@astram/guard 0.2.0 → 0.3.0

package/dist/index.d.ts

@@ -14,21 +14,53 @@
  * Depends on `@astram/core` (workspace); PEER-depends on `@nestjs/common`,
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
-export { ShieldModule, SHIELD_DECISION_AUTHORITY, type ShieldModuleOptions, type ShieldModuleAsyncOptions, } from './module/shield.module.js';
-export { Public, Classified, CLASSIFICATION_METADATA, } from './enforcement/classification.decorator.js';
+export { ShieldModule, SHIELD_DECISION_AUTHORITY, type ShieldModuleOptions, type ShieldModuleAsyncOptions, type RecordAuthorizationInputs, } from './module/shield.module.js';
+export { Public, Classified, CLASSIFICATION_METADATA, DEFAULT_CLASSIFIED_ACTION, normalizeClassification, } from './enforcement/classification.decorator.js';
+export type { Classification } from './enforcement/classification.decorator.js';
+export { OperationInventoryScanner } from './completeness/operation-inventory-scanner.js';
+export { CatalogReconciler, CatalogGatabilityError } from './completeness/catalog-reconciler.js';
+export type { CatalogStore, CatalogPermissionRow, ReconcileReport, } from './completeness/ports/catalog-store.js';
+export { SHIELD_SESSION_TOKEN_BINDER } from './request-auth/tokens.js';
+export { SessionTokenBinder } from './request-auth/session-token-binder.js';
+export type { BoundPrincipalClaims } from './request-auth/session-token-binder.js';
+export { resolveRequestPrincipal, principalFromClaims, extractBearerToken, } from './request-auth/request-principal.js';
+export { SHIELD_SESSION_FACTS_ALS, NO_SESSION_FACTS, type SessionFactsStore, } from './request-auth/session-facts-als.js';
 export { GlobalEnforcementGuard } from './enforcement/global-enforcement.guard.js';
 export { stubDecisionAuthority, type Effect, type CoreDecisionAuthority, type CoreDecision, type Principal, } from './enforcement/core-seam.js';
 export { Argon2idPasswordHasher, argon2idHasherProvider, SHIELD_PASSWORD_HASHER, type Argon2idParams, } from './authentication/argon2id-password-hasher.js';
 export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, } from './session/index.js';
+export { MariaDbRecordPermissionRuleAdapter, SHIELD_RECORD_RULE_PORT, type RuleQueryable, } from './authz/mariadb-record-rule-adapter.js';
+export { MariaDbRecordShareAdapter, SHIELD_RECORD_SHARE_PORT, type ShareQueryable, } from './authz/mariadb-record-share-adapter.js';
+export { RecordShareWriter, SHIELD_RECORD_SHARE_WRITER, ShareNotPermittedError, ShareStoreUnavailableError, type ShareInput, type ShareGranteeKind, type ShareTypeInfo, type ShareTypeResolver, type ShareAuditEvent, type ShareAuditSink, } from './authz/record-share-writer.js';
+export { makeShareDeleteCascade, type RecordDeletedHook, type ShareQueryFn, } from './authz/record-share-cascade.js';
+export { MariaDbCrossTenantGrantAdapter, SHIELD_CROSS_TENANT_GRANT_PORT, type GrantQueryable, } from './authz/mariadb-cross-tenant-grant-adapter.js';
+export { CrossTenantGrantWriter, SHIELD_CROSS_TENANT_GRANT_WRITER, GrantNotPermittedError, InvalidGrantError, GrantStoreUnavailableError, type GrantAuthorizeFn, type GrantAuditEvent, type GrantAuditSink, type GrantGranteeKind, type GrantScope, type OfferGrantInput, type AcceptGrantInput, type RevokeGrantInput, } from './authz/cross-tenant-grant-writer.js';
+export { ManifestOperationAuthorityAdapter, SHIELD_OPERATION_AUTHORITY_PORT, type OperationManifestEntry, } from './authz/manifest-operation-authority-adapter.js';
+export { buildRecordAuthorization } from './authz/wire-record-authorization.js';
 export { BootSequence, assertPoolBudget } from './boot/boot-sequence.js';
 export { APP_CONFIG } from './config/config.module.js';
 export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, } from './config/app-config.js';
-export { SHIELD_DB_POOL, SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, } from './auth/tokens.js';
+export { SHIELD_DB_POOL, SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
 export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
 export type { SessionView, SessionTokensView, SessionSuccess, LoginRequest, MfaChallengeResponse, LoginResponse, MfaRequest, MfaResponse, RefreshRequest, RefreshResponse, LogoutRequest, LogoutAck, } from './auth/dto.js';
 export { PersistenceModule } from './auth/persistence.module.js';
 export { AuthModule, type AuthModuleOptions } from './auth/auth.module.js';
+export { makeDefaultTotpVerifier, resolveTotpVerifier, hmacSha1 } from './auth/auth.module.js';
 export type { CredentialResolver, ResolvedCredential, RequiredFactor, } from '@astram/core';
+export type { FactorVerifier, FactorVerdict, Credential } from '@astram/core';
+export type { ProfileResolver, CurrentUserProfile, ProfileRole, ProfileTenant, } from './auth/profile-resolver.js';
+export type { CredentialWriter } from './auth/ports/credential-writer.js';
+export type { ResetTokenStore } from './auth/ports/reset-token-store.js';
+export type { EmailSender, EmailMessage } from './auth/ports/email-sender.js';
+export type { RecoveryCodeStore } from './auth/ports/recovery-code-store.js';
+export type { ProfileWriter } from './auth/ports/profile-writer.js';
+export type { SessionSweeper } from './auth/ports/session-sweeper.js';
+export type { MfaDeviceStore, MfaDevice } from './auth/ports/mfa-device-store.js';
+export type { AuditSink, AuthAuditEvent } from './auth/ports/audit-sink.js';
+export type { SessionFactsProjector } from './auth/ports/session-facts-projector.js';
+export { SHIELD_SESSION_FACTS_PROJECTOR } from './auth/tokens.js';
 export { AuthController } from './auth/auth.controller.js';
 export { PendingMfaStore } from './auth/pending-mfa-store.js';
+export { generateTotpSecret, buildOtpauthUri, generateRecoveryCodes, } from './auth/totp-enrollment.js';
+export { AccountController } from './auth/account.controller.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AAUnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAS3E,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAOtB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAMhD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -16,7 +16,8 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PendingMfaStore = exports.AuthController = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = void 0;
+exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = void 0;
+exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = void 0;
 // The single registration seam.
 var shield_module_js_1 = require("./module/shield.module.js");
 Object.defineProperty(exports, "ShieldModule", { enumerable: true, get: function () { return shield_module_js_1.ShieldModule; } });
@@ -26,6 +27,38 @@ var classification_decorator_js_1 = require("./enforcement/classification.decora
 Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return classification_decorator_js_1.Public; } });
 Object.defineProperty(exports, "Classified", { enumerable: true, get: function () { return classification_decorator_js_1.Classified; } });
 Object.defineProperty(exports, "CLASSIFICATION_METADATA", { enumerable: true, get: function () { return classification_decorator_js_1.CLASSIFICATION_METADATA; } });
+Object.defineProperty(exports, "DEFAULT_CLASSIFIED_ACTION", { enumerable: true, get: function () { return classification_decorator_js_1.DEFAULT_CLASSIFIED_ACTION; } });
+Object.defineProperty(exports, "normalizeClassification", { enumerable: true, get: function () { return classification_decorator_js_1.normalizeClassification; } });
+// Auto-catalog: boot-time route reflection + catalog reconcile (register a @Classified
+// route → its permission auto-appears; route-less permissions orphaned). The consumer
+// supplies the CatalogStore DB impl (ADR-0003 — guard does no DB).
+var operation_inventory_scanner_js_1 = require("./completeness/operation-inventory-scanner.js");
+Object.defineProperty(exports, "OperationInventoryScanner", { enumerable: true, get: function () { return operation_inventory_scanner_js_1.OperationInventoryScanner; } });
+var catalog_reconciler_js_1 = require("./completeness/catalog-reconciler.js");
+Object.defineProperty(exports, "CatalogReconciler", { enumerable: true, get: function () { return catalog_reconciler_js_1.CatalogReconciler; } });
+Object.defineProperty(exports, "CatalogGatabilityError", { enumerable: true, get: function () { return catalog_reconciler_js_1.CatalogGatabilityError; } });
+// The request-auth layer (access token → Principal → decide()). The binder token is
+// exported so advanced consumers can inspect/override it; `SessionTokenBinder` +
+// `resolveRequestPrincipal` are exported for testing + reuse. The guard wires these
+// internally — a consumer does NOT hand-wire request auth.
+var tokens_js_1 = require("./request-auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_TOKEN_BINDER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SESSION_TOKEN_BINDER; } });
+var session_token_binder_js_1 = require("./request-auth/session-token-binder.js");
+Object.defineProperty(exports, "SessionTokenBinder", { enumerable: true, get: function () { return session_token_binder_js_1.SessionTokenBinder; } });
+var request_principal_js_1 = require("./request-auth/request-principal.js");
+Object.defineProperty(exports, "resolveRequestPrincipal", { enumerable: true, get: function () { return request_principal_js_1.resolveRequestPrincipal; } });
+Object.defineProperty(exports, "principalFromClaims", { enumerable: true, get: function () { return request_principal_js_1.principalFromClaims; } });
+Object.defineProperty(exports, "extractBearerToken", { enumerable: true, get: function () { return request_principal_js_1.extractBearerToken; } });
+// The per-request session-facts hot path (ADR-0011): the SINGLE shared
+// `AsyncLocalStorage` the enforcement guard ENTERS around decide() and the consumer's
+// app-owned `SessionFactsReader` READS. The consumer imports THIS exact singleton to
+// build an ALS-backed reader (swapping the null-facts slot in its authz wiring), so
+// both sides share one instance — the guard writes THIS request's cached grants, the
+// reader serves them to gate 5. `SessionFactsStore` is the store shape (mirrors core's
+// SessionFactsReader 1:1); `NO_SESSION_FACTS` is the fail-closed empty store.
+var session_facts_als_js_1 = require("./request-auth/session-facts-als.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_ALS", { enumerable: true, get: function () { return session_facts_als_js_1.SHIELD_SESSION_FACTS_ALS; } });
+Object.defineProperty(exports, "NO_SESSION_FACTS", { enumerable: true, get: function () { return session_facts_als_js_1.NO_SESSION_FACTS; } });
 // The global enforcement guard (framework-owned; exported so the enforcement
 // point is inspectable/testable, not so consumers re-wire it).
 //
@@ -68,6 +101,83 @@ Object.defineProperty(exports, "systemClockProvider", { enumerable: true, get: f
 Object.defineProperty(exports, "SHIELD_TOKEN_GENERATOR", { enumerable: true, get: function () { return index_js_1.SHIELD_TOKEN_GENERATOR; } });
 Object.defineProperty(exports, "SHIELD_REFRESH_HASHER", { enumerable: true, get: function () { return index_js_1.SHIELD_REFRESH_HASHER; } });
 Object.defineProperty(exports, "SHIELD_CLOCK", { enumerable: true, get: function () { return index_js_1.SHIELD_CLOCK; } });
+// The record-permit ADMIN-rule adapter (ADR-0003 / design §5.1): the concrete
+// `RecordPermissionRulePort` over the `record_permission_rule` table. Reads ADMIN
+// rules only; the framework-owned OWNER baseline is core's job (not a row here). An
+// empty table ⇒ owner-only access (core baseline), NOT a lockout. Injected into core's
+// wired decision authority by the consumer's authz wiring.
+var mariadb_record_rule_adapter_js_1 = require("./authz/mariadb-record-rule-adapter.js");
+Object.defineProperty(exports, "MariaDbRecordPermissionRuleAdapter", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_RULE_PORT", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.SHIELD_RECORD_RULE_PORT; } });
+// The per-record SHARE adapter (ADR-0003 / design §6): the concrete `RecordSharePort` over
+// the `record_share` table. Answers `hasShare` (user- OR role-granted shares, exact-or-`*`
+// action). No share ⇒ false; store outage ⇒ AuthorizationUnavailableError. Injected into
+// core's wired decision authority by the consumer's authz wiring.
+var mariadb_record_share_adapter_js_1 = require("./authz/mariadb-record-share-adapter.js");
+Object.defineProperty(exports, "MariaDbRecordShareAdapter", { enumerable: true, get: function () { return mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_SHARE_PORT", { enumerable: true, get: function () { return mariadb_record_share_adapter_js_1.SHIELD_RECORD_SHARE_PORT; } });
+// The WHO-MAY-SHARE write path (design §6.2, the Phase-3 invariant): share CREATION is
+// framework-bounded — only the record's OWNER (fetched tenant-scoped, never trusted from
+// input) may share an `owned`-type record; non-owners + grantees are rejected by
+// construction. Idempotent INSERT, DELETE on unshare, best-effort audit. Exposed as a
+// provider the consumer's share/unshare surface calls. The consumer supplies a
+// `ShareTypeResolver` (over the engine registry) + an optional `ShareAuditSink` — keeping
+// guard decoupled from `@astram/engine`.
+var record_share_writer_js_1 = require("./authz/record-share-writer.js");
+Object.defineProperty(exports, "RecordShareWriter", { enumerable: true, get: function () { return record_share_writer_js_1.RecordShareWriter; } });
+Object.defineProperty(exports, "SHIELD_RECORD_SHARE_WRITER", { enumerable: true, get: function () { return record_share_writer_js_1.SHIELD_RECORD_SHARE_WRITER; } });
+Object.defineProperty(exports, "ShareNotPermittedError", { enumerable: true, get: function () { return record_share_writer_js_1.ShareNotPermittedError; } });
+Object.defineProperty(exports, "ShareStoreUnavailableError", { enumerable: true, get: function () { return record_share_writer_js_1.ShareStoreUnavailableError; } });
+// The delete-cascade (design §6.2 orphan-share cleanup): builds the guard-owned
+// `(typeKey, recordId, tenantId) => Promise<void>` the consumer wires into the engine's
+// OPTIONAL `onRecordDeleted` hook (the engine never imports guard — ADR-0003). Removes a
+// deleted record's `record_share` rows, tenant-scoped.
+var record_share_cascade_js_1 = require("./authz/record-share-cascade.js");
+Object.defineProperty(exports, "makeShareDeleteCascade", { enumerable: true, get: function () { return record_share_cascade_js_1.makeShareDeleteCascade; } });
+// The CROSS-TENANT GRANT adapter (ADR-0009 / Phase 4): the concrete `CrossTenantGrantPort` over
+// the `cross_tenant_grant` table. Answers `findActiveGrant` — the ONE active (accepted, unexpired,
+// unrevoked) consented grant matching (owning tenant, type, grantee user/role, scope+record). No
+// active grant ⇒ null; store outage ⇒ AuthorizationUnavailableError. Injected into core's wired
+// decision authority by the consumer's authz wiring.
+var mariadb_cross_tenant_grant_adapter_js_1 = require("./authz/mariadb-cross-tenant-grant-adapter.js");
+Object.defineProperty(exports, "MariaDbCrossTenantGrantAdapter", { enumerable: true, get: function () { return mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter; } });
+Object.defineProperty(exports, "SHIELD_CROSS_TENANT_GRANT_PORT", { enumerable: true, get: function () { return mariadb_cross_tenant_grant_adapter_js_1.SHIELD_CROSS_TENANT_GRANT_PORT; } });
+// The WHO-MAY-GRANT lifecycle write path (ADR-0009, the Phase-4 invariant): grant offer/accept/
+// revoke is framework-bounded — only an OWNING-tenant admin may OFFER (the grantee's own tenant
+// can NEVER mint a grant), only a GRANTEE-tenant member may ACCEPT, EITHER side may REVOKE. Hard
+// non-wildcard/non-empty action ceiling + mandatory future expiry enforced at offer. Audit on
+// BOTH tenants (both tenant ids in structured fields, no raw uuid in a message). Exposed as a
+// provider the consumer's grant surface calls. The consumer supplies a `GrantAuthorizeFn`
+// (may this principal perform share/accept/revoke in this tenant? — resolved via the app's own
+// `decide()`) + an optional `GrantAuditSink` — keeping guard decoupled from `@astram/engine` +
+// the app.
+var cross_tenant_grant_writer_js_1 = require("./authz/cross-tenant-grant-writer.js");
+Object.defineProperty(exports, "CrossTenantGrantWriter", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.CrossTenantGrantWriter; } });
+Object.defineProperty(exports, "SHIELD_CROSS_TENANT_GRANT_WRITER", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.SHIELD_CROSS_TENANT_GRANT_WRITER; } });
+Object.defineProperty(exports, "GrantNotPermittedError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.GrantNotPermittedError; } });
+Object.defineProperty(exports, "InvalidGrantError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.InvalidGrantError; } });
+Object.defineProperty(exports, "GrantStoreUnavailableError", { enumerable: true, get: function () { return cross_tenant_grant_writer_js_1.GrantStoreUnavailableError; } });
+// The DELEGATION / trusted-operation authority adapter (ADR-0008 / Phase 4): the concrete
+// `OperationAuthorityPort` over a DECLARED operation manifest (no DB — declared metadata). Answers
+// `resolveDelegatedAuthority` — a scoped, non-wildcard authority for a trusted operation's step,
+// or undefined (pass-through, the common case). A malformed / wildcard declared entry is dropped
+// (fail-closed ⇒ undefined). An EMPTY manifest ⇒ every lookup undefined = pass-through. Injected
+// into core's wired decision authority by the consumer's authz wiring.
+var manifest_operation_authority_adapter_js_1 = require("./authz/manifest-operation-authority-adapter.js");
+Object.defineProperty(exports, "ManifestOperationAuthorityAdapter", { enumerable: true, get: function () { return manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter; } });
+Object.defineProperty(exports, "SHIELD_OPERATION_AUTHORITY_PORT", { enumerable: true, get: function () { return manifest_operation_authority_adapter_js_1.SHIELD_OPERATION_AUTHORITY_PORT; } });
+// The framework-owned record-tier WIRING (design §9, Phase 5): constructs the four
+// record-tier adapters over a supplied pool + manifest and returns the fully-wired core
+// DecisionAuthority. `ShieldModule.forRoot({ recordAuthorization })` uses this internally
+// (the preferred path — the app never touches the adapters). Exported so a consumer's
+// TESTS can build the same wired authority directly from the app-owned inputs WITHOUT
+// re-implementing the adapter construction (the app still cannot substitute a record
+// adapter — it supplies only `RecordAuthorizationInputs`, which is re-exported from the
+// ShieldModule seam above). NOTE: this value-imports `@astram/core` + the adapters;
+// `ShieldModule` itself does NOT import it statically (it lazy-loads it) to keep the
+// enforcement-only path core-free.
+var wire_record_authorization_js_1 = require("./authz/wire-record-authorization.js");
+Object.defineProperty(exports, "buildRecordAuthorization", { enumerable: true, get: function () { return wire_record_authorization_js_1.buildRecordAuthorization; } });
 // Boot infrastructure (ADR-0018 connection-pool budget assertion). `BootModule`
 // itself is NOT exported — it is composed internally by `ShieldModule.forRoot()`.
 var boot_sequence_js_1 = require("./boot/boot-sequence.js");
@@ -106,12 +216,28 @@ Object.defineProperty(exports, "DEFAULT_REDIS_URL", { enumerable: true, get: fun
 // ---------------------------------------------------------------------------
 // Shared DI provider tokens (the seams the teams bind/consume — see tokens.ts for
 // who provides/consumes each).
-var tokens_js_1 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_1.SHIELD_DB_POOL; } });
-Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_1.SHIELD_REDIS; } });
-Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_CREDENTIAL_RESOLVER; } });
-Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_1.SHIELD_AUTHENTICATOR; } });
-Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SESSION_AUTHORITY; } });
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_2.SHIELD_DB_POOL; } });
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUTHENTICATOR; } });
+Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_AUTHORITY; } });
+// Account & credential-surface seams (forgot/reset, change-password, MFA
+// enrollment, profile edit) — all OPTIONAL, consumer-plugged through
+// ShieldModule.forRoot. See tokens.ts for who provides/consumes each.
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_WRITER; } });
+Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RESET_TOKEN_STORE; } });
+Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_EMAIL_SENDER; } });
+Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RECOVERY_CODE_STORE; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_WRITER; } });
+Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_SWEEPER; } });
+// The auth-surface audit sink seam (the first auth audit event — recovery login).
+Object.defineProperty(exports, "SHIELD_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUDIT_SINK; } });
+// The multi-device MFA store seam (multiple independent authenticator devices).
+Object.defineProperty(exports, "SHIELD_MFA_DEVICE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_MFA_DEVICE_STORE; } });
+// The login totp-verifier OVERRIDE seam (Phase 2 — plug an OR-matching verifier).
+Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_TOTP_VERIFIER_OVERRIDE; } });
 // The credential-store contract (skeleton — Team A implements the SELECT).
 var mariadb_credential_resolver_js_1 = require("./authentication/mariadb-credential-resolver.js");
 Object.defineProperty(exports, "MariaDbCredentialResolver", { enumerable: true, get: function () { return mariadb_credential_resolver_js_1.MariaDbCredentialResolver; } });
@@ -122,6 +248,19 @@ var persistence_module_js_1 = require("./auth/persistence.module.js");
 Object.defineProperty(exports, "PersistenceModule", { enumerable: true, get: function () { return persistence_module_js_1.PersistenceModule; } });
 var auth_module_js_1 = require("./auth/auth.module.js");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_js_1.AuthModule; } });
+// Phase-2 verifier-seam helpers. `makeDefaultTotpVerifier()` builds the framework's
+// DEFAULT single-secret TOTP FactorVerifier (loading the ESM-only core factory lazily,
+// the CJS↔ESM invariant) so a CONSUMER can WRAP it (e.g. an OR-matching multi-device
+// verifier delegates to it per device secret) WITHOUT importing `@astram/core`
+// directly. `resolveTotpVerifier(override, default)` is the pure `override ?? default`
+// decision the authenticator composition uses (exported for unit testing the seam).
+// `hmacSha1` is the node:crypto HMAC-SHA1 primitive the core TOTP verifier needs.
+var auth_module_js_2 = require("./auth/auth.module.js");
+Object.defineProperty(exports, "makeDefaultTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.makeDefaultTotpVerifier; } });
+Object.defineProperty(exports, "resolveTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.resolveTotpVerifier; } });
+Object.defineProperty(exports, "hmacSha1", { enumerable: true, get: function () { return auth_module_js_2.hmacSha1; } });
+var tokens_js_3 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_3.SHIELD_SESSION_FACTS_PROJECTOR; } });
 // The framework-owned `/auth/*` HTTP controller (Team C) + its pending-MFA store.
 // The controller CONSUMES SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY and the
 // PendingMfaStore. It is EXPORTED so AuthModule (Team B) / the integration owner
@@ -131,3 +270,16 @@ var auth_controller_js_1 = require("./auth/auth.controller.js");
 Object.defineProperty(exports, "AuthController", { enumerable: true, get: function () { return auth_controller_js_1.AuthController; } });
 var pending_mfa_store_js_1 = require("./auth/pending-mfa-store.js");
 Object.defineProperty(exports, "PendingMfaStore", { enumerable: true, get: function () { return pending_mfa_store_js_1.PendingMfaStore; } });
+// The pure TOTP-enrollment helpers (Phase 4 MFA). Re-exported for consumers/tests
+// that need them; the multi-device MFA routes (Phase 3) reuse them to mint a device
+// secret + provisioning URI + recovery codes. (The old in-memory
+// PendingEnrollmentStore is gone — a pending device is now a row in the MfaDeviceStore.)
+var totp_enrollment_js_1 = require("./auth/totp-enrollment.js");
+Object.defineProperty(exports, "generateTotpSecret", { enumerable: true, get: function () { return totp_enrollment_js_1.generateTotpSecret; } });
+Object.defineProperty(exports, "buildOtpauthUri", { enumerable: true, get: function () { return totp_enrollment_js_1.buildOtpauthUri; } });
+Object.defineProperty(exports, "generateRecoveryCodes", { enumerable: true, get: function () { return totp_enrollment_js_1.generateRecoveryCodes; } });
+// The framework-owned `/account/*` self-scoped HTTP controller — the authenticated
+// user acting on THEIR OWN credential/profile (change-password today; MFA/profile
+// later). Registered by AuthModule alongside AuthController under `auth: true`.
+var account_controller_js_1 = require("./auth/account.controller.js");
+Object.defineProperty(exports, "AccountController", { enumerable: true, get: function () { return account_controller_js_1.AccountController; } });

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;AAEH,gCAAgC;AAChC,8DASmC;AARjC,gHAAA,YAAY,OAAA;AACZ,6HAAA,yBAAyB,OAAA;AAS3B,wEAAwE;AACxE,yFAMmD;AALjD,qHAAA,MAAM,OAAA;AACN,yHAAA,UAAU,OAAA;AACV,sIAAA,uBAAuB,OAAA;AACvB,wIAAA,yBAAyB,OAAA;AACzB,sIAAA,uBAAuB,OAAA;AAIzB,uFAAuF;AACvF,sFAAsF;AACtF,mEAAmE;AACnE,gGAA0F;AAAjF,2IAAA,yBAAyB,OAAA;AAClC,8EAAiG;AAAxF,0HAAA,iBAAiB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AAOlD,oFAAoF;AACpF,iFAAiF;AACjF,oFAAoF;AACpF,2DAA2D;AAC3D,sDAAuE;AAA9D,wHAAA,2BAA2B,OAAA;AACpC,kFAA4E;AAAnE,6HAAA,kBAAkB,OAAA;AAE3B,4EAI6C;AAH3C,+HAAA,uBAAuB,OAAA;AACvB,2HAAA,mBAAmB,OAAA;AACnB,0HAAA,kBAAkB,OAAA;AAGpB,uEAAuE;AACvE,sFAAsF;AACtF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,uFAAuF;AACvF,8EAA8E;AAC9E,4EAI6C;AAH3C,gIAAA,wBAAwB,OAAA;AACxB,wHAAA,gBAAgB,OAAA;AAIlB,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,+EAA+E;AAC/E,yFAAmF;AAA1E,qIAAA,sBAAsB,OAAA;AAE/B,6EAA6E;AAC7E,gFAAgF;AAChF,2CAA2C;AAC3C,2DAMoC;AALlC,qHAAA,qBAAqB,OAAA;AAOvB,sEAAsE;AACtE,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,4FAKsD;AAJpD,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AAIxB,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,wDAAwD;AACxD,+CAc4B;AAb1B,qHAAA,yBAAyB,OAAA;AACzB,uHAAA,2BAA2B,OAAA;AAC3B,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,uGAAA,WAAW,OAAA;AACX,wHAAA,4BAA4B,OAAA;AAC5B,iHAAA,qBAAqB,OAAA;AACrB,+GAAA,mBAAmB,OAAA;AACnB,kHAAA,sBAAsB,OAAA;AACtB,iHAAA,qBAAqB,OAAA;AACrB,wGAAA,YAAY,OAAA;AAGd,8EAA8E;AAC9E,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,2DAA2D;AAC3D,yFAIgD;AAH9C,oJAAA,kCAAkC,OAAA;AAClC,yIAAA,uBAAuB,OAAA;AAIzB,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,kEAAkE;AAClE,2FAIiD;AAH/C,4IAAA,yBAAyB,OAAA;AACzB,2IAAA,wBAAwB,OAAA;AAI1B,uFAAuF;AACvF,yFAAyF;AACzF,iFAAiF;AACjF,sFAAsF;AACtF,+EAA+E;AAC/E,0FAA0F;AAC1F,yCAAyC;AACzC,yEAWwC;AAVtC,2HAAA,iBAAiB,OAAA;AACjB,oIAAA,0BAA0B,OAAA;AAC1B,gIAAA,sBAAsB,OAAA;AACtB,oIAAA,0BAA0B,OAAA;AAS5B,gFAAgF;AAChF,wFAAwF;AACxF,yFAAyF;AACzF,uDAAuD;AACvD,2EAIyC;AAHvC,iIAAA,sBAAsB,OAAA;AAKxB,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,gGAAgG;AAChG,qDAAqD;AACrD,uGAIuD;AAHrD,uJAAA,8BAA8B,OAAA;AAC9B,uJAAA,8BAA8B,OAAA;AAIhC,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,8FAA8F;AAC9F,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,WAAW;AACX,qFAc8C;AAb5C,sIAAA,sBAAsB,OAAA;AACtB,gJAAA,gCAAgC,OAAA;AAChC,sIAAA,sBAAsB,OAAA;AACtB,iIAAA,iBAAiB,OAAA;AACjB,0IAAA,0BAA0B,OAAA;AAW5B,0FAA0F;AAC1F,mGAAmG;AACnG,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,uEAAuE;AACvE,2GAIyD;AAHvD,4JAAA,iCAAiC,OAAA;AACjC,0JAAA,+BAA+B,OAAA;AAIjC,mFAAmF;AACnF,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,wFAAwF;AACxF,oFAAoF;AACpF,qFAAqF;AACrF,mCAAmC;AACnC,qFAAgF;AAAvE,wIAAA,wBAAwB,OAAA;AAEjC,gFAAgF;AAChF,kFAAkF;AAClF,4DAAyE;AAAhE,gHAAA,YAAY,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAEvC,8EAA8E;AAC9E,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,iDAAiD;AACjD,8DAAuD;AAA9C,8GAAA,UAAU,OAAA;AACnB,wDAsBgC;AArB9B,8GAAA,aAAa,OAAA;AACb,+GAAA,cAAc,OAAA;AACd,mHAAA,kBAAkB,OAAA;AAClB,oHAAA,mBAAmB,OAAA;AACnB,yHAAA,wBAAwB,OAAA;AAKxB,+EAA+E;AAC/E,yDAAyD;AACzD,6GAAA,YAAY,OAAA;AACZ,gHAAA,eAAe,OAAA;AACf,qHAAA,oBAAoB,OAAA;AACpB,mHAAA,kBAAkB,OAAA;AAClB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AACjB,kHAAA,iBAAiB,OAAA;AAMnB,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,iFAAiF;AACjF,0EAA0E;AAC1E,mEAAmE;AACnE,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAE9E,kFAAkF;AAClF,+BAA+B;AAC/B,8CAsB0B;AArBxB,2GAAA,cAAc,OAAA;AACd,yGAAA,YAAY,OAAA;AACZ,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,qHAAA,wBAAwB,OAAA;AACxB,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,gHAAA,mBAAmB,OAAA;AACnB,uHAAA,0BAA0B,OAAA;AAC1B,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,kFAAkF;AAClF,8GAAA,iBAAiB,OAAA;AACjB,uEAAuE;AACvE,oHAAA,uBAAuB,OAAA;AACvB,kFAAkF;AAClF,0HAAA,6BAA6B,OAAA;AAG/B,2EAA2E;AAC3E,kGAA4F;AAAnF,2IAAA,yBAAyB,OAAA;AAmBlC,yEAAyE;AACzE,gFAAgF;AAChF,YAAY;AACZ,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA;AAC1B,wDAA2E;AAAlE,4GAAA,UAAU,OAAA;AACnB,oFAAoF;AACpF,uFAAuF;AACvF,qFAAqF;AACrF,+EAA+E;AAC/E,uFAAuF;AACvF,oFAAoF;AACpF,kFAAkF;AAClF,wDAA+F;AAAtF,yHAAA,uBAAuB,OAAA;AAAE,qHAAA,mBAAmB,OAAA;AAAE,0GAAA,QAAQ,OAAA;AAmD/D,8CAAkE;AAAzD,2HAAA,8BAA8B,OAAA;AAEvC,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,mFAAmF;AACnF,6EAA6E;AAC7E,gEAA2D;AAAlD,oHAAA,cAAc,OAAA;AACvB,oEAA8D;AAArD,uHAAA,eAAe,OAAA;AACxB,kFAAkF;AAClF,oFAAoF;AACpF,iEAAiE;AACjE,yFAAyF;AACzF,gEAImC;AAHjC,wHAAA,kBAAkB,OAAA;AAClB,qHAAA,eAAe,OAAA;AACf,2HAAA,qBAAqB,OAAA;AAGvB,mFAAmF;AACnF,kFAAkF;AAClF,gFAAgF;AAChF,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA"}

package/dist/module/shield-tokens.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Framework DI tokens that must be importable WITHOUT pulling in `ShieldModule`
+ * itself (which would create import cycles: `ShieldModule` → `EnforcementModule` →
+ * the guard → back to a token declared in `ShieldModule`). Declaring the shared
+ * tokens here lets both `shield.module.ts` and the enforcement guard depend on them
+ * with no cycle. `shield.module.ts` re-exports these for the public barrel.
+ */
+/**
+ * The Core decision authority (`@astram/core`'s `DecisionAuthority`) — the single
+ * ADR-0001 decision entry both the global enforcement guard and the engine's
+ * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
+ * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ */
+export declare const SHIELD_DECISION_AUTHORITY: unique symbol;
+//# sourceMappingURL=shield-tokens.d.ts.map

package/dist/module/shield-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-tokens.d.ts","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC"}

package/dist/module/shield-tokens.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Framework DI tokens that must be importable WITHOUT pulling in `ShieldModule`
+ * itself (which would create import cycles: `ShieldModule` → `EnforcementModule` →
+ * the guard → back to a token declared in `ShieldModule`). Declaring the shared
+ * tokens here lets both `shield.module.ts` and the enforcement guard depend on them
+ * with no cycle. `shield.module.ts` re-exports these for the public barrel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHIELD_DECISION_AUTHORITY = void 0;
+/**
+ * The Core decision authority (`@astram/core`'s `DecisionAuthority`) — the single
+ * ADR-0001 decision entry both the global enforcement guard and the engine's
+ * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
+ * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ */
+exports.SHIELD_DECISION_AUTHORITY = Symbol('SHIELD_DECISION_AUTHORITY');

package/dist/module/shield-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-tokens.js","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH;;;;;GAKG;AACU,QAAA,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC"}

package/dist/module/shield.module.d.ts

@@ -1,15 +1,21 @@
 import { type DynamicModule } from '@nestjs/common';
-import type { CredentialResolver } from '@astram/core';
+import type { CredentialResolver, FactorVerifier } from '@astram/core';
+import type { RecordAuthorizationInputs } from '../authz/wire-record-authorization.js';
+import type { ProfileResolver } from '../auth/profile-resolver.js';
+import type { CredentialWriter } from '../auth/ports/credential-writer.js';
+import type { ResetTokenStore } from '../auth/ports/reset-token-store.js';
+import type { EmailSender } from '../auth/ports/email-sender.js';
+import type { RecoveryCodeStore } from '../auth/ports/recovery-code-store.js';
+import type { ProfileWriter } from '../auth/ports/profile-writer.js';
+import type { SessionSweeper } from '../auth/ports/session-sweeper.js';
+import type { MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+import type { AuditSink } from '../auth/ports/audit-sink.js';
+import type { SessionFactsProjector } from '../auth/ports/session-facts-projector.js';
 import type { CoreDecisionAuthority } from '../enforcement/core-seam.js';
 import { type AppConfig } from '../config/app-config.js';
-/**
- * DI token for the Core decision authority (the ADR-0001 single decision
- * authority) that the enforcement guard consults. The consumer supplies the real
- * `@astram/core` authority through {@link ShieldModule.forRoot}; when omitted the
- * framework binds the fail-closed {@link stubDecisionAuthority} (deny-by-default),
- * so a mis-wiring cannot silently open a door.
- */
-export declare const SHIELD_DECISION_AUTHORITY: unique symbol;
+import { SHIELD_DECISION_AUTHORITY } from './shield-tokens.js';
+export { SHIELD_DECISION_AUTHORITY };
+export type { RecordAuthorizationInputs } from '../authz/wire-record-authorization.js';
 /**
  * Options for {@link ShieldModule.forRoot}. Intentionally minimal (ADR-0023 §7 —
  * no speculative abstraction): the consumer declares Shield through this ONE seam.
@@ -22,6 +28,27 @@ export interface ShieldModuleOptions {
      * the real Core authority — the guard's call site does not change.
      */
     readonly decisionAuthority?: CoreDecisionAuthority;
+    /**
+     * ⛔ FRAMEWORK-OWNED RECORD-TIER WIRING (design §9, Phase 5 — the preferred path).
+     *
+     * Supply the PIECES the framework needs to build the real Core decision authority
+     * ITSELF, instead of a pre-built {@link decisionAuthority}. When present, ShieldModule
+     * INTERNALLY constructs the four record-tier adapters
+     * (`MariaDbRecordPermissionRuleAdapter` / `MariaDbRecordShareAdapter` /
+     * `MariaDbCrossTenantGrantAdapter` / `ManifestOperationAuthorityAdapter`) over the
+     * supplied `pool`/`operationManifest` and calls core's `createWiredDecisionAuthority`
+     * with them + the app-owned `permissionFacts` / `sessionFacts` / `registry`.
+     *
+     * The app supplies ONLY: the DB `pool`, the two app-owned ports (`permissionFacts`,
+     * `sessionFacts`), the module `registry`, and the operation-manifest DATA. It CANNOT
+     * supply — or weaken — the four record-tier read adapters: they are framework-owned and
+     * un-overridable BY CONSTRUCTION (a planted fail-open record adapter is impossible —
+     * the whole point of the "framework-owns-the-data-layer" initiative).
+     *
+     * MUTUALLY EXCLUSIVE with {@link decisionAuthority} — supplying BOTH is a misconfig and
+     * throws at registration. Supplying NEITHER binds the fail-closed stub (unchanged).
+     */
+    readonly recordAuthorization?: RecordAuthorizationInputs;
     /**
      * Application config (port/environment/ADR-0018 pool budget). Omit to load from
      * the environment via {@link loadAppConfig}. Supplied here so a consumer can
@@ -59,6 +86,68 @@ export interface ShieldModuleOptions {
      * (generic 401); throwing = fail-closed transient — exactly the default contract.
      */
     readonly credentialResolver?: CredentialResolver;
+    /**
+     * OPTIONAL current-user profile resolver backing `GET /auth/me`. Omit → `/auth/me`
+     * returns an honest 501 (the framework is agnostic to your ORG schema, so it cannot
+     * name the user/company/roles without your tables). Supply an implementation of the
+     * {@link ProfileResolver} port to return the signed-in user's display profile
+     * (names, never UUIDs). Only consulted when `auth: true`.
+     */
+    readonly profileResolver?: ProfileResolver;
+    /**
+     * OPTIONAL account/credential-surface seams (forgot/reset, change-password, MFA
+     * enrollment, profile edit). Each is threaded straight through to
+     * {@link AuthModule.forRoot} (bound under its token, or `null` when absent → the
+     * route returns 501). Only consulted when `auth: true`. Supply a consumer
+     * implementation of the matching `@astram/guard` port to enable the route.
+     */
+    readonly credentialWriter?: CredentialWriter;
+    readonly resetTokenStore?: ResetTokenStore;
+    readonly emailSender?: EmailSender;
+    readonly recoveryCodeStore?: RecoveryCodeStore;
+    readonly profileWriter?: ProfileWriter;
+    readonly sessionSweeper?: SessionSweeper;
+    /**
+     * OPTIONAL auth-surface audit sink — see {@link AuthModuleOptions.auditSink}.
+     * Threaded straight through to {@link AuthModule.forRoot} (bound under its token, or
+     * `null` when absent → the recovery-login audit no-ops). Only consulted when
+     * `auth: true`.
+     */
+    readonly auditSink?: AuditSink;
+    /**
+     * OPTIONAL multi-device MFA store — see {@link AuthModuleOptions.mfaDeviceStore}.
+     * Threaded straight through to {@link AuthModule.forRoot} (bound under its token,
+     * or `null` when absent → the device routes 501). Only consulted when `auth: true`.
+     */
+    readonly mfaDeviceStore?: MfaDeviceStore;
+    /**
+     * OPTIONAL login `totp` verifier override — see {@link AuthModuleOptions.totpVerifier}.
+     * Threaded straight through to {@link AuthModule.forRoot} (replaces the default
+     * single-secret verifier in the composed authenticator; absent → the default). A
+     * consumer plugs an OR-matching multi-device verifier here. Only consulted when
+     * `auth: true`.
+     */
+    readonly totpVerifier?: FactorVerifier;
+    /**
+     * OPTIONAL root allowlist — the server-side, trusted set of canonical
+     * principal ids (user uuids) that ARE roots. Threaded straight through
+     * to {@link AuthModule.forRoot} → `createIdentityBroker({ internalRootIds })`.
+     * ROOT SAFETY: this is the ONLY way a login mints a root (the
+     * Internal identity adapter keys the trusted signal off THIS list, never off a
+     * claim). Omit → `[]` → default-deny (nobody is a root). Only consulted when
+     * `auth: true`.
+     */
+    readonly rootIds?: readonly string[];
+    /**
+     * OPTIONAL eager session-facts projector (ADR-0011) — see
+     * {@link AuthModuleOptions.sessionFactsProjector}. Threaded straight through to
+     * {@link AuthModule.forRoot} (bound under {@link SHIELD_SESSION_FACTS_PROJECTOR}, or
+     * `null` when absent → the auth controller omits `cachedFacts` and gate 5 DB-reloads
+     * every request, today's behavior). When supplied, login/refresh cache the principal's
+     * coarse grants on the session binding so gate 5 serves them from the request's
+     * `cachedFacts`. Only consulted when `auth: true`.
+     */
+    readonly sessionFactsProjector?: SessionFactsProjector;
 }
 /** Async variant of {@link ShieldModuleOptions} (DI-computed config). */
 export interface ShieldModuleAsyncOptions {
@@ -87,6 +176,61 @@ export interface ShieldModuleAsyncOptions {
      * async-resolved options. Only consulted when `auth: true`.
      */
     readonly credentialResolver?: CredentialResolver;
+    /**
+     * OPTIONAL current-user profile resolver — see {@link ShieldModuleOptions.profileResolver}.
+     * STATIC here (like {@link credentialResolver}): a registration-time collaborator
+     * threaded into the statically-composed {@link AuthModule} import. Only consulted
+     * when `auth: true`.
+     */
+    readonly profileResolver?: ProfileResolver;
+    /**
+     * OPTIONAL account/credential-surface seams — see
+     * {@link ShieldModuleOptions.credentialWriter} et al. STATIC here (like the other
+     * seams): registration-time collaborators threaded into the statically-composed
+     * {@link AuthModule} import, so they cannot depend on the async-resolved options.
+     * Only consulted when `auth: true`.
+     */
+    readonly credentialWriter?: CredentialWriter;
+    readonly resetTokenStore?: ResetTokenStore;
+    readonly emailSender?: EmailSender;
+    readonly recoveryCodeStore?: RecoveryCodeStore;
+    readonly profileWriter?: ProfileWriter;
+    readonly sessionSweeper?: SessionSweeper;
+    /**
+     * OPTIONAL auth-surface audit sink — see {@link ShieldModuleOptions.auditSink}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import. Only consulted when `auth: true`.
+     */
+    readonly auditSink?: AuditSink;
+    /**
+     * OPTIONAL multi-device MFA store — see {@link ShieldModuleOptions.mfaDeviceStore}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import. Only consulted when `auth: true`.
+     */
+    readonly mfaDeviceStore?: MfaDeviceStore;
+    /**
+     * OPTIONAL login `totp` verifier override — see {@link ShieldModuleOptions.totpVerifier}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import. Only consulted when `auth: true`.
+     */
+    readonly totpVerifier?: FactorVerifier;
+    /**
+     * OPTIONAL root allowlist — see {@link ShieldModuleOptions.rootIds}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into
+     * the statically-composed {@link AuthModule} import (it is passed to the broker at
+     * authenticator-composition time, not part of the async factory result). A consumer
+     * that must COMPUTE the list at boot (e.g. read it from a DB) uses `forRootAsync`'s
+     * `useFactory` to build the whole options object — the resolved `rootIds` is
+     * then threaded exactly like the static case. Only consulted when `auth: true`.
+     */
+    readonly rootIds?: readonly string[];
+    /**
+     * OPTIONAL eager session-facts projector — see {@link ShieldModuleOptions.sessionFactsProjector}.
+     * STATIC here (like the other seams): a registration-time collaborator threaded into the
+     * statically-composed {@link AuthModule} import, so it cannot depend on the async-resolved
+     * options. Only consulted when `auth: true`.
+     */
+    readonly sessionFactsProjector?: SessionFactsProjector;
 }
 /**
  * `ShieldModule` — the SINGLE registration seam (ADR-0023 §4).

package/dist/module/shield.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAMnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AASxE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAgDhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAwDtE"}
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAIrC,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAyFvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAiFhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAqFtE"}