduce POOL_MAX_CORE, ` +
+            'POOL_MAX_ENGINE, APP_AUTHZ_POOL_MAX, POOL_WORKERS or POOL_HEADROOM, or raise ' +
+            'MAX_USER_CONNECTIONS on the account (ADR-0041).');
+    }
     if (!e.withinBudget) {
         throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): required ' +
             `connections ${e.requiredConnections} exceed max_connections ` +
             `${cfg.maxConnections}. Budget = workers(${cfg.workers}) × ` +
             `Σ(per-account pool max)(${e.perWorkerConnections}) + headroom(` +
             `${cfg.headroom}) = ${e.requiredConnections} > ${cfg.maxConnections}. ` +
-            'Reduce a per-account pool cap, the worker count, or raise ' +
-            'max_connections (and MariaDB my.cnf) to restore the budget.');
+            (cfg.layout === 'single'
+                ? 'Single layout: one account opens POOL_MAX_CORE + POOL_MAX_ENGINE (unset ⇒ ' +
+                    'APP_DB_MAX_CONNECTIONS, else 10) + APP_AUTHZ_POOL_MAX per worker; set POOL_MAX_ENGINE ' +
+                    'explicitly, lower a pool cap or the worker count, or raise max_connections.'
+                : 'Reduce a per-account pool cap, the worker count, or raise ' +
+                    'max_connections (and MariaDB my.cnf) to restore the budget.'));
     }
 }

package/dist/boot/single-layout-probe.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Single-database-layout boot privilege probe (single-database-layout spec §5.F, Req 7, AC-8,
+ * ADR-0041).
+ *
+ * With `SHIELD_DB_LAYOUT=single` the four framework modules share one database, so the isolation
+ * the four-database grant matrix gave is partly gone. Which protections are really lost depends on
+ * what the runtime account may do, so this reads (never writes) `information_schema`
+ * USER_PRIVILEGES / SCHEMA_PRIVILEGES / TABLE_PRIVILEGES / COLUMN_PRIVILEGES / APPLICABLE_ROLES for `CURRENT_USER()`, once at boot, and
+ * derives the five protections lost (spec §5.F). It does not look for `prune_audit`: MariaDB hides
+ * a routine from an account without EXECUTE on it, which the runtime account must not have (spec
+ * v3); `audit:prune` reports a missing routine itself.
+ *
+ * `GRANT ... TO PUBLIC` (MariaDB 10.11+) applies to every account but information_schema shows
+ * those rows only to privileged accounts (verified on 10.11 and 11.4: a plain account sees none).
+ * `SHOW GRANTS` for the current user needs no privilege and does list them, so its `TO PUBLIC`
+ * lines are parsed and merged with the information_schema rows. Its routine-level lines
+ * (`ON PROCEDURE|FUNCTION`) are the only view of routine privileges the account has: any such grant
+ * on the database loses the retention floor. An unparsable line of the account's own is ignored, an
+ * unparsable PUBLIC or routine line fails closed; a failing `SHOW GRANTS`
+ * fails closed like any other failed read.
+ *
+ * The probe never blocks boot (the operator's ack already accepted the risk) and is never on the
+ * request path (Shield #12). Warning lines carry no credential and no host (Shield #10): a failed
+ * query's driver message is dropped.
+ */
+import { Logger, type OnApplicationBootstrap } from '@nestjs/common';
+/** Runs one parameterized read on the runtime pool (a mariadb `Pool.query` fits). */
+export type ProbeQuery = (sql: string, params?: unknown[]) => Promise<unknown[]>;
+/** Id of a protection the single layout can lose. */
+export type LostProtectionId = 'append-only-audit' | 'no-runtime-ddl' | 'schema-separation' | 'retention-floor' | 'separate-ddl-account';
+/** One lost protection: id, the invariant it belongs to, and the operator-facing text. */
+export interface LostProtection {
+    readonly id: LostProtectionId;
+    /** The Shield invariant citation, e.g. `Shield #6`. */
+    readonly invariant: string;
+    readonly text: string;
+}
+/** The probe outcome. `readFailed` ⇒ the privileges could not be read (all five reported). */
+export interface SingleLayoutProbe {
+    readonly lost: readonly LostProtection[];
+    readonly readFailed: boolean;
+}
+/**
+ * Derive the protections the runtime account has lost. Never throws, and never reports the audit
+ * wall intact when it cannot see the grants: a failed query, a runtime account whose own
+ * SELECT+INSERT on the database is invisible, or an account with roles (not inspected) reports all
+ * five with `readFailed`.
+ */
+export declare function probeSingleLayoutPrivileges(query: ProbeQuery, database: string): Promise<SingleLayoutProbe>;
+/**
+ * The boot warning: a header naming the database and ADR-0041, then one line per lost protection
+ * citing its invariant. No credential, host or driver message.
+ */
+export declare function singleLayoutWarningLines(probe: SingleLayoutProbe, database: string): string[];
+/**
+ * Runs the probe once at application bootstrap on the runtime pool and logs the warning. Never
+ * throws, so boot is never blocked (spec §5.F).
+ */
+export declare class SingleLayoutProbeBoot implements OnApplicationBootstrap {
+    private readonly query;
+    private readonly database;
+    private readonly logger;
+    constructor(query: ProbeQuery, database: string, logger?: Pick<Logger, 'warn'>);
+    onApplicationBootstrap(): Promise<void>;
+}
+//# sourceMappingURL=single-layout-probe.d.ts.map

package/dist/boot/single-layout-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-layout-probe.d.ts","sourceRoot":"","sources":["../../src/boot/single-layout-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAErE,qFAAqF;AACrF,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAEjF,qDAAqD;AACrD,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,gBAAgB,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAoMD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,CAAC,CAoG5B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB7F;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAwB;IAGhE,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;CAI9C"}