@astram/guard 0.18.0 → 0.20.0

package/dist/authentication/mariadb-mfa-requirement-source.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `MariaDbMfaRequirementSource` — the guard's MariaDB adapter for core's
+ * {@link MfaRequirementSource} port (auth capabilities B-1, R2.4, R2.8, R2.9). Guard never imports
+ * identity (ADR-0003): it reads identity's tables directly with its runtime account, as
+ * `permission-facts.adapter.ts` does.
+ *
+ *  - scope chain: `<authz>.scope_closure` ancestors of the node (the node itself always included);
+ *  - policies: `<app>.security_policy` rows on the chain, plus EVERY platform-floor row;
+ *  - enrolled: a CONFIRMED `<identity>.mfa_device` row (R2.8: every device is TOTP today; pending
+ *    devices and recovery codes never count);
+ *  - the grace clock: `<identity>.mfa_requirement_state`, kept at the EARLIER value (`LEAST`).
+ *
+ * Lifecycle reads only (sign-in, a permission-version move, device removal): never on an unchanged
+ * version (the caller's stamp check guarantees it). Database names come from the resolved framework
+ * schemas, never a literal. The adapter is built only when the policy feature is wired, so a
+ * missing policy table (identity migration 104 not applied) is an error like any other: it
+ * propagates and the caller fails closed (review round 1, item D). A missing clock table still
+ * reads as "none stored" (the first clock write then fails closed). Every other error propagates.
+ */
+import type { MfaPolicy, MfaRequirementSource } from '@astram/core';
+import type { MfaStatusBatchSource } from '../session/mfa-requirement-service.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
+/** The one pool method the adapter uses. */
+export interface MfaSourcePool {
+    query(sql: string, params?: unknown[]): Promise<unknown>;
+}
+export declare class MariaDbMfaRequirementSource implements MfaRequirementSource, MfaStatusBatchSource {
+    private readonly pool;
+    private readonly closureTable;
+    private readonly policyTable;
+    private readonly deviceTable;
+    private readonly stateTable;
+    private readonly membershipTable;
+    constructor(pool: MfaSourcePool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
+    scopeChainOf(nodeId: string): Promise<readonly string[]>;
+    loadPolicies(nodeIds: readonly string[]): Promise<readonly MfaPolicy[]>;
+    hasConfirmedFactor(principalId: string): Promise<boolean>;
+    getRequiredSince(principalId: string): Promise<number | null>;
+    setRequiredSince(principalId: string, sinceMs: number): Promise<number>;
+    /** R11.3: the ids among `principalIds` with a CONFIRMED device. One `IN` query; none ⇒ no query. */
+    confirmedFactorsOf(principalIds: readonly string[]): Promise<ReadonlySet<string>>;
+    /** R11.3: stored grace clocks for `principalIds`. One `IN` query; no table ⇒ none. */
+    requiredSinceOf(principalIds: readonly string[]): Promise<ReadonlyMap<string, number>>;
+    /**
+     * Review item E2: the principal's ACTIVE membership nodes (`<app>.company_membership`,
+     * `cm_is_active = 1`, the predicate the users page uses), for the sign-in clock check. One query.
+     */
+    activeNodesOf(principalId: string): Promise<readonly string[]>;
+    /** R11.3: each node with its ancestors (the node itself always included). One `IN` query. */
+    scopeChainsOf(nodeIds: readonly string[]): Promise<ReadonlyMap<string, readonly string[]>>;
+    clearRequiredSince(principalId: string): Promise<void>;
+}
+//# sourceMappingURL=mariadb-mfa-requirement-source.d.ts.map

package/dist/authentication/mariadb-mfa-requirement-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-mfa-requirement-source.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-requirement-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAA4B,MAAM,cAAc,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAsCD,qBAAa,2BAA4B,YAAW,oBAAoB,EAAE,oBAAoB;IAQ1F,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPvB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAGtB,IAAI,EAAE,aAAa;IACpC,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAU1B,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAUxD,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAevE,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiB7D,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa7E,oGAAoG;IAC9F,kBAAkB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAavF,sFAAsF;IAChF,eAAe,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA4B5F;;;OAGG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IASpE,6FAA6F;IACvF,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAgB1F,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAS7D"}

package/dist/authentication/mariadb-mfa-requirement-source.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbMfaRequirementSource = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
+/** MariaDB `ER_NO_SUCH_TABLE`. */
+const ER_NO_SUCH_TABLE = 1146;
+function isNoSuchTable(err) {
+    return err?.errno === ER_NO_SUCH_TABLE;
+}
+/** A stored row as the core rule reads it. Unknown kinds pass through (the rule applies them). */
+function toPolicy(r) {
+    const platform = Number(r.sp_platform) === 1;
+    const grace = Number(r.sp_grace_days);
+    return {
+        ...(typeof r.sp_uuid === 'string' ? { id: r.sp_uuid } : {}),
+        scopeNodeId: typeof r.sp_scope_node_uuid === 'string' ? r.sp_scope_node_uuid : null,
+        platform,
+        kind: String(r.sp_target_kind),
+        target: typeof r.sp_target_value === 'string' ? r.sp_target_value : null,
+        // An unreadable grace becomes NaN, which the rule counts as 0 (the strictest).
+        graceDays: grace,
+    };
+}
+/** `?, ?, …` for an `IN` list. */
+function placeholders(n) {
+    return Array.from({ length: n }, () => '?').join(', ');
+}
+class MariaDbMfaRequirementSource {
+    pool;
+    closureTable;
+    policyTable;
+    deviceTable;
+    stateTable;
+    membershipTable;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
+        this.pool = pool;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.closureTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.authz, 'scope_closure');
+        this.policyTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'security_policy');
+        this.deviceTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'mfa_device');
+        this.stateTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'mfa_requirement_state');
+        this.membershipTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'company_membership');
+    }
+    async scopeChainOf(nodeId) {
+        const rows = (await this.pool.query(`SELECT ancestor_uuid FROM ${this.closureTable} WHERE descendant_uuid = ?`, [nodeId]));
+        const chain = new Set([nodeId]);
+        for (const r of rows)
+            if (typeof r.ancestor_uuid === 'string')
+                chain.add(r.ancestor_uuid);
+        return [...chain];
+    }
+    async loadPolicies(nodeIds) {
+        const ids = nodeIds.filter((n) => typeof n === 'string' && n.length > 0);
+        const where = ids.length > 0
+            ? `sp_platform = 1 OR sp_scope_node_uuid IN (${ids.map(() => '?').join(', ')})`
+            : 'sp_platform = 1';
+        // Review round 1, item D: no fallback for a missing table (1146). This adapter exists only
+        // when the policy feature is wired, so the error propagates and the caller fails closed (503).
+        const rows = (await this.pool.query(`SELECT sp_uuid, sp_scope_node_uuid, sp_platform, sp_target_kind, sp_target_value, sp_grace_days FROM ${this.policyTable} WHERE ${where}`, [...ids]));
+        return rows.map(toPolicy);
+    }
+    async hasConfirmedFactor(principalId) {
+        const rows = (await this.pool.query(`SELECT 1 AS ok FROM ${this.deviceTable} WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL LIMIT 1`, [principalId]));
+        return Array.isArray(rows) && rows.length > 0;
+    }
+    async getRequiredSince(principalId) {
+        let rows;
+        try {
+            rows = (await this.pool.query(`SELECT mrs_required_since_ms FROM ${this.stateTable} WHERE mrs_principal_id = ? LIMIT 1`, [principalId]));
+        }
+        catch (err) {
+            if (isNoSuchTable(err))
+                return null;
+            throw err;
+        }
+        const v = rows[0]?.mrs_required_since_ms;
+        if (v === undefined || v === null)
+            return null;
+        const n = Number(v);
+        return Number.isFinite(n) ? n : null;
+    }
+    async setRequiredSince(principalId, sinceMs) {
+        await this.pool.query(`INSERT INTO ${this.stateTable} (mrs_principal_id, mrs_required_since_ms) VALUES (?, ?)
+       ON DUPLICATE KEY UPDATE
+         mrs_required_since_ms = LEAST(mrs_required_since_ms, VALUES(mrs_required_since_ms))`, [principalId, sinceMs]);
+        const stored = await this.getRequiredSince(principalId);
+        // The row was just written; a missing read-back is not a value to trust (fail closed: the
+        // caller keeps its own, which is never later than the stored one could be).
+        return stored ?? sinceMs;
+    }
+    /** R11.3: the ids among `principalIds` with a CONFIRMED device. One `IN` query; none ⇒ no query. */
+    async confirmedFactorsOf(principalIds) {
+        const ids = [...new Set(principalIds.filter((i) => typeof i === 'string' && i.length > 0))];
+        if (ids.length === 0)
+            return new Set();
+        const rows = (await this.pool.query(`SELECT DISTINCT md_principal_id FROM ${this.deviceTable}
+        WHERE md_principal_id IN (${placeholders(ids.length)}) AND md_confirmed_at_ms IS NOT NULL`, ids));
+        return new Set(rows.map((r) => r.md_principal_id).filter((v) => typeof v === 'string'));
+    }
+    /** R11.3: stored grace clocks for `principalIds`. One `IN` query; no table ⇒ none. */
+    async requiredSinceOf(principalIds) {
+        const ids = [...new Set(principalIds.filter((i) => typeof i === 'string' && i.length > 0))];
+        const out = new Map();
+        if (ids.length === 0)
+            return out;
+        let rows;
+        try {
+            rows = (await this.pool.query(`SELECT mrs_principal_id, mrs_required_since_ms FROM ${this.stateTable}
+          WHERE mrs_principal_id IN (${placeholders(ids.length)})`, ids));
+        }
+        catch (err) {
+            if (isNoSuchTable(err))
+                return out;
+            throw err;
+        }
+        for (const r of rows) {
+            const n = Number(r.mrs_required_since_ms);
+            if (typeof r.mrs_principal_id === 'string' &&
+                r.mrs_required_since_ms !== null &&
+                Number.isFinite(n)) {
+                out.set(r.mrs_principal_id, n);
+            }
+        }
+        return out;
+    }
+    /**
+     * Review item E2: the principal's ACTIVE membership nodes (`<app>.company_membership`,
+     * `cm_is_active = 1`, the predicate the users page uses), for the sign-in clock check. One query.
+     */
+    async activeNodesOf(principalId) {
+        const rows = (await this.pool.query(`SELECT DISTINCT cm_company_uuid FROM ${this.membershipTable}
+        WHERE cm_user_uuid = ? AND cm_is_active = 1`, [principalId]));
+        return rows.map((r) => r.cm_company_uuid).filter((v) => typeof v === 'string');
+    }
+    /** R11.3: each node with its ancestors (the node itself always included). One `IN` query. */
+    async scopeChainsOf(nodeIds) {
+        const ids = [...new Set(nodeIds.filter((i) => typeof i === 'string' && i.length > 0))];
+        const chains = new Map(ids.map((n) => [n, new Set([n])]));
+        if (ids.length === 0)
+            return new Map();
+        const rows = (await this.pool.query(`SELECT descendant_uuid, ancestor_uuid FROM ${this.closureTable}
+        WHERE descendant_uuid IN (${placeholders(ids.length)})`, ids));
+        for (const r of rows) {
+            if (typeof r.descendant_uuid !== 'string' || typeof r.ancestor_uuid !== 'string')
+                continue;
+            chains.get(r.descendant_uuid)?.add(r.ancestor_uuid);
+        }
+        return new Map([...chains].map(([n, set]) => [n, [...set]]));
+    }
+    async clearRequiredSince(principalId) {
+        try {
+            await this.pool.query(`DELETE FROM ${this.stateTable} WHERE mrs_principal_id = ?`, [
+                principalId,
+            ]);
+        }
+        catch (err) {
+            if (!isNoSuchTable(err))
+                throw err;
+        }
+    }
+}
+exports.MariaDbMfaRequirementSource = MariaDbMfaRequirementSource;

package/dist/authentication/mariadb-mfa-resetter.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `MariaDbMfaResetter` — auth capabilities R11.1 (task 18): an admin "reset 2FA" for one principal.
+ * ONE transaction on the given pool deletes the principal's MFA devices (confirmed and pending),
+ * recovery codes and mandatory-2FA grace clock (`mfa_requirement_state`, so the clock restarts at
+ * their next sign-in, R2.4), then runs the caller's `withinTransaction` (identity writes its
+ * `auth.mfa.reset_by_admin` audit row there) and commits. Any error, the audit write included,
+ * rolls the whole reset back and propagates (the caller answers 503).
+ *
+ * Sessions are not touched here: the caller revokes them through the session sweeper after the
+ * commit. Guard never imports identity (ADR-0003): identity builds this over its runtime pool, as it
+ * does `MariaDbEmailAddressChanger`, and reaches it through `@astram/guard/internal`. Database names
+ * come from the resolved framework schemas, never a literal. An app without identity migration 104
+ * has no clock table: that delete is skipped.
+ */
+import type { Pool } from 'mariadb';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
+/** A query on the reset's own transaction connection. */
+export type MfaResetQuery = (sql: string, params?: unknown[]) => Promise<unknown>;
+export interface MfaResetResult {
+    /** Device rows deleted (audit or logging only; never returned to a client). */
+    readonly devicesRemoved: number;
+}
+export interface MfaResetRequest {
+    readonly principalId: string;
+    /** Runs on the reset's transaction before the commit; a throw rolls everything back. */
+    readonly withinTransaction: (query: MfaResetQuery, result: MfaResetResult) => Promise<void>;
+}
+/** The seam identity uses (built over its runtime pool). */
+export interface MfaResetter {
+    reset(request: MfaResetRequest): Promise<MfaResetResult>;
+}
+export declare class MariaDbMfaResetter implements MfaResetter {
+    private readonly pool;
+    private readonly deviceTable;
+    private readonly recoveryTable;
+    private readonly stateTable;
+    constructor(pool: Pick<Pool, 'getConnection'>, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
+    reset(request: MfaResetRequest): Promise<MfaResetResult>;
+}
+//# sourceMappingURL=mariadb-mfa-resetter.d.ts.map

package/dist/authentication/mariadb-mfa-resetter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-mfa-resetter.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-resetter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAK7C,yDAAyD;AACzD,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAElF,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F;AAED,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1D;AAED,qBAAa,kBAAmB,YAAW,WAAW;IAMlD,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;IAClD,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;CAoC/D"}

package/dist/authentication/mariadb-mfa-resetter.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbMfaResetter = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
+/** MariaDB `ER_NO_SUCH_TABLE`. */
+const ER_NO_SUCH_TABLE = 1146;
+class MariaDbMfaResetter {
+    pool;
+    deviceTable;
+    recoveryTable;
+    stateTable;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
+        this.pool = pool;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.deviceTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'mfa_device');
+        this.recoveryTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'mfa_recovery_code');
+        this.stateTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'mfa_requirement_state');
+    }
+    async reset(request) {
+        const { principalId } = request;
+        if (typeof principalId !== 'string' || principalId === '') {
+            throw new Error('MariaDbMfaResetter: a principal id is required');
+        }
+        const conn = await this.pool.getConnection();
+        try {
+            await conn.beginTransaction();
+            try {
+                const devices = (await conn.query(`DELETE FROM ${this.deviceTable} WHERE md_principal_id = ?`, [principalId]));
+                await conn.query(`DELETE FROM ${this.recoveryTable} WHERE mrc_principal_id = ?`, [
+                    principalId,
+                ]);
+                try {
+                    await conn.query(`DELETE FROM ${this.stateTable} WHERE mrs_principal_id = ?`, [
+                        principalId,
+                    ]);
+                }
+                catch (err) {
+                    // Statement-level failure only (the transaction stays open): no clock table, no clock.
+                    if (err?.errno !== ER_NO_SUCH_TABLE)
+                        throw err;
+                }
+                const result = { devicesRemoved: Number(devices?.affectedRows ?? 0) };
+                await request.withinTransaction((sql, params) => conn.query(sql, params), result);
+                await conn.commit();
+                return result;
+            }
+            catch (err) {
+                await conn.rollback().catch(() => undefined);
+                throw err;
+            }
+        }
+        finally {
+            conn.release();
+        }
+    }
+}
+exports.MariaDbMfaResetter = MariaDbMfaResetter;

package/dist/authentication/mariadb-profile-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAe7C,qBAAa,oBAAqB,YAAW,aAAa;IAKtD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,gGAAgG;IAChG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEV,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,CAAC;CAgD/B"}
+{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAe7C,qBAAa,oBAAqB,YAAW,aAAa;IAKtD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,gGAAgG;IAChG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEV,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,CAAC;CAqD/B"}

package/dist/authentication/mariadb-profile-writer.js

@@ -32,6 +32,11 @@ class MariaDbProfileWriter {
         if (changes.email !== undefined) {
             throw new Error('MariaDbProfileWriter: email changes go through the verified email-change flow only');
         }
+        // Auth capabilities R1.7 / D-8: the login name (`u_login_name`) is set by an admin or
+        // `bootstrap:org` only; a self-service writer never touches it. Refuse a caller that tries.
+        if (changes.loginName !== undefined) {
+            throw new Error('MariaDbProfileWriter: the login name is set by an administrator only');
+        }
         const sets = [];
         const params = [];
         if (changes.name !== undefined) {

package/dist/authentication/sign-in-with.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The `signInWith` option (auth capabilities R1.8): which typed forms `POST /auth/login` accepts.
+ * `['email']` (default) is today's behaviour; `['email', 'username']` also accepts the login name
+ * (`users.u_login_name`, admin- or bootstrap-set). Validated once at registration: an unknown
+ * value, an empty list or a list without `email` throws (email sign-in cannot be turned off here;
+ * password reset and invites depend on it).
+ */
+/** A sign-in form `POST /auth/login` may accept. */
+export type SignInMethod = 'email' | 'username';
+/** The default: email only (today's behaviour). */
+export declare const DEFAULT_SIGN_IN_WITH: readonly SignInMethod[];
+/** Validate the option; `undefined` ⇒ {@link DEFAULT_SIGN_IN_WITH}. Throws a clear boot error. */
+export declare function resolveSignInWith(value: unknown): readonly SignInMethod[];
+//# sourceMappingURL=sign-in-with.d.ts.map

package/dist/authentication/sign-in-with.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-with.d.ts","sourceRoot":"","sources":["../../src/authentication/sign-in-with.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,oDAAoD;AACpD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,UAAU,CAAC;AAIhD,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,EAAE,SAAS,YAAY,EAA6B,CAAC;AAEtF,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,YAAY,EAAE,CAsBzE"}

package/dist/authentication/sign-in-with.js

@@ -0,0 +1,36 @@
+"use strict";
+/**
+ * The `signInWith` option (auth capabilities R1.8): which typed forms `POST /auth/login` accepts.
+ * `['email']` (default) is today's behaviour; `['email', 'username']` also accepts the login name
+ * (`users.u_login_name`, admin- or bootstrap-set). Validated once at registration: an unknown
+ * value, an empty list or a list without `email` throws (email sign-in cannot be turned off here;
+ * password reset and invites depend on it).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SIGN_IN_WITH = void 0;
+exports.resolveSignInWith = resolveSignInWith;
+const METHODS = ['email', 'username'];
+/** The default: email only (today's behaviour). */
+exports.DEFAULT_SIGN_IN_WITH = Object.freeze(['email']);
+/** Validate the option; `undefined` ⇒ {@link DEFAULT_SIGN_IN_WITH}. Throws a clear boot error. */
+function resolveSignInWith(value) {
+    if (value === undefined)
+        return exports.DEFAULT_SIGN_IN_WITH;
+    if (!Array.isArray(value) || value.length === 0) {
+        throw new Error("ShieldModule: signInWith must be a non-empty array of 'email' | 'username' " +
+            "(default ['email'])");
+    }
+    const out = [];
+    for (const v of value) {
+        if (typeof v !== 'string' || !METHODS.includes(v)) {
+            throw new Error(`ShieldModule: signInWith has an unknown value ${JSON.stringify(v)}; ` +
+                "allowed: 'email', 'username'");
+        }
+        if (!out.includes(v))
+            out.push(v);
+    }
+    if (!out.includes('email')) {
+        throw new Error("ShieldModule: signInWith must include 'email' (e.g. ['email', 'username'])");
+    }
+    return Object.freeze(out);
+}

package/dist/authz/core-access.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The engine access declaration → core's record posture. Core knows `owned`, `tenantScoped` and
+ * `system`; a global reference type (G-022, ADR-0046) is presented as `system` — grant-governed,
+ * owner baseline allow, list owner baseline `all` — so core's frozen contract is unchanged (R9).
+ * The guard emits no tenant clause for it (`list-scope-sql.ts`) and loads its record rules for
+ * the caller's active tenant only (`wire-record-authorization.ts`).
+ */
+import type { RecordAccessPosture } from '@astram/core';
+import type { AccessDeclaration } from '@astram/engine';
+export declare function coreAccessOf(access: AccessDeclaration | undefined): RecordAccessPosture;
+//# sourceMappingURL=core-access.d.ts.map

package/dist/authz/core-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-access.d.ts","sourceRoot":"","sources":["../../src/authz/core-access.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,CAQvF"}

package/dist/authz/core-access.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreAccessOf = coreAccessOf;
+function coreAccessOf(access) {
+    if (access === undefined)
+        return {};
+    if (access.global === true)
+        return { system: true };
+    return {
+        ...(access.owned !== undefined ? { owned: access.owned } : {}),
+        ...(access.tenantScoped !== undefined ? { tenantScoped: access.tenantScoped } : {}),
+        ...(access.system !== undefined ? { system: access.system } : {}),
+    };
+}

package/dist/authz/list-scope-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-scope-sql.d.ts","sourceRoot":"","sources":["../../src/authz/list-scope-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAGxB,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAO3C;AAmID;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE;IACJ;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,SAAS,cAAc,EAAE,CAAC,EAAE,CAAC;CAC3D,GACA,mBAAmB,CAoJrB"}
+{"version":3,"file":"list-scope-sql.d.ts","sourceRoot":"","sources":["../../src/authz/list-scope-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAGxB,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAO3C;AAmID;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE;IACJ;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,SAAS,cAAc,EAAE,CAAC,EAAE,CAAC;CAC3D,GACA,mBAAmB,CAyJrB"}

package/dist/authz/list-scope-sql.js

@@ -252,8 +252,10 @@ function translateListScope(spec, reg, principal, opts) {
                 // readScope, a subtree bound on a tenant-column-less type is a misconfiguration →
                 // fail closed. tenantNodeIds stays null → the share term (which needs a tenant value)
                 // is naturally omitted (a readScope type is not record-shared in v1).
-                if (reg.readScope) {
-                    // defer to readScope — no tenant clause added; fall through to the union/deny.
+                // A global type (G-022, ADR-0046) has no wall at all: the same rows for every tenant,
+                // still governed by the positive union and deny below.
+                if (reg.readScope || (0, engine_1.isGlobalType)(reg)) {
+                    // defer to readScope / global — no tenant clause added; fall through to the union/deny.
                 }
                 else {
                     return { sql: 'FALSE', params: [] };
@@ -279,10 +281,15 @@ function translateListScope(spec, reg, principal, opts) {
             if (tenantCol === null) {
                 // A tenant-scoped bound on a type with no tenant column is a misconfiguration →
                 // fail closed (the whole fragment is FALSE — no rows). Documented (Decision).
-                return { sql: 'FALSE', params: [] };
+                // G-022: a global type is the exception — no tenant clause, and tenantNodeIds stays
+                // null so the share term is omitted (a global type is never shared).
+                if (!(0, engine_1.isGlobalType)(reg))
+                    return { sql: 'FALSE', params: [] };
+            }
+            else {
+                tenantClause = `\`${tenantCol}\` = ${p.bind(tenantValue)}`;
+                tenantNodeIds = [tenantValue]; // the flat case: the share is scoped to the one tenant
             }
-            tenantClause = `\`${tenantCol}\` = ${p.bind(tenantValue)}`;
-            tenantNodeIds = [tenantValue]; // the flat case: the share is scoped to the one tenant
         }
         if (tenantClause !== null)
             clauses.push(tenantClause);
@@ -423,6 +430,9 @@ function translateCrossTenant(spec, reg, schema, nowMs, p) {
     const xt = spec.crossTenant;
     if (xt.kind !== 'granted')
         return null;
+    // G-022 R6: a global type is omitted from cross-tenant reach (its rows belong to no tenant).
+    if ((0, engine_1.isGlobalType)(reg))
+        return null;
     const tenantCol = (0, engine_1.tenantColumnOf)(reg);
     const hasUuidPk = reg.primaryKey.kind === 'uuid';
     if (tenantCol === null && !hasUuidPk)

package/dist/authz/wire-record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAOD;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA8BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAyE/E"}
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EAEjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAOD;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA8BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CA2F/E"}

package/dist/authz/wire-record-authorization.js

@@ -4,6 +4,8 @@ exports.withRedisPermissionVersion = withRedisPermissionVersion;
 exports.buildRecordAuthorization = buildRecordAuthorization;
 exports.buildListScopeFn = buildListScopeFn;
 const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+const core_access_js_1 = require("./core-access.js");
 const mariadb_record_rule_adapter_js_1 = require("./mariadb-record-rule-adapter.js");
 const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapter.js");
 const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
@@ -128,15 +130,30 @@ function buildListScopeFn(inputs) {
         // `computeListScope` reads ONLY `descriptor.access` for the owner-baseline posture
         // (see list-scope.ts `ownerBaselineFor`), so `label`/`fields` are inert — the engine's
         // `reg.access` (`AccessDeclaration`) is structurally core's `RecordAccessPosture`.
+        // A global type (G-022) is presented as core `system` by `coreAccessOf`, as the bridge does.
         const registry = {
             resolveObjectType(typeKey) {
                 return typeKey === reg.typeKey
-                    ? { typeKey: reg.typeKey, label: reg.typeKey, fields: [], access: reg.access }
+                    ? {
+                        typeKey: reg.typeKey,
+                        label: reg.typeKey,
+                        fields: [],
+                        access: (0, core_access_js_1.coreAccessOf)(reg.access),
+                    }
                     : undefined;
             },
         };
+        // D-5 (G-022): a global row has no tenant, so the single-row check loads record rules for
+        // the caller's active tenant (`resource.tenantId ?? principal.tenantId`, record-rule
+        // adapter). The list must load the same set, not the whole subtree: otherwise a child
+        // tenant's deny would hide a global row from a parent's caller in lists only.
+        const scopePort = (0, engine_1.isGlobalType)(reg)
+            ? {
+                listPolicyConditions: (typeKey, _subtree, a, subject) => listScopePort.listPolicyConditions(typeKey, [actor.tenantId], a, subject),
+            }
+            : listScopePort;
         // A transient throw here PROPAGATES (fail-closed — NOT caught).
-        const spec = await (0, core_1.computeListScope)({ registry, listScope: listScopePort }, { principal: actor, action, typeKey: reg.typeKey, tenantId: actor.tenantId });
+        const spec = await (0, core_1.computeListScope)({ registry, listScope: scopePort }, { principal: actor, action, typeKey: reg.typeKey, tenantId: actor.tenantId });
         // ── OWNING-TENANT DENY (Task 4.2 — the fail-open leak fix) ────────────────────────────
         // A cross-tenant grant reaches the OWNING tenant's records; `decide()` evaluates those at
         // the RESOURCE's (owning) tenant, so the owning tenant's DENY rules apply (deny-wins,
@@ -148,7 +165,8 @@ function buildListScopeFn(inputs) {
         // PROPAGATES (fail-closed — never drop the owning-tenant deny). Global (NULL-tenant) deny
         // rules come back in BOTH fetches, so they apply to both branches (as `decide()` does).
         let owningTenantDeny = [];
-        if (spec.crossTenant.kind === 'granted') {
+        // A global type has no cross-tenant branch (`translateCrossTenant` omits it, G-022 R6).
+        if (spec.crossTenant.kind === 'granted' && !(0, engine_1.isGlobalType)(reg)) {
             const owningTenants = await crossTenantAdapter.listActiveOwningTenants({
                 grantee: actor.id,
                 roleIds: actor.roleIds,

package/dist/captcha/captcha.providers.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `AuthModule` providers for the `captcha` option (auth capabilities R7.1, D-6):
+ * - absent ⇒ `SHIELD_CAPTCHA_CONFIG` and `SHIELD_CAPTCHA_GATE` bound `null` (every route as today,
+ *   no `CAPTCHA_*` variable read);
+ * - `'env'` ⇒ the config from `CAPTCHA_*` (`loadCaptchaConfig`, boot fails on a bad value), the
+ *   provider's verifier, and the gate over the guard's Redis client and the auth audit sink. One
+ *   boot line names the provider, mode, fail mode and endpoints (never the keys).
+ */
+import { type Provider } from '@nestjs/common';
+import type { CaptchaVerifier } from '@astram/core';
+import { type CaptchaConfig } from '../config/captcha-config.js';
+/** The `captcha` option on `ShieldModule.forRoot` / `forRootAsync` / `AuthModule.forRoot`. */
+export type ShieldCaptchaOption = 'env';
+/** Build the adapter named by `CAPTCHA_PROVIDER`. */
+export declare function buildCaptchaVerifier(config: CaptchaConfig): CaptchaVerifier;
+/** Providers for one `AuthModule` registration (see the file header). */
+export declare function captchaProviders(option: ShieldCaptchaOption | undefined): Provider[];
+//# sourceMappingURL=captcha.providers.d.ts.map

package/dist/captcha/captcha.providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha.providers.d.ts","sourceRoot":"","sources":["../../src/captcha/captcha.providers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAcpF,8FAA8F;AAC9F,MAAM,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAExC,qDAAqD;AACrD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAe3E;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAgDpF"}