@astram/guard 0.19.0 → 0.20.0

package/dist/auth/profile-resolver.d.ts

@@ -55,6 +55,12 @@ export interface CurrentUserProfile {
     readonly company: ProfileTenant;
     /** The roles the user holds in the active tenant (display names). */
     readonly roles: readonly ProfileRole[];
+    /**
+     * Auth capabilities R2.4: set by `GET /auth/me` (never by the resolver) while the session is in a
+     * mandatory-2FA grace period — the enrolment deadline as an ISO-8601 UTC instant, for a banner.
+     * Absent when no grace deadline is bound.
+     */
+    readonly mfaEnrollmentDeadline?: string;
 }
 /**
  * The port a consumer implements to back `GET /auth/me`. Supplied to the framework

package/dist/auth/profile-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile-resolver.d.ts","sourceRoot":"","sources":["../../src/auth/profile-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACnE"}
+{"version":3,"file":"profile-resolver.d.ts","sourceRoot":"","sources":["../../src/auth/profile-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACnE"}

package/dist/auth/rate-limit/attempt-limiter.d.ts

@@ -151,5 +151,11 @@ export declare class AttemptLimiter {
      * leaves the (soon-to-expire) counter in place.
      */
     reset(key: string): Promise<void>;
+    /**
+     * Delete the counter on purpose (auth capabilities R11.1: an admin unlock). Unlike the
+     * best-effort {@link reset}, a Redis error REJECTS with {@link AttemptLimiterUnavailableError}:
+     * an unlock must never report a success it did not achieve.
+     */
+    clear(key: string): Promise<void>;
 }
 //# sourceMappingURL=attempt-limiter.d.ts.map

package/dist/auth/rate-limit/attempt-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attempt-limiter.d.ts","sourceRoot":"","sources":["../../../src/auth/rate-limit/attempt-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAEjC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,yJAI1B,CAAC;AAEV,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,4JAGzB,CAAC;AAEV,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,cAAc;IAKvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,oFAAoF;IACpF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAmC;gBAG9C,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB;IAG5C;;;;;OAKG;IACH,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,iFAAiF;IACjF,OAAO,CAAC,CAAC;IAIT;;;;;OAKG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1C;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBnD;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBjD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOxC"}
+{"version":3,"file":"attempt-limiter.d.ts","sourceRoot":"","sources":["../../../src/auth/rate-limit/attempt-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAEjC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,yJAI1B,CAAC;AAEV,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,4JAGzB,CAAC;AAEV,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;;CAKxD;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,cAAc;IAKvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,oFAAoF;IACpF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAmC;gBAG9C,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB;IAG5C;;;;;OAKG;IACH,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,iFAAiF;IACjF,OAAO,CAAC,CAAC;IAIT;;;;;OAKG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1C;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBnD;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBjD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQvC;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUxC"}

package/dist/auth/rate-limit/attempt-limiter.js

@@ -214,6 +214,20 @@ class AttemptLimiter {
             // Ignore — the counter TTL will expire it anyway; never fail a success path.
         }
     }
+    /**
+     * Delete the counter on purpose (auth capabilities R11.1: an admin unlock). Unlike the
+     * best-effort {@link reset}, a Redis error REJECTS with {@link AttemptLimiterUnavailableError}:
+     * an unlock must never report a success it did not achieve.
+     */
+    async clear(key) {
+        try {
+            await this.redis.del(this.k(key));
+        }
+        catch (err) {
+            AttemptLimiter.logger.warn(`attempt-limiter clear failed — Redis unavailable: ${describeError(err)}`);
+            throw new AttemptLimiterUnavailableError();
+        }
+    }
 }
 exports.AttemptLimiter = AttemptLimiter;
 /** A tiny, secret-free error description for the fail-open log (never logs a key). */

package/dist/auth/tokens.d.ts

@@ -166,6 +166,14 @@ export declare const SHIELD_PROFILE_WRITER: unique symbol;
  * un-audited). Consumed by the `/auth/mfa` recovery branch (fire-and-forget).
  */
 export declare const SHIELD_AUDIT_SINK: unique symbol;
+/**
+ * The framework DEFAULT auth `AuditSink` (R12.1, B-3). `@astram/identity`'s
+ * `IdentityFeatureModule.forRoot` binds it (globally) to an adapter over the engine audit sink,
+ * which writes `<ns>_audit.audit_log`. {@link SHIELD_AUDIT_SINK} resolves to the app-supplied
+ * `auditSink` when there is one, else to this token when bound, else `null`. Guard never imports
+ * identity (ADR-0003): the token is the seam. Exported from `@astram/guard/internal`.
+ */
+export declare const SHIELD_DEFAULT_AUTH_AUDIT_SINK: unique symbol;
 /**
  * The `MfaDeviceStore` (guard port, `../auth/ports/mfa-device-store.ts`) — persists
  * a principal's N TOTP authenticator DEVICES (multi-device MFA). Consumed
@@ -388,4 +396,55 @@ export declare const SHIELD_PERMISSION_VERSION_CACHE: unique symbol;
  * the rebuild is refused (401) and recovery logins cannot be marked (they fail closed).
  */
 export declare const SHIELD_SESSION_RESTRICTIONS: unique symbol;
+/**
+ * The validated `signInWith` option (auth capabilities R1.8; `readonly SignInMethod[]`, default
+ * `['email']`). Consumed by the default credential resolver (and by login-options).
+ */
+export declare const SHIELD_SIGN_IN_WITH: unique symbol;
+/**
+ * Mandatory 2FA (auth capabilities R2, B-1): the guard's MariaDB {@link
+ * import('@astram/core').MfaRequirementSource} (`authentication/mariadb-mfa-requirement-source.ts`)
+ * over the runtime pool — policies, the scope chain, confirmed devices and the per-user grace clock.
+ * Provided by `AuthModule` whenever the pool exists; reads nothing until asked.
+ */
+export declare const SHIELD_MFA_REQUIREMENT_SOURCE: unique symbol;
+/**
+ * Mandatory 2FA (R2.3–R2.5, R2.7): the {@link
+ * import('../session/mfa-requirement-service.js').MfaRequirementService} the login, the request
+ * path (gate-5 reload and the self-authenticating routes), device confirm and device removal use.
+ * `null` unless {@link SHIELD_MFA_POLICY_FEATURE} is bound: without the policy feature, guard
+ * behaves exactly as before (no evaluation, no extra read, no new claim).
+ */
+export declare const SHIELD_MFA_REQUIREMENT: unique symbol;
+/**
+ * Admin sign-in controls (auth capabilities R11.2): the {@link
+ * import('./admin-signin-controls.js').AdminStepUp} — the admin's own current TOTP on their
+ * `mfa:pid` budget through the replay-guarded login verifier. For `@astram/identity` only;
+ * exported from `@astram/guard/internal`.
+ */
+export declare const SHIELD_ADMIN_STEP_UP: unique symbol;
+/**
+ * Admin sign-in controls (R11.1 unlock): the {@link
+ * import('./admin-signin-controls.js').AccountUnlocker} that clears one principal's login, MFA,
+ * recovery and CAPTCHA account counters. For `@astram/identity` only; exported from
+ * `@astram/guard/internal`.
+ */
+export declare const SHIELD_ACCOUNT_UNLOCKER: unique symbol;
+/**
+ * The switch that turns mandatory-2FA evaluation on (R2). `@astram/identity` binds it `true`
+ * globally when its security-policy feature is registered (`IdentityFeatureModule.forRoot`); guard
+ * never imports identity (ADR-0003), so the token is the seam. Exported from
+ * `@astram/guard/internal`.
+ */
+export declare const SHIELD_MFA_POLICY_FEATURE: unique symbol;
+/**
+ * Auth capabilities R7 (CAPTCHA). `SHIELD_CAPTCHA_CONFIG`: the validated {@link
+ * import('../config/captcha-config.js').CaptchaConfig} (`null` unless `captcha: 'env'`).
+ * `SHIELD_CAPTCHA_VERIFIER`: the provider adapter (core `CaptchaVerifier`). `SHIELD_CAPTCHA_GATE`:
+ * the {@link import('./captcha-gate.js').CaptchaGate} on login / forgot / reset (`null` when off,
+ * so every route answers exactly as before).
+ */
+export declare const SHIELD_CAPTCHA_CONFIG: unique symbol;
+export declare const SHIELD_CAPTCHA_VERIFIER: unique symbol;
+export declare const SHIELD_CAPTCHA_GATE: unique symbol;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AACrE,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AACzE,eAAO,MAAM,mBAAmB,eAAgC,CAAC"}

package/dist/auth/tokens.js

@@ -23,7 +23,8 @@
  * ADR-0003: no framework/DB/crypto imports here — just Symbols (+ one re-export).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_SIGN_IN_WITH = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.SHIELD_CAPTCHA_GATE = exports.SHIELD_CAPTCHA_VERIFIER = exports.SHIELD_CAPTCHA_CONFIG = void 0;
 var argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
 /**
@@ -178,6 +179,14 @@ exports.SHIELD_PROFILE_WRITER = Symbol('SHIELD_PROFILE_WRITER');
  * un-audited). Consumed by the `/auth/mfa` recovery branch (fire-and-forget).
  */
 exports.SHIELD_AUDIT_SINK = Symbol('SHIELD_AUDIT_SINK');
+/**
+ * The framework DEFAULT auth `AuditSink` (R12.1, B-3). `@astram/identity`'s
+ * `IdentityFeatureModule.forRoot` binds it (globally) to an adapter over the engine audit sink,
+ * which writes `<ns>_audit.audit_log`. {@link SHIELD_AUDIT_SINK} resolves to the app-supplied
+ * `auditSink` when there is one, else to this token when bound, else `null`. Guard never imports
+ * identity (ADR-0003): the token is the seam. Exported from `@astram/guard/internal`.
+ */
+exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = Symbol('SHIELD_DEFAULT_AUTH_AUDIT_SINK');
 /**
  * The `MfaDeviceStore` (guard port, `../auth/ports/mfa-device-store.ts`) — persists
  * a principal's N TOTP authenticator DEVICES (multi-device MFA). Consumed
@@ -407,3 +416,54 @@ exports.SHIELD_PERMISSION_VERSION_CACHE = Symbol('SHIELD_PERMISSION_VERSION_CACH
  * the rebuild is refused (401) and recovery logins cannot be marked (they fail closed).
  */
 exports.SHIELD_SESSION_RESTRICTIONS = Symbol('SHIELD_SESSION_RESTRICTIONS');
+/**
+ * The validated `signInWith` option (auth capabilities R1.8; `readonly SignInMethod[]`, default
+ * `['email']`). Consumed by the default credential resolver (and by login-options).
+ */
+exports.SHIELD_SIGN_IN_WITH = Symbol('SHIELD_SIGN_IN_WITH');
+/**
+ * Mandatory 2FA (auth capabilities R2, B-1): the guard's MariaDB {@link
+ * import('@astram/core').MfaRequirementSource} (`authentication/mariadb-mfa-requirement-source.ts`)
+ * over the runtime pool — policies, the scope chain, confirmed devices and the per-user grace clock.
+ * Provided by `AuthModule` whenever the pool exists; reads nothing until asked.
+ */
+exports.SHIELD_MFA_REQUIREMENT_SOURCE = Symbol('SHIELD_MFA_REQUIREMENT_SOURCE');
+/**
+ * Mandatory 2FA (R2.3–R2.5, R2.7): the {@link
+ * import('../session/mfa-requirement-service.js').MfaRequirementService} the login, the request
+ * path (gate-5 reload and the self-authenticating routes), device confirm and device removal use.
+ * `null` unless {@link SHIELD_MFA_POLICY_FEATURE} is bound: without the policy feature, guard
+ * behaves exactly as before (no evaluation, no extra read, no new claim).
+ */
+exports.SHIELD_MFA_REQUIREMENT = Symbol('SHIELD_MFA_REQUIREMENT');
+/**
+ * Admin sign-in controls (auth capabilities R11.2): the {@link
+ * import('./admin-signin-controls.js').AdminStepUp} — the admin's own current TOTP on their
+ * `mfa:pid` budget through the replay-guarded login verifier. For `@astram/identity` only;
+ * exported from `@astram/guard/internal`.
+ */
+exports.SHIELD_ADMIN_STEP_UP = Symbol('SHIELD_ADMIN_STEP_UP');
+/**
+ * Admin sign-in controls (R11.1 unlock): the {@link
+ * import('./admin-signin-controls.js').AccountUnlocker} that clears one principal's login, MFA,
+ * recovery and CAPTCHA account counters. For `@astram/identity` only; exported from
+ * `@astram/guard/internal`.
+ */
+exports.SHIELD_ACCOUNT_UNLOCKER = Symbol('SHIELD_ACCOUNT_UNLOCKER');
+/**
+ * The switch that turns mandatory-2FA evaluation on (R2). `@astram/identity` binds it `true`
+ * globally when its security-policy feature is registered (`IdentityFeatureModule.forRoot`); guard
+ * never imports identity (ADR-0003), so the token is the seam. Exported from
+ * `@astram/guard/internal`.
+ */
+exports.SHIELD_MFA_POLICY_FEATURE = Symbol('SHIELD_MFA_POLICY_FEATURE');
+/**
+ * Auth capabilities R7 (CAPTCHA). `SHIELD_CAPTCHA_CONFIG`: the validated {@link
+ * import('../config/captcha-config.js').CaptchaConfig} (`null` unless `captcha: 'env'`).
+ * `SHIELD_CAPTCHA_VERIFIER`: the provider adapter (core `CaptchaVerifier`). `SHIELD_CAPTCHA_GATE`:
+ * the {@link import('./captcha-gate.js').CaptchaGate} on login / forgot / reset (`null` when off,
+ * so every route answers exactly as before).
+ */
+exports.SHIELD_CAPTCHA_CONFIG = Symbol('SHIELD_CAPTCHA_CONFIG');
+exports.SHIELD_CAPTCHA_VERIFIER = Symbol('SHIELD_CAPTCHA_VERIFIER');
+exports.SHIELD_CAPTCHA_GATE = Symbol('SHIELD_CAPTCHA_GATE');

package/dist/authentication/credential-provisioner.d.ts

@@ -27,6 +27,13 @@ export interface CredentialProvisioner {
      * (`none` when no row). Empty input ⇒ empty map, no query. Duplicate ids are fine.
      */
     statesOf(principalIds: readonly string[], query?: CredentialQuery): Promise<Map<string, CredentialState>>;
+    /**
+     * The principal whose credential's login hint (`ic_identity_hint`) equals `hint` under the
+     * column's collation (case-insensitive), or `null`. Identity uses it to refuse a login name that
+     * equals another principal's legacy (non-email) hint (auth capabilities review round 1, item F).
+     * Optional for custom provisioners; a store error propagates.
+     */
+    hintHolderOf?(hint: string, query?: CredentialQuery): Promise<string | null>;
 }
 /** The principal or login hint already has a credential. Fixed message: no hint, no driver text. */
 export declare class CredentialExistsError extends Error {

package/dist/authentication/credential-provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,gEAAgE;IAChE,iBAAiB,CACf,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChF;;;OAGG;IACH,QAAQ,CACN,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;CAC1C;AAED,oGAAoG;AACpG,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C"}
+{"version":3,"file":"credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gCAAiC,SAAQ,wBAAwB;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yGAAyG;AACzG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,gEAAgE;IAChE,iBAAiB,CACf,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChF;;;OAGG;IACH,QAAQ,CACN,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzC;;;;;OAKG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC9E;AAED,oGAAoG;AACpG,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C"}

package/dist/authentication/mariadb-credential-provisioner.d.ts

@@ -20,6 +20,7 @@ export declare class MariaDbCredentialProvisioner implements CredentialProvision
     provisionPassword(input: PasswordCredentialProvisionInput, query?: CredentialQuery): Promise<void>;
     stateOf(principalId: string, query?: CredentialQuery): Promise<CredentialState>;
     statesOf(principalIds: readonly string[], query?: CredentialQuery): Promise<Map<string, CredentialState>>;
+    hintHolderOf(hint: string, query?: CredentialQuery): Promise<string | null>;
     private validate;
     private run;
     private insert;

package/dist/authentication/mariadb-credential-provisioner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACtC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAkB7C,qBAAa,4BAA6B,YAAW,qBAAqB;IAMtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,iBAAiB,CACrB,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAU/E,QAAQ,CACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAqBxC,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,GAAG;YAIG,MAAM;CA0BrB"}
+{"version":3,"file":"mariadb-credential-provisioner.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-provisioner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gCAAgC,EACtC,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAkB7C,qBAAa,4BAA6B,YAAW,qBAAqB;IAMtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,eAAe,CAAC,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxF,iBAAiB,CACrB,KAAK,EAAE,gCAAgC,EACvC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAU/E,QAAQ,CACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAqBlC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUjF,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,GAAG;YAIG,MAAM;CA0BrB"}

package/dist/authentication/mariadb-credential-provisioner.js

@@ -65,6 +65,13 @@ class MariaDbCredentialProvisioner {
         }
         return out;
     }
+    async hintHolderOf(hint, query) {
+        if (typeof hint !== 'string' || hint === '')
+            return null;
+        const rows = (await this.run(query)(`SELECT ic_principal_id FROM ${this.table} WHERE ic_identity_hint = ? LIMIT 1`, [hint]));
+        const holder = rows[0]?.ic_principal_id;
+        return typeof holder === 'string' ? holder : null;
+    }
     validate(input) {
         requireText(input.principalId, 'principalId');
         requireText(input.hint, 'hint');

package/dist/authentication/mariadb-credential-resolver.d.ts

@@ -58,9 +58,10 @@
  * reads `shield_identity` via the runtime `shield_core` account.
  */
 import type { Pool } from 'mariadb';
-import type { CredentialResolver, ResolvedCredential } from '@astram/core';
+import { type CredentialResolver, type ResolvedCredential } from '@astram/core';
 import type { MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
 import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
+import { type SignInMethod } from './sign-in-with.js';
 /** DI token for the resolver — re-exported from the shared auth tokens module. */
 export { SHIELD_CREDENTIAL_RESOLVER } from '../auth/tokens.js';
 /**
@@ -88,6 +89,8 @@ export declare class MariaDbCredentialResolver implements CredentialResolver {
     private readonly credentialTable;
     /** `<app>`.`users` (the account status JOIN). */
     private readonly usersTable;
+    /** `signInWith` includes `username` (R1.8): a hint without `@` may be a login name. */
+    private readonly loginNameEnabled;
     constructor(pool: Pool, 
     /**
      * The device store whose CONFIRMED keys become the login's `totp` required factor.
@@ -98,7 +101,11 @@ export declare class MariaDbCredentialResolver implements CredentialResolver {
     /** Clock (epoch-ms) for the users-table re-probe window. */
     now?: () => number, 
     /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
-    schemas?: FrameworkSchemaNames);
+    schemas?: FrameworkSchemaNames, 
+    /** `signInWith` (R1.8); absent ⇒ `['email']`, today's lookup byte for byte. */
+    options?: {
+        readonly signInWith?: readonly SignInMethod[];
+    });
     /**
      * Resolve `identityHint` → {@link ResolvedCredential}, or `null` when no such
      * principal exists.
@@ -122,6 +129,20 @@ export declare class MariaDbCredentialResolver implements CredentialResolver {
      * restriction store). Any other error propagates (fail closed).
      */
     private lookup;
+    /**
+     * The normalized login name to try for `identityHint`, or `null` when the login-name path does
+     * not apply: `username` not enabled, the hint has `@` (an email form, R1.3), or the normalized
+     * text is not an allowed login name (no row could match).
+     */
+    private loginNameOf;
+    /**
+     * R1.4: ONE statement, two indexed branches — the typed text as a credential hint (PK, as
+     * today) and the normalized text as `users.u_login_name` (unique) joined to the credential on
+     * `ic_principal_id` (indexed, migration 103). Both branches carry the account status. Two
+     * DIFFERENT credential rows (two accounts, or one account holding two credentials) cannot be
+     * told apart ⇒ no row (fail closed: the caller answers the generic 401 after decoy work).
+     */
+    private lookupWithLoginName;
     /**
      * The principal's required second factors: one `totp` factor bundling every CONFIRMED
      * device key, or `[]` when none (or no device store wired). A store error propagates.

package/dist/authentication/mariadb-credential-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-credential-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAkB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,kFAAkF;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA6D/D;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAchE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG;IArBtB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAK;IAEnC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iDAAiD;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI;IAC3B;;;;OAIG;IACc,UAAU,CAAC,GAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IACjF,4DAA4D;IAC3C,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAOhC;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoCvE;;;;;;OAMG;YACW,MAAM;IAyBpB;;;OAGG;YACW,kBAAkB;CAQjC"}
+{"version":3,"file":"mariadb-credential-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAIL,KAAK,kBAAkB,EAEvB,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEzE,kFAAkF;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA+D/D;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAgBhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG;IAvBtB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAK;IAEnC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iDAAiD;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;gBAGxB,IAAI,EAAE,IAAI;IAC3B;;;;OAIG;IACc,UAAU,CAAC,GAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IACjF,4DAA4D;IAC3C,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAC9B,+EAA+E;IAC/E,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;KAAE;IAQ7D;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoCvE;;;;;;OAMG;YACW,MAAM;IA2BpB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;OAMG;YACW,mBAAmB;IAuBjC;;;OAGG;YACW,kBAAkB;CAQjC"}

package/dist/authentication/mariadb-credential-resolver.js

@@ -60,7 +60,9 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCredentialResolver = exports.SHIELD_CREDENTIAL_RESOLVER = void 0;
+const core_1 = require("@astram/core");
 const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
+const sign_in_with_js_1 = require("./sign-in-with.js");
 /** DI token for the resolver — re-exported from the shared auth tokens module. */
 var tokens_js_1 = require("../auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_CREDENTIAL_RESOLVER; } });
@@ -118,6 +120,8 @@ class MariaDbCredentialResolver {
     credentialTable;
     /** `<app>`.`users` (the account status JOIN). */
     usersTable;
+    /** `signInWith` includes `username` (R1.8): a hint without `@` may be a login name. */
+    loginNameEnabled;
     constructor(pool, 
     /**
      * The device store whose CONFIRMED keys become the login's `totp` required factor.
@@ -128,13 +132,16 @@ class MariaDbCredentialResolver {
     /** Clock (epoch-ms) for the users-table re-probe window. */
     now = Date.now, 
     /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
-    schemas) {
+    schemas, 
+    /** `signInWith` (R1.8); absent ⇒ `['email']`, today's lookup byte for byte. */
+    options) {
         this.pool = pool;
         this.mfaDevices = mfaDevices;
         this.now = now;
         const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
         this.credentialTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'identity_credential');
         this.usersTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'users');
+        this.loginNameEnabled = (0, sign_in_with_js_1.resolveSignInWith)(options?.signInWith).includes('username');
     }
     /**
      * Resolve `identityHint` → {@link ResolvedCredential}, or `null` when no such
@@ -191,6 +198,9 @@ class MariaDbCredentialResolver {
     async lookup(identityHint) {
         if (this.now() >= this.usersTableMissingUntil) {
             try {
+                const loginName = this.loginNameOf(identityHint);
+                if (loginName !== null)
+                    return await this.lookupWithLoginName(identityHint, loginName);
                 return (await this.pool.query(`SELECT ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, u.u_status
              FROM ${this.credentialTable}
              LEFT JOIN ${this.usersTable} u ON u.u_uuid = ic_principal_id
@@ -208,6 +218,40 @@ class MariaDbCredentialResolver {
         WHERE ic_identity_hint = ?
         LIMIT 1`, [identityHint]));
     }
+    /**
+     * The normalized login name to try for `identityHint`, or `null` when the login-name path does
+     * not apply: `username` not enabled, the hint has `@` (an email form, R1.3), or the normalized
+     * text is not an allowed login name (no row could match).
+     */
+    loginNameOf(identityHint) {
+        if (!this.loginNameEnabled || (0, core_1.looksLikeEmail)(identityHint))
+            return null;
+        const name = (0, core_1.normalizeLoginName)(identityHint);
+        return (0, core_1.isValidLoginName)(name) ? name : null;
+    }
+    /**
+     * R1.4: ONE statement, two indexed branches — the typed text as a credential hint (PK, as
+     * today) and the normalized text as `users.u_login_name` (unique) joined to the credential on
+     * `ic_principal_id` (indexed, migration 103). Both branches carry the account status. Two
+     * DIFFERENT credential rows (two accounts, or one account holding two credentials) cannot be
+     * told apart ⇒ no row (fail closed: the caller answers the generic 401 after decoy work).
+     */
+    async lookupWithLoginName(identityHint, loginName) {
+        const rows = (await this.pool.query(`SELECT ic.ic_identity_hint, ic.ic_password_hash, ic.ic_principal_id, ic.ic_tenant_id,
+              ic.ic_roles, u.u_status
+         FROM ${this.credentialTable} ic
+         LEFT JOIN ${this.usersTable} u ON u.u_uuid = ic.ic_principal_id
+        WHERE ic.ic_identity_hint = ?
+       UNION ALL
+       SELECT ic.ic_identity_hint, ic.ic_password_hash, ic.ic_principal_id, ic.ic_tenant_id,
+              ic.ic_roles, u.u_status
+         FROM ${this.usersTable} u
+         JOIN ${this.credentialTable} ic ON ic.ic_principal_id = u.u_uuid
+        WHERE u.u_login_name = ?
+        LIMIT 3`, [identityHint, loginName]));
+        const distinct = new Set(rows.map((r) => r.ic_identity_hint));
+        return distinct.size === 1 ? [rows[0]] : [];
+    }
     /**
      * The principal's required second factors: one `totp` factor bundling every CONFIRMED
      * device key, or `[]` when none (or no device store wired). A store error propagates.

package/dist/authentication/mariadb-mfa-device-store.d.ts

@@ -15,6 +15,13 @@ export declare class MariaDbMfaDeviceStore implements MfaDeviceStore {
     confirm(principalId: string, deviceId: string): Promise<boolean>;
     rename(principalId: string, deviceId: string, name: string): Promise<MfaDevice | null>;
     remove(principalId: string, deviceId: string): Promise<boolean>;
+    /**
+     * R2.7: remove `deviceId` unless it is the principal's last CONFIRMED device, atomically. One
+     * transaction: lock the principal's confirmed rows (`FOR UPDATE`, so a concurrent removal waits
+     * and then re-reads the committed state), re-count, refuse (`last_device`, rolled back) when this
+     * delete would leave none, else delete and commit. Errors roll back and propagate.
+     */
+    removeKeepingOne(principalId: string, deviceId: string): Promise<'removed' | 'not_found' | 'last_device'>;
     countConfirmed(principalId: string): Promise<number>;
     stampUsed(secret: string): Promise<void>;
 }

package/dist/authentication/mariadb-mfa-device-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-mfa-device-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-device-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAuB7C,qBAAa,qBAAsB,YAAW,cAAc;IAKxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAK1B,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASlD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS5D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASxE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBhE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAetF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}
+{"version":3,"file":"mariadb-mfa-device-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-device-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAuB7C,qBAAa,qBAAsB,YAAW,cAAc;IAKxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAK1B,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASlD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS5D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASxE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBhE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAetF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQrE;;;;;OAKG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;IA+B7C,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}

package/dist/authentication/mariadb-mfa-device-store.js

@@ -95,6 +95,38 @@ class MariaDbMfaDeviceStore {
         const res = (await this.pool.query(`DELETE FROM ${this.table} WHERE md_id = ? AND md_principal_id = ?`, [deviceId, principalId]));
         return res.affectedRows === 1;
     }
+    /**
+     * R2.7: remove `deviceId` unless it is the principal's last CONFIRMED device, atomically. One
+     * transaction: lock the principal's confirmed rows (`FOR UPDATE`, so a concurrent removal waits
+     * and then re-reads the committed state), re-count, refuse (`last_device`, rolled back) when this
+     * delete would leave none, else delete and commit. Errors roll back and propagate.
+     */
+    async removeKeepingOne(principalId, deviceId) {
+        const conn = await this.pool.getConnection();
+        try {
+            await conn.beginTransaction();
+            try {
+                const rows = (await conn.query(`SELECT md_id FROM ${this.table}
+            WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL
+            FOR UPDATE`, [principalId]));
+                const confirmed = rows.map((r) => String(r.md_id).toLowerCase());
+                if (confirmed.length === 1 && confirmed[0] === deviceId.toLowerCase()) {
+                    await conn.rollback();
+                    return 'last_device';
+                }
+                const res = (await conn.query(`DELETE FROM ${this.table} WHERE md_id = ? AND md_principal_id = ?`, [deviceId, principalId]));
+                await conn.commit();
+                return res.affectedRows === 1 ? 'removed' : 'not_found';
+            }
+            catch (err) {
+                await conn.rollback().catch(() => undefined);
+                throw err;
+            }
+        }
+        finally {
+            conn.release();
+        }
+    }
     async countConfirmed(principalId) {
         const rows = (await this.pool.query(`SELECT COUNT(*) AS c FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL`, [principalId]));

package/dist/authentication/mariadb-mfa-requirement-source.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `MariaDbMfaRequirementSource` — the guard's MariaDB adapter for core's
+ * {@link MfaRequirementSource} port (auth capabilities B-1, R2.4, R2.8, R2.9). Guard never imports
+ * identity (ADR-0003): it reads identity's tables directly with its runtime account, as
+ * `permission-facts.adapter.ts` does.
+ *
+ *  - scope chain: `<authz>.scope_closure` ancestors of the node (the node itself always included);
+ *  - policies: `<app>.security_policy` rows on the chain, plus EVERY platform-floor row;
+ *  - enrolled: a CONFIRMED `<identity>.mfa_device` row (R2.8: every device is TOTP today; pending
+ *    devices and recovery codes never count);
+ *  - the grace clock: `<identity>.mfa_requirement_state`, kept at the EARLIER value (`LEAST`).
+ *
+ * Lifecycle reads only (sign-in, a permission-version move, device removal): never on an unchanged
+ * version (the caller's stamp check guarantees it). Database names come from the resolved framework
+ * schemas, never a literal. The adapter is built only when the policy feature is wired, so a
+ * missing policy table (identity migration 104 not applied) is an error like any other: it
+ * propagates and the caller fails closed (review round 1, item D). A missing clock table still
+ * reads as "none stored" (the first clock write then fails closed). Every other error propagates.
+ */
+import type { MfaPolicy, MfaRequirementSource } from '@astram/core';
+import type { MfaStatusBatchSource } from '../session/mfa-requirement-service.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
+/** The one pool method the adapter uses. */
+export interface MfaSourcePool {
+    query(sql: string, params?: unknown[]): Promise<unknown>;
+}
+export declare class MariaDbMfaRequirementSource implements MfaRequirementSource, MfaStatusBatchSource {
+    private readonly pool;
+    private readonly closureTable;
+    private readonly policyTable;
+    private readonly deviceTable;
+    private readonly stateTable;
+    private readonly membershipTable;
+    constructor(pool: MfaSourcePool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
+    scopeChainOf(nodeId: string): Promise<readonly string[]>;
+    loadPolicies(nodeIds: readonly string[]): Promise<readonly MfaPolicy[]>;
+    hasConfirmedFactor(principalId: string): Promise<boolean>;
+    getRequiredSince(principalId: string): Promise<number | null>;
+    setRequiredSince(principalId: string, sinceMs: number): Promise<number>;
+    /** R11.3: the ids among `principalIds` with a CONFIRMED device. One `IN` query; none ⇒ no query. */
+    confirmedFactorsOf(principalIds: readonly string[]): Promise<ReadonlySet<string>>;
+    /** R11.3: stored grace clocks for `principalIds`. One `IN` query; no table ⇒ none. */
+    requiredSinceOf(principalIds: readonly string[]): Promise<ReadonlyMap<string, number>>;
+    /**
+     * Review item E2: the principal's ACTIVE membership nodes (`<app>.company_membership`,
+     * `cm_is_active = 1`, the predicate the users page uses), for the sign-in clock check. One query.
+     */
+    activeNodesOf(principalId: string): Promise<readonly string[]>;
+    /** R11.3: each node with its ancestors (the node itself always included). One `IN` query. */
+    scopeChainsOf(nodeIds: readonly string[]): Promise<ReadonlyMap<string, readonly string[]>>;
+    clearRequiredSince(principalId: string): Promise<void>;
+}
+//# sourceMappingURL=mariadb-mfa-requirement-source.d.ts.map

package/dist/authentication/mariadb-mfa-requirement-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-mfa-requirement-source.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-requirement-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAA4B,MAAM,cAAc,CAAC;AAC9F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAClF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAsCD,qBAAa,2BAA4B,YAAW,oBAAoB,EAAE,oBAAoB;IAQ1F,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPvB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAGtB,IAAI,EAAE,aAAa;IACpC,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAU1B,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAUxD,YAAY,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAevE,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiB7D,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa7E,oGAAoG;IAC9F,kBAAkB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAavF,sFAAsF;IAChF,eAAe,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA4B5F;;;OAGG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IASpE,6FAA6F;IACvF,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAgB1F,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAS7D"}