@astram/guard 0.18.0 → 0.20.0

package/dist/index.js

@@ -17,9 +17,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wasResolvedFromSecretRef = exports.assertNoUnresolvedSecretRefs = exports.createSecretsProviderFromEnv = exports.resolveBootSecrets = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.resolveAuthLinkBaseUrls = exports.CredentialExistsError = exports.isLockedHash = exports.lockedPasswordHash = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.uuidArrayField = exports.optionalUuidField = exports.uuidField = exports.UuidPipe = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_RECORD_AUTHORIZATION = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsOf = exports.actionsFor = exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
-exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
-exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.mariadbSslOption = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = void 0;
-exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = void 0;
+exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.loadAuditSealConfig = exports.NodeSha256Hash = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
+exports.SHIELD_REDIS = exports.mariadbSslOption = exports.reservedOperationPrincipal = exports.RESERVED_OPERATION_PRINCIPALS = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = void 0;
+exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.SHIELD_CAPTCHA_GATE = exports.RECAPTCHA_SITEVERIFY_URL = exports.RecaptchaVerifier = exports.TURNSTILE_SITEVERIFY_URL = exports.TurnstileVerifier = exports.MAX_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_MIN_SCORE = exports.DEFAULT_CAPTCHA_THRESHOLD = exports.CAPTCHA_FAIL_MODES = exports.CAPTCHA_MODES = exports.CAPTCHA_ENDPOINTS = exports.loadCaptchaConfig = exports.SHIELD_SIGN_IN_WITH = exports.DEFAULT_SIGN_IN_WITH = exports.resolveSignInWith = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -153,6 +154,12 @@ var s3_object_store_js_1 = require("./storage/s3-object-store.js");
 Object.defineProperty(exports, "S3ObjectStore", { enumerable: true, get: function () { return s3_object_store_js_1.S3ObjectStore; } });
 var node_sha256_digest_js_1 = require("./storage/node-sha256-digest.js");
 Object.defineProperty(exports, "NodeSha256Digest", { enumerable: true, get: function () { return node_sha256_digest_js_1.NodeSha256Digest; } });
+// Durable audit chain (audit-chain-store SPEC §5.F, §5.I): the chain hash adapter and the
+// `AUDIT_SEAL_*` loader. The sealer itself is wired by `ShieldModule.forRoot({ auth: true })`.
+var node_sha256_hash_js_1 = require("./audit/node-sha256-hash.js");
+Object.defineProperty(exports, "NodeSha256Hash", { enumerable: true, get: function () { return node_sha256_hash_js_1.NodeSha256Hash; } });
+var audit_seal_config_js_1 = require("./audit/audit-seal-config.js");
+Object.defineProperty(exports, "loadAuditSealConfig", { enumerable: true, get: function () { return audit_seal_config_js_1.loadAuditSealConfig; } });
 var object_store_boot_check_js_1 = require("./storage/object-store-boot-check.js");
 Object.defineProperty(exports, "ObjectStoreBootCheck", { enumerable: true, get: function () { return object_store_boot_check_js_1.ObjectStoreBootCheck; } });
 var file_intake_interceptor_js_1 = require("./storage/file-intake.interceptor.js");
@@ -375,6 +382,9 @@ Object.defineProperty(exports, "rootIdsFromEnv", { enumerable: true, get: functi
 var reserved_principal_ids_js_1 = require("./config/reserved-principal-ids.js");
 Object.defineProperty(exports, "ORG_BOOTSTRAP_PRINCIPAL_ID", { enumerable: true, get: function () { return reserved_principal_ids_js_1.ORG_BOOTSTRAP_PRINCIPAL_ID; } });
 Object.defineProperty(exports, "assertNoReservedRootId", { enumerable: true, get: function () { return reserved_principal_ids_js_1.assertNoReservedRootId; } });
+// KI #140 (additive): reserved operation principals, labelled by the audit viewer.
+Object.defineProperty(exports, "RESERVED_OPERATION_PRINCIPALS", { enumerable: true, get: function () { return reserved_principal_ids_js_1.RESERVED_OPERATION_PRINCIPALS; } });
+Object.defineProperty(exports, "reservedOperationPrincipal", { enumerable: true, get: function () { return reserved_principal_ids_js_1.reservedOperationPrincipal; } });
 // Phase 16: the driver `ssl` option every framework pool uses (identity's pools build on it).
 var connections_js_1 = require("./auth/connections.js");
 Object.defineProperty(exports, "mariadbSslOption", { enumerable: true, get: function () { return connections_js_1.mariadbSslOption; } });
@@ -417,6 +427,28 @@ Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: tr
 // The credential-store contract (skeleton — Team A implements the SELECT).
 var mariadb_credential_resolver_js_1 = require("./authentication/mariadb-credential-resolver.js");
 Object.defineProperty(exports, "MariaDbCredentialResolver", { enumerable: true, get: function () { return mariadb_credential_resolver_js_1.MariaDbCredentialResolver; } });
+var sign_in_with_js_1 = require("./authentication/sign-in-with.js");
+Object.defineProperty(exports, "resolveSignInWith", { enumerable: true, get: function () { return sign_in_with_js_1.resolveSignInWith; } });
+Object.defineProperty(exports, "DEFAULT_SIGN_IN_WITH", { enumerable: true, get: function () { return sign_in_with_js_1.DEFAULT_SIGN_IN_WITH; } });
+var tokens_js_5 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SIGN_IN_WITH", { enumerable: true, get: function () { return tokens_js_5.SHIELD_SIGN_IN_WITH; } });
+var captcha_config_js_1 = require("./config/captcha-config.js");
+Object.defineProperty(exports, "loadCaptchaConfig", { enumerable: true, get: function () { return captcha_config_js_1.loadCaptchaConfig; } });
+Object.defineProperty(exports, "CAPTCHA_ENDPOINTS", { enumerable: true, get: function () { return captcha_config_js_1.CAPTCHA_ENDPOINTS; } });
+Object.defineProperty(exports, "CAPTCHA_MODES", { enumerable: true, get: function () { return captcha_config_js_1.CAPTCHA_MODES; } });
+Object.defineProperty(exports, "CAPTCHA_FAIL_MODES", { enumerable: true, get: function () { return captcha_config_js_1.CAPTCHA_FAIL_MODES; } });
+Object.defineProperty(exports, "DEFAULT_CAPTCHA_THRESHOLD", { enumerable: true, get: function () { return captcha_config_js_1.DEFAULT_CAPTCHA_THRESHOLD; } });
+Object.defineProperty(exports, "DEFAULT_CAPTCHA_MIN_SCORE", { enumerable: true, get: function () { return captcha_config_js_1.DEFAULT_CAPTCHA_MIN_SCORE; } });
+Object.defineProperty(exports, "DEFAULT_CAPTCHA_TIMEOUT_MS", { enumerable: true, get: function () { return captcha_config_js_1.DEFAULT_CAPTCHA_TIMEOUT_MS; } });
+Object.defineProperty(exports, "MAX_CAPTCHA_TIMEOUT_MS", { enumerable: true, get: function () { return captcha_config_js_1.MAX_CAPTCHA_TIMEOUT_MS; } });
+var turnstile_verifier_js_1 = require("./captcha/turnstile-verifier.js");
+Object.defineProperty(exports, "TurnstileVerifier", { enumerable: true, get: function () { return turnstile_verifier_js_1.TurnstileVerifier; } });
+Object.defineProperty(exports, "TURNSTILE_SITEVERIFY_URL", { enumerable: true, get: function () { return turnstile_verifier_js_1.TURNSTILE_SITEVERIFY_URL; } });
+var recaptcha_verifier_js_1 = require("./captcha/recaptcha-verifier.js");
+Object.defineProperty(exports, "RecaptchaVerifier", { enumerable: true, get: function () { return recaptcha_verifier_js_1.RecaptchaVerifier; } });
+Object.defineProperty(exports, "RECAPTCHA_SITEVERIFY_URL", { enumerable: true, get: function () { return recaptcha_verifier_js_1.RECAPTCHA_SITEVERIFY_URL; } });
+var tokens_js_6 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_CAPTCHA_GATE", { enumerable: true, get: function () { return tokens_js_6.SHIELD_CAPTCHA_GATE; } });
 // The composition module skeletons (Team B fills the factory bodies; the
 // integration owner imports AuthModule into ShieldModule — see auth.module.ts /
 // DONE.md).
@@ -454,10 +486,10 @@ var recipient_mask_js_1 = require("./messaging/recipient-mask.js");
 Object.defineProperty(exports, "maskPhone", { enumerable: true, get: function () { return recipient_mask_js_1.maskPhone; } });
 var profile_writer_js_1 = require("./auth/ports/profile-writer.js");
 Object.defineProperty(exports, "ProfileNameTakenError", { enumerable: true, get: function () { return profile_writer_js_1.ProfileNameTakenError; } });
-var tokens_js_5 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_5.SHIELD_SESSION_FACTS_PROJECTOR; } });
-var tokens_js_6 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SCOPE_SUBTREE_RESOLVER", { enumerable: true, get: function () { return tokens_js_6.SHIELD_SCOPE_SUBTREE_RESOLVER; } });
+var tokens_js_7 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_7.SHIELD_SESSION_FACTS_PROJECTOR; } });
+var tokens_js_8 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SCOPE_SUBTREE_RESOLVER", { enumerable: true, get: function () { return tokens_js_8.SHIELD_SCOPE_SUBTREE_RESOLVER; } });
 // The framework-owned `/auth/*` HTTP controller (Team C) + its pending-MFA store.
 // The controller CONSUMES SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY and the
 // PendingMfaStore. It is EXPORTED so AuthModule (Team B) / the integration owner
@@ -474,10 +506,10 @@ var mfa_step_up_js_1 = require("./auth/mfa-step-up.js");
 Object.defineProperty(exports, "CredentialMfaStepUp", { enumerable: true, get: function () { return mfa_step_up_js_1.CredentialMfaStepUp; } });
 Object.defineProperty(exports, "credentialFingerprint", { enumerable: true, get: function () { return mfa_step_up_js_1.credentialFingerprint; } });
 Object.defineProperty(exports, "challengeMatches", { enumerable: true, get: function () { return mfa_step_up_js_1.challengeMatches; } });
-var tokens_js_7 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_LIMITER", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_LIMITER; } });
-Object.defineProperty(exports, "SHIELD_MFA_STEP_UP", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_STEP_UP; } });
-Object.defineProperty(exports, "SHIELD_LOGIN_TOTP_VERIFIER", { enumerable: true, get: function () { return tokens_js_7.SHIELD_LOGIN_TOTP_VERIFIER; } });
+var tokens_js_9 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_LIMITER", { enumerable: true, get: function () { return tokens_js_9.SHIELD_MFA_LIMITER; } });
+Object.defineProperty(exports, "SHIELD_MFA_STEP_UP", { enumerable: true, get: function () { return tokens_js_9.SHIELD_MFA_STEP_UP; } });
+Object.defineProperty(exports, "SHIELD_LOGIN_TOTP_VERIFIER", { enumerable: true, get: function () { return tokens_js_9.SHIELD_LOGIN_TOTP_VERIFIER; } });
 // The pure TOTP-enrollment helpers (Phase 4 MFA). Re-exported for consumers/tests
 // that need them; the multi-device MFA routes (Phase 3) reuse them to mint a device
 // secret + provisioning URI + recovery codes. (The old in-memory

package/dist/internal.d.ts

@@ -20,4 +20,31 @@ export { AttemptLimiter } from './auth/rate-limit/attempt-limiter.js';
 export { SHIELD_REDIS } from './auth/tokens.js';
 export { SHIELD_ATTEMPT_LIMITER_FACTORY } from './auth/tokens.js';
 export type { AttemptLimiterFactory } from './auth/auth.module.js';
+/**
+ * For `@astram/identity` only (R12.1, B-3): the token identity binds its default auth audit sink
+ * under, so guard's auth surface records to `audit_log` when the app supplies no `auditSink`.
+ */
+export { SHIELD_DEFAULT_AUTH_AUDIT_SINK } from './auth/tokens.js';
+/**
+ * For `@astram/identity` only (auth capabilities R2): the token identity binds `true` when its
+ * security-policy feature is registered, which turns guard's mandatory-2FA evaluation on.
+ */
+export { SHIELD_MFA_POLICY_FEATURE } from './auth/tokens.js';
+/** Test surface (auth capabilities R2): the guard's mandatory-2FA service token (`null` when off). */
+export { SHIELD_MFA_REQUIREMENT } from './auth/tokens.js';
+/**
+ * For `@astram/identity` only (auth capabilities R11.3): the guard's MariaDB mandatory-2FA source
+ * token; identity's users list falls back to its batched confirmed-device read when the policy
+ * feature is off.
+ */
+export { SHIELD_MFA_REQUIREMENT_SOURCE } from './auth/tokens.js';
+/**
+ * For `@astram/identity` only (auth capabilities R11, B-5): the admin sign-in controls. The step-up
+ * (the admin's own TOTP on their `mfa:pid` budget), the account unlocker (login, MFA, recovery and
+ * CAPTCHA account counters) and the MFA resetter identity builds over its runtime pool.
+ */
+export { SHIELD_ADMIN_STEP_UP, SHIELD_ACCOUNT_UNLOCKER } from './auth/tokens.js';
+export { AdminControlUnavailableError, accountUnlockKeys, type AccountUnlocker, type AdminStepUp, type AdminStepUpOutcome, } from './auth/admin-signin-controls.js';
+export { MariaDbMfaResetter, type MfaResetQuery, type MfaResetRequest, type MfaResetResult, type MfaResetter, } from './authentication/mariadb-mfa-resetter.js';
+export type { MfaAdminStatus, MfaStatusBatchSource, MfaStatusSubject, } from './session/mfa-requirement-service.js';
 //# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE;;;GAGG;AACH,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE;;;GAGG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,sGAAsG;AACtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D;;;;GAIG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACjE;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,0CAA0C,CAAC;AAClD,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,sCAAsC,CAAC"}

package/dist/internal.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_REDIS = exports.AttemptLimiter = exports.MariaDbCredentialProvisioner = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
+exports.MariaDbMfaResetter = exports.accountUnlockKeys = exports.AdminControlUnavailableError = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_REDIS = exports.AttemptLimiter = exports.MariaDbCredentialProvisioner = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
 /**
  * @astram/guard/internal — framework-composition and test surface (Phase 8 #5).
  *
@@ -28,3 +28,38 @@ var tokens_js_2 = require("./auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
 var tokens_js_3 = require("./auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_ATTEMPT_LIMITER_FACTORY", { enumerable: true, get: function () { return tokens_js_3.SHIELD_ATTEMPT_LIMITER_FACTORY; } });
+/**
+ * For `@astram/identity` only (R12.1, B-3): the token identity binds its default auth audit sink
+ * under, so guard's auth surface records to `audit_log` when the app supplies no `auditSink`.
+ */
+var tokens_js_4 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_DEFAULT_AUTH_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_4.SHIELD_DEFAULT_AUTH_AUDIT_SINK; } });
+/**
+ * For `@astram/identity` only (auth capabilities R2): the token identity binds `true` when its
+ * security-policy feature is registered, which turns guard's mandatory-2FA evaluation on.
+ */
+var tokens_js_5 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_POLICY_FEATURE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_MFA_POLICY_FEATURE; } });
+/** Test surface (auth capabilities R2): the guard's mandatory-2FA service token (`null` when off). */
+var tokens_js_6 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT", { enumerable: true, get: function () { return tokens_js_6.SHIELD_MFA_REQUIREMENT; } });
+/**
+ * For `@astram/identity` only (auth capabilities R11.3): the guard's MariaDB mandatory-2FA source
+ * token; identity's users list falls back to its batched confirmed-device read when the policy
+ * feature is off.
+ */
+var tokens_js_7 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT_SOURCE", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_REQUIREMENT_SOURCE; } });
+/**
+ * For `@astram/identity` only (auth capabilities R11, B-5): the admin sign-in controls. The step-up
+ * (the admin's own TOTP on their `mfa:pid` budget), the account unlocker (login, MFA, recovery and
+ * CAPTCHA account counters) and the MFA resetter identity builds over its runtime pool.
+ */
+var tokens_js_8 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_ADMIN_STEP_UP", { enumerable: true, get: function () { return tokens_js_8.SHIELD_ADMIN_STEP_UP; } });
+Object.defineProperty(exports, "SHIELD_ACCOUNT_UNLOCKER", { enumerable: true, get: function () { return tokens_js_8.SHIELD_ACCOUNT_UNLOCKER; } });
+var admin_signin_controls_js_1 = require("./auth/admin-signin-controls.js");
+Object.defineProperty(exports, "AdminControlUnavailableError", { enumerable: true, get: function () { return admin_signin_controls_js_1.AdminControlUnavailableError; } });
+Object.defineProperty(exports, "accountUnlockKeys", { enumerable: true, get: function () { return admin_signin_controls_js_1.accountUnlockKeys; } });
+var mariadb_mfa_resetter_js_1 = require("./authentication/mariadb-mfa-resetter.js");
+Object.defineProperty(exports, "MariaDbMfaResetter", { enumerable: true, get: function () { return mariadb_mfa_resetter_js_1.MariaDbMfaResetter; } });

package/dist/module/shield.module.d.ts

@@ -16,8 +16,10 @@ import type { MembershipChecker } from '../auth/ports/membership-checker.js';
 import type { CoreDecisionAuthority } from '../enforcement/core-seam.js';
 import { type AppConfig } from '../config/app-config.js';
 import { SHIELD_DECISION_AUTHORITY, SHIELD_RECORD_AUTHORIZATION } from './shield-tokens.js';
+import type { SignInMethod } from '../authentication/sign-in-with.js';
 export { SHIELD_DECISION_AUTHORITY, SHIELD_RECORD_AUTHORIZATION };
 import { type ShieldStorageOption } from '../storage/storage.providers.js';
+import type { ShieldCaptchaOption } from '../captcha/captcha.providers.js';
 export type { RecordAuthorizationInputs } from '../authz/wire-record-authorization.js';
 /**
  * Options for {@link ShieldModule.forRoot}. Intentionally minimal (ADR-0023 §7 —
@@ -199,6 +201,25 @@ export interface ShieldModuleOptions {
      * loopback (`localhost`, `127.0.0.1`, `::1`, `0.0.0.0`), unless `emailSender: 'disabled'`.
      */
     readonly emailChangeLinkBaseUrl?: string;
+    /**
+     * R15.1 / D-9: require proof for `POST /auth/logout` — see
+     * {@link AuthModuleOptions.logoutRequiresProof}. Default `false` in this release (an unproven
+     * logout still revokes, counted `auth.logout.unproven`); `true` from the next guard major. Only
+     * consulted when `auth: true`.
+     */
+    readonly logoutRequiresProof?: boolean;
+    /**
+     * R1.8: sign-in forms accepted by `POST /auth/login` — see {@link AuthModuleOptions.signInWith}.
+     * Default `['email']`; `['email', 'username']` adds the login name. An unknown value throws at
+     * registration. Only consulted when `auth: true`.
+     */
+    readonly signInWith?: readonly SignInMethod[];
+    /**
+     * Auth capabilities R7 (D-6): `'env'` turns CAPTCHA on for login, forgot-password and
+     * reset-password from `CAPTCHA_*` (see {@link AuthModuleOptions.captcha}). Omitted ⇒ off, every
+     * route as today. Only consulted when `auth: true`.
+     */
+    readonly captcha?: ShieldCaptchaOption;
     /**
      * OPTIONAL object storage (FILE_STORAGE SPEC §6): an `ObjectStore` instance, or `'env'` to build
      * an `S3ObjectStore` from `OBJECT_STORAGE_*` (`loadObjectStorageConfig`; storage stays off when
@@ -313,6 +334,12 @@ export interface ShieldModuleAsyncOptions {
     readonly membershipChecker?: MembershipChecker;
     /** See {@link ShieldModuleOptions.emailChangeLinkBaseUrl}. STATIC here (registration-time). */
     readonly emailChangeLinkBaseUrl?: string;
+    /** See {@link ShieldModuleOptions.logoutRequiresProof}. STATIC here (registration-time). */
+    readonly logoutRequiresProof?: boolean;
+    /** See {@link ShieldModuleOptions.signInWith}. STATIC here (registration-time). */
+    readonly signInWith?: readonly SignInMethod[];
+    /** See {@link ShieldModuleOptions.captcha}. STATIC here (registration-time). */
+    readonly captcha?: ShieldCaptchaOption;
     /** See {@link ShieldModuleOptions.storage}. STATIC here (registration-time, like `auth`). */
     readonly storage?: ShieldStorageOption;
 }

package/dist/module/shield.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAoB,MAAM,cAAc,CAAC;AAQzF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AASzE,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAsC5F,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,CAAC;AAElE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AA6JvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,+FAA+F;IAC/F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAYD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAiHhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CA6HtE"}
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAoB,MAAM,cAAc,CAAC;AAQzF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AASzE,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAsC5F,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,CAAC;AAElE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAI3E,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AA6JvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,+FAA+F;IAC/F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,4FAA4F;IAC5F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAYD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAsHhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAkItE"}

package/dist/module/shield.module.js

@@ -281,6 +281,11 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.emailChangeLinkBaseUrl
                     ? { emailChangeLinkBaseUrl: options.emailChangeLinkBaseUrl }
                     : {}),
+                ...(options.logoutRequiresProof !== undefined
+                    ? { logoutRequiresProof: options.logoutRequiresProof }
+                    : {}),
+                ...(options.signInWith !== undefined ? { signInWith: options.signInWith } : {}),
+                ...(options.captcha !== undefined ? { captcha: options.captcha } : {}),
             })
             : undefined;
         return {
@@ -417,6 +422,11 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.emailChangeLinkBaseUrl
                     ? { emailChangeLinkBaseUrl: options.emailChangeLinkBaseUrl }
                     : {}),
+                ...(options.logoutRequiresProof !== undefined
+                    ? { logoutRequiresProof: options.logoutRequiresProof }
+                    : {}),
+                ...(options.signInWith !== undefined ? { signInWith: options.signInWith } : {}),
+                ...(options.captcha !== undefined ? { captcha: options.captcha } : {}),
             })
             : undefined;
         return {

package/dist/request-auth/request-principal.d.ts

@@ -14,6 +14,7 @@
  */
 import type { Principal, ServiceAuthenticator } from '@astram/core';
 import type { SessionTokenBinder, BoundPrincipalClaims } from './session-token-binder.js';
+import type { MfaRequirementService } from '../session/mfa-requirement-service.js';
 /** Extract a bearer token from an `Authorization: Bearer <token>` header. */
 export declare function extractBearerToken(authorizationHeader: unknown): string | null;
 /**
@@ -43,7 +44,13 @@ export declare function resolveRequestPrincipal(authorizationHeader: unknown, bi
  * uses this so it can read `claims.mustReenroll` to apply the enforced-re-enroll gate
  * while still attaching the resolved `Principal` for `decide()`.
  */
-export declare function resolveRequestAuth(authorizationHeader: unknown, binder: SessionTokenBinder, serviceAuth?: ServiceAuthenticator): Promise<{
+export declare function resolveRequestAuth(authorizationHeader: unknown, binder: SessionTokenBinder, serviceAuth?: ServiceAuthenticator, 
+/**
+ * Auth capabilities R2.5 (self-authenticating routes): the mandatory-2FA recompute. Given → the
+ * claims are re-evaluated when the tenant's permission version moved past the session's stamp
+ * (no DB query otherwise) before they are returned; a failure throws (503, fail closed).
+ */
+mfa?: Pick<MfaRequirementService, 'refresh'> | null): Promise<{
     principal: Principal;
     claims: BoundPrincipalClaims;
 } | null>;

package/dist/request-auth/request-principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-principal.d.ts","sourceRoot":"","sources":["../../src/request-auth/request-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAa1F,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAiClF;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AA4BD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAU3B;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,CAAC,CAgBxE"}
+{"version":3,"file":"request-principal.d.ts","sourceRoot":"","sources":["../../src/request-auth/request-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAanF,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAiClF;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AA4BD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAU3B;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,WAAW,CAAC,EAAE,oBAAoB;AAClC;;;;GAIG;AACH,GAAG,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAAG,IAAI,GAClD,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,CAAC,CAiBxE"}

package/dist/request-auth/request-principal.js

@@ -132,7 +132,13 @@ async function resolveRequestPrincipal(authorizationHeader, binder, serviceAuth)
  * uses this so it can read `claims.mustReenroll` to apply the enforced-re-enroll gate
  * while still attaching the resolved `Principal` for `decide()`.
  */
-async function resolveRequestAuth(authorizationHeader, binder, serviceAuth) {
+async function resolveRequestAuth(authorizationHeader, binder, serviceAuth, 
+/**
+ * Auth capabilities R2.5 (self-authenticating routes): the mandatory-2FA recompute. Given → the
+ * claims are re-evaluated when the tenant's permission version moved past the session's stamp
+ * (no DB query otherwise) before they are returned; a failure throws (503, fail closed).
+ */
+mfa) {
     const token = extractBearerToken(authorizationHeader);
     if (token === null)
         return null;
@@ -145,11 +151,12 @@ async function resolveRequestAuth(authorizationHeader, binder, serviceAuth) {
             return null; // uniform fail-closed (malformed/unknown/expired/revoked/outage).
         return { principal: res.principal, claims: claimsFromServicePrincipal(res.principal) };
     }
-    const claims = await binder.resolve(token);
-    if (claims === null)
+    const bound = await binder.resolve(token);
+    if (bound === null)
         return null;
-    const principal = principalFromClaims(claims);
+    const principal = principalFromClaims(bound);
     if (principal === null)
         return null;
+    const claims = mfa !== undefined && mfa !== null ? await mfa.refresh(token, bound) : bound;
     return { principal, claims };
 }

package/dist/request-auth/session-token-binder.d.ts

@@ -94,6 +94,36 @@ export interface BoundPrincipalClaims {
      * failed) → the next gate-5 reload re-derives once and stamps.
      */
     readonly scopeSubtreeVersion?: number;
+    /**
+     * The restricted-session REASON (auth capabilities D-2, R2.3). `'mfa_enrollment'`: a mandatory
+     * 2FA policy applies and the user has no confirmed factor, so the session reaches only the
+     * enrolment routes (`REENROLL_ALLOWED`) and everything else answers 403 `mfa_enrollment_required`.
+     * The re-enrol reason is still carried as `mustReenroll: true` (old bindings and old readers keep
+     * working); the effective reason is read with `restrictionOf` (`session/session-restriction.ts`):
+     * `restriction ?? (mustReenroll ? 'reenroll' : none)`, plus a passed grace deadline.
+     *
+     * Like `mustReenroll`, AUTHORITATIVE on the SESSION-CLAIMS entry: `resolve()` overlays it from
+     * there, so a change keyed by session id reaches every live access token at once.
+     */
+    readonly restriction?: 'reenroll' | 'mfa_enrollment';
+    /**
+     * The mandatory-2FA grace deadline (R2.4), epoch ms, while the user is required but not enrolled
+     * and still inside the grace. Once `now >= deadline` the session counts as `'mfa_enrollment'`
+     * restricted (compared on every request, no DB read). Session-claims entry is authoritative.
+     */
+    readonly mfaEnrollmentDeadlineMs?: number;
+    /**
+     * The permission version of `tenantId` the mandatory-2FA requirement was last evaluated at
+     * (R2.5). The request path re-evaluates only when the tenant's current version is NEWER (or this
+     * stamp is absent); an unchanged version makes no DB query. Session-claims entry is authoritative.
+     */
+    readonly mfaRequirementVersion?: number;
+    /**
+     * Compare-and-set counter for the mandatory-2FA state (absent = 0). Every write of the state
+     * (a recompute, a device-confirm clear) increments it, and a recompute writes only when the
+     * counter still holds the value it read, so a slow recompute can never undo a device confirm.
+     */
+    readonly mfaStateEpoch?: number;
 }
 /**
  * The `cachedFacts` slot a binding stores (ADR-0035): the version, the keys and the optional time
@@ -103,6 +133,19 @@ export interface BoundPrincipalClaims {
 export declare function factsSlot(grants: CoarseGrants): CoarseGrants;
 /** The projection's live roles when it reported them (a string array), else `undefined`. */
 export declare function liveRoleIds(grants: CoarseGrants | null | undefined): string[] | undefined;
+/** The mandatory-2FA state a session-claims entry carries, validated. */
+export interface StoredMfaState {
+    restriction?: 'reenroll' | 'mfa_enrollment';
+    mfaEnrollmentDeadlineMs?: number;
+    mfaRequirementVersion?: number;
+    mfaStateEpoch?: number;
+}
+/** The new state a recompute writes ({@link SessionTokenBinder.updateMfaRequirement}). */
+export interface MfaRequirementState {
+    readonly restriction?: 'mfa_enrollment';
+    readonly mfaEnrollmentDeadlineMs?: number;
+    readonly mfaRequirementVersion: number;
+}
 /** Lifetimes the binder applies (security hardening #8). Both optional for back-compat. */
 export interface SessionTokenBinderOptions {
     /**
@@ -307,6 +350,45 @@ export declare class SessionTokenBinder {
      * token simply has no key.
      */
     resolve(accessToken: string): Promise<BoundPrincipalClaims | null>;
+    /**
+     * MANDATORY-2FA RECOMPUTE write (R2.5, D-2): store a re-evaluated requirement on the
+     * session-claims entry (authoritative for every live token of the session; see `resolve()`).
+     * Compare-and-set, so a slow recompute never undoes a newer change:
+     *  - the entry must still belong to `sessionId` + `tenantId` (a scope-switch moved it → refused);
+     *  - its `mfaStateEpoch` (absent = 0) must equal `expectedEpoch`, the value the evaluation started
+     *    from (a device confirm or another recompute since → refused);
+     *  - a stored stamp NEWER than `state.mfaRequirementVersion` wins (nothing written, refused).
+     * The write is ONE script that compares the exact entry it read (review round 1, item A), so of N
+     * concurrent recomputes exactly one writes; it keeps the remaining TTL (never extends the
+     * session) and increments the epoch. The re-enrol flag is never touched. Returns `false` when
+     * refused, gone, or Redis failed — the caller then re-reads the stored state with
+     * {@link mfaRequirementOf} and enforces it, or denies (fail closed).
+     */
+    updateMfaRequirement(sessionId: string, tenantId: string, expectedEpoch: number, state: MfaRequirementState): Promise<boolean>;
+    /**
+     * The mandatory-2FA state stored on the session-claims entry, for a recompute whose
+     * compare-and-set was refused (review round 1, item A): `null` when the entry is gone, belongs to
+     * another node, or Redis failed. A Redis error yields `null` (the caller denies).
+     */
+    mfaRequirementOf(sessionId: string, tenantId: string): Promise<StoredMfaState | null>;
+    /**
+     * R2.7 defence in depth: restrict the session NOW (`restriction: 'mfa_enrollment'`, any grace
+     * deadline dropped) after a removal left the user with no confirmed factor while a policy applies.
+     * Unconditional rather than compare-and-set (restricting is always the safe direction), and it
+     * increments the epoch, so an in-flight recompute that read the old state cannot lift it. The
+     * re-enrol flag and the requirement stamp are kept. Returns `false` when the entry is gone or Redis
+     * failed.
+     */
+    restrictMfaEnrollment(sessionId: string): Promise<boolean>;
+    /**
+     * DEVICE CONFIRM clear (R2.3, AC-7): the user now has a confirmed factor, so lift BOTH reasons
+     * (`mustReenroll` and `restriction`) and any grace deadline on the session-claims entry, keeping
+     * its remaining TTL and the requirement stamp, and increment the epoch so an in-flight recompute
+     * that started before the confirm cannot write its stale result back. The live token's next
+     * request is unrestricted (it is not re-minted). Best-effort: a gone entry or a Redis error leaves
+     * the session as it is (still restricted: the safe direction).
+     */
+    clearRestriction(sessionId: string): Promise<void>;
     /**
      * Clear the ENFORCED-RE-ENROLL flag for a session — the re-secure is complete
      * (a fresh device was confirmed, spec §4.3). Rewrites the session-claims entry with

package/dist/request-auth/session-token-binder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-binder.d.ts","sourceRoot":"","sources":["../../src/request-auth/session-token-binder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAKjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AA2CD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAQ5D;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAIzF;AA4ED,2FAA2F;AAC3F,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,uBAAuB,29BA0B3B,CAAC;AAMV,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,KAAK,EAAE,KAAK,EACZ,OAAO,GAAE,yBAA8B;IAG1D,gEAAgE;IAChE,OAAO,CAAC,UAAU;IAOlB;;;;;;;;OAQG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU3F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,YAAY,GAAG,IAAI,EAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE;IAChC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE;IAChC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM;IACzB,oGAAoG;IACpG,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC,OAAO,CAAC;IAuFnB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;IACG,WAAW,CAAC,SAAS,SAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAAC,OAAO,CAAC;IA0BnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,IAAI;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,OAAO,CAAC;IAiEnB;;;;;;;;;;;;OAYG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;IAgCnB;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA+ExE;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BrD,gDAAgD;IAC1C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD;;;;;OAKG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3D;;;;;;;OAOG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CActD"}
+{"version":3,"file":"session-token-binder.d.ts","sourceRoot":"","sources":["../../src/request-auth/session-token-binder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAKjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AA2CD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAQ5D;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,SAAS,CAIzF;AA2DD,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAC;IAC5C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AA0DD,2FAA2F;AAC3F,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,uBAAuB,29BA0B3B,CAAC;AAmBV,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,KAAK,EAAE,KAAK,EACZ,OAAO,GAAE,yBAA8B;IAG1D,gEAAgE;IAChE,OAAO,CAAC,UAAU;IAOlB;;;;;;;;OAQG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU3F;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,YAAY,GAAG,IAAI,EAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE;IAChC;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE;IAChC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM;IACzB,oGAAoG;IACpG,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC,OAAO,CAAC;IAuFnB;;;;;;;;;;OAUG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAW9D;;;;;;;;;OASG;IACG,WAAW,CAAC,SAAS,SAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBxE;;;;;;;;;;;;OAYG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAAC,OAAO,CAAC;IA0BnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,IAAI;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,OAAO,CAAC;IAwEnB;;;;;;;;;;;;OAYG;IACG,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC;IAgCnB;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAwFxE;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,OAAO,CAAC;IAwCnB;;;;OAIG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAY3F;;;;;;;OAOG;IACG,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBhE;;;;;;;OAOG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBxD;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BrD,gDAAgD;IAC1C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD;;;;;OAKG;IACG,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3D;;;;;;;OAOG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CActD"}