@astram/guard 0.18.0 → 0.19.0

package/dist/audit/audit-chain-sealer.d.ts

@@ -0,0 +1,90 @@
+import { type LoggerService } from '@nestjs/common';
+import type { Pool } from 'mariadb';
+import { type Clock, type FrameworkSchemas, type HashFunction } from '@astram/core';
+/** Lookback for the incremental scan (SPEC §10). */
+export declare const AUDIT_SEAL_LOOKBACK_MS: number;
+/** Full sweep and table re-probe period (SPEC §10). */
+export declare const AUDIT_SEAL_SWEEP_MS: number;
+/** Candidate rows per keyset page (SPEC §10). */
+export declare const AUDIT_SEAL_PAGE = 1000;
+/** Keyset pages per tick (SPEC §10). */
+export declare const AUDIT_SEAL_PAGES = 10;
+/** Tenants sealed per tick (SPEC §10). */
+export declare const AUDIT_SEAL_TENANTS = 200;
+/** Parked (stuck) tenants held at most (SPEC §10). */
+export declare const AUDIT_SEAL_STUCK = 200;
+/** The logger surface the sealer uses (Nest `Logger` shape). */
+export type AuditSealerLogger = Pick<LoggerService, 'log' | 'warn' | 'error'>;
+export interface AuditChainSealerOptions {
+    /** `SHIELD_DB_POOL`. Only `getConnection()` is used: every statement runs on the lock's session. */
+    readonly pool: Pool;
+    /** Resolved framework database names (`FRAMEWORK_SCHEMAS`). */
+    readonly schemas: FrameworkSchemas;
+    /** Chain hash (`NodeSha256Hash` in production). */
+    readonly hash: HashFunction;
+    /** Rows per tenant per tick (`AUDIT_SEAL_BATCH`). */
+    readonly batch: number;
+    /** Sealer clock: `ac_sealed_at_ms` and the sweep period. Default `Date.now`. */
+    readonly clock?: Clock;
+    /** Default `new Logger('Shield')`. */
+    readonly logger?: AuditSealerLogger;
+}
+/**
+ * A log-safe class for an error: a typed core reason, a driver error code / errno, or
+ * `unexpected`. Never the message (it can echo row content, e.g. a duplicate-key value).
+ */
+export declare function auditSealErrorClass(err: unknown): string;
+/** The leader lock name: `<ns>:audit_sealer` (single layout: `<db>:audit_sealer`), ≤ 64 chars. */
+export declare function auditSealerLockName(schemas: Pick<FrameworkSchemas, 'namespace'>): string;
+export declare class AuditChainSealer {
+    private readonly pool;
+    private readonly hash;
+    private readonly batch;
+    private readonly clock;
+    private readonly logger;
+    private readonly lockName;
+    private readonly logTable;
+    private readonly chainTable;
+    private readonly checkpointTable;
+    /** Sealer clock at the start of the last sweep; `undefined` ⇒ the next leader tick sweeps. */
+    private lastSweepAtMs;
+    /** Tenants parked until the next sweep (exact strings). */
+    private readonly stuck;
+    /** `(reason, tenant)` keys already logged this sweep. */
+    private readonly logged;
+    /** The stuck-set overflow was logged this sweep. */
+    private overflowLogged;
+    /**
+     * Backlog cursor (SPEC §5.G step 2): the oldest position the last tick left unsealed because
+     * of the batch / page / tenant caps (stuck tenants excluded). Leader memory only.
+     */
+    private cursor;
+    constructor(options: AuditChainSealerOptions);
+    /**
+     * One tick. Always releases the lock and returns (or destroys) the connection before it
+     * settles. A tenant batch error never rejects; an unexpected error (e.g. the candidate read
+     * failing) rejects after the cleanup.
+     */
+    tick(): Promise<void>;
+    private forgetLeadership;
+    private sealOnce;
+    /** The oldest position the caps left behind, skipping stuck tenants; `undefined` ⇒ none. */
+    private oldestLeftBehind;
+    /** `MIN(MAX(ac_occurred_at_ms), db now) − lookback`, or `undefined` for an empty chain. */
+    private readWindowStart;
+    /**
+     * Keyset-paged candidate read, grouped by exact tenant string, ≤ `batch` rows per tenant and
+     * ≤ 200 tenants (first appearance in keyset order; the rest wait for the next tick). The
+     * first page starts after `windowStart`, or at the backlog cursor `start` when given. Also
+     * returns what the caps left behind, for the backlog cursor.
+     */
+    private readCandidates;
+    /** Each tenant's head: the `MAX(ac_sequence)` chain row, else its latest checkpoint. */
+    private readHeads;
+    /** Link and insert one tenant's batch in one transaction; errors stay with this tenant. */
+    private sealTenant;
+    /** Log a failed batch (once per tenant and reason per sweep) and park it if it repeats. */
+    private recordFailure;
+    private logOnce;
+}
+//# sourceMappingURL=audit-chain-sealer.d.ts.map

package/dist/audit/audit-chain-sealer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain-sealer.d.ts","sourceRoot":"","sources":["../../src/audit/audit-chain-sealer.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,EASL,KAAK,KAAK,EACV,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,iDAAiD;AACjD,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,0CAA0C;AAC1C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAOpC,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE9E,MAAM,WAAW,uBAAuB;IACtC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAyDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASxD;AAUD,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAOxF;AAOD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,8FAA8F;IAC9F,OAAO,CAAC,aAAa,CAAqB;IAC1C,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,oDAAoD;IACpD,OAAO,CAAC,cAAc,CAAS;IAC/B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAA6B;gBAE/B,OAAO,EAAE,uBAAuB;IAa5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,OAAO,CAAC,gBAAgB;YAQV,QAAQ;IAwCtB,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAWxB,2FAA2F;YAC7E,eAAe;IAa7B;;;;;OAKG;YACW,cAAc;IA0H5B,wFAAwF;YAC1E,SAAS;IAyDvB,2FAA2F;YAC7E,UAAU;IAmExB,2FAA2F;IAC3F,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,OAAO;CAMhB"}

package/dist/audit/audit-chain-sealer.js

@@ -0,0 +1,520 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditChainSealer = exports.AUDIT_SEAL_STUCK = exports.AUDIT_SEAL_TENANTS = exports.AUDIT_SEAL_PAGES = exports.AUDIT_SEAL_PAGE = exports.AUDIT_SEAL_SWEEP_MS = exports.AUDIT_SEAL_LOOKBACK_MS = void 0;
+exports.auditSealErrorClass = auditSealErrorClass;
+exports.auditSealerLockName = auditSealerLockName;
+/**
+ * `AuditChainSealer` — one tick of the deferred audit sealer (audit-chain-store SPEC §5.G,
+ * §10, §11, §13).
+ *
+ * Writers keep appending plain rows to `<audit>.audit_log`; one leader per namespace (named
+ * lock) chains every committed row per tenant into the append-only `<audit>.audit_chain`.
+ * A tick:
+ *   1. checks out ONE pool connection and takes `GET_LOCK('<ns>:audit_sealer', 0)`; not
+ *      acquired ⇒ return the connection, no work;
+ *   2. window start `W = MIN(MAX(ac_occurred_at_ms), db now) − 15 min` from the chain alone
+ *      (`idx_ac_occurred`); empty chain ⇒ no bound. The first tick of a leader and then one
+ *      tick per hour is a sweep: no bound, the stuck set and the logged-once memory clear.
+ *      Backlog cursor: when the batch / page / tenant caps leave rows behind, the oldest such
+ *      `(al_occurred_at_ms, al_uuid)` (stuck tenants excluded) is kept in memory and the next
+ *      tick starts its keyset there instead of at `W` when it is older; cleared when a tick
+ *      leaves nothing behind, on lock loss and at each sweep (which may set it again);
+ *   3./4. reads candidates in keyset pages on `idx_audit_time` (1000 rows, ≤ 10 pages, stops at
+ *      200 tenants), anti-joined into `uq_ac_al_uuid`, excluding parked tenants and tenants
+ *      that already hold `batch` rows this tick; groups them by exact tenant string in Node;
+ *      reads each tenant's head (chain PK, else latest checkpoint, else genesis);
+ *   5. links each tenant's rows with core `auditEventFromRow` + `linkEntry` and inserts them
+ *      in ONE transaction per tenant on the same connection. A failed batch rolls back alone;
+ *      a repeating error (duplicate key 1062, `AuditRowError`, `AuditValidationError`) parks
+ *      the tenant until the next sweep (≤ 200 parked), anything else retries next tick;
+ *   6. `finally`: `RELEASE_LOCK`, then return the connection; if the release fails (or the
+ *      lock state is unknown) destroy the connection instead, so a pooled connection never
+ *      carries the lock.
+ *
+ * Every `audit_log` ⇄ chain comparison and every tenant filter on `audit_log` carries
+ * `COLLATE utf8mb4_nopad_bin` on the `audit_log` side (exact bytes, NO PAD; `audit_log` is
+ * `utf8mb4_unicode_ci`, a bare comparison raises error 1267). Database names come from
+ * `FrameworkSchemas`, never a literal. Logs carry fixed text, tenant and sequence only:
+ * never `err.message` and never row content (SPEC §11).
+ */
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@astram/core");
+/** Lookback for the incremental scan (SPEC §10). */
+exports.AUDIT_SEAL_LOOKBACK_MS = 15 * 60_000;
+/** Full sweep and table re-probe period (SPEC §10). */
+exports.AUDIT_SEAL_SWEEP_MS = 60 * 60_000;
+/** Candidate rows per keyset page (SPEC §10). */
+exports.AUDIT_SEAL_PAGE = 1000;
+/** Keyset pages per tick (SPEC §10). */
+exports.AUDIT_SEAL_PAGES = 10;
+/** Tenants sealed per tick (SPEC §10). */
+exports.AUDIT_SEAL_TENANTS = 200;
+/** Parked (stuck) tenants held at most (SPEC §10). */
+exports.AUDIT_SEAL_STUCK = 200;
+/** MariaDB's limit on a `GET_LOCK` name. */
+const MAX_LOCK_NAME = 64;
+/** MariaDB duplicate-key error number. */
+const ER_DUP_ENTRY = 1062;
+/** A BIGINT column value as a `bigint` for ordering; `undefined` when it is not an integer. */
+function ordinalOf(value) {
+    try {
+        if (typeof value === 'bigint')
+            return value;
+        if (typeof value === 'number' && Number.isInteger(value))
+            return BigInt(value);
+        if (typeof value === 'string' && /^-?\d+$/.test(value.trim()))
+            return BigInt(value.trim());
+    }
+    catch {
+        // fall through
+    }
+    return undefined;
+}
+/** Thrown inside a tick when the connection can no longer be trusted (rollback failed). */
+class ConnectionUnusable extends Error {
+    constructor() {
+        super('audit_sealer_connection_unusable');
+        this.name = 'ConnectionUnusable';
+    }
+}
+const DRIVER_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+/**
+ * A log-safe class for an error: a typed core reason, a driver error code / errno, or
+ * `unexpected`. Never the message (it can echo row content, e.g. a duplicate-key value).
+ */
+function auditSealErrorClass(err) {
+    if (err instanceof core_1.AuditRowError)
+        return `row_rejected:${err.reason}`;
+    if (err instanceof core_1.AuditValidationError)
+        return `event_rejected:${err.reason}`;
+    if (typeof err === 'object' && err !== null) {
+        const { code, errno } = err;
+        if (typeof code === 'string' && DRIVER_CODE.test(code))
+            return `db_error:${code}`;
+        if (typeof errno === 'number' && Number.isSafeInteger(errno))
+            return `db_error:${errno}`;
+    }
+    return 'unexpected';
+}
+/** Errors that repeat on every retry of the same rows, so the tenant is parked (SPEC §5.G.3). */
+function isRepeating(err) {
+    if (err instanceof core_1.AuditRowError || err instanceof core_1.AuditValidationError)
+        return true;
+    return (typeof err === 'object' && err !== null && err.errno === ER_DUP_ENTRY);
+}
+/** The leader lock name: `<ns>:audit_sealer` (single layout: `<db>:audit_sealer`), ≤ 64 chars. */
+function auditSealerLockName(schemas) {
+    const name = `${schemas.namespace}:audit_sealer`;
+    if (name.length <= MAX_LOCK_NAME)
+        return name;
+    // A 55-char namespace or 64-char single-layout database exceeds MariaDB's limit: keep the
+    // name unique per namespace with a digest (same approach as the migrate ledger lock).
+    const digest = (0, node_crypto_1.createHash)('sha256').update(schemas.namespace, 'utf8').digest('hex');
+    return `audit_sealer:${digest.slice(0, MAX_LOCK_NAME - 'audit_sealer:'.length)}`;
+}
+const quoteId = (name) => `\`${name.replace(/`/g, '``')}\``;
+/** `?, ?, …` for `n` parameters. */
+const placeholders = (n) => Array.from({ length: n }, () => '?').join(', ');
+class AuditChainSealer {
+    pool;
+    hash;
+    batch;
+    clock;
+    logger;
+    lockName;
+    logTable;
+    chainTable;
+    checkpointTable;
+    /** Sealer clock at the start of the last sweep; `undefined` ⇒ the next leader tick sweeps. */
+    lastSweepAtMs;
+    /** Tenants parked until the next sweep (exact strings). */
+    stuck = new Set();
+    /** `(reason, tenant)` keys already logged this sweep. */
+    logged = new Set();
+    /** The stuck-set overflow was logged this sweep. */
+    overflowLogged = false;
+    /**
+     * Backlog cursor (SPEC §5.G step 2): the oldest position the last tick left unsealed because
+     * of the batch / page / tenant caps (stuck tenants excluded). Leader memory only.
+     */
+    cursor;
+    constructor(options) {
+        this.pool = options.pool;
+        this.hash = options.hash;
+        this.batch = options.batch;
+        this.clock = options.clock ?? { nowMs: () => Date.now() };
+        this.logger = options.logger ?? new common_1.Logger('Shield');
+        this.lockName = auditSealerLockName(options.schemas);
+        const db = quoteId(options.schemas.audit);
+        this.logTable = `${db}.${quoteId('audit_log')}`;
+        this.chainTable = `${db}.${quoteId('audit_chain')}`;
+        this.checkpointTable = `${db}.${quoteId('audit_chain_checkpoint')}`;
+    }
+    /**
+     * One tick. Always releases the lock and returns (or destroys) the connection before it
+     * settles. A tenant batch error never rejects; an unexpected error (e.g. the candidate read
+     * failing) rejects after the cleanup.
+     */
+    async tick() {
+        const conn = await this.pool.getConnection();
+        /** GET_LOCK's answer; stays `undefined` (outcome unknown) when the statement fails. */
+        let locked;
+        let destroy = false;
+        try {
+            const rows = (await conn.query('SELECT GET_LOCK(?, 0) AS acquired', [
+                this.lockName,
+            ]));
+            const acquired = rows[0]?.acquired;
+            locked = acquired !== null && acquired !== undefined && Number(acquired) === 1;
+            if (!locked) {
+                // Another instance leads. If this one leads again later it is a new leader: it sweeps
+                // first and starts with an empty stuck set.
+                this.forgetLeadership();
+                return;
+            }
+            await this.sealOnce(conn);
+        }
+        catch (err) {
+            if (!(err instanceof ConnectionUnusable))
+                throw err;
+            destroy = true;
+        }
+        finally {
+            if (locked === undefined) {
+                // GET_LOCK failed: whether the session holds the lock is unknown, so never pool it.
+                destroy = true;
+            }
+            else if (locked) {
+                try {
+                    await conn.query('SELECT RELEASE_LOCK(?) AS released', [this.lockName]);
+                }
+                catch {
+                    destroy = true;
+                }
+            }
+            if (destroy) {
+                try {
+                    conn.destroy();
+                }
+                catch {
+                    // The socket is closed either way; the server drops the session's lock with it.
+                }
+            }
+            else {
+                try {
+                    await conn.release();
+                }
+                catch {
+                    // Returning a connection to a closing pool is non-fatal.
+                }
+            }
+        }
+    }
+    forgetLeadership() {
+        this.lastSweepAtMs = undefined;
+        this.stuck.clear();
+        this.logged.clear();
+        this.overflowLogged = false;
+        this.cursor = undefined;
+    }
+    async sealOnce(conn) {
+        const now = this.clock.nowMs();
+        const sweep = this.lastSweepAtMs === undefined || now - this.lastSweepAtMs >= exports.AUDIT_SEAL_SWEEP_MS;
+        if (sweep) {
+            this.lastSweepAtMs = now;
+            this.stuck.clear();
+            this.logged.clear();
+            this.overflowLogged = false;
+            // The sweep scans from the start; it sets the cursor again if it leaves rows behind.
+            this.cursor = undefined;
+        }
+        const windowStart = sweep ? undefined : await this.readWindowStart(conn);
+        // Start from the backlog cursor instead of W when it is older (SPEC §5.G step 2).
+        const start = windowStart !== undefined &&
+            this.cursor !== undefined &&
+            this.cursor.ordinal <= BigInt(windowStart)
+            ? this.cursor
+            : undefined;
+        const read = await this.readCandidates(conn, start === undefined ? windowStart : undefined, start);
+        // Rows left behind by the caps, before sealing: if the connection dies mid-tick, the next
+        // tick still resumes from here.
+        this.cursor = this.oldestLeftBehind(read);
+        const { groups } = read;
+        if (groups.size === 0)
+            return;
+        const heads = await this.readHeads(conn, [...groups.keys()]);
+        for (const [tenant, rows] of groups) {
+            await this.sealTenant(conn, tenant, rows, heads.get(tenant));
+        }
+        // Tenants parked during this tick wait for the sweep: their rows do not hold the cursor.
+        this.cursor = this.oldestLeftBehind(read);
+    }
+    /** The oldest position the caps left behind, skipping stuck tenants; `undefined` ⇒ none. */
+    oldestLeftBehind(read) {
+        let oldest = read.tail;
+        for (const [tenant, position] of read.leftBehind) {
+            if (this.stuck.has(tenant))
+                continue;
+            if (oldest === undefined || read.order.get(position) < read.order.get(oldest)) {
+                oldest = position;
+            }
+        }
+        return oldest;
+    }
+    /** `MIN(MAX(ac_occurred_at_ms), db now) − lookback`, or `undefined` for an empty chain. */
+    async readWindowStart(conn) {
+        const rows = (await conn.query(`SELECT MAX(ac_occurred_at_ms) AS max_ms,
+              CAST(UNIX_TIMESTAMP(NOW(3)) * 1000 AS SIGNED) AS now_ms
+         FROM ${this.chainTable}`));
+        const row = rows[0];
+        if (row?.max_ms === null || row?.max_ms === undefined)
+            return undefined;
+        const max = (0, core_1.toSafeInteger)(row.max_ms);
+        const dbNow = row.now_ms === null || row.now_ms === undefined ? max : (0, core_1.toSafeInteger)(row.now_ms);
+        return Math.min(max, dbNow) - exports.AUDIT_SEAL_LOOKBACK_MS;
+    }
+    /**
+     * Keyset-paged candidate read, grouped by exact tenant string, ≤ `batch` rows per tenant and
+     * ≤ 200 tenants (first appearance in keyset order; the rest wait for the next tick). The
+     * first page starts after `windowStart`, or at the backlog cursor `start` when given. Also
+     * returns what the caps left behind, for the backlog cursor.
+     */
+    async readCandidates(conn, windowStart, start) {
+        const groups = new Map();
+        const full = new Set();
+        const leftBehind = new Map();
+        const order = new Map();
+        /** Per full tenant, the read-order index of its last taken row. */
+        const lastTaken = new Map();
+        let after = start;
+        let index = 0;
+        let lastRow;
+        let exhausted = false;
+        const positionOf = (row, inclusive) => {
+            const ordinal = ordinalOf(row.al_occurred_at_ms);
+            if (ordinal === undefined)
+                return undefined;
+            return { occurred: row.al_occurred_at_ms, ordinal, uuid: row.al_uuid, inclusive };
+        };
+        for (let page = 0; page < exports.AUDIT_SEAL_PAGES; page++) {
+            const where = [];
+            const params = [];
+            if (windowStart !== undefined) {
+                where.push('al_occurred_at_ms > ?');
+                params.push(windowStart);
+            }
+            if (after !== undefined) {
+                // The cursor row itself is still unsealed: an inclusive start keeps it (`>=`).
+                where.push(`(al_occurred_at_ms > ? OR (al_occurred_at_ms = ? AND al_uuid ${after.inclusive ? '>=' : '>'} ?))`);
+                params.push(after.occurred, after.occurred, after.uuid);
+            }
+            const excluded = [...this.stuck, ...full];
+            if (excluded.length > 0) {
+                where.push(`al_tenant_id COLLATE utf8mb4_nopad_bin NOT IN (${placeholders(excluded.length)})`);
+                params.push(...excluded);
+            }
+            where.push(`NOT EXISTS (SELECT 1 FROM ${this.chainTable}
+                      WHERE ac_al_uuid = al_uuid COLLATE utf8mb4_nopad_bin)`);
+            params.push(exports.AUDIT_SEAL_PAGE);
+            const rows = (await conn.query(`SELECT al_uuid, al_type, al_occurred_at_ms, al_actor_id, al_tenant_id, al_action_key,
+                al_resource_json, al_decision_json, al_attributes_json
+           FROM ${this.logTable}
+          WHERE ${where.join('\n            AND ')}
+          ORDER BY al_occurred_at_ms, al_uuid
+          LIMIT ?`, params));
+            for (const row of rows) {
+                const i = index++;
+                const tenant = row.al_tenant_id;
+                if (this.stuck.has(tenant))
+                    continue;
+                let group = groups.get(tenant);
+                let skip = false;
+                if (group === undefined) {
+                    if (groups.size >= exports.AUDIT_SEAL_TENANTS) {
+                        skip = true; // tenant cap
+                    }
+                    else {
+                        group = [];
+                        groups.set(tenant, group);
+                    }
+                }
+                else if (group.length >= this.batch) {
+                    skip = true; // batch cap
+                }
+                if (skip || group === undefined) {
+                    if (!leftBehind.has(tenant)) {
+                        const position = positionOf(row, true);
+                        if (position !== undefined) {
+                            leftBehind.set(tenant, position);
+                            order.set(position, i);
+                        }
+                    }
+                    continue;
+                }
+                group.push(row);
+                if (group.length >= this.batch) {
+                    full.add(tenant);
+                    lastTaken.set(tenant, { index: i, row });
+                }
+            }
+            lastRow = rows[rows.length - 1] ?? lastRow;
+            if (rows.length < exports.AUDIT_SEAL_PAGE) {
+                exhausted = true;
+                break;
+            }
+            if (groups.size >= exports.AUDIT_SEAL_TENANTS)
+                break;
+            const last = rows[rows.length - 1];
+            after = { occurred: last.al_occurred_at_ms, uuid: last.al_uuid, inclusive: false };
+        }
+        // A full tenant's later rows were excluded from the following pages (NOT IN), so it may
+        // have rows left even when none was seen: resume strictly after its last taken row.
+        for (const [tenant, taken] of lastTaken) {
+            if (leftBehind.has(tenant))
+                continue;
+            const position = positionOf(taken.row, false);
+            if (position === undefined)
+                continue;
+            leftBehind.set(tenant, position);
+            // Strictly after row `index`: before any row read later, after the row itself.
+            order.set(position, taken.index + 0.5);
+        }
+        // Paging stopped on `pages` or `tenants` with a full last page: the rest was never read.
+        let tail;
+        if (!exhausted && lastRow !== undefined) {
+            tail = positionOf(lastRow, false);
+            if (tail !== undefined)
+                order.set(tail, index - 1 + 0.5);
+        }
+        return { groups, leftBehind, tail, order };
+    }
+    /** Each tenant's head: the `MAX(ac_sequence)` chain row, else its latest checkpoint. */
+    async readHeads(conn, tenants) {
+        const heads = new Map();
+        const chainRows = (await conn.query(`SELECT ac.ac_tenant_id, ac.ac_sequence, ac.ac_entry_hash,
+              CASE WHEN al.al_uuid IS NULL THEN 1 ELSE 0 END AS al_missing
+         FROM (SELECT ac_tenant_id AS head_tenant, MAX(ac_sequence) AS head_sequence
+                 FROM ${this.chainTable}
+                WHERE ac_tenant_id IN (${placeholders(tenants.length)})
+                GROUP BY ac_tenant_id) h
+         JOIN ${this.chainTable} ac
+           ON ac.ac_tenant_id = h.head_tenant AND ac.ac_sequence = h.head_sequence
+         LEFT JOIN ${this.logTable} al
+           ON al.al_uuid = ac.ac_al_uuid COLLATE utf8mb4_unicode_ci
+          AND al.al_uuid COLLATE utf8mb4_nopad_bin = ac.ac_al_uuid`, tenants));
+        for (const r of chainRows) {
+            heads.set(r.ac_tenant_id, {
+                anchor: {
+                    tenantId: r.ac_tenant_id,
+                    sequenceNumber: (0, core_1.toSafeInteger)(r.ac_sequence),
+                    entryHash: r.ac_entry_hash,
+                },
+                missingRow: Number(r.al_missing) === 1,
+            });
+        }
+        const rest = tenants.filter((t) => !heads.has(t));
+        if (rest.length === 0)
+            return heads;
+        const checkpoints = (await conn.query(`SELECT c.acc_tenant_id, c.acc_sequence, c.acc_entry_hash
+         FROM (SELECT acc_tenant_id AS cp_tenant, MAX(acc_sequence) AS cp_sequence
+                 FROM ${this.checkpointTable}
+                WHERE acc_tenant_id IN (${placeholders(rest.length)})
+                GROUP BY acc_tenant_id) m
+         JOIN ${this.checkpointTable} c
+           ON c.acc_tenant_id = m.cp_tenant AND c.acc_sequence = m.cp_sequence`, rest));
+        for (const r of checkpoints) {
+            heads.set(r.acc_tenant_id, {
+                anchor: {
+                    tenantId: r.acc_tenant_id,
+                    sequenceNumber: (0, core_1.toSafeInteger)(r.acc_sequence),
+                    entryHash: r.acc_entry_hash,
+                },
+                missingRow: false,
+            });
+        }
+        return heads;
+    }
+    /** Link and insert one tenant's batch in one transaction; errors stay with this tenant. */
+    async sealTenant(conn, tenant, rows, head) {
+        if (head?.missingRow) {
+            // Keep sealing from the head's hash; audit:verify keeps reporting missing_row there.
+            this.logOnce('head_missing_row', tenant, `audit sealer: tenant ${JSON.stringify(tenant)} head at sequence ` +
+                `${head.anchor.sequenceNumber} has no audit_log row; sealing continues from its hash`);
+        }
+        let prev = head?.anchor;
+        /** The sequence being linked or inserted; a failure is reported at it. */
+        let sequence = prev !== undefined ? prev.sequenceNumber + 1 : 0;
+        let inTransaction = false;
+        try {
+            const links = rows.map((row) => {
+                sequence = prev !== undefined ? prev.sequenceNumber + 1 : 0;
+                const event = (0, core_1.auditEventFromRow)(row);
+                const link = (0, core_1.linkEntry)(event, prev, this.hash);
+                prev = { tenantId: tenant, sequenceNumber: link.sequenceNumber, entryHash: link.entryHash };
+                return { row, link, occurredAtMs: event.occurredAtMs };
+            });
+            const sealedAtMs = this.clock.nowMs();
+            await conn.beginTransaction();
+            inTransaction = true;
+            for (const { row, link, occurredAtMs } of links) {
+                sequence = link.sequenceNumber;
+                await conn.query(`INSERT INTO ${this.chainTable}
+             (ac_tenant_id, ac_sequence, ac_al_uuid, ac_content_hash, ac_prev_hash,
+              ac_entry_hash, ac_occurred_at_ms, ac_sealed_at_ms)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, [
+                    tenant,
+                    link.sequenceNumber,
+                    row.al_uuid,
+                    link.contentHash,
+                    link.prevHash,
+                    link.entryHash,
+                    occurredAtMs,
+                    sealedAtMs,
+                ]);
+            }
+            await conn.commit();
+            inTransaction = false;
+        }
+        catch (err) {
+            let rollbackFailed = false;
+            if (inTransaction) {
+                try {
+                    await conn.rollback();
+                }
+                catch {
+                    rollbackFailed = true;
+                }
+            }
+            this.recordFailure(tenant, sequence, err);
+            if (rollbackFailed)
+                throw new ConnectionUnusable();
+        }
+    }
+    /** Log a failed batch (once per tenant and reason per sweep) and park it if it repeats. */
+    recordFailure(tenant, sequence, err) {
+        const reason = auditSealErrorClass(err);
+        const repeating = isRepeating(err);
+        if (repeating && this.stuck.size >= exports.AUDIT_SEAL_STUCK && !this.stuck.has(tenant)) {
+            // Systemic failure: one count-only line per sweep, no per-tenant log, retried each tick.
+            if (!this.overflowLogged) {
+                this.overflowLogged = true;
+                this.logger.error(`audit sealer: ${exports.AUDIT_SEAL_STUCK} tenants are parked (the maximum); further ` +
+                    'tenants failing with a repeating error are retried every tick until the next sweep');
+            }
+            return;
+        }
+        if (repeating)
+            this.stuck.add(tenant);
+        this.logOnce(reason, tenant, `audit sealer: tenant ${JSON.stringify(tenant)} batch rolled back at sequence ${sequence} ` +
+            `(${reason}); ${repeating ? 'parked until the next sweep' : 'retried next tick'}`);
+    }
+    logOnce(reason, tenant, message) {
+        const key = `${reason}\u0000${tenant}`;
+        if (this.logged.has(key))
+            return;
+        this.logged.add(key);
+        this.logger.error(message);
+    }
+}
+exports.AuditChainSealer = AuditChainSealer;

package/dist/audit/audit-seal-config.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `AUDIT_SEAL_*` env loader for the deferred audit sealer (audit-chain-store SPEC §5.I, §10,
+ * §13). Read once at boot by the persistence wiring; an invalid value fails the boot with the
+ * variable name and its bounds, never the value (it might be a misplaced secret). Unset, empty
+ * or whitespace-only ⇒ the default (as `loadMessageConfig`).
+ */
+/** The two tunables of the sealer (the sealer itself cannot be switched off, SPEC §11). */
+export interface AuditSealConfig {
+    /** Milliseconds between the end of one tick and the start of the next. */
+    readonly intervalMs: number;
+    /** Rows sealed per tenant per tick. */
+    readonly batch: number;
+}
+export declare const DEFAULT_AUDIT_SEAL_INTERVAL_MS = 2000;
+export declare const MIN_AUDIT_SEAL_INTERVAL_MS = 500;
+export declare const MAX_AUDIT_SEAL_INTERVAL_MS = 60000;
+export declare const DEFAULT_AUDIT_SEAL_BATCH = 500;
+export declare const MIN_AUDIT_SEAL_BATCH = 1;
+export declare const MAX_AUDIT_SEAL_BATCH = 5000;
+/** Load and validate `AUDIT_SEAL_INTERVAL_MS` and `AUDIT_SEAL_BATCH`. Throws on an invalid value. */
+export declare function loadAuditSealConfig(env: NodeJS.ProcessEnv): AuditSealConfig;
+//# sourceMappingURL=audit-seal-config.d.ts.map

package/dist/audit/audit-seal-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-seal-config.d.ts","sourceRoot":"","sources":["../../src/audit/audit-seal-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,8BAA8B,OAAO,CAAC;AACnD,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAC5C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAqBzC,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,eAAe,CAiB3E"}

package/dist/audit/audit-seal-config.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * `AUDIT_SEAL_*` env loader for the deferred audit sealer (audit-chain-store SPEC §5.I, §10,
+ * §13). Read once at boot by the persistence wiring; an invalid value fails the boot with the
+ * variable name and its bounds, never the value (it might be a misplaced secret). Unset, empty
+ * or whitespace-only ⇒ the default (as `loadMessageConfig`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_AUDIT_SEAL_BATCH = exports.MIN_AUDIT_SEAL_BATCH = exports.DEFAULT_AUDIT_SEAL_BATCH = exports.MAX_AUDIT_SEAL_INTERVAL_MS = exports.MIN_AUDIT_SEAL_INTERVAL_MS = exports.DEFAULT_AUDIT_SEAL_INTERVAL_MS = void 0;
+exports.loadAuditSealConfig = loadAuditSealConfig;
+exports.DEFAULT_AUDIT_SEAL_INTERVAL_MS = 2000;
+exports.MIN_AUDIT_SEAL_INTERVAL_MS = 500;
+exports.MAX_AUDIT_SEAL_INTERVAL_MS = 60_000;
+exports.DEFAULT_AUDIT_SEAL_BATCH = 500;
+exports.MIN_AUDIT_SEAL_BATCH = 1;
+exports.MAX_AUDIT_SEAL_BATCH = 5000;
+/** Plain decimal digits only (no sign, exponent, radix prefix or fraction). */
+const PLAIN_DIGITS = /^[0-9]{1,10}$/;
+function boundedInteger(env, name, fallback, min, max) {
+    const value = env[name]?.trim();
+    if (!value)
+        return fallback;
+    const n = PLAIN_DIGITS.test(value) ? Number(value) : NaN;
+    if (!Number.isSafeInteger(n) || n < min || n > max) {
+        throw new Error(`${name} must be a whole number between ${min} and ${max}`);
+    }
+    return n;
+}
+/** Load and validate `AUDIT_SEAL_INTERVAL_MS` and `AUDIT_SEAL_BATCH`. Throws on an invalid value. */
+function loadAuditSealConfig(env) {
+    return {
+        intervalMs: boundedInteger(env, 'AUDIT_SEAL_INTERVAL_MS', exports.DEFAULT_AUDIT_SEAL_INTERVAL_MS, exports.MIN_AUDIT_SEAL_INTERVAL_MS, exports.MAX_AUDIT_SEAL_INTERVAL_MS),
+        batch: boundedInteger(env, 'AUDIT_SEAL_BATCH', exports.DEFAULT_AUDIT_SEAL_BATCH, exports.MIN_AUDIT_SEAL_BATCH, exports.MAX_AUDIT_SEAL_BATCH),
+    };
+}

package/dist/audit/audit-sealer.service.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `AuditSealerService` — runs the deferred audit sealer in the app (audit-chain-store SPEC
+ * §5.H, §11, §12).
+ *
+ * Registered by `PersistenceModule.forRoot()`, so it exists exactly when `SHIELD_DB_POOL`
+ * does (`ShieldModule.forRoot({ auth: true })`); an enforcement-only app has neither. There
+ * is no switch to turn it off: only `AUDIT_SEAL_INTERVAL_MS` / `AUDIT_SEAL_BATCH` tune it.
+ *
+ * - Boot (`onApplicationBootstrap`): one bounded table probe on `information_schema.TABLES`;
+ *   both `audit_log` and `audit_chain` present ⇒ tick every interval. `audit_log` absent
+ *   (auth without identity), or the probe failing (DB down, a test's stub pool) ⇒ one warning,
+ *   idle; `audit_chain` absent (migration 102 not applied) ⇒ one error per probe, idle. The
+ *   probe repeats every sweep period (1 h) and starts or stops the ticks. Never throws.
+ * - Ticks never overlap: the next one is scheduled only after the previous settled. A
+ *   rejected tick is logged by error class only and the loop continues.
+ * - Shutdown (`onModuleDestroy`, which runs before the pool is ended, and
+ *   `onApplicationShutdown`): stops the timers and waits for an in-flight tick. Idempotent.
+ * - Every timer is `unref()`'d: the sealer never keeps a process alive. Nothing here touches
+ *   the request path (Shield #12).
+ */
+import { type OnApplicationBootstrap, type OnApplicationShutdown, type OnModuleDestroy } from '@nestjs/common';
+import type { Pool } from 'mariadb';
+import type { FrameworkSchemas } from '@astram/core';
+import { type AuditSealConfig } from './audit-seal-config.js';
+import { type AuditSealerLogger } from './audit-chain-sealer.js';
+export interface AuditSealerServiceOptions {
+    /** Default `loadAuditSealConfig(process.env)`. */
+    readonly config?: AuditSealConfig;
+    /** Default `new Logger('Shield')`. */
+    readonly logger?: AuditSealerLogger;
+    /** Test seam; default an {@link AuditChainSealer} over the pool with {@link NodeSha256Hash}. */
+    readonly sealer?: {
+        tick(): Promise<unknown>;
+    };
+}
+export declare class AuditSealerService implements OnApplicationBootstrap, OnModuleDestroy, OnApplicationShutdown {
+    private readonly pool;
+    private readonly schemas;
+    private readonly config;
+    private readonly logger;
+    private readonly sealer;
+    private stopped;
+    private active;
+    private lastOutcome;
+    private tickTimer;
+    private probeTimer;
+    private inFlightTick;
+    private inFlightProbe;
+    constructor(pool: Pool, schemas: FrameworkSchemas, options?: AuditSealerServiceOptions);
+    onApplicationBootstrap(): Promise<void>;
+    onModuleDestroy(): Promise<void>;
+    onApplicationShutdown(): Promise<void>;
+    private stop;
+    /** Probe once (never overlapping, never throwing) and start or stop the ticks. */
+    private runProbe;
+    private probe;
+    /** Warnings once per change of state; the missing-chain error on every probe (SPEC §12). */
+    private report;
+    private schedule;
+    private runTick;
+}
+//# sourceMappingURL=audit-sealer.service.d.ts.map

package/dist/audit/audit-sealer.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sealer.service.d.ts","sourceRoot":"","sources":["../../src/audit/audit-sealer.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,WAAW,yBAAyB;IACxC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CAChD;AAID,qBACa,kBACX,YAAW,sBAAsB,EAAE,eAAe,EAAE,qBAAqB;IAevE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAd1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,aAAa,CAA4B;gBAG9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,gBAAgB,EAC1C,OAAO,GAAE,yBAA8B;IAenC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI9B,IAAI;IAWlB,kFAAkF;IAClF,OAAO,CAAC,QAAQ;YAwBF,KAAK;IA4BnB,4FAA4F;IAC5F,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,OAAO;CAehB"}

package/dist/audit/audit-sealer.service.js

@@ -0,0 +1,197 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditSealerService = void 0;
+/**
+ * `AuditSealerService` — runs the deferred audit sealer in the app (audit-chain-store SPEC
+ * §5.H, §11, §12).
+ *
+ * Registered by `PersistenceModule.forRoot()`, so it exists exactly when `SHIELD_DB_POOL`
+ * does (`ShieldModule.forRoot({ auth: true })`); an enforcement-only app has neither. There
+ * is no switch to turn it off: only `AUDIT_SEAL_INTERVAL_MS` / `AUDIT_SEAL_BATCH` tune it.
+ *
+ * - Boot (`onApplicationBootstrap`): one bounded table probe on `information_schema.TABLES`;
+ *   both `audit_log` and `audit_chain` present ⇒ tick every interval. `audit_log` absent
+ *   (auth without identity), or the probe failing (DB down, a test's stub pool) ⇒ one warning,
+ *   idle; `audit_chain` absent (migration 102 not applied) ⇒ one error per probe, idle. The
+ *   probe repeats every sweep period (1 h) and starts or stops the ticks. Never throws.
+ * - Ticks never overlap: the next one is scheduled only after the previous settled. A
+ *   rejected tick is logged by error class only and the loop continues.
+ * - Shutdown (`onModuleDestroy`, which runs before the pool is ended, and
+ *   `onApplicationShutdown`): stops the timers and waits for an in-flight tick. Idempotent.
+ * - Every timer is `unref()`'d: the sealer never keeps a process alive. Nothing here touches
+ *   the request path (Shield #12).
+ */
+const common_1 = require("@nestjs/common");
+const audit_seal_config_js_1 = require("./audit-seal-config.js");
+const audit_chain_sealer_js_1 = require("./audit-chain-sealer.js");
+const node_sha256_hash_js_1 = require("./node-sha256-hash.js");
+/** Upper bound on the boot/re-probe query, so a hung pool cannot stall the boot hook. */
+const PROBE_TIMEOUT_MS = 10_000;
+let AuditSealerService = class AuditSealerService {
+    pool;
+    schemas;
+    config;
+    logger;
+    sealer;
+    stopped = false;
+    active = false;
+    lastOutcome;
+    tickTimer;
+    probeTimer;
+    inFlightTick;
+    inFlightProbe;
+    constructor(pool, schemas, options = {}) {
+        this.pool = pool;
+        this.schemas = schemas;
+        this.config = options.config ?? (0, audit_seal_config_js_1.loadAuditSealConfig)(process.env);
+        this.logger = options.logger ?? new common_1.Logger('Shield');
+        this.sealer =
+            options.sealer ??
+                new audit_chain_sealer_js_1.AuditChainSealer({
+                    pool,
+                    schemas,
+                    hash: new node_sha256_hash_js_1.NodeSha256Hash(),
+                    batch: this.config.batch,
+                    logger: this.logger,
+                });
+    }
+    async onApplicationBootstrap() {
+        if (this.stopped)
+            return;
+        await this.runProbe();
+        if (this.stopped || this.probeTimer !== undefined)
+            return;
+        this.probeTimer = setInterval(() => void this.runProbe(), audit_chain_sealer_js_1.AUDIT_SEAL_SWEEP_MS);
+        this.probeTimer.unref();
+    }
+    async onModuleDestroy() {
+        await this.stop();
+    }
+    async onApplicationShutdown() {
+        await this.stop();
+    }
+    async stop() {
+        this.stopped = true;
+        this.active = false;
+        if (this.tickTimer !== undefined)
+            clearTimeout(this.tickTimer);
+        if (this.probeTimer !== undefined)
+            clearInterval(this.probeTimer);
+        this.tickTimer = undefined;
+        this.probeTimer = undefined;
+        await this.inFlightProbe;
+        await this.inFlightTick;
+    }
+    /** Probe once (never overlapping, never throwing) and start or stop the ticks. */
+    runProbe() {
+        if (this.inFlightProbe !== undefined)
+            return this.inFlightProbe;
+        const run = (async () => {
+            const outcome = await this.probe();
+            if (this.stopped)
+                return;
+            this.report(outcome);
+            this.lastOutcome = outcome;
+            if (outcome === 'ready') {
+                if (!this.active) {
+                    this.active = true;
+                    this.schedule();
+                }
+            }
+            else {
+                this.active = false;
+                if (this.tickTimer !== undefined)
+                    clearTimeout(this.tickTimer);
+                this.tickTimer = undefined;
+            }
+        })().finally(() => {
+            this.inFlightProbe = undefined;
+        });
+        this.inFlightProbe = run;
+        return run;
+    }
+    async probe() {
+        let timer;
+        try {
+            const timeout = new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('probe_timeout')), PROBE_TIMEOUT_MS);
+                timer.unref();
+            });
+            const query = Promise.resolve().then(() => this.pool.query(`SELECT TABLE_NAME FROM information_schema.TABLES
+            WHERE TABLE_SCHEMA = ? AND TABLE_NAME IN ('audit_log', 'audit_chain')`, [this.schemas.audit]));
+            query.catch(() => undefined); // a late rejection after the timeout is not unhandled
+            const rows = await Promise.race([query, timeout]);
+            if (!Array.isArray(rows))
+                return 'probe_failed';
+            const names = new Set(rows.map((r) => r.TABLE_NAME));
+            if (!names.has('audit_log'))
+                return 'no_audit_log';
+            if (!names.has('audit_chain'))
+                return 'no_audit_chain';
+            return 'ready';
+        }
+        catch {
+            return 'probe_failed';
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+    }
+    /** Warnings once per change of state; the missing-chain error on every probe (SPEC §12). */
+    report(outcome) {
+        const db = this.schemas.audit;
+        if (outcome === 'no_audit_chain') {
+            this.logger.error(`audit sealer idle: ${db}.audit_chain does not exist (apply framework migration ` +
+                '1710000000102); audit_log rows stay unsealed until it does');
+            return;
+        }
+        if (outcome === this.lastOutcome)
+            return;
+        if (outcome === 'no_audit_log') {
+            this.logger.warn(`audit sealer idle: ${db}.audit_log does not exist (no identity audit store); ` +
+                're-checked every hour');
+        }
+        else if (outcome === 'probe_failed') {
+            this.logger.warn('audit sealer idle: the audit table check could not run; re-checked every hour');
+        }
+    }
+    schedule() {
+        if (!this.active || this.stopped || this.tickTimer !== undefined)
+            return;
+        this.tickTimer = setTimeout(() => {
+            this.tickTimer = undefined;
+            this.runTick();
+        }, this.config.intervalMs);
+        this.tickTimer.unref();
+    }
+    runTick() {
+        if (!this.active || this.stopped || this.inFlightTick !== undefined)
+            return;
+        this.inFlightTick = (async () => {
+            try {
+                await this.sealer.tick();
+            }
+            catch (err) {
+                this.logger.error(`audit sealer: tick failed (${(0, audit_chain_sealer_js_1.auditSealErrorClass)(err)}); retried next interval`);
+            }
+        })().finally(() => {
+            this.inFlightTick = undefined;
+            this.schedule();
+        });
+    }
+};
+exports.AuditSealerService = AuditSealerService;
+exports.AuditSealerService = AuditSealerService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Object, Object, Object])
+], AuditSealerService);

package/dist/audit/node-sha256-hash.d.ts

@@ -0,0 +1,6 @@
+import type { HashFunction } from '@astram/core';
+export declare class NodeSha256Hash implements HashFunction {
+    /** Lower-case hex SHA-256 of the UTF-8 bytes of `input`. */
+    hash(input: string): string;
+}
+//# sourceMappingURL=node-sha256-hash.d.ts.map

package/dist/audit/node-sha256-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sha256-hash.d.ts","sourceRoot":"","sources":["../../src/audit/node-sha256-hash.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,qBAAa,cAAe,YAAW,YAAY;IACjD,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAG5B"}

package/dist/audit/node-sha256-hash.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeSha256Hash = void 0;
+/**
+ * `HashFunction` adapter over `node:crypto` SHA-256 for the durable audit chain
+ * (audit-chain-store SPEC §5.F). Core is zero-dependency, so the hash is injected into
+ * `linkEntry` / `verifyChain`. Lower-case hex of the UTF-8 bytes; never logs its input.
+ */
+const node_crypto_1 = require("node:crypto");
+class NodeSha256Hash {
+    /** Lower-case hex SHA-256 of the UTF-8 bytes of `input`. */
+    hash(input) {
+        return (0, node_crypto_1.createHash)('sha256').update(input, 'utf8').digest('hex');
+    }
+}
+exports.NodeSha256Hash = NodeSha256Hash;

package/dist/auth/persistence.module.d.ts

@@ -33,8 +33,8 @@
 import { type DynamicModule } from '@nestjs/common';
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them) plus the shutdown holder. Opt-in: only
- * imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
+ * Opt-in: only imported when auth is wired.
  */
 export declare class PersistenceModule {
     static forRoot(): DynamicModule;

package/dist/auth/persistence.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA0C3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAOhC"}
+{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA2D3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAOhC"}

package/dist/auth/persistence.module.js

@@ -41,7 +41,10 @@ var PersistenceModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PersistenceModule = void 0;
 const common_1 = require("@nestjs/common");
+const app_config_js_1 = require("../config/app-config.js");
 const config_module_js_1 = require("../config/config.module.js");
+const audit_sealer_service_js_1 = require("../audit/audit-sealer.service.js");
+const audit_seal_config_js_1 = require("../audit/audit-seal-config.js");
 const tokens_js_1 = require("./tokens.js");
 const connections_js_1 = require("./connections.js");
 /**
@@ -74,16 +77,29 @@ const lifecycleProvider = {
     useFactory: (pool, redis) => new connections_js_1.ConnectionLifecycle(pool, redis),
     inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
 };
+/**
+ * The deferred audit sealer (audit-chain-store SPEC §5.H): registered here so it exists
+ * exactly when {@link SHIELD_DB_POOL} does. `AUDIT_SEAL_*` is read now, so an invalid value
+ * fails the boot (SPEC §13). It ticks only once its table probe finds `audit_log` and
+ * `audit_chain`; a stub or unreachable pool leaves it idle (never a boot failure).
+ */
+const auditSealerProvider = {
+    provide: audit_sealer_service_js_1.AuditSealerService,
+    useFactory: (pool, config) => new audit_sealer_service_js_1.AuditSealerService(pool, (0, app_config_js_1.frameworkSchemasOf)(config), {
+        config: (0, audit_seal_config_js_1.loadAuditSealConfig)(process.env),
+    }),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+};
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them) plus the shutdown holder. Opt-in: only
- * imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
+ * Opt-in: only imported when auth is wired.
  */
 let PersistenceModule = PersistenceModule_1 = class PersistenceModule {
     static forRoot() {
         return {
             module: PersistenceModule_1,
-            providers: [dbPoolProvider, redisProvider, lifecycleProvider],
+            providers: [dbPoolProvider, redisProvider, lifecycleProvider, auditSealerProvider],
             exports: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
         };
     }

package/dist/index.d.ts

@@ -40,6 +40,8 @@ export { EncryptedFileSecretsProvider } from './secrets/encrypted-file-secrets.j
 export { resolveBootSecrets, createSecretsProviderFromEnv, assertNoUnresolvedSecretRefs, wasResolvedFromSecretRef, type ResolveBootSecretsOptions, } from './secrets/boot-secrets.js';
 export { S3ObjectStore, type S3ObjectStoreConfig, type S3ObjectStoreOptions, } from './storage/s3-object-store.js';
 export { NodeSha256Digest } from './storage/node-sha256-digest.js';
+export { NodeSha256Hash } from './audit/node-sha256-hash.js';
+export { loadAuditSealConfig, type AuditSealConfig } from './audit/audit-seal-config.js';
 export { ObjectStoreBootCheck } from './storage/object-store-boot-check.js';
 export { FileIntake, FILE_INTAKE_REQUEST_KEY, FILE_INTAKE_DEFAULT_MAX_BYTES, type FileIntakeOptions, type FileIntakeResult, } from './storage/file-intake.interceptor.js';
 export type { ShieldStorageOption } from './storage/storage.providers.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG9E,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG9E,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -17,9 +17,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wasResolvedFromSecretRef = exports.assertNoUnresolvedSecretRefs = exports.createSecretsProviderFromEnv = exports.resolveBootSecrets = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.resolveAuthLinkBaseUrls = exports.CredentialExistsError = exports.isLockedHash = exports.lockedPasswordHash = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.uuidArrayField = exports.optionalUuidField = exports.uuidField = exports.UuidPipe = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_RECORD_AUTHORIZATION = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsOf = exports.actionsFor = exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
-exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
-exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.mariadbSslOption = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = void 0;
-exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = void 0;
+exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.loadAuditSealConfig = exports.NodeSha256Hash = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
+exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.mariadbSslOption = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -153,6 +153,12 @@ var s3_object_store_js_1 = require("./storage/s3-object-store.js");
 Object.defineProperty(exports, "S3ObjectStore", { enumerable: true, get: function () { return s3_object_store_js_1.S3ObjectStore; } });
 var node_sha256_digest_js_1 = require("./storage/node-sha256-digest.js");
 Object.defineProperty(exports, "NodeSha256Digest", { enumerable: true, get: function () { return node_sha256_digest_js_1.NodeSha256Digest; } });
+// Durable audit chain (audit-chain-store SPEC §5.F, §5.I): the chain hash adapter and the
+// `AUDIT_SEAL_*` loader. The sealer itself is wired by `ShieldModule.forRoot({ auth: true })`.
+var node_sha256_hash_js_1 = require("./audit/node-sha256-hash.js");
+Object.defineProperty(exports, "NodeSha256Hash", { enumerable: true, get: function () { return node_sha256_hash_js_1.NodeSha256Hash; } });
+var audit_seal_config_js_1 = require("./audit/audit-seal-config.js");
+Object.defineProperty(exports, "loadAuditSealConfig", { enumerable: true, get: function () { return audit_seal_config_js_1.loadAuditSealConfig; } });
 var object_store_boot_check_js_1 = require("./storage/object-store-boot-check.js");
 Object.defineProperty(exports, "ObjectStoreBootCheck", { enumerable: true, get: function () { return object_store_boot_check_js_1.ObjectStoreBootCheck; } });
 var file_intake_interceptor_js_1 = require("./storage/file-intake.interceptor.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -36,8 +36,8 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.5.4",
-    "@astram/core": "1.9.0",
-    "@astram/engine": "0.10.1"
+    "@astram/core": "1.10.0",
+    "@astram/engine": "0.10.2"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -45,7 +45,7 @@
     "@nestjs/platform-express": "^11",
     "reflect-metadata": "^0.2",
     "rxjs": "^7",
-    "@astram/messaging": "^0.1.1"
+    "@astram/messaging": "^0.1.2"
   },
   "peerDependenciesMeta": {
     "@astram/messaging": {
@@ -68,7 +68,12 @@
     "typescript": "^5.7.0",
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8",
-    "@astram/messaging": "0.1.1"
+    "@astram/messaging": "0.1.2"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ASTRAM-2-0/astram-framework.git",
+    "directory": "packages/guard"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",