@astram/guard 0.17.0 → 0.19.0

package/dist/config/message-config.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = void 0;
+exports.loadMessageConfig = loadMessageConfig;
+/**
+ * Message delivery config (G-010, docs/features/message-delivery/SPEC.md R2–R8): what
+ * `ShieldModule.forRoot({ emailSender: 'env' })` reads from the environment. Mirrors
+ * {@link loadObjectStorageConfig}: every missing, invalid or contradictory value refuses boot with
+ * a message that names the variable, never its value (Shield #1, #10); outside development/test
+ * every credential must have been resolved from a `secret-ref:` at boot (ADR-0032, ADR-0040).
+ *
+ * Adapters live in `@astram/messaging`, which receives the validated {@link EmailDeliveryConfig}
+ * and reads no environment itself (spec P-2).
+ */
+const node_net_1 = require("node:net");
+const core_1 = require("@astram/core");
+const email_address_js_1 = require("../auth/email-address.js");
+const app_config_js_1 = require("./app-config.js");
+const loopback_host_js_1 = require("./loopback-host.js");
+/** The email providers `EMAIL_PROVIDER` accepts. */
+exports.EMAIL_PROVIDER_VALUES = ['smtp', 'brevo', 'sendgrid', 'mailgun', 'disabled'];
+/** Default and ceiling for `MESSAGE_SEND_TIMEOUT_MS` (R6). */
+exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = 10_000;
+exports.MAX_MESSAGE_SEND_TIMEOUT_MS = 30_000;
+const HOST_LABEL = '[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?';
+const HOSTNAME = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})*$`);
+const PLAIN_POSITIVE_INT = /^[1-9]\d*$/;
+// C0 controls, DEL and C1 controls: a display name never carries a line break into a header.
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
+/**
+ * Read the message config for `emailSender: 'env'`. Refuses (naming variables only):
+ * - `EMAIL_PROVIDER` unset or not one of {@link EMAIL_PROVIDER_VALUES};
+ * - `SMS_PROVIDER` / `WHATSAPP_PROVIDER` other than `disabled` (no adapter yet);
+ * - a missing or malformed `EMAIL_FROM_ADDRESS`, a control character in `EMAIL_FROM_NAME`;
+ * - a missing provider credential, an unresolved `secret-ref:` (naming the `SECRETS_PROVIDER`
+ *   prerequisite when none is set), or outside development/test a credential not resolved from
+ *   a `secret-ref:`;
+ * - `EMAIL_API_BASE_URL` that is not `https:`, carries credentials, or is set for `smtp`;
+ * - Mailgun without a domain, or with a region other than `us` / `eu`;
+ * - SMTP without a host, with a bad port, half a login, an unknown `SMTP_TLS`, `none` to a
+ *   non-loopback host outside development/test, or an unreadable `SMTP_TLS_CA`;
+ * - `MESSAGE_SEND_TIMEOUT_MS` outside 1–30000, `MESSAGE_BOOT_PROBE` other than `1` / `0`.
+ */
+function loadMessageConfig(env, options) {
+    const devOrTest = (0, app_config_js_1.isDevOrTestNodeEnv)(env.NODE_ENV);
+    const sms = channelSwitch(env, 'SMS_PROVIDER');
+    const whatsapp = channelSwitch(env, 'WHATSAPP_PROVIDER');
+    const probe = parseProbe(env.MESSAGE_BOOT_PROBE);
+    const provider = env.EMAIL_PROVIDER?.trim();
+    const list = exports.EMAIL_PROVIDER_VALUES.join(', ');
+    if (!provider) {
+        throw new Error(`EMAIL_PROVIDER must be set when ShieldModule.forRoot({ emailSender: 'env' }) (one of ${list})`);
+    }
+    if (!exports.EMAIL_PROVIDER_VALUES.includes(provider)) {
+        throw new Error(`EMAIL_PROVIDER has an unknown value (expected one of ${list})`);
+    }
+    if (provider === 'disabled') {
+        return { email: { provider: 'disabled' }, sms, whatsapp, probe };
+    }
+    const from = parseFrom(env);
+    const timeoutMs = parseTimeout(env.MESSAGE_SEND_TIMEOUT_MS);
+    const credential = (name) => readCredential(env, name, devOrTest, options);
+    let email;
+    if (provider === 'smtp') {
+        if (present(env.EMAIL_API_BASE_URL)) {
+            throw new Error('EMAIL_API_BASE_URL applies only to HTTP providers, not EMAIL_PROVIDER=smtp');
+        }
+        email = parseSmtp(env, from, timeoutMs, devOrTest, credential, options.readFile);
+    }
+    else {
+        const baseUrl = parseBaseUrl(env.EMAIL_API_BASE_URL);
+        const withBase = baseUrl === undefined ? {} : { baseUrl };
+        if (provider === 'mailgun') {
+            email = {
+                provider,
+                from,
+                apiKey: credential('MAILGUN_API_KEY'),
+                domain: parseMailgunDomain(env.MAILGUN_DOMAIN),
+                region: parseMailgunRegion(env.MAILGUN_REGION),
+                timeoutMs,
+                ...withBase,
+            };
+        }
+        else {
+            const keyVar = provider === 'brevo' ? 'BREVO_API_KEY' : 'SENDGRID_API_KEY';
+            email = {
+                provider: provider,
+                from,
+                apiKey: credential(keyVar),
+                timeoutMs,
+                ...withBase,
+            };
+        }
+    }
+    return { email, sms, whatsapp, probe };
+}
+function present(value) {
+    return value !== undefined && value.trim() !== '';
+}
+function channelSwitch(env, name) {
+    const value = env[name]?.trim();
+    if (value && value !== 'disabled') {
+        throw new Error(`${name}: no adapter for this channel yet (only 'disabled')`);
+    }
+    return 'disabled';
+}
+function parseProbe(raw) {
+    const value = raw?.trim();
+    if (!value || value === '0')
+        return false;
+    if (value === '1')
+        return true;
+    throw new Error("MESSAGE_BOOT_PROBE must be '1' or '0'");
+}
+function parseTimeout(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS;
+    const n = PLAIN_POSITIVE_INT.test(value) ? Number(value) : NaN;
+    if (!Number.isSafeInteger(n) || n > exports.MAX_MESSAGE_SEND_TIMEOUT_MS) {
+        throw new Error(`MESSAGE_SEND_TIMEOUT_MS must be a whole number of milliseconds between 1 and ${exports.MAX_MESSAGE_SEND_TIMEOUT_MS}`);
+    }
+    return n;
+}
+function parseFrom(env) {
+    const address = env.EMAIL_FROM_ADDRESS?.trim();
+    if (!address)
+        throw new Error('EMAIL_FROM_ADDRESS must be set for EMAIL_PROVIDER');
+    if (!(0, email_address_js_1.isEmailShaped)(address))
+        throw new Error('EMAIL_FROM_ADDRESS is not an email address');
+    const name = env.EMAIL_FROM_NAME?.trim();
+    if (!name)
+        return { address };
+    if (CONTROL_CHARS.test(name)) {
+        throw new Error('EMAIL_FROM_NAME must not contain control characters (line breaks included)');
+    }
+    if ([...name].length > 128)
+        throw new Error('EMAIL_FROM_NAME must be at most 128 characters');
+    return { address, name };
+}
+function readCredential(env, name, devOrTest, options) {
+    const value = env[name];
+    if (!present(value))
+        throw new Error(`${name} must be set for EMAIL_PROVIDER`);
+    const noProvider = !present(env.SECRETS_PROVIDER) || env.SECRETS_PROVIDER.trim() === 'none';
+    if ((0, core_1.isSecretRef)(value)) {
+        if (noProvider) {
+            throw new Error(`${name} is a secret-ref: value but SECRETS_PROVIDER is not set; configure a secrets ` +
+                "provider (e.g. 'encrypted-file') before using emailSender: 'env' (runbook §6)");
+        }
+        throw new Error(`${name} still holds an unresolved secret-ref: value; call resolveBootSecrets() in main.ts ` +
+            'before loading AppModule');
+    }
+    if (!devOrTest && !(options.resolvedFromSecretRef?.(name, env) === true)) {
+        const prerequisite = noProvider
+            ? "; this needs SECRETS_PROVIDER (e.g. 'encrypted-file') configured first (runbook §6)"
+            : '';
+        throw new Error(`${name} must be a secret-ref: value outside NODE_ENV development/test ` +
+            `(literal credentials are refused; see ADR-0032)${prerequisite}`);
+    }
+    return value;
+}
+function parseBaseUrl(raw) {
+    if (!present(raw))
+        return undefined;
+    let url;
+    try {
+        url = new URL(raw.trim());
+    }
+    catch {
+        throw new Error('EMAIL_API_BASE_URL is not a valid URL');
+    }
+    if (url.protocol !== 'https:')
+        throw new Error('EMAIL_API_BASE_URL must be an https: URL');
+    if (url.username !== '' || url.password !== '') {
+        throw new Error('EMAIL_API_BASE_URL must not carry credentials (use the provider API key)');
+    }
+    if (url.search !== '' || url.hash !== '') {
+        throw new Error('EMAIL_API_BASE_URL must not carry a query or fragment');
+    }
+    return `${url.origin}${url.pathname}`.replace(/\/+$/, '');
+}
+function parseMailgunDomain(raw) {
+    const domain = raw?.trim();
+    if (!domain)
+        throw new Error('MAILGUN_DOMAIN must be set for EMAIL_PROVIDER=mailgun');
+    if (!HOSTNAME.test(domain) || domain.length > 253) {
+        throw new Error('MAILGUN_DOMAIN is not a domain name');
+    }
+    return domain;
+}
+function parseMailgunRegion(raw) {
+    const region = raw?.trim() || 'us';
+    if (region !== 'us' && region !== 'eu')
+        throw new Error("MAILGUN_REGION must be 'us' or 'eu'");
+    return region;
+}
+function parseSmtp(env, from, timeoutMs, devOrTest, credential, readFile) {
+    const host = env.SMTP_HOST?.trim();
+    if (!host)
+        throw new Error('SMTP_HOST must be set for EMAIL_PROVIDER=smtp');
+    if (!(HOSTNAME.test(host) || (0, node_net_1.isIP)(host) !== 0) || host.length > 253) {
+        throw new Error('SMTP_HOST is not a host name or IP address');
+    }
+    const tlsRaw = env.SMTP_TLS?.trim() || 'starttls';
+    if (tlsRaw !== 'starttls' && tlsRaw !== 'implicit' && tlsRaw !== 'none') {
+        throw new Error('SMTP_TLS must be one of starttls, implicit, none');
+    }
+    const tls = tlsRaw;
+    if (tls === 'none' && !devOrTest && !(0, loopback_host_js_1.isLoopbackHost)(host)) {
+        throw new Error('SMTP_TLS=none is allowed only to a loopback host outside NODE_ENV development/test ' +
+            '(use starttls or implicit)');
+    }
+    const portRaw = env.SMTP_PORT?.trim();
+    let port = tls === 'implicit' ? 465 : tls === 'starttls' ? 587 : 25;
+    if (portRaw) {
+        const n = PLAIN_POSITIVE_INT.test(portRaw) ? Number(portRaw) : NaN;
+        if (!Number.isSafeInteger(n) || n > 65_535) {
+            throw new Error('SMTP_PORT must be a port number (1–65535)');
+        }
+        port = n;
+    }
+    const hasUser = present(env.SMTP_USER);
+    const hasPassword = present(env.SMTP_PASSWORD);
+    if (hasUser !== hasPassword) {
+        throw new Error('SMTP_USER and SMTP_PASSWORD must be set together (or both left unset)');
+    }
+    const login = hasUser
+        ? { user: env.SMTP_USER.trim(), password: credential('SMTP_PASSWORD') }
+        : {};
+    let ca = {};
+    if (present(env.SMTP_TLS_CA)) {
+        if (tls === 'none')
+            throw new Error('SMTP_TLS_CA needs SMTP_TLS starttls or implicit');
+        let pem;
+        try {
+            pem = readFile(env.SMTP_TLS_CA.trim());
+        }
+        catch {
+            throw new Error('SMTP_TLS_CA could not be read (set it to a readable PEM file path)');
+        }
+        if (!pem.includes('-----BEGIN CERTIFICATE-----')) {
+            throw new Error('SMTP_TLS_CA is not a PEM certificate file');
+        }
+        ca = { tlsCaPem: pem };
+    }
+    return { provider: 'smtp', from, host, port, tls, ...login, ...ca, timeoutMs };
+}

package/dist/index.d.ts

@@ -40,6 +40,8 @@ export { EncryptedFileSecretsProvider } from './secrets/encrypted-file-secrets.j
 export { resolveBootSecrets, createSecretsProviderFromEnv, assertNoUnresolvedSecretRefs, wasResolvedFromSecretRef, type ResolveBootSecretsOptions, } from './secrets/boot-secrets.js';
 export { S3ObjectStore, type S3ObjectStoreConfig, type S3ObjectStoreOptions, } from './storage/s3-object-store.js';
 export { NodeSha256Digest } from './storage/node-sha256-digest.js';
+export { NodeSha256Hash } from './audit/node-sha256-hash.js';
+export { loadAuditSealConfig, type AuditSealConfig } from './audit/audit-seal-config.js';
 export { ObjectStoreBootCheck } from './storage/object-store-boot-check.js';
 export { FileIntake, FILE_INTAKE_REQUEST_KEY, FILE_INTAKE_DEFAULT_MAX_BYTES, type FileIntakeOptions, type FileIntakeResult, } from './storage/file-intake.interceptor.js';
 export type { ShieldStorageOption } from './storage/storage.providers.js';
@@ -72,7 +74,7 @@ export { frameworkSchemasOf, loadAppConfig, loadPoolBudget, evaluatePoolBudget,
 export { rootIdsFromEnv } from './config/root-ids-from-env.js';
 export { ORG_BOOTSTRAP_PRINCIPAL_ID, assertNoReservedRootId, } from './config/reserved-principal-ids.js';
 export { mariadbSslOption } from './auth/connections.js';
-export { SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_CHANGE_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
+export { SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_CHANGE_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_MESSAGE_DISPATCHER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
 export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
 export type { SessionView, SessionTokensView, SessionSuccess, LoginRequest, MfaChallengeResponse, LoginResponse, MfaRequest, MfaResponse, RefreshRequest, RefreshResponse, LogoutRequest, LogoutAck, } from './auth/dto.js';
 export { AuthModule, type AuthModuleOptions } from './auth/auth.module.js';
@@ -87,6 +89,10 @@ export { canonicalEmail, isEmailShaped, maskEmail } from './auth/email-address.j
 export { MariaDbEmailAddressChanger } from './authentication/mariadb-email-address-changer.js';
 export type { EmailAddressChanger, EmailChangeRequest, EmailChangeOutcome, CurrentEmail, TransactionQuery, } from './auth/ports/email-address-changer.js';
 export type { EmailSender, EmailMessage } from './auth/ports/email-sender.js';
+export type { MessageDispatcher, MessageAuditContext, EmailDeliveryOutcome, } from './messaging/message-dispatcher.js';
+export type { EmailSenderOption } from './messaging/email-delivery.js';
+export { loadMessageConfig, EMAIL_PROVIDER_VALUES, DEFAULT_MESSAGE_SEND_TIMEOUT_MS, MAX_MESSAGE_SEND_TIMEOUT_MS, type MessageConfig, type EmailDeliveryConfig, type EmailFromConfig, type LoadMessageConfigOptions, } from './config/message-config.js';
+export { maskPhone } from './messaging/recipient-mask.js';
 export type { RecoveryCodeStore } from './auth/ports/recovery-code-store.js';
 export type { ProfileWriter } from './auth/ports/profile-writer.js';
 export { ProfileNameTakenError } from './auth/ports/profile-writer.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG9E,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -17,9 +17,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wasResolvedFromSecretRef = exports.assertNoUnresolvedSecretRefs = exports.createSecretsProviderFromEnv = exports.resolveBootSecrets = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.resolveAuthLinkBaseUrls = exports.CredentialExistsError = exports.isLockedHash = exports.lockedPasswordHash = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.uuidArrayField = exports.optionalUuidField = exports.uuidField = exports.UuidPipe = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_RECORD_AUTHORIZATION = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsOf = exports.actionsFor = exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
-exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
-exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.mariadbSslOption = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = void 0;
-exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = void 0;
+exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.loadAuditSealConfig = exports.NodeSha256Hash = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
+exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.mariadbSslOption = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -153,6 +153,12 @@ var s3_object_store_js_1 = require("./storage/s3-object-store.js");
 Object.defineProperty(exports, "S3ObjectStore", { enumerable: true, get: function () { return s3_object_store_js_1.S3ObjectStore; } });
 var node_sha256_digest_js_1 = require("./storage/node-sha256-digest.js");
 Object.defineProperty(exports, "NodeSha256Digest", { enumerable: true, get: function () { return node_sha256_digest_js_1.NodeSha256Digest; } });
+// Durable audit chain (audit-chain-store SPEC §5.F, §5.I): the chain hash adapter and the
+// `AUDIT_SEAL_*` loader. The sealer itself is wired by `ShieldModule.forRoot({ auth: true })`.
+var node_sha256_hash_js_1 = require("./audit/node-sha256-hash.js");
+Object.defineProperty(exports, "NodeSha256Hash", { enumerable: true, get: function () { return node_sha256_hash_js_1.NodeSha256Hash; } });
+var audit_seal_config_js_1 = require("./audit/audit-seal-config.js");
+Object.defineProperty(exports, "loadAuditSealConfig", { enumerable: true, get: function () { return audit_seal_config_js_1.loadAuditSealConfig; } });
 var object_store_boot_check_js_1 = require("./storage/object-store-boot-check.js");
 Object.defineProperty(exports, "ObjectStoreBootCheck", { enumerable: true, get: function () { return object_store_boot_check_js_1.ObjectStoreBootCheck; } });
 var file_intake_interceptor_js_1 = require("./storage/file-intake.interceptor.js");
@@ -404,6 +410,7 @@ Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, g
 // Phase 12 (KI #14): the self-service email-change token store (framework default).
 Object.defineProperty(exports, "SHIELD_EMAIL_CHANGE_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_EMAIL_CHANGE_TOKEN_STORE; } });
 Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_EMAIL_SENDER; } });
+Object.defineProperty(exports, "SHIELD_MESSAGE_DISPATCHER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_MESSAGE_DISPATCHER; } });
 Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_RECOVERY_CODE_STORE; } });
 Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_PROFILE_WRITER; } });
 Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SESSION_SWEEPER; } });
@@ -444,6 +451,13 @@ Object.defineProperty(exports, "maskEmail", { enumerable: true, get: function ()
 // follow, pending-token burn). Guard's confirm route uses it; identity's admin path constructs it.
 var mariadb_email_address_changer_js_1 = require("./authentication/mariadb-email-address-changer.js");
 Object.defineProperty(exports, "MariaDbEmailAddressChanger", { enumerable: true, get: function () { return mariadb_email_address_changer_js_1.MariaDbEmailAddressChanger; } });
+var message_config_js_1 = require("./config/message-config.js");
+Object.defineProperty(exports, "loadMessageConfig", { enumerable: true, get: function () { return message_config_js_1.loadMessageConfig; } });
+Object.defineProperty(exports, "EMAIL_PROVIDER_VALUES", { enumerable: true, get: function () { return message_config_js_1.EMAIL_PROVIDER_VALUES; } });
+Object.defineProperty(exports, "DEFAULT_MESSAGE_SEND_TIMEOUT_MS", { enumerable: true, get: function () { return message_config_js_1.DEFAULT_MESSAGE_SEND_TIMEOUT_MS; } });
+Object.defineProperty(exports, "MAX_MESSAGE_SEND_TIMEOUT_MS", { enumerable: true, get: function () { return message_config_js_1.MAX_MESSAGE_SEND_TIMEOUT_MS; } });
+var recipient_mask_js_1 = require("./messaging/recipient-mask.js");
+Object.defineProperty(exports, "maskPhone", { enumerable: true, get: function () { return recipient_mask_js_1.maskPhone; } });
 var profile_writer_js_1 = require("./auth/ports/profile-writer.js");
 Object.defineProperty(exports, "ProfileNameTakenError", { enumerable: true, get: function () { return profile_writer_js_1.ProfileNameTakenError; } });
 var tokens_js_5 = require("./auth/tokens.js");

package/dist/internal.d.ts

@@ -10,4 +10,14 @@
 export { PersistenceModule } from './auth/persistence.module.js';
 export { SHIELD_DB_POOL } from './auth/tokens.js';
 export { MariaDbCredentialProvisioner } from './authentication/mariadb-credential-provisioner.js';
+/**
+ * For `@astram/identity`'s invite rate limits only (G-010, spec P-5), not app use: guard's
+ * Redis-backed {@link AttemptLimiter} and the existing `SHIELD_REDIS` token its own limiters
+ * inject (the one client `PersistenceModule` provides; no second connection). `check()` fails
+ * open on a Redis error, as forgot-password does.
+ */
+export { AttemptLimiter } from './auth/rate-limit/attempt-limiter.js';
+export { SHIELD_REDIS } from './auth/tokens.js';
+export { SHIELD_ATTEMPT_LIMITER_FACTORY } from './auth/tokens.js';
+export type { AttemptLimiterFactory } from './auth/auth.module.js';
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/internal.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MariaDbCredentialProvisioner = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
+exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_REDIS = exports.AttemptLimiter = exports.MariaDbCredentialProvisioner = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
 /**
  * @astram/guard/internal — framework-composition and test surface (Phase 8 #5).
  *
@@ -16,3 +16,15 @@ var tokens_js_1 = require("./auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_1.SHIELD_DB_POOL; } });
 var mariadb_credential_provisioner_js_1 = require("./authentication/mariadb-credential-provisioner.js");
 Object.defineProperty(exports, "MariaDbCredentialProvisioner", { enumerable: true, get: function () { return mariadb_credential_provisioner_js_1.MariaDbCredentialProvisioner; } });
+/**
+ * For `@astram/identity`'s invite rate limits only (G-010, spec P-5), not app use: guard's
+ * Redis-backed {@link AttemptLimiter} and the existing `SHIELD_REDIS` token its own limiters
+ * inject (the one client `PersistenceModule` provides; no second connection). `check()` fails
+ * open on a Redis error, as forgot-password does.
+ */
+var attempt_limiter_js_1 = require("./auth/rate-limit/attempt-limiter.js");
+Object.defineProperty(exports, "AttemptLimiter", { enumerable: true, get: function () { return attempt_limiter_js_1.AttemptLimiter; } });
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
+var tokens_js_3 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_ATTEMPT_LIMITER_FACTORY", { enumerable: true, get: function () { return tokens_js_3.SHIELD_ATTEMPT_LIMITER_FACTORY; } });

package/dist/messaging/deliver-email.d.ts

@@ -0,0 +1,10 @@
+import type { EmailMessage, MessagePurpose } from '@astram/core';
+import type { EmailSender } from '../auth/ports/email-sender.js';
+import type { MessageAuditContext, MessageDispatcher } from './message-dispatcher.js';
+/**
+ * Send one framework email (G-010 P-1): through the {@link MessageDispatcher} (bounded, audited,
+ * never throws) when it is bound, else through the bound sender as before (a controller built
+ * without the dispatcher, e.g. positionally in a test). Never throws: returns what happened.
+ */
+export declare function deliverEmail(dispatcher: MessageDispatcher | null | undefined, sender: EmailSender, purpose: MessagePurpose, message: EmailMessage, context: MessageAuditContext): Promise<'sent' | 'failed' | 'disabled'>;
+//# sourceMappingURL=deliver-email.d.ts.map

package/dist/messaging/deliver-email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliver-email.d.ts","sourceRoot":"","sources":["../../src/messaging/deliver-email.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEtF;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAChD,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EACrB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC,CAQzC"}

package/dist/messaging/deliver-email.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliverEmail = deliverEmail;
+/**
+ * Send one framework email (G-010 P-1): through the {@link MessageDispatcher} (bounded, audited,
+ * never throws) when it is bound, else through the bound sender as before (a controller built
+ * without the dispatcher, e.g. positionally in a test). Never throws: returns what happened.
+ */
+async function deliverEmail(dispatcher, sender, purpose, message, context) {
+    if (dispatcher)
+        return (await dispatcher.sendEmail(purpose, message, context)).status;
+    try {
+        await sender.send(message);
+        return 'sent';
+    }
+    catch {
+        return 'failed';
+    }
+}

package/dist/messaging/email-delivery.d.ts

@@ -0,0 +1,42 @@
+import { type EmailProvider } from '@astram/core';
+import type { FrameworkSchemas } from '@astram/core';
+import type { Pool } from 'mariadb';
+import type { EmailSender } from '../auth/ports/email-sender.js';
+import { type EmailDeliveryConfig } from '../config/message-config.js';
+import { type MessageAuditWriter } from './message-dispatcher.js';
+/** `ShieldModule.forRoot({ emailSender })`. */
+export type EmailSenderOption = EmailSender | 'disabled' | 'env';
+/** What `@astram/messaging` must export for guard (spec P-2). */
+export interface MessagingModule {
+    createEmailProvider(config: EmailDeliveryConfig): Promise<EmailProvider>;
+}
+export interface EmailDelivery {
+    /** `null` ⇒ mail disabled. */
+    readonly provider: EmailProvider | null;
+    /** The per-send bound the dispatcher applies. */
+    readonly timeoutMs: number;
+}
+export interface BuildEmailProviderDeps {
+    readonly env?: NodeJS.ProcessEnv;
+    /** Loader for the optional peer (default `require`). */
+    readonly load?: (id: string) => unknown;
+    readonly readFile?: (path: string) => string;
+}
+export declare function buildEmailProvider(option: EmailSenderOption | undefined, boundSender: EmailSender | null, deps: BuildEmailProviderDeps): Promise<EmailDelivery>;
+/**
+ * The link-base boot rule applies only with a real sender (Phase 13 #1). `'env'` is real unless
+ * `EMAIL_PROVIDER=disabled`. Read at `forRoot` time, after `resolveBootSecrets()`.
+ */
+export declare function isMailDisabled(option: EmailSenderOption | undefined, env: Readonly<Record<string, string | undefined>>): boolean;
+/**
+ * The `EmailSender` bound under `SHIELD_EMAIL_SENDER` for `'env'`, so existing injectors keep the
+ * port they know. Each send is bounded; a failure rejects (callers already treat it best-effort).
+ */
+export declare function senderFromProvider(provider: EmailProvider, timeoutMs: number): EmailSender;
+/**
+ * `message.sent` / `message.failed` rows go to the framework audit log over guard's own pool
+ * (the runtime account holds append-only INSERT on the audit schema), independent of the
+ * optional app `auditSink` (Shield #6).
+ */
+export declare function messageAuditWriter(pool: Pick<Pool, 'query'>, schemas: Pick<FrameworkSchemas, 'audit'>): MessageAuditWriter;
+//# sourceMappingURL=email-delivery.d.ts.map

package/dist/messaging/email-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-delivery.d.ts","sourceRoot":"","sources":["../../src/messaging/email-delivery.ts"],"names":[],"mappings":"AAcA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;AAEjE,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IACxC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,wDAAwD;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAKD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,aAAa,CAAC,CA+BxB;AA+BD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAChD,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAM1F;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EACzB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,GACvC,kBAAkB,CAKpB"}

package/dist/messaging/email-delivery.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildEmailProvider = buildEmailProvider;
+exports.isMailDisabled = isMailDisabled;
+exports.senderFromProvider = senderFromProvider;
+exports.messageAuditWriter = messageAuditWriter;
+/**
+ * Email delivery binding (G-010, docs/features/message-delivery/SPEC.md R2, R8, R14). Turns the
+ * `ShieldModule.forRoot({ emailSender })` option into the provider the {@link MessageDispatcher}
+ * wraps:
+ *  - `'env'` → {@link loadMessageConfig}, then `@astram/messaging` loaded as an OPTIONAL peer (only
+ *    here, so apps that never choose `'env'` never load it) and its `createEmailProvider`; with
+ *    `MESSAGE_BOOT_PROBE=1` the adapter's probe runs (no message is sent) and a failure refuses
+ *    boot. `EMAIL_PROVIDER=disabled` binds nothing and loads nothing.
+ *  - `'disabled'` → no provider (nothing delivered, nothing audited).
+ *  - an app `EmailSender` → adapted as provider `custom`; omitted (development/test) → `log`.
+ */
+const node_fs_1 = require("node:fs");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+const message_config_js_1 = require("../config/message-config.js");
+const boot_secrets_js_1 = require("../secrets/boot-secrets.js");
+const optional_peer_js_1 = require("../storage/optional-peer.js");
+const message_dispatcher_js_1 = require("./message-dispatcher.js");
+const MESSAGING_PACKAGE = '@astram/messaging';
+const logger = new common_1.Logger('ShieldMessaging');
+async function buildEmailProvider(option, boundSender, deps) {
+    const fallback = { timeoutMs: message_config_js_1.DEFAULT_MESSAGE_SEND_TIMEOUT_MS };
+    if (option === 'disabled')
+        return { provider: null, ...fallback };
+    if (option !== 'env') {
+        if (boundSender === null)
+            return { provider: null, ...fallback };
+        return { provider: (0, message_dispatcher_js_1.providerFromSender)(boundSender, option ? 'custom' : 'log'), ...fallback };
+    }
+    const env = deps.env ?? process.env;
+    const config = (0, message_config_js_1.loadMessageConfig)(env, {
+        resolvedFromSecretRef: boot_secrets_js_1.wasResolvedFromSecretRef,
+        readFile: deps.readFile ?? ((path) => (0, node_fs_1.readFileSync)(path, 'utf8')),
+    });
+    if (config.email.provider === 'disabled') {
+        logger.warn("emailSender: 'env' with EMAIL_PROVIDER=disabled — framework emails (password reset, " +
+            'invites, notices) are NOT delivered.');
+        return { provider: null, ...fallback };
+    }
+    const messaging = (0, optional_peer_js_1.requireOptionalPeer)(MESSAGING_PACKAGE, "ShieldModule.forRoot({ emailSender: 'env' })", deps.load);
+    const provider = await messaging.createEmailProvider(config.email);
+    const timeoutMs = config.email.timeoutMs;
+    if (config.probe)
+        await probe(provider, timeoutMs);
+    logger.log(`Email delivery: ${provider.name}${config.probe ? ' (boot probe passed)' : ''}`);
+    return { provider, timeoutMs };
+}
+/** Reachability + credentials, no message (R8). Bounded; any failure refuses boot. */
+async function probe(provider, timeoutMs) {
+    const fail = (detail) => new Error(`MESSAGE_BOOT_PROBE: the ${provider.name} check failed (${detail}); check EMAIL_PROVIDER ` +
+        'and the provider host / credential variables');
+    if (!provider.probe)
+        return;
+    const signal = AbortSignal.timeout(timeoutMs);
+    let timer;
+    const expiry = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(fail('timeout')), timeoutMs + 1_000);
+        timer.unref?.();
+    });
+    try {
+        await Promise.race([provider.probe({ signal }), expiry]);
+    }
+    catch (e) {
+        if (e instanceof core_1.MessageDeliveryError) {
+            const status = e.status !== undefined ? `, HTTP ${e.status}` : '';
+            throw fail(`${e.failureClass}${status}`);
+        }
+        if (signal.aborted)
+            throw fail('timeout');
+        if (e instanceof Error && e.message.startsWith('MESSAGE_BOOT_PROBE:'))
+            throw e;
+        throw fail('unreachable');
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The link-base boot rule applies only with a real sender (Phase 13 #1). `'env'` is real unless
+ * `EMAIL_PROVIDER=disabled`. Read at `forRoot` time, after `resolveBootSecrets()`.
+ */
+function isMailDisabled(option, env) {
+    if (option === undefined || option === 'disabled')
+        return true;
+    if (option === 'env')
+        return env.EMAIL_PROVIDER?.trim() === 'disabled';
+    return false;
+}
+/**
+ * The `EmailSender` bound under `SHIELD_EMAIL_SENDER` for `'env'`, so existing injectors keep the
+ * port they know. Each send is bounded; a failure rejects (callers already treat it best-effort).
+ */
+function senderFromProvider(provider, timeoutMs) {
+    return {
+        send: async (message) => {
+            await provider.send(message, { signal: AbortSignal.timeout(timeoutMs) });
+        },
+    };
+}
+/**
+ * `message.sent` / `message.failed` rows go to the framework audit log over guard's own pool
+ * (the runtime account holds append-only INSERT on the audit schema), independent of the
+ * optional app `auditSink` (Shield #6).
+ */
+function messageAuditWriter(pool, schemas) {
+    const sink = new engine_1.MariaDbAuditSink({ schemas });
+    return {
+        record: (event) => sink.record(event, (sql, params) => pool.query(sql, params)),
+    };
+}