@astram/guard 0.17.0 → 0.19.0

package/dist/auth/auth.module.js

@@ -104,7 +104,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 var AuthModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthModule = exports.singleLayoutProbeProvider = exports.SHIELD_SINGLE_LAYOUT_PROBE = exports.hmacSha1 = void 0;
+exports.AuthModule = exports.attemptLimiterFactoryProvider = exports.singleLayoutProbeProvider = exports.SHIELD_SINGLE_LAYOUT_PROBE = exports.hmacSha1 = void 0;
 exports.resolveTotpVerifier = resolveTotpVerifier;
 exports.makeDefaultTotpVerifier = makeDefaultTotpVerifier;
 exports.resolveDefaultEmailSender = resolveDefaultEmailSender;
@@ -145,6 +145,8 @@ const permission_version_cache_js_1 = require("../authz/permission-version-cache
 const session_restriction_store_js_1 = require("../session/session-restriction-store.js");
 const attempt_limiter_js_1 = require("./rate-limit/attempt-limiter.js");
 const trust_proxy_check_js_1 = require("./rate-limit/trust-proxy-check.js");
+const email_delivery_js_1 = require("../messaging/email-delivery.js");
+const message_dispatcher_js_1 = require("../messaging/message-dispatcher.js");
 const tokens_js_2 = require("../request-auth/tokens.js");
 const mariadb_api_key_store_js_1 = require("../authentication/mariadb-api-key-store.js");
 const core_1 = require("@astram/core");
@@ -741,10 +743,11 @@ const emailAddressChangerProvider = {
     useFactory: (pool, config) => new mariadb_email_address_changer_js_1.MariaDbEmailAddressChanger(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
     inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
-/**
- * The per-account email-change REQUEST limiter (Phase 12) — `email-change:pid:<id>`, 3 per 60-min
- * window, so the route cannot spam an inbox. `consume` fails closed (503).
- */
+exports.attemptLimiterFactoryProvider = {
+    provide: tokens_js_1.SHIELD_ATTEMPT_LIMITER_FACTORY,
+    useFactory: (redis) => (cfg) => new attempt_limiter_js_1.AttemptLimiter(redis, cfg),
+    inject: [tokens_js_1.SHIELD_REDIS],
+};
 const emailChangeLimiterProvider = {
     provide: tokens_js_1.SHIELD_EMAIL_CHANGE_LIMITER,
     useFactory: (redis) => new attempt_limiter_js_1.AttemptLimiter(redis, { maxAttempts: 3, windowMs: 60 * 60 * 1000 }),
@@ -818,6 +821,44 @@ function resolveDefaultEmailSender(rawNodeEnv) {
         'to stdout, reset links included. Never run like this in production — supply an emailSender.');
     return new log_email_sender_js_1.LogEmailSender();
 }
+/**
+ * The email delivery chain (G-010): `SHIELD_EMAIL_DELIVERY` (the bound provider and its per-send
+ * bound), `SHIELD_EMAIL_SENDER` (the port existing injectors know) and `SHIELD_MESSAGE_DISPATCHER`
+ * (bounded, audited, never throws). For `'env'` the sender is derived from the adapter; otherwise
+ * the sender binds exactly as before (AC-11) and the provider wraps it.
+ */
+function makeEmailDeliveryProviders(option) {
+    const dispatcher = {
+        provide: tokens_js_1.SHIELD_MESSAGE_DISPATCHER,
+        useFactory: (delivery, pool, config) => new message_dispatcher_js_1.GuardMessageDispatcher(delivery.provider, (0, email_delivery_js_1.messageAuditWriter)(pool, (0, app_config_js_1.frameworkSchemasOf)(config)), { timeoutMs: delivery.timeoutMs }),
+        inject: [tokens_js_1.SHIELD_EMAIL_DELIVERY, tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+    };
+    if (option === 'env') {
+        return [
+            {
+                provide: tokens_js_1.SHIELD_EMAIL_DELIVERY,
+                useFactory: () => (0, email_delivery_js_1.buildEmailProvider)('env', null, {}),
+            },
+            {
+                provide: tokens_js_1.SHIELD_EMAIL_SENDER,
+                useFactory: (delivery) => delivery.provider
+                    ? (0, email_delivery_js_1.senderFromProvider)(delivery.provider, delivery.timeoutMs)
+                    : new noop_email_sender_js_1.NoopEmailSender(),
+                inject: [tokens_js_1.SHIELD_EMAIL_DELIVERY],
+            },
+            dispatcher,
+        ];
+    }
+    return [
+        makeEmailSenderProvider(option),
+        {
+            provide: tokens_js_1.SHIELD_EMAIL_DELIVERY,
+            useFactory: (sender) => (0, email_delivery_js_1.buildEmailProvider)(option, sender, {}),
+            inject: [tokens_js_1.SHIELD_EMAIL_SENDER],
+        },
+        dispatcher,
+    ];
+}
 function makeRecoveryCodeStoreProvider(override) {
     return override
         ? { provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE, useValue: override }
@@ -930,7 +971,8 @@ let AuthModule = AuthModule_1 = class AuthModule {
         // The link-base boot rule (Phase 13 #1) applies only with a real sender: `'disabled'` delivers
         // nothing, and an omitted sender outside development/test already fails the boot through
         // `resolveDefaultEmailSender` (that clearer error is kept; in development/test the rule is off).
-        const mailDisabled = options.emailSender === undefined || options.emailSender === 'disabled';
+        // G-010: `'env'` is a real sender unless `EMAIL_PROVIDER=disabled` (read after resolveBootSecrets).
+        const mailDisabled = (0, email_delivery_js_1.isMailDisabled)(options.emailSender, process.env);
         return {
             module: AuthModule_1,
             imports: [persistence_module_js_1.PersistenceModule.forRoot()],
@@ -954,8 +996,9 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 emailAddressChangerProvider,
                 emailChangeLimiterProvider,
                 confirmEmailLimiterProvider,
+                exports.attemptLimiterFactoryProvider,
                 makeEmailChangeLinkBaseUrlProvider(options.emailChangeLinkBaseUrl, mailDisabled),
-                makeEmailSenderProvider(options.emailSender),
+                ...makeEmailDeliveryProviders(options.emailSender),
                 makeRecoveryCodeStoreProvider(options.recoveryCodeStore),
                 makeProfileWriterProvider(options.profileWriter),
                 makeSessionSweeperProvider(options.sessionSweeper),
@@ -1065,6 +1108,10 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // Phase 12: identity's admin email change invalidates pending self-service tokens.
                 tokens_js_1.SHIELD_EMAIL_CHANGE_TOKEN_STORE,
                 tokens_js_1.SHIELD_EMAIL_SENDER,
+                // G-010: the one exit for framework messages (identity's invite injects it).
+                tokens_js_1.SHIELD_MESSAGE_DISPATCHER,
+                // G-010: identity's invite rate limits (a limiter factory, never the raw Redis client).
+                tokens_js_1.SHIELD_ATTEMPT_LIMITER_FACTORY,
                 tokens_js_1.SHIELD_RECOVERY_CODE_STORE,
                 tokens_js_1.SHIELD_PROFILE_WRITER,
                 tokens_js_1.SHIELD_SESSION_SWEEPER,

package/dist/auth/confirm-email.controller.d.ts

@@ -2,6 +2,7 @@ import type { AttemptLimiter } from './rate-limit/attempt-limiter.js';
 import { TrustProxyBootCheck } from './rate-limit/trust-proxy-check.js';
 import type { AuditSink } from './ports/audit-sink.js';
 import type { EmailSender } from './ports/email-sender.js';
+import type { MessageDispatcher } from '../messaging/message-dispatcher.js';
 import type { EmailChangeTokenStore } from './ports/email-change-token-store.js';
 import type { EmailAddressChanger } from './ports/email-address-changer.js';
 import type { ResetTokenStore } from './ports/reset-token-store.js';
@@ -15,7 +16,8 @@ export declare class ConfirmEmailController {
     private readonly auditSink?;
     private readonly limiter?;
     private readonly trustProxyCheck?;
-    constructor(tokens?: (EmailChangeTokenStore | null) | undefined, addresses?: (EmailAddressChanger | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, auditSink?: (AuditSink | null) | undefined, limiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (Pick<TrustProxyBootCheck, "perIpLimitingEnabled"> | null) | undefined);
+    private readonly messageDispatcher?;
+    constructor(tokens?: (EmailChangeTokenStore | null) | undefined, addresses?: (EmailAddressChanger | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, auditSink?: (AuditSink | null) | undefined, limiter?: (AttemptLimiter | null) | undefined, trustProxyCheck?: (Pick<TrustProxyBootCheck, "perIpLimitingEnabled"> | null) | undefined, messageDispatcher?: (MessageDispatcher | null) | undefined);
     confirmEmail(body: {
         token?: unknown;
     }, ip: string): Promise<{

package/dist/auth/confirm-email.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-email.controller.d.ts","sourceRoot":"","sources":["../../src/auth/confirm-email.controller.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,kCAAkC,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAcjE,qBACa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAGzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAGzB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBArBhB,MAAM,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAGrC,SAAS,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAGtC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAG/B,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAGpC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAGhC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAG5B,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAG/B,eAAe,CAAC,GAAE,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IAMvF,YAAY,CACR,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAE3B,EAAE,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IA6ExB;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;CAkBd"}
+{"version":3,"file":"confirm-email.controller.d.ts","sourceRoot":"","sources":["../../src/auth/confirm-email.controller.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,kCAAkC,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAcjE,qBACa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAGzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAGzB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAKjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBA1BlB,MAAM,CAAC,GAAE,qBAAqB,GAAG,IAAI,aAAA,EAGrC,SAAS,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAGtC,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAG/B,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EAGpC,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAGhC,SAAS,CAAC,GAAE,SAAS,GAAG,IAAI,aAAA,EAG5B,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAG/B,eAAe,CAAC,GAAE,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA,EAK1E,iBAAiB,CAAC,GAAE,iBAAiB,GAAG,IAAI,aAAA;IAMzD,YAAY,CACR,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAE3B,EAAE,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IAkFxB;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;CAkBd"}

package/dist/auth/confirm-email.controller.js

@@ -39,6 +39,7 @@ const node_crypto_1 = require("node:crypto");
 const classification_decorator_js_1 = require("../enforcement/classification.decorator.js");
 const tokens_js_1 = require("./tokens.js");
 const trust_proxy_check_js_1 = require("./rate-limit/trust-proxy-check.js");
+const deliver_email_js_1 = require("../messaging/deliver-email.js");
 const email_address_js_1 = require("./email-address.js");
 const email_change_messages_js_1 = require("./email-change-messages.js");
 function fail(status, error) {
@@ -59,7 +60,8 @@ let ConfirmEmailController = class ConfirmEmailController {
     auditSink;
     limiter;
     trustProxyCheck;
-    constructor(tokens, addresses, sweeper, resetTokens, emailSender, auditSink, limiter, trustProxyCheck) {
+    messageDispatcher;
+    constructor(tokens, addresses, sweeper, resetTokens, emailSender, auditSink, limiter, trustProxyCheck, messageDispatcher) {
         this.tokens = tokens;
         this.addresses = addresses;
         this.sweeper = sweeper;
@@ -68,6 +70,7 @@ let ConfirmEmailController = class ConfirmEmailController {
         this.auditSink = auditSink;
         this.limiter = limiter;
         this.trustProxyCheck = trustProxyCheck;
+        this.messageDispatcher = messageDispatcher;
     }
     async confirmEmail(body, ip) {
         const tokens = this.tokens;
@@ -138,9 +141,8 @@ let ConfirmEmailController = class ConfirmEmailController {
             });
         }
         if (outcome.oldEmail !== null && outcome.oldEmail !== '' && this.emailSender != null) {
-            await this.emailSender
-                .send((0, email_change_messages_js_1.emailChangedNoticeMessage)(outcome.oldEmail, maskedNew, Date.now()))
-                .catch(() => undefined); // best-effort: the change is committed
+            // Best-effort (the change is committed); G-010: bounded and audited (`security_notice`).
+            await (0, deliver_email_js_1.deliverEmail)(this.messageDispatcher, this.emailSender, 'security_notice', (0, email_change_messages_js_1.emailChangedNoticeMessage)(outcome.oldEmail, maskedNew, Date.now()), { actorId: binding.principalId, tenantId: binding.tenantId });
         }
         this.audit(binding, 'account.email_changed', {
             newEmail: maskedNew,
@@ -201,5 +203,7 @@ exports.ConfirmEmailController = ConfirmEmailController = __decorate([
     __param(6, (0, common_1.Inject)(tokens_js_1.SHIELD_CONFIRM_EMAIL_LIMITER)),
     __param(7, (0, common_1.Optional)()),
     __param(7, (0, common_1.Inject)(trust_proxy_check_js_1.TrustProxyBootCheck)),
-    __metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object, Object, Object])
+    __param(8, (0, common_1.Optional)()),
+    __param(8, (0, common_1.Inject)(tokens_js_1.SHIELD_MESSAGE_DISPATCHER)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object, Object, Object, Object])
 ], ConfirmEmailController);

package/dist/auth/email-change-messages.d.ts

@@ -19,6 +19,8 @@ export declare const DEFAULT_EMAIL_CHANGE_LINK_BASE_URL = "http://localhost:5173
  * first, and the reset advice is qualified rather than given as the remedy.
  */
 export declare const NOT_YOU_SENTENCE: string;
+/** Escape a value for HTML text or a DOUBLE-quoted attribute (shared by framework messages). */
+export declare function escapeHtml(value: string): string;
 /** The confirm link: the token rides in the fragment, never the query (A4). */
 export declare function emailChangeLink(base: string, rawToken: string): string;
 export declare function confirmEmailChangeMessage(to: string, link: string): EmailMessage;

package/dist/auth/email-change-messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-change-messages.d.ts","sourceRoot":"","sources":["../../src/auth/email-change-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAElD,sFAAsF;AACtF,eAAO,MAAM,kCAAkC,wCAAwC,CAAC;AAExF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAE8C,CAAC;AAU5E,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAehF;AAED,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,GACX,YAAY,CAYd"}
+{"version":3,"file":"email-change-messages.d.ts","sourceRoot":"","sources":["../../src/auth/email-change-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAElD,sFAAsF;AACtF,eAAO,MAAM,kCAAkC,wCAAwC,CAAC;AAExF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAE8C,CAAC;AAE5E,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAehF;AAED,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,GACX,YAAY,CAYd"}

package/dist/auth/email-change-messages.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NOT_YOU_SENTENCE = exports.DEFAULT_EMAIL_CHANGE_LINK_BASE_URL = exports.EMAIL_CHANGE_TTL_MS = void 0;
+exports.escapeHtml = escapeHtml;
 exports.emailChangeLink = emailChangeLink;
 exports.confirmEmailChangeMessage = confirmEmailChangeMessage;
 exports.emailChangedNoticeMessage = emailChangedNoticeMessage;
@@ -16,6 +17,7 @@ exports.DEFAULT_EMAIL_CHANGE_LINK_BASE_URL = 'http://localhost:5173/confirm-emai
  */
 exports.NOT_YOU_SENTENCE = "If this wasn't you, contact your administrator immediately. Your sign-in email may have " +
     'changed too, so a password reset from the login page may not reach you.';
+/** Escape a value for HTML text or a DOUBLE-quoted attribute (shared by framework messages). */
 function escapeHtml(value) {
     return value
         .replace(/&/g, '&')

package/dist/auth/password-reset-message.d.ts

@@ -0,0 +1,7 @@
+import type { EmailMessage } from './ports/email-sender.js';
+/**
+ * The forgot-password email (G-010 R9: the link is HTML-escaped; before G-010 it was interpolated
+ * raw). The text part carries the plain link.
+ */
+export declare function passwordResetMessage(to: string, link: string): EmailMessage;
+//# sourceMappingURL=password-reset-message.d.ts.map

package/dist/auth/password-reset-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-message.d.ts","sourceRoot":"","sources":["../../src/auth/password-reset-message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAG5D;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAQ3E"}

package/dist/auth/password-reset-message.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passwordResetMessage = passwordResetMessage;
+const email_change_messages_js_1 = require("./email-change-messages.js");
+/**
+ * The forgot-password email (G-010 R9: the link is HTML-escaped; before G-010 it was interpolated
+ * raw). The text part carries the plain link.
+ */
+function passwordResetMessage(to, link) {
+    const safe = (0, email_change_messages_js_1.escapeHtml)(link);
+    return {
+        to,
+        subject: 'Reset your password',
+        text: `Reset your password: ${link}`,
+        html: `<p>Reset your password: <a href="${safe}">${safe}</a></p>`,
+    };
+}

package/dist/auth/persistence.module.d.ts

@@ -33,8 +33,8 @@
 import { type DynamicModule } from '@nestjs/common';
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them) plus the shutdown holder. Opt-in: only
- * imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
+ * Opt-in: only imported when auth is wired.
  */
 export declare class PersistenceModule {
     static forRoot(): DynamicModule;

package/dist/auth/persistence.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA0C3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAOhC"}
+{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA2D3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAOhC"}

package/dist/auth/persistence.module.js

@@ -41,7 +41,10 @@ var PersistenceModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PersistenceModule = void 0;
 const common_1 = require("@nestjs/common");
+const app_config_js_1 = require("../config/app-config.js");
 const config_module_js_1 = require("../config/config.module.js");
+const audit_sealer_service_js_1 = require("../audit/audit-sealer.service.js");
+const audit_seal_config_js_1 = require("../audit/audit-seal-config.js");
 const tokens_js_1 = require("./tokens.js");
 const connections_js_1 = require("./connections.js");
 /**
@@ -74,16 +77,29 @@ const lifecycleProvider = {
     useFactory: (pool, redis) => new connections_js_1.ConnectionLifecycle(pool, redis),
     inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
 };
+/**
+ * The deferred audit sealer (audit-chain-store SPEC §5.H): registered here so it exists
+ * exactly when {@link SHIELD_DB_POOL} does. `AUDIT_SEAL_*` is read now, so an invalid value
+ * fails the boot (SPEC §13). It ticks only once its table probe finds `audit_log` and
+ * `audit_chain`; a stub or unreachable pool leaves it idle (never a boot failure).
+ */
+const auditSealerProvider = {
+    provide: audit_sealer_service_js_1.AuditSealerService,
+    useFactory: (pool, config) => new audit_sealer_service_js_1.AuditSealerService(pool, (0, app_config_js_1.frameworkSchemasOf)(config), {
+        config: (0, audit_seal_config_js_1.loadAuditSealConfig)(process.env),
+    }),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+};
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them) plus the shutdown holder. Opt-in: only
- * imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
+ * Opt-in: only imported when auth is wired.
  */
 let PersistenceModule = PersistenceModule_1 = class PersistenceModule {
     static forRoot() {
         return {
             module: PersistenceModule_1,
-            providers: [dbPoolProvider, redisProvider, lifecycleProvider],
+            providers: [dbPoolProvider, redisProvider, lifecycleProvider, auditSealerProvider],
             exports: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
         };
     }

package/dist/auth/ports/email-sender.d.ts

@@ -1,13 +1,13 @@
 /**
  * EmailSender — the delivery seam. The framework builds the message; the consumer
- * delivers it (SendGrid, SMTP, or a test capturer). Consumer-plugged.
+ * delivers it (SendGrid, SMTP, or a test capturer). Consumer-plugged, or chosen by
+ * configuration with `ShieldModule.forRoot({ emailSender: 'env' })` (G-010).
+ *
+ * `EmailMessage` is core's channel type (G-010 R1); the name and shape are unchanged, so an app's
+ * existing sender keeps working.
  */
-export interface EmailMessage {
-    readonly to: string;
-    readonly subject: string;
-    readonly html: string;
-    readonly text: string;
-}
+import type { EmailMessage } from '@astram/core';
+export type { EmailMessage };
 export interface EmailSender {
     send(message: EmailMessage): Promise<void>;
 }

package/dist/auth/ports/email-sender.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-sender.d.ts","sourceRoot":"","sources":["../../../src/auth/ports/email-sender.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"email-sender.d.ts","sourceRoot":"","sources":["../../../src/auth/ports/email-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,YAAY,EAAE,YAAY,EAAE,CAAC;AAE7B,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C"}

package/dist/auth/tokens.d.ts

@@ -131,6 +131,20 @@ export declare const SHIELD_CONFIRM_EMAIL_LIMITER: unique symbol;
  * consumer delivers it. Consumed by forgot-password.
  */
 export declare const SHIELD_EMAIL_SENDER: unique symbol;
+/**
+ * The {@link MessageDispatcher} (G-010, `../messaging/message-dispatcher.ts`): the one exit for
+ * framework messages. Bounds, audits (`message.sent` / `message.failed`) and never throws. Every
+ * framework send uses it; `@astram/identity`'s invite injects it too.
+ */
+export declare const SHIELD_MESSAGE_DISPATCHER: unique symbol;
+/**
+ * A factory for guard's Redis-backed `AttemptLimiter` (G-010 P-5): `(cfg) => AttemptLimiter`. For
+ * `@astram/identity`'s invite rate limits; exported from `AuthModule` and `@astram/guard/internal`
+ * so identity builds limiters without ever holding the raw Redis client.
+ */
+export declare const SHIELD_ATTEMPT_LIMITER_FACTORY: unique symbol;
+/** Internal: the bound email provider and its per-send bound (`EmailDelivery`). Not exported. */
+export declare const SHIELD_EMAIL_DELIVERY: unique symbol;
 /**
  * The `RecoveryCodeStore` (guard port, `../auth/ports/recovery-code-store.ts`) —
  * persists Argon2-hashed one-time MFA recovery codes. Consumed by MFA enrollment.

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC"}

package/dist/auth/tokens.js

@@ -23,7 +23,7 @@
  * ADR-0003: no framework/DB/crypto imports here — just Symbols (+ one re-export).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
 var argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
 /**
@@ -143,6 +143,20 @@ exports.SHIELD_CONFIRM_EMAIL_LIMITER = Symbol('SHIELD_CONFIRM_EMAIL_LIMITER');
  * consumer delivers it. Consumed by forgot-password.
  */
 exports.SHIELD_EMAIL_SENDER = Symbol('SHIELD_EMAIL_SENDER');
+/**
+ * The {@link MessageDispatcher} (G-010, `../messaging/message-dispatcher.ts`): the one exit for
+ * framework messages. Bounds, audits (`message.sent` / `message.failed`) and never throws. Every
+ * framework send uses it; `@astram/identity`'s invite injects it too.
+ */
+exports.SHIELD_MESSAGE_DISPATCHER = Symbol('SHIELD_MESSAGE_DISPATCHER');
+/**
+ * A factory for guard's Redis-backed `AttemptLimiter` (G-010 P-5): `(cfg) => AttemptLimiter`. For
+ * `@astram/identity`'s invite rate limits; exported from `AuthModule` and `@astram/guard/internal`
+ * so identity builds limiters without ever holding the raw Redis client.
+ */
+exports.SHIELD_ATTEMPT_LIMITER_FACTORY = Symbol('SHIELD_ATTEMPT_LIMITER_FACTORY');
+/** Internal: the bound email provider and its per-send bound (`EmailDelivery`). Not exported. */
+exports.SHIELD_EMAIL_DELIVERY = Symbol('SHIELD_EMAIL_DELIVERY');
 /**
  * The `RecoveryCodeStore` (guard port, `../auth/ports/recovery-code-store.ts`) —
  * persists Argon2-hashed one-time MFA recovery codes. Consumed by MFA enrollment.

package/dist/authentication/credential-provisioner.d.ts

@@ -22,6 +22,11 @@ export interface CredentialProvisioner {
     /** Insert an Argon2id credential for `password` (≥ 8 chars). */
     provisionPassword(input: PasswordCredentialProvisionInput, query?: CredentialQuery): Promise<void>;
     stateOf(principalId: string, query?: CredentialQuery): Promise<CredentialState>;
+    /**
+     * Batch {@link stateOf} (G-010 P-6): one query per 500 ids, an entry for EVERY requested id
+     * (`none` when no row). Empty input ⇒ empty map, no query. Duplicate ids are fine.
+     */
+    statesOf(principalIds: readonly string[], query?: CredentialQuery): Promise<Map<string, CredentialState>>;
 }
 /** The principal or login hint already has a credential. Fixed message: no hint, no driver text. */
 export declare class CredentialExistsError extends Error {

package/dist/authentication/credential-provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,gEAAgE;IAChE,iBAAiB,CACf,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACjF;AAED,oGAAoG;AACpG,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C"}
+{"version":3,"file":"credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,gEAAgE;IAChE,iBAAiB,CACf,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChF;;;OAGG;IACH,QAAQ,CACN,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;CAC1C;AAED,oGAAoG;AACpG,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C"}

package/dist/authentication/mariadb-credential-provisioner.d.ts

@@ -19,6 +19,7 @@ export declare class MariaDbCredentialProvisioner implements CredentialProvision
     provisionLocked(input: CredentialProvisionInput, query?: CredentialQuery): Promise<void>;
     provisionPassword(input: PasswordCredentialProvisionInput, query?: CredentialQuery): Promise<void>;
     stateOf(principalId: string, query?: CredentialQuery): Promise<CredentialState>;
+    statesOf(principalIds: readonly string[], query?: CredentialQuery): Promise<Map<string, CredentialState>>;
     private validate;
     private run;
     private insert;

package/dist/authentication/mariadb-credential-provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACtC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAW7C,qBAAa,4BAA6B,YAAW,qBAAqB;IAMtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,iBAAiB,CACrB,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAUrF,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,GAAG;YAIG,MAAM;CA0BrB"}
+{"version":3,"file":"mariadb-credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACtC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAkB7C,qBAAa,4BAA6B,YAAW,qBAAqB;IAMtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,iBAAiB,CACrB,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAU/E,QAAQ,CACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAqBxC,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,GAAG;YAIG,MAAM;CA0BrB"}

package/dist/authentication/mariadb-credential-provisioner.js

@@ -6,11 +6,17 @@ const argon2id_password_hasher_js_1 = require("./argon2id-password-hasher.js");
 const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 const MIN_PASSWORD_LENGTH = 8;
 const ER_DUP_ENTRY = 1062;
+/** Max ids bound into one `statesOf` `IN (...)`. */
+const STATES_CHUNK = 500;
 function requireText(value, name) {
     if (typeof value !== 'string' || value.trim() === '') {
         throw new TypeError(`${name} must be a non-empty string`);
     }
 }
+/** Locked placeholder ⇒ `locked`; any other stored hash ⇒ `usable`. The hash never leaves here. */
+function classify(hash) {
+    return (0, argon2id_password_hasher_js_1.isLockedHash)(hash) ? 'locked' : 'usable';
+}
 class MariaDbCredentialProvisioner {
     pool;
     now;
@@ -40,7 +46,24 @@ class MariaDbCredentialProvisioner {
         const row = rows[0];
         if (!row)
             return 'none';
-        return (0, argon2id_password_hasher_js_1.isLockedHash)(row.ic_password_hash) ? 'locked' : 'usable';
+        return classify(row.ic_password_hash);
+    }
+    async statesOf(principalIds, query) {
+        const ids = [...new Set(principalIds)];
+        const out = new Map(ids.map((id) => [id, 'none']));
+        const run = this.run(query);
+        for (let i = 0; i < ids.length; i += STATES_CHUNK) {
+            const chunk = ids.slice(i, i + STATES_CHUNK);
+            const rows = (await run(`SELECT ic_principal_id, ic_password_hash FROM ${this.table} WHERE ic_principal_id IN (${chunk
+                .map(() => '?')
+                .join(', ')})`, chunk));
+            for (const row of rows) {
+                if (out.has(row.ic_principal_id)) {
+                    out.set(row.ic_principal_id, classify(row.ic_password_hash));
+                }
+            }
+        }
+        return out;
     }
     validate(input) {
         requireText(input.principalId, 'principalId');

package/dist/config/message-config.d.ts

@@ -0,0 +1,70 @@
+/** The email providers `EMAIL_PROVIDER` accepts. */
+export declare const EMAIL_PROVIDER_VALUES: readonly ["smtp", "brevo", "sendgrid", "mailgun", "disabled"];
+/** Default and ceiling for `MESSAGE_SEND_TIMEOUT_MS` (R6). */
+export declare const DEFAULT_MESSAGE_SEND_TIMEOUT_MS = 10000;
+export declare const MAX_MESSAGE_SEND_TIMEOUT_MS = 30000;
+export interface EmailFromConfig {
+    readonly address: string;
+    readonly name?: string;
+}
+/** A validated email provider config, structurally `@astram/messaging`'s `EmailProviderConfig`. */
+export type EmailDeliveryConfig = {
+    readonly provider: 'smtp';
+    readonly from: EmailFromConfig;
+    readonly timeoutMs: number;
+    readonly host: string;
+    readonly port: number;
+    readonly tls: 'starttls' | 'implicit' | 'none';
+    readonly user?: string;
+    readonly password?: string;
+    readonly tlsCaPem?: string;
+} | {
+    readonly provider: 'brevo' | 'sendgrid';
+    readonly from: EmailFromConfig;
+    readonly timeoutMs: number;
+    readonly apiKey: string;
+    readonly baseUrl?: string;
+} | {
+    readonly provider: 'mailgun';
+    readonly from: EmailFromConfig;
+    readonly timeoutMs: number;
+    readonly apiKey: string;
+    readonly domain: string;
+    readonly region: 'us' | 'eu';
+    readonly baseUrl?: string;
+};
+export interface MessageConfig {
+    readonly email: EmailDeliveryConfig | {
+        readonly provider: 'disabled';
+    };
+    /** SMS and WhatsApp have ports only this round (OD-1): always `disabled`. */
+    readonly sms: 'disabled';
+    readonly whatsapp: 'disabled';
+    /** `MESSAGE_BOOT_PROBE=1`: check reachability and credentials at boot, sending nothing (R8). */
+    readonly probe: boolean;
+}
+export interface LoadMessageConfigOptions {
+    /**
+     * Provenance check for credential variables outside development/test (`wasResolvedFromSecretRef`).
+     * Omitted there: fail closed, every credential counts as a literal and is refused.
+     */
+    readonly resolvedFromSecretRef?: (envKey: string, env: Readonly<Record<string, string | undefined>>) => boolean;
+    /** Reads `SMTP_TLS_CA` (UTF-8 PEM). Injected so the loader stays testable. */
+    readonly readFile: (path: string) => string;
+}
+/**
+ * Read the message config for `emailSender: 'env'`. Refuses (naming variables only):
+ * - `EMAIL_PROVIDER` unset or not one of {@link EMAIL_PROVIDER_VALUES};
+ * - `SMS_PROVIDER` / `WHATSAPP_PROVIDER` other than `disabled` (no adapter yet);
+ * - a missing or malformed `EMAIL_FROM_ADDRESS`, a control character in `EMAIL_FROM_NAME`;
+ * - a missing provider credential, an unresolved `secret-ref:` (naming the `SECRETS_PROVIDER`
+ *   prerequisite when none is set), or outside development/test a credential not resolved from
+ *   a `secret-ref:`;
+ * - `EMAIL_API_BASE_URL` that is not `https:`, carries credentials, or is set for `smtp`;
+ * - Mailgun without a domain, or with a region other than `us` / `eu`;
+ * - SMTP without a host, with a bad port, half a login, an unknown `SMTP_TLS`, `none` to a
+ *   non-loopback host outside development/test, or an unreadable `SMTP_TLS_CA`;
+ * - `MESSAGE_SEND_TIMEOUT_MS` outside 1–30000, `MESSAGE_BOOT_PROBE` other than `1` / `0`.
+ */
+export declare function loadMessageConfig(env: NodeJS.ProcessEnv, options: LoadMessageConfigOptions): MessageConfig;
+//# sourceMappingURL=message-config.d.ts.map

package/dist/config/message-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-config.d.ts","sourceRoot":"","sources":["../../src/config/message-config.ts"],"names":[],"mappings":"AAkBA,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,+DAAgE,CAAC;AAEnG,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mGAAmG;AACnG,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;KAAE,CAAC;IACxE,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;IACb,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7C;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,wBAAwB,GAChC,aAAa,CAuDf"}