@astram/guard 0.2.0 → 0.4.0

package/dist/authz/wire-record-authorization.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `buildRecordAuthorization` — the ONE place the four framework-owned record-tier
+ * guard adapters are constructed and handed to core's `createWiredDecisionAuthority`
+ * (design §9, Phase 5 — "the framework pre-wires").
+ *
+ * ── WHY THIS FILE EXISTS (the record-tier ownership invariant, ADR-0003 / the
+ *    "framework-owns-the-data-layer" initiative): before Phase 5, the CONSUMER app
+ *    hand-constructed `MariaDbRecordPermissionRuleAdapter` / `MariaDbRecordShareAdapter`
+ *    / `MariaDbCrossTenantGrantAdapter` / `ManifestOperationAuthorityAdapter` and called
+ *    core's `createWiredDecisionAuthority` itself. That meant the app COULD swap in a
+ *    fail-OPEN record adapter — the exact hole the initiative closes. Phase 5 moves that
+ *    construction HERE, inside the framework: the app supplies ONLY the DB pool + the two
+ *    app-owned ports (`permissionFacts`, `sessionFacts`) + the module registry + the
+ *    operation-manifest DATA. The four record-tier read adapters are framework-built and
+ *    UN-overridable — a planted fail-open adapter is now impossible.
+ *
+ * ── WHY IT IS NOT STATICALLY IMPORTED BY shield.module.ts (the enforcement-only
+ *    invariant): this file value-imports `@astram/core` (`createWiredDecisionAuthority`)
+ *    and the adapter classes (which themselves value-import core). `shield.module.ts` is
+ *    deliberately kept core-free in its OWN compiled output (see its header) so the
+ *    enforcement-only path is provably free of a top-level `require('@astram/core')`.
+ *    So `shield.module.ts` reaches `buildRecordAuthorization` ONLY through a LAZY dynamic
+ *    import inside the `SHIELD_DECISION_AUTHORITY` async factory — which runs ONLY when a
+ *    consumer opts into `recordAuthorization`. This file (and thus core) loads only then.
+ */
+import type { DecisionAuthority, ModuleRegistry, PermissionFactsPort, SessionFactsReader } from '@astram/core';
+import { type RuleQueryable } from './mariadb-record-rule-adapter.js';
+import { type OperationManifestEntry } from './manifest-operation-authority-adapter.js';
+/**
+ * The pieces a consumer supplies for the framework to build the real record-tier
+ * DecisionAuthority. The app owns ONLY these — the pool, the two app-owned ports, the
+ * module registry, and the operation-manifest DATA. The four record-tier read adapters
+ * are framework-constructed from `pool` and are DELIBERATELY NOT part of this shape
+ * (they cannot be overridden — the Phase-5 acceptance criterion).
+ */
+export interface RecordAuthorizationInputs {
+    /**
+     * The MariaDB pool the three DB-backed record-tier adapters read through. Typed
+     * structurally (`RuleQueryable`: `{ query(sql, params?) }`) — a `mariadb` `Pool`
+     * satisfies it — so the guard module signature does not force a hard `mariadb` type
+     * on consumers that inject a custom queryable. The framework builds the adapters over
+     * THIS pool; the app never constructs them.
+     */
+    readonly pool: RuleQueryable;
+    /** APP-OWNED port: the principal's coarse grants for the object-type gate (gate 5). */
+    readonly permissionFacts: PermissionFactsPort;
+    /** APP-OWNED port: per-request cached session facts (null-slot until the Redis hot path). */
+    readonly sessionFacts: SessionFactsReader;
+    /** APP-OWNED: the module registry (object types + actions + tiers), bridged from the app's registrations. */
+    readonly registry: ModuleRegistry;
+    /**
+     * APP-SUPPLIED DATA (not an adapter): the declared trusted-operation manifest entries.
+     * The framework constructs the `ManifestOperationAuthorityAdapter` over them. Empty
+     * (default) ⇒ every delegation lookup is pass-through (undefined). The app supplies the
+     * ENTRIES; the framework owns the ADAPTER.
+     */
+    readonly operationManifest?: readonly OperationManifestEntry[];
+}
+/**
+ * Construct the four framework-owned record-tier adapters over the supplied pool +
+ * manifest, and return the fully-wired core {@link DecisionAuthority}. Behavior-identical
+ * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
+ * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
+ */
+export declare function buildRecordAuthorization(inputs: RecordAuthorizationInputs): DecisionAuthority;
+//# sourceMappingURL=wire-record-authorization.d.ts.map

package/dist/authz/wire-record-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,yBAAyB,GAAG,iBAAiB,CAmB7F"}

package/dist/authz/wire-record-authorization.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRecordAuthorization = buildRecordAuthorization;
+const core_1 = require("@astram/core");
+const mariadb_record_rule_adapter_js_1 = require("./mariadb-record-rule-adapter.js");
+const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapter.js");
+const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
+const manifest_operation_authority_adapter_js_1 = require("./manifest-operation-authority-adapter.js");
+/**
+ * Construct the four framework-owned record-tier adapters over the supplied pool +
+ * manifest, and return the fully-wired core {@link DecisionAuthority}. Behavior-identical
+ * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
+ * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
+ */
+function buildRecordAuthorization(inputs) {
+    return (0, core_1.createWiredDecisionAuthority)({
+        registry: inputs.registry,
+        permissionFacts: inputs.permissionFacts,
+        sessionFacts: inputs.sessionFacts,
+        // ── The FOUR framework-owned record-tier adapters — constructed HERE, and ONLY here.
+        // Record-permit ADMIN rules over `shield_authz.record_permission_rule` (widen the
+        // core-owned owner baseline, deny-wins). Empty table ⇒ owner-only (NOT a lockout).
+        recordRule: new mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter(inputs.pool),
+        // Per-record SHARE source over `shield_authz.record_share` (widening permit, union
+        // with baseline under deny-wins). No share ⇒ false (baseline still governs).
+        recordShare: new mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter(inputs.pool),
+        // Cross-tenant consented grants over `shield_authz.cross_tenant_grant`. No active
+        // grant ⇒ null (deny-by-default for the cross-tenant reach).
+        crossTenantGrant: new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool),
+        // Delegation / trusted-operation authority over the DECLARED manifest (no DB).
+        // Empty ⇒ pass-through. The app supplies the entries; the framework owns the adapter.
+        operationAuthority: new manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter(inputs.operationManifest ?? []),
+    });
+}

package/dist/completeness/catalog-reconciler.d.ts

@@ -0,0 +1,21 @@
+import type { OperationInventory, ModuleRegistry } from '@astram/core';
+import type { CatalogStore, ReconcileReport } from './ports/catalog-store.js';
+/** A @Classified route could not be gated (stranded or key-not-registered). Boot must
+ *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
+export declare class CatalogGatabilityError extends Error {
+    constructor(message: string);
+}
+export declare class CatalogReconciler {
+    /**
+     * BOOT — read-only, fail-closed. Throws if any non-public route is stranded (no key)
+     * or unclassified (declares a key the registry doesn't know). No DB, no writes.
+     */
+    verifyGatable(inventory: OperationInventory, registry: ModuleRegistry): void;
+    /**
+     * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
+     * marks orphaned any stored row with no registered action, reactivates revived ones.
+     * Idempotent. Returns a report for logging + /health/catalog.
+     */
+    reconcile(registry: ModuleRegistry, store: CatalogStore, nowIso: string): Promise<ReconcileReport>;
+}
+//# sourceMappingURL=catalog-reconciler.d.ts.map

package/dist/completeness/catalog-reconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-reconciler.d.ts","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E;iFACiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAgB5E;;;;OAIG;IACG,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAoCzG"}

package/dist/completeness/catalog-reconciler.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CatalogReconciler = exports.CatalogGatabilityError = void 0;
+// astram-framework/packages/guard/src/completeness/catalog-reconciler.ts
+const core_1 = require("@astram/core");
+/** A @Classified route could not be gated (stranded or key-not-registered). Boot must
+ *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
+class CatalogGatabilityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CatalogGatabilityError';
+    }
+}
+exports.CatalogGatabilityError = CatalogGatabilityError;
+class CatalogReconciler {
+    /**
+     * BOOT — read-only, fail-closed. Throws if any non-public route is stranded (no key)
+     * or unclassified (declares a key the registry doesn't know). No DB, no writes.
+     */
+    verifyGatable(inventory, registry) {
+        const result = (0, core_1.checkCompleteness)(inventory, registry);
+        if (result.strandedOperations.length > 0 || result.unclassifiedOperations.length > 0) {
+            const stranded = result.strandedOperations.map((o) => o.operationId);
+            const unclassified = result.unclassifiedOperations.map((o) => `${o.operationId}${o.declaredPermissionKey ? ` (${o.declaredPermissionKey})` : ''}`);
+            throw new CatalogGatabilityError(`Shield: ${stranded.length} stranded + ${unclassified.length} unclassified route(s) — cannot boot. ` +
+                `Stranded (no @Classified): ${stranded.join(', ') || 'none'}. ` +
+                `Unclassified (key not registered): ${unclassified.join(', ') || 'none'}. ` +
+                `Classify the route or register the action.`);
+        }
+    }
+    /**
+     * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
+     * marks orphaned any stored row with no registered action, reactivates revived ones.
+     * Idempotent. Returns a report for logging + /health/catalog.
+     */
+    async reconcile(registry, store, nowIso) {
+        const stored = await store.listPermissions();
+        const storedByKey = new Map(stored.map((r) => [r.permissionKey, r]));
+        const registered = registry.listActions().filter((a) => a.tier !== 'public');
+        const registeredKeys = new Set(registered.map((a) => a.permissionKey));
+        // code → catalog: add missing rows; revive orphaned-but-now-registered.
+        const added = [];
+        const reactivated = [];
+        for (const a of registered) {
+            const key = a.permissionKey;
+            const existing = storedByKey.get(key);
+            if (!existing) {
+                const inserted = await store.upsertPermission({
+                    permissionKey: key,
+                    moduleKey: a.moduleKey,
+                    typeKey: a.action.typeKey,
+                    action: a.action.actionKey,
+                    label: `${a.action.actionKey} ${a.action.typeKey}`,
+                    tier: a.tier,
+                });
+                if (inserted)
+                    added.push(key);
+            }
+            else if (existing.status === 'orphaned') {
+                reactivated.push(key);
+            }
+        }
+        if (reactivated.length)
+            await store.markActive(reactivated);
+        // catalog → code: mark orphaned any active stored row with no registered action.
+        const orphaned = stored
+            .filter((r) => r.status === 'active' && !registeredKeys.has(r.permissionKey))
+            .map((r) => r.permissionKey);
+        if (orphaned.length)
+            await store.markOrphaned(orphaned);
+        return { added, orphaned, reactivated, at: nowIso };
+    }
+}
+exports.CatalogReconciler = CatalogReconciler;

package/dist/completeness/operation-inventory-scanner.d.ts

@@ -0,0 +1,17 @@
+import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
+import type { OperationInventory } from '@astram/core';
+/**
+ * Reflects every controller handler at boot and emits an OperationInventory for core's
+ * checkCompleteness. operationId = `${ControllerClass.name}#${method}` (core's contract).
+ * A handler's permissionKey is `${moduleKey}:${typeKey}:${action}` from its @Classified;
+ * @Public handlers carry isPublic:true; an unclassified non-public handler carries no
+ * permissionKey (→ core reports it stranded).
+ */
+export declare class OperationInventoryScanner {
+    private readonly discovery;
+    private readonly scanner;
+    private readonly reflector;
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector);
+    scan(moduleKey: string): OperationInventory;
+}
+//# sourceMappingURL=operation-inventory-scanner.d.ts.map

package/dist/completeness/operation-inventory-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-inventory-scanner.d.ts","sourceRoot":"","sources":["../../src/completeness/operation-inventory-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,KAAK,EAAE,kBAAkB,EAAuB,MAAM,cAAc,CAAC;AAO5E;;;;;;GAMG;AACH,qBACa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS;IAGvC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB;CAyC5C"}

package/dist/completeness/operation-inventory-scanner.js

@@ -0,0 +1,79 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OperationInventoryScanner = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const core_1 = require("@nestjs/core");
+const core_2 = require("@astram/core");
+const classification_decorator_js_1 = require("../enforcement/classification.decorator.js");
+/**
+ * Reflects every controller handler at boot and emits an OperationInventory for core's
+ * checkCompleteness. operationId = `${ControllerClass.name}#${method}` (core's contract).
+ * A handler's permissionKey is `${moduleKey}:${typeKey}:${action}` from its @Classified;
+ * @Public handlers carry isPublic:true; an unclassified non-public handler carries no
+ * permissionKey (→ core reports it stranded).
+ */
+let OperationInventoryScanner = class OperationInventoryScanner {
+    discovery;
+    scanner;
+    reflector;
+    constructor(discovery, scanner, reflector) {
+        this.discovery = discovery;
+        this.scanner = scanner;
+        this.reflector = reflector;
+    }
+    scan(moduleKey) {
+        const operations = [];
+        for (const wrapper of this.discovery.getControllers()) {
+            const { instance, metatype } = wrapper;
+            if (!instance || !metatype)
+                continue;
+            const controllerName = metatype.name;
+            const prototype = Object.getPrototypeOf(instance);
+            for (const method of this.scanner.getAllMethodNames(prototype)) {
+                const handler = prototype[method];
+                // Only real HTTP route handlers carry route metadata (set by @Get/@Post/etc.).
+                // Private/helper methods (e.g. buildQuery()) are emitted by getAllMethodNames but
+                // carry no PATH_METADATA — skipping them prevents core from stranding them and
+                // aborting boot. This matches what the guard actually enforces at runtime, which
+                // only ever runs on mapped handlers via context.getHandler().
+                if (Reflect.getMetadata(constants_1.PATH_METADATA, handler) === undefined)
+                    continue;
+                // Mirror the guard's precedence: method metadata overrides class-level.
+                const isPublic = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.PUBLIC, [
+                    handler,
+                    metatype,
+                ]) === true;
+                const raw = this.reflector.getAllAndOverride(classification_decorator_js_1.CLASSIFICATION_METADATA.CLASSIFIED, [handler, metatype]);
+                const classification = (0, classification_decorator_js_1.normalizeClassification)(raw);
+                // Single-source the key format via core's derivePermissionKey (returns the
+                // branded PermissionKey) rather than a hand-built template string.
+                const permissionKey = !isPublic && classification
+                    ? (0, core_2.derivePermissionKey)(moduleKey, classification.typeKey, classification.action)
+                    : undefined;
+                operations.push({
+                    operationId: `${controllerName}#${method}`,
+                    isPublic,
+                    ...(permissionKey ? { permissionKey } : {}),
+                });
+            }
+        }
+        return { operations };
+    }
+};
+exports.OperationInventoryScanner = OperationInventoryScanner;
+exports.OperationInventoryScanner = OperationInventoryScanner = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.MetadataScanner,
+        core_1.Reflector])
+], OperationInventoryScanner);

package/dist/completeness/ports/catalog-store.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The DB seam for the catalog reconciler. The framework defines the interface only;
+ * the consumer app supplies the implementation (ADR-0003 — guard does no DB). A row is
+ * keyed by its permission key (`moduleKey:typeKey:actionKey`); `status` is the soft
+ * active/orphaned marker (never hard-delete).
+ */
+export interface CatalogPermissionRow {
+    readonly permissionKey: string;
+    readonly moduleKey: string;
+    readonly typeKey: string;
+    readonly action: string;
+    readonly label: string;
+    readonly tier: string;
+    readonly status: 'active' | 'orphaned';
+}
+/** The result of one mutating reconcile pass — surfaced via /health/catalog + logged. */
+export interface ReconcileReport {
+    readonly added: readonly string[];
+    readonly orphaned: readonly string[];
+    readonly reactivated: readonly string[];
+    readonly at: string;
+}
+export interface CatalogStore {
+    /** All catalog rows (both active + orphaned). */
+    listPermissions(): Promise<CatalogPermissionRow[]>;
+    /** Idempotent insert of an ACTIVE row (no-op if the key already exists as active). */
+    upsertPermission(row: Omit<CatalogPermissionRow, 'status'>): Promise<boolean>;
+    /** Mark keys orphaned (soft). No-op for keys already orphaned. */
+    markOrphaned(keys: readonly string[]): Promise<void>;
+    /** Flip keys orphaned → active (a route returned). */
+    markActive(keys: readonly string[]): Promise<void>;
+}
+//# sourceMappingURL=catalog-store.d.ts.map

package/dist/completeness/ports/catalog-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-store.d.ts","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnD,sFAAsF;IACtF,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,sDAAsD;IACtD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/completeness/ports/catalog-store.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/config/app-config.d.ts

@@ -42,7 +42,7 @@ export interface AppConfig {
      */
     readonly redis: RedisConfig;
     /**
-     * The keyed-HMAC secret for the refresh-token hasher (`SHIELD_REFRESH_HMAC_KEY`).
+     * The keyed-HMAC secret for the refresh-token hasher (`REFRESH_HMAC_KEY`).
      * ⛔ REQUIRED FOR AUTH — this is a SECRET (a leaked DB would be offline-brute-
      * forceable without it). {@link loadAppConfig} reads it but does NOT throw when
      * blank, so the ENFORCEMENT-ONLY scaffold (example-backend / a freshly-scaffolded
@@ -146,12 +146,13 @@ export declare const SCHEMA_SVC_POOL_HARD_CAP = 2;
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
- *   workers                       ← SHIELD_POOL_WORKERS
- *   maxConnections                ← SHIELD_DB_MAX_CONNECTIONS
- *   headroom                      ← SHIELD_POOL_HEADROOM
- *   perAccountMax.shield_core     ← SHIELD_POOL_MAX_CORE
- *   perAccountMax.shield_app_crud ← SHIELD_POOL_MAX_APP_CRUD
- *   perAccountMax.shield_schema_svc ← SHIELD_POOL_MAX_SCHEMA_SVC
+ *   workers                       ← POOL_WORKERS
+ *   maxConnections                ← DB_MAX_CONNECTIONS
+ *   headroom                      ← POOL_HEADROOM
+ *   perAccountMax.shield_core     ← POOL_MAX_CORE
+ *   perAccountMax.shield_app_crud ← POOL_MAX_APP_CRUD
+ *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
+ * (Legacy `SHIELD_`-prefixed names are still read as a fallback — see {@link readEnv}.)
  */
 export declare function loadPoolBudget(env?: NodeJS.ProcessEnv): PoolBudgetConfig;
 /** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
@@ -161,9 +162,9 @@ export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
 /**
  * Build the runtime {@link DbConfig} from env with documented defaults.
  * Field ↔ env name:
- *   host     ← SHIELD_DB_HOST      port     ← SHIELD_DB_PORT
- *   user     ← SHIELD_DB_USER      password ← SHIELD_DB_PASSWORD (secret)
- *   database ← SHIELD_DB_NAME
+ *   host     ← DB_HOST      port     ← DB_PORT
+ *   user     ← DB_USER      password ← DB_PASSWORD (secret)
+ *   database ← DB_NAME    (legacy SHIELD_DB_* still read as a fallback)
  * The password defaults to '' when absent — a live connection then fails at
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
@@ -171,9 +172,9 @@ export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
  */
 export declare function loadDbConfig(env?: NodeJS.ProcessEnv): DbConfig;
 /**
- * Build the {@link RedisConfig} from env. Prefers `SHIELD_REDIS_URL`; falls back
- * to composing `redis://host:port` from `SHIELD_REDIS_HOST`/`SHIELD_REDIS_PORT`,
- * else the documented default.
+ * Build the {@link RedisConfig} from env. Prefers `REDIS_URL`; falls back
+ * to composing `redis://host:port` from `REDIS_HOST`/`REDIS_PORT`, else the
+ * documented default. (Legacy `SHIELD_REDIS_*` names still read as a fallback.)
  */
 export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
 /**
@@ -182,9 +183,10 @@ export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
  * core's `resolveLifetimes` job (throws LOUD at composition) — this loader only
  * reads the numbers.
  * Field ↔ env name:
- *   accessTtlMs          ← SHIELD_ACCESS_TTL_MS
- *   refreshIdleMs        ← SHIELD_REFRESH_IDLE_MS
- *   refreshAbsoluteCapMs ← SHIELD_REFRESH_ABSOLUTE_CAP_MS
+ *   accessTtlMs          ← ACCESS_TTL_MS
+ *   refreshIdleMs        ← REFRESH_IDLE_MS
+ *   refreshAbsoluteCapMs ← REFRESH_ABSOLUTE_CAP_MS
+ * (Legacy `SHIELD_`-prefixed names still read as a fallback.)
  */
 export declare function loadSessionLifetimes(env?: NodeJS.ProcessEnv): SessionLifetimeOverrides;
 /**

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoD1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}

package/dist/config/app-config.js

@@ -47,22 +47,23 @@ function parsePositiveInt(raw, fallback) {
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
- *   workers                       ← SHIELD_POOL_WORKERS
- *   maxConnections                ← SHIELD_DB_MAX_CONNECTIONS
- *   headroom                      ← SHIELD_POOL_HEADROOM
- *   perAccountMax.shield_core     ← SHIELD_POOL_MAX_CORE
- *   perAccountMax.shield_app_crud ← SHIELD_POOL_MAX_APP_CRUD
- *   perAccountMax.shield_schema_svc ← SHIELD_POOL_MAX_SCHEMA_SVC
+ *   workers                       ← POOL_WORKERS
+ *   maxConnections                ← DB_MAX_CONNECTIONS
+ *   headroom                      ← POOL_HEADROOM
+ *   perAccountMax.shield_core     ← POOL_MAX_CORE
+ *   perAccountMax.shield_app_crud ← POOL_MAX_APP_CRUD
+ *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
+ * (Legacy `SHIELD_`-prefixed names are still read as a fallback — see {@link readEnv}.)
  */
 function loadPoolBudget(env = process.env) {
     return {
-        workers: parsePositiveInt(env.SHIELD_POOL_WORKERS, exports.DEFAULT_POOL_BUDGET.workers),
-        maxConnections: parsePositiveInt(env.SHIELD_DB_MAX_CONNECTIONS, exports.DEFAULT_POOL_BUDGET.maxConnections),
-        headroom: parsePositiveInt(env.SHIELD_POOL_HEADROOM, exports.DEFAULT_POOL_BUDGET.headroom),
+        workers: parsePositiveInt(readEnv(env, 'POOL_WORKERS'), exports.DEFAULT_POOL_BUDGET.workers),
+        maxConnections: parsePositiveInt(readEnv(env, 'DB_MAX_CONNECTIONS'), exports.DEFAULT_POOL_BUDGET.maxConnections),
+        headroom: parsePositiveInt(readEnv(env, 'POOL_HEADROOM'), exports.DEFAULT_POOL_BUDGET.headroom),
         perAccountMax: {
-            shield_core: parsePositiveInt(env.SHIELD_POOL_MAX_CORE, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_core),
-            shield_app_crud: parsePositiveInt(env.SHIELD_POOL_MAX_APP_CRUD, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_app_crud),
-            shield_schema_svc: parsePositiveInt(env.SHIELD_POOL_MAX_SCHEMA_SVC, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_schema_svc),
+            shield_core: parsePositiveInt(readEnv(env, 'POOL_MAX_CORE'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_core),
+            shield_app_crud: parsePositiveInt(readEnv(env, 'POOL_MAX_APP_CRUD'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_app_crud),
+            shield_schema_svc: parsePositiveInt(readEnv(env, 'POOL_MAX_SCHEMA_SVC'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_schema_svc),
         },
     };
 }
@@ -80,6 +81,36 @@ exports.DEFAULT_DB_CONFIG = {
 };
 /** Documented default Redis url (local docker substrate). */
 exports.DEFAULT_REDIS_URL = 'redis://localhost:6379';
+/**
+ * Read a consumer-facing env var by its CURRENT (unprefixed) name, falling back to
+ * the LEGACY `SHIELD_`-prefixed name for one deprecation window. The framework's
+ * public config vars were debranded from `SHIELD_*` to bare names (e.g.
+ * `SHIELD_DB_HOST` → `DB_HOST`); reading both keeps existing `.env` files (which may
+ * still set `SHIELD_*`) working unchanged. The new name wins when both are set.
+ * A non-blank legacy value emits a one-time deprecation warning (never logs secrets —
+ * only the var NAME). Internal DI-token symbols (`Symbol('SHIELD_...')`) are unrelated
+ * and unchanged.
+ */
+const legacyEnvWarned = new Set();
+function readEnv(env, name) {
+    const current = env[name];
+    if (current !== undefined && current.trim() !== '')
+        return current;
+    const legacyName = `SHIELD_${name}`;
+    const legacy = env[legacyName];
+    if (legacy !== undefined && legacy.trim() !== '') {
+        if (!legacyEnvWarned.has(legacyName)) {
+            legacyEnvWarned.add(legacyName);
+            // eslint-disable-next-line no-console
+            console.warn(`[astram] env var '${legacyName}' is deprecated — rename it to '${name}'. ` +
+                `The SHIELD_ prefix will be removed in a future release.`);
+        }
+        return legacy;
+    }
+    // Return whichever was present-but-blank (so parseString applies its own fallback),
+    // preferring the current name.
+    return current ?? legacy;
+}
 /** Read a string from env with a fallback (trims; blank ⇒ fallback). */
 function parseString(raw, fallback) {
     if (raw === undefined || raw.trim() === '')
@@ -101,9 +132,9 @@ function parseOptionalPositiveInt(raw) {
 /**
  * Build the runtime {@link DbConfig} from env with documented defaults.
  * Field ↔ env name:
- *   host     ← SHIELD_DB_HOST      port     ← SHIELD_DB_PORT
- *   user     ← SHIELD_DB_USER      password ← SHIELD_DB_PASSWORD (secret)
- *   database ← SHIELD_DB_NAME
+ *   host     ← DB_HOST      port     ← DB_PORT
+ *   user     ← DB_USER      password ← DB_PASSWORD (secret)
+ *   database ← DB_NAME    (legacy SHIELD_DB_* still read as a fallback)
  * The password defaults to '' when absent — a live connection then fails at
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
@@ -111,25 +142,25 @@ function parseOptionalPositiveInt(raw) {
  */
 function loadDbConfig(env = process.env) {
     return {
-        host: parseString(env.SHIELD_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
-        port: parsePort(env.SHIELD_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
-        user: parseString(env.SHIELD_DB_USER, exports.DEFAULT_DB_CONFIG.user),
-        password: parseString(env.SHIELD_DB_PASSWORD, ''),
-        database: parseString(env.SHIELD_DB_NAME, exports.DEFAULT_DB_CONFIG.database),
+        host: parseString(readEnv(env, 'DB_HOST'), exports.DEFAULT_DB_CONFIG.host),
+        port: parsePort(readEnv(env, 'DB_PORT'), exports.DEFAULT_DB_CONFIG.port),
+        user: parseString(readEnv(env, 'DB_USER'), exports.DEFAULT_DB_CONFIG.user),
+        password: parseString(readEnv(env, 'DB_PASSWORD'), ''),
+        database: parseString(readEnv(env, 'DB_NAME'), exports.DEFAULT_DB_CONFIG.database),
     };
 }
 /**
- * Build the {@link RedisConfig} from env. Prefers `SHIELD_REDIS_URL`; falls back
- * to composing `redis://host:port` from `SHIELD_REDIS_HOST`/`SHIELD_REDIS_PORT`,
- * else the documented default.
+ * Build the {@link RedisConfig} from env. Prefers `REDIS_URL`; falls back
+ * to composing `redis://host:port` from `REDIS_HOST`/`REDIS_PORT`, else the
+ * documented default. (Legacy `SHIELD_REDIS_*` names still read as a fallback.)
  */
 function loadRedisConfig(env = process.env) {
-    const explicit = env.SHIELD_REDIS_URL;
+    const explicit = readEnv(env, 'REDIS_URL');
     if (explicit !== undefined && explicit.trim() !== '') {
         return { url: explicit.trim() };
     }
-    const host = env.SHIELD_REDIS_HOST;
-    const port = env.SHIELD_REDIS_PORT;
+    const host = readEnv(env, 'REDIS_HOST');
+    const port = readEnv(env, 'REDIS_PORT');
     if ((host !== undefined && host.trim() !== '') || (port !== undefined && port.trim() !== '')) {
         const h = parseString(host, 'localhost');
         const p = parsePort(port, 6379);
@@ -143,15 +174,16 @@ function loadRedisConfig(env = process.env) {
  * core's `resolveLifetimes` job (throws LOUD at composition) — this loader only
  * reads the numbers.
  * Field ↔ env name:
- *   accessTtlMs          ← SHIELD_ACCESS_TTL_MS
- *   refreshIdleMs        ← SHIELD_REFRESH_IDLE_MS
- *   refreshAbsoluteCapMs ← SHIELD_REFRESH_ABSOLUTE_CAP_MS
+ *   accessTtlMs          ← ACCESS_TTL_MS
+ *   refreshIdleMs        ← REFRESH_IDLE_MS
+ *   refreshAbsoluteCapMs ← REFRESH_ABSOLUTE_CAP_MS
+ * (Legacy `SHIELD_`-prefixed names still read as a fallback.)
  */
 function loadSessionLifetimes(env = process.env) {
     const overrides = {};
-    const access = parseOptionalPositiveInt(env.SHIELD_ACCESS_TTL_MS);
-    const idle = parseOptionalPositiveInt(env.SHIELD_REFRESH_IDLE_MS);
-    const cap = parseOptionalPositiveInt(env.SHIELD_REFRESH_ABSOLUTE_CAP_MS);
+    const access = parseOptionalPositiveInt(readEnv(env, 'ACCESS_TTL_MS'));
+    const idle = parseOptionalPositiveInt(readEnv(env, 'REFRESH_IDLE_MS'));
+    const cap = parseOptionalPositiveInt(readEnv(env, 'REFRESH_ABSOLUTE_CAP_MS'));
     if (access !== undefined)
         overrides.accessTtlMs = access;
     if (idle !== undefined)
@@ -167,7 +199,7 @@ function loadSessionLifetimes(env = process.env) {
  * the key's value.
  */
 function loadRefreshHmacKey(env = process.env) {
-    return parseString(env.SHIELD_REFRESH_HMAC_KEY, '');
+    return parseString(readEnv(env, 'REFRESH_HMAC_KEY'), '');
 }
 /**
  * ⛔ FAIL-CLOSED GATE for the refresh-token HMAC key. Called by the auth
@@ -186,9 +218,10 @@ function loadRefreshHmacKey(env = process.env) {
  */
 function assertRefreshHmacKey(key) {
     if (typeof key !== 'string' || key.trim() === '') {
-        throw new Error('Shield auth composition: SHIELD_REFRESH_HMAC_KEY is required and must be ' +
+        throw new Error('Astram auth composition: REFRESH_HMAC_KEY is required and must be ' +
             'non-empty (fail-closed — refusing to compose auth with a blank refresh-token ' +
-            'HMAC key). Set it from your secrets manager; never commit the value.');
+            'HMAC key). Set it from your secrets manager; never commit the value. ' +
+            '(The legacy env var name SHIELD_REFRESH_HMAC_KEY is still accepted.)');
     }
     return key;
 }