@astram/guard 0.16.0 → 0.18.0

package/dist/auth/tokens.js

@@ -23,7 +23,7 @@
  * ADR-0003: no framework/DB/crypto imports here — just Symbols (+ one re-export).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
 var argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
 /**
@@ -143,6 +143,20 @@ exports.SHIELD_CONFIRM_EMAIL_LIMITER = Symbol('SHIELD_CONFIRM_EMAIL_LIMITER');
  * consumer delivers it. Consumed by forgot-password.
  */
 exports.SHIELD_EMAIL_SENDER = Symbol('SHIELD_EMAIL_SENDER');
+/**
+ * The {@link MessageDispatcher} (G-010, `../messaging/message-dispatcher.ts`): the one exit for
+ * framework messages. Bounds, audits (`message.sent` / `message.failed`) and never throws. Every
+ * framework send uses it; `@astram/identity`'s invite injects it too.
+ */
+exports.SHIELD_MESSAGE_DISPATCHER = Symbol('SHIELD_MESSAGE_DISPATCHER');
+/**
+ * A factory for guard's Redis-backed `AttemptLimiter` (G-010 P-5): `(cfg) => AttemptLimiter`. For
+ * `@astram/identity`'s invite rate limits; exported from `AuthModule` and `@astram/guard/internal`
+ * so identity builds limiters without ever holding the raw Redis client.
+ */
+exports.SHIELD_ATTEMPT_LIMITER_FACTORY = Symbol('SHIELD_ATTEMPT_LIMITER_FACTORY');
+/** Internal: the bound email provider and its per-send bound (`EmailDelivery`). Not exported. */
+exports.SHIELD_EMAIL_DELIVERY = Symbol('SHIELD_EMAIL_DELIVERY');
 /**
  * The `RecoveryCodeStore` (guard port, `../auth/ports/recovery-code-store.ts`) —
  * persists Argon2-hashed one-time MFA recovery codes. Consumed by MFA enrollment.

package/dist/authentication/argon2id-password-hasher.d.ts

@@ -29,6 +29,9 @@ export interface Argon2idParams {
     readonly timeCost?: number;
     readonly parallelism?: number;
 }
+/** `!locked:` + a real argon2id hash of 32 random bytes that are never kept. */
+export declare function lockedPasswordHash(): Promise<string>;
+export declare function isLockedHash(hash: string): boolean;
 /** The DI token consumers/ShieldModule bind the concrete hasher under. */
 export declare const SHIELD_PASSWORD_HASHER: unique symbol;
 /**

package/dist/authentication/argon2id-password-hasher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"argon2id-password-hasher.d.ts","sourceRoot":"","sources":["../../src/authentication/argon2id-password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAQD,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,cAAc;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;gBAEnD,MAAM,GAAE,cAAmB;IASvC,8EAA8E;IACxE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAQhE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,cAAmB,GAAG;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CAClC,CAKA"}
+{"version":3,"file":"argon2id-password-hasher.d.ts","sourceRoot":"","sources":["../../src/authentication/argon2id-password-hasher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAWD,gFAAgF;AAChF,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAM1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,cAAc;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;gBAEnD,MAAM,GAAE,cAAmB;IASvC,8EAA8E;IACxE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK9C;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAahE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,cAAmB,GAAG;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,sBAAsB,CAAC;CAClC,CAKA"}

package/dist/authentication/argon2id-password-hasher.js

@@ -49,13 +49,29 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Argon2idPasswordHasher = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.lockedPasswordHash = lockedPasswordHash;
+exports.isLockedHash = isLockedHash;
 exports.argon2idHasherProvider = argon2idHasherProvider;
+const node_crypto_1 = require("node:crypto");
 const argon2 = __importStar(require("argon2"));
 const DEFAULT_PARAMS = {
     memoryCost: 19_456,
     timeCost: 2,
     parallelism: 1,
 };
+/** Prefix marking a credential nobody can authenticate against (set later via reset). */
+const LOCKED_PREFIX = '!locked:';
+/** `!locked:` + a real argon2id hash of 32 random bytes that are never kept. */
+async function lockedPasswordHash() {
+    const hash = await argon2.hash((0, node_crypto_1.randomBytes)(32), {
+        type: argon2.argon2id,
+        ...DEFAULT_PARAMS,
+    });
+    return LOCKED_PREFIX + hash;
+}
+function isLockedHash(hash) {
+    return hash.startsWith(LOCKED_PREFIX);
+}
 /** The DI token consumers/ShieldModule bind the concrete hasher under. */
 exports.SHIELD_PASSWORD_HASHER = Symbol('SHIELD_PASSWORD_HASHER');
 /**
@@ -85,6 +101,11 @@ class Argon2idPasswordHasher {
      */
     async verify(hash, plaintext) {
         try {
+            if (isLockedHash(hash)) {
+                // Real verify (no timing shortcut) on the remainder, then false regardless of the outcome.
+                await argon2.verify(hash.slice(LOCKED_PREFIX.length), plaintext);
+                return false;
+            }
             return await argon2.verify(hash, plaintext);
         }
         catch {

package/dist/authentication/credential-provisioner.d.ts

@@ -0,0 +1,35 @@
+/**
+ * CredentialProvisioner — the INSERT-ONLY port that creates a login credential for a new principal
+ * (org bootstrap). It never updates or replaces an existing credential: a principal that already has
+ * one is refused with {@link CredentialExistsError}, so provisioning can never reset someone's password.
+ */
+/** Caller-supplied SQL runner (a transaction connection's `query`); absent ⇒ the pool. */
+export type CredentialQuery = (sql: string, params?: unknown[]) => Promise<unknown>;
+export interface CredentialProvisionInput {
+    readonly principalId: string;
+    /** Login key (`ic_identity_hint`, the canonical email). */
+    readonly hint: string;
+    readonly tenantId: string;
+}
+export interface PasswordCredentialProvisionInput extends CredentialProvisionInput {
+    readonly password: string;
+}
+/** `none` = no credential row; `locked` = unusable placeholder hash; `usable` = a real password hash. */
+export type CredentialState = 'none' | 'locked' | 'usable';
+export interface CredentialProvisioner {
+    /** Insert a credential no password verifies against (set later via reset). */
+    provisionLocked(input: CredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    /** Insert an Argon2id credential for `password` (≥ 8 chars). */
+    provisionPassword(input: PasswordCredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    stateOf(principalId: string, query?: CredentialQuery): Promise<CredentialState>;
+    /**
+     * Batch {@link stateOf} (G-010 P-6): one query per 500 ids, an entry for EVERY requested id
+     * (`none` when no row). Empty input ⇒ empty map, no query. Duplicate ids are fine.
+     */
+    statesOf(principalIds: readonly string[], query?: CredentialQuery): Promise<Map<string, CredentialState>>;
+}
+/** The principal or login hint already has a credential. Fixed message: no hint, no driver text. */
+export declare class CredentialExistsError extends Error {
+    constructor();
+}
+//# sourceMappingURL=credential-provisioner.d.ts.map

package/dist/authentication/credential-provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,gEAAgE;IAChE,iBAAiB,CACf,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChF;;;OAGG;IACH,QAAQ,CACN,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;CAC1C;AAED,oGAAoG;AACpG,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C"}

package/dist/authentication/credential-provisioner.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * CredentialProvisioner — the INSERT-ONLY port that creates a login credential for a new principal
+ * (org bootstrap). It never updates or replaces an existing credential: a principal that already has
+ * one is refused with {@link CredentialExistsError}, so provisioning can never reset someone's password.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialExistsError = void 0;
+/** The principal or login hint already has a credential. Fixed message: no hint, no driver text. */
+class CredentialExistsError extends Error {
+    constructor() {
+        super('A credential already exists for this principal or login');
+        this.name = 'CredentialExistsError';
+    }
+}
+exports.CredentialExistsError = CredentialExistsError;

package/dist/authentication/mariadb-credential-provisioner.d.ts

@@ -0,0 +1,27 @@
+/**
+ * MariaDbCredentialProvisioner — the framework CredentialProvisioner over `identity_credential`.
+ * INSERT only (never UPDATE/upsert): an existing principal, or a duplicate login hint (PK), is a
+ * {@link CredentialExistsError}. Stores only an Argon2id hash (or the locked placeholder); never logs it.
+ * Pass `query` to run inside the caller's transaction connection.
+ */
+import type { Pool } from 'mariadb';
+import { type CredentialProvisioner, type CredentialProvisionInput, type CredentialQuery, type CredentialState, type PasswordCredentialProvisionInput } from './credential-provisioner.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
+export declare class MariaDbCredentialProvisioner implements CredentialProvisioner {
+    private readonly pool;
+    private readonly now;
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    private readonly table;
+    private readonly hasher;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
+    provisionLocked(input: CredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    provisionPassword(input: PasswordCredentialProvisionInput, query?: CredentialQuery): Promise<void>;
+    stateOf(principalId: string, query?: CredentialQuery): Promise<CredentialState>;
+    statesOf(principalIds: readonly string[], query?: CredentialQuery): Promise<Map<string, CredentialState>>;
+    private validate;
+    private run;
+    private insert;
+}
+//# sourceMappingURL=mariadb-credential-provisioner.d.ts.map

package/dist/authentication/mariadb-credential-provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACtC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAkB7C,qBAAa,4BAA6B,YAAW,qBAAqB;IAMtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,iBAAiB,CACrB,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAU/E,QAAQ,CACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAqBxC,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,GAAG;YAIG,MAAM;CA0BrB"}

package/dist/authentication/mariadb-credential-provisioner.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbCredentialProvisioner = void 0;
+const credential_provisioner_js_1 = require("./credential-provisioner.js");
+const argon2id_password_hasher_js_1 = require("./argon2id-password-hasher.js");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
+const MIN_PASSWORD_LENGTH = 8;
+const ER_DUP_ENTRY = 1062;
+/** Max ids bound into one `statesOf` `IN (...)`. */
+const STATES_CHUNK = 500;
+function requireText(value, name) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new TypeError(`${name} must be a non-empty string`);
+    }
+}
+/** Locked placeholder ⇒ `locked`; any other stored hash ⇒ `usable`. The hash never leaves here. */
+function classify(hash) {
+    return (0, argon2id_password_hasher_js_1.isLockedHash)(hash) ? 'locked' : 'usable';
+}
+class MariaDbCredentialProvisioner {
+    pool;
+    now;
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    table;
+    hasher = new argon2id_password_hasher_js_1.Argon2idPasswordHasher();
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
+        this.pool = pool;
+        this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'identity_credential');
+    }
+    async provisionLocked(input, query) {
+        this.validate(input);
+        await this.insert(input, await (0, argon2id_password_hasher_js_1.lockedPasswordHash)(), query);
+    }
+    async provisionPassword(input, query) {
+        this.validate(input);
+        if (typeof input.password !== 'string' || input.password.length < MIN_PASSWORD_LENGTH) {
+            throw new Error(`password must be at least ${MIN_PASSWORD_LENGTH} characters`);
+        }
+        await this.insert(input, await this.hasher.hash(input.password), query);
+    }
+    async stateOf(principalId, query) {
+        const rows = (await this.run(query)(`SELECT ic_password_hash FROM ${this.table} WHERE ic_principal_id = ? LIMIT 1`, [principalId]));
+        const row = rows[0];
+        if (!row)
+            return 'none';
+        return classify(row.ic_password_hash);
+    }
+    async statesOf(principalIds, query) {
+        const ids = [...new Set(principalIds)];
+        const out = new Map(ids.map((id) => [id, 'none']));
+        const run = this.run(query);
+        for (let i = 0; i < ids.length; i += STATES_CHUNK) {
+            const chunk = ids.slice(i, i + STATES_CHUNK);
+            const rows = (await run(`SELECT ic_principal_id, ic_password_hash FROM ${this.table} WHERE ic_principal_id IN (${chunk
+                .map(() => '?')
+                .join(', ')})`, chunk));
+            for (const row of rows) {
+                if (out.has(row.ic_principal_id)) {
+                    out.set(row.ic_principal_id, classify(row.ic_password_hash));
+                }
+            }
+        }
+        return out;
+    }
+    validate(input) {
+        requireText(input.principalId, 'principalId');
+        requireText(input.hint, 'hint');
+        requireText(input.tenantId, 'tenantId');
+    }
+    run(query) {
+        return query ?? ((sql, params) => this.pool.query(sql, params));
+    }
+    async insert(input, hash, query) {
+        const run = this.run(query);
+        const existing = (await run(`SELECT ic_identity_hint FROM ${this.table} WHERE ic_principal_id = ? LIMIT 1 FOR UPDATE`, [input.principalId]));
+        if (existing.length > 0)
+            throw new credential_provisioner_js_1.CredentialExistsError();
+        const nowMs = this.now();
+        try {
+            await run(`INSERT INTO ${this.table}
+           (ic_identity_hint, ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, ic_created_at_ms, ic_updated_at_ms)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`, [input.hint, hash, input.principalId, input.tenantId, '[]', nowMs, nowMs]);
+        }
+        catch (err) {
+            if (err?.errno === ER_DUP_ENTRY) {
+                throw new credential_provisioner_js_1.CredentialExistsError();
+            }
+            throw err;
+        }
+    }
+}
+exports.MariaDbCredentialProvisioner = MariaDbCredentialProvisioner;

package/dist/authz/operation-marker-check.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `withOperationMarkerCheck` — the guard-side seal on core gate 7's delegation marker (G-009 R1-2).
+ *
+ * Core's `decide()` reads `context.attributes['shield.delegation']` and delegates whatever the
+ * principal is. The marker therefore must come only from a principal the engine bound to that
+ * exact operation step (`operationOf`, an unforgeable WeakMap binding; the engine's
+ * `withDelegation` sets the matching marker). Here, every decision entry the authority exposes
+ * (`decide`) passes the attribute through ONLY when `operationOf(principal)` exists and its
+ * `operationKey` and `stepKey` equal the marker's; in every other case it is removed before the
+ * inner `decide()`, so the baseline decision stands (Shield #1, #9).
+ */
+import type { DecisionAuthority } from '@astram/core';
+export declare function withOperationMarkerCheck(inner: DecisionAuthority): DecisionAuthority;
+//# sourceMappingURL=operation-marker-check.d.ts.map

package/dist/authz/operation-marker-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-marker-check.d.ts","sourceRoot":"","sources":["../../src/authz/operation-marker-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,CAoBpF"}

package/dist/authz/operation-marker-check.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withOperationMarkerCheck = withOperationMarkerCheck;
+const engine_1 = require("@astram/engine");
+const MARKER = 'shield.delegation';
+function withOperationMarkerCheck(inner) {
+    return {
+        decide: (principal, action, resource, context) => {
+            const attributes = context.attributes;
+            if (attributes === undefined || !(MARKER in attributes)) {
+                return inner.decide(principal, action, resource, context);
+            }
+            const raw = attributes[MARKER];
+            const binding = (0, engine_1.operationOf)(principal);
+            const { operationKey, stepKey } = typeof raw === 'object' && raw !== null ? raw : {};
+            const genuine = binding !== undefined &&
+                binding.operationKey === operationKey &&
+                binding.stepKey === stepKey;
+            if (genuine)
+                return inner.decide(principal, action, resource, context);
+            const { [MARKER]: _forged, ...rest } = attributes;
+            return inner.decide(principal, action, resource, { ...context, attributes: rest });
+        },
+    };
+}

package/dist/authz/wire-record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAM1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAOD;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA4BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAyE/E"}
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAOD;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA8BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAyE/E"}

package/dist/authz/wire-record-authorization.js

@@ -8,6 +8,7 @@ const mariadb_record_rule_adapter_js_1 = require("./mariadb-record-rule-adapter.
 const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapter.js");
 const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
 const mariadb_list_scope_adapter_js_1 = require("./mariadb-list-scope-adapter.js");
+const operation_marker_check_js_1 = require("./operation-marker-check.js");
 const list_scope_sql_js_1 = require("./list-scope-sql.js");
 const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
 const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
@@ -71,7 +72,7 @@ function buildRecordAuthorization(inputs, options = {}) {
         ? withRedisPermissionVersion(inputs.permissionFacts, options.versionCache)
         : inputs.permissionFacts;
     const schema = authzSchemaOf(inputs);
-    return (0, core_1.createWiredDecisionAuthority)({
+    return (0, operation_marker_check_js_1.withOperationMarkerCheck)((0, core_1.createWiredDecisionAuthority)({
         registry: inputs.registry,
         // The app-owned port, wrapped so a gate-5 reload inside an enforcement request notifies the
         // guard (security hardening Phase 1C: a permission-version move re-derives the session's
@@ -92,7 +93,7 @@ function buildRecordAuthorization(inputs, options = {}) {
         // Delegation / trusted-operation authority over the DECLARED manifest (no DB).
         // Empty ⇒ pass-through. The app supplies the entries; the framework owns the adapter.
         operationAuthority: new manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter(inputs.operationManifest ?? []),
-    });
+    }));
 }
 /**
  * Construct the engine-facing {@link ListScopeFn} — the LIST-form sibling to

package/dist/config/message-config.d.ts

@@ -0,0 +1,70 @@
+/** The email providers `EMAIL_PROVIDER` accepts. */
+export declare const EMAIL_PROVIDER_VALUES: readonly ["smtp", "brevo", "sendgrid", "mailgun", "disabled"];
+/** Default and ceiling for `MESSAGE_SEND_TIMEOUT_MS` (R6). */
+export declare const DEFAULT_MESSAGE_SEND_TIMEOUT_MS = 10000;
+export declare const MAX_MESSAGE_SEND_TIMEOUT_MS = 30000;
+export interface EmailFromConfig {
+    readonly address: string;
+    readonly name?: string;
+}
+/** A validated email provider config, structurally `@astram/messaging`'s `EmailProviderConfig`. */
+export type EmailDeliveryConfig = {
+    readonly provider: 'smtp';
+    readonly from: EmailFromConfig;
+    readonly timeoutMs: number;
+    readonly host: string;
+    readonly port: number;
+    readonly tls: 'starttls' | 'implicit' | 'none';
+    readonly user?: string;
+    readonly password?: string;
+    readonly tlsCaPem?: string;
+} | {
+    readonly provider: 'brevo' | 'sendgrid';
+    readonly from: EmailFromConfig;
+    readonly timeoutMs: number;
+    readonly apiKey: string;
+    readonly baseUrl?: string;
+} | {
+    readonly provider: 'mailgun';
+    readonly from: EmailFromConfig;
+    readonly timeoutMs: number;
+    readonly apiKey: string;
+    readonly domain: string;
+    readonly region: 'us' | 'eu';
+    readonly baseUrl?: string;
+};
+export interface MessageConfig {
+    readonly email: EmailDeliveryConfig | {
+        readonly provider: 'disabled';
+    };
+    /** SMS and WhatsApp have ports only this round (OD-1): always `disabled`. */
+    readonly sms: 'disabled';
+    readonly whatsapp: 'disabled';
+    /** `MESSAGE_BOOT_PROBE=1`: check reachability and credentials at boot, sending nothing (R8). */
+    readonly probe: boolean;
+}
+export interface LoadMessageConfigOptions {
+    /**
+     * Provenance check for credential variables outside development/test (`wasResolvedFromSecretRef`).
+     * Omitted there: fail closed, every credential counts as a literal and is refused.
+     */
+    readonly resolvedFromSecretRef?: (envKey: string, env: Readonly<Record<string, string | undefined>>) => boolean;
+    /** Reads `SMTP_TLS_CA` (UTF-8 PEM). Injected so the loader stays testable. */
+    readonly readFile: (path: string) => string;
+}
+/**
+ * Read the message config for `emailSender: 'env'`. Refuses (naming variables only):
+ * - `EMAIL_PROVIDER` unset or not one of {@link EMAIL_PROVIDER_VALUES};
+ * - `SMS_PROVIDER` / `WHATSAPP_PROVIDER` other than `disabled` (no adapter yet);
+ * - a missing or malformed `EMAIL_FROM_ADDRESS`, a control character in `EMAIL_FROM_NAME`;
+ * - a missing provider credential, an unresolved `secret-ref:` (naming the `SECRETS_PROVIDER`
+ *   prerequisite when none is set), or outside development/test a credential not resolved from
+ *   a `secret-ref:`;
+ * - `EMAIL_API_BASE_URL` that is not `https:`, carries credentials, or is set for `smtp`;
+ * - Mailgun without a domain, or with a region other than `us` / `eu`;
+ * - SMTP without a host, with a bad port, half a login, an unknown `SMTP_TLS`, `none` to a
+ *   non-loopback host outside development/test, or an unreadable `SMTP_TLS_CA`;
+ * - `MESSAGE_SEND_TIMEOUT_MS` outside 1–30000, `MESSAGE_BOOT_PROBE` other than `1` / `0`.
+ */
+export declare function loadMessageConfig(env: NodeJS.ProcessEnv, options: LoadMessageConfigOptions): MessageConfig;
+//# sourceMappingURL=message-config.d.ts.map

package/dist/config/message-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-config.d.ts","sourceRoot":"","sources":["../../src/config/message-config.ts"],"names":[],"mappings":"AAkBA,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,+DAAgE,CAAC;AAEnG,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;KAAE,CAAC;IACxE,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;IACb,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7C;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,wBAAwB,GAChC,aAAa,CAuDf"}