@astram/guard 0.2.0 → 0.4.0

package/dist/request-auth/session-token-binder.d.ts

@@ -0,0 +1,130 @@
+/**
+ * SessionTokenBinder — binds an opaque access token to its session's principal
+ * claims, so the request-auth layer can turn a bearer token on a later request
+ * back into a `Principal`.
+ *
+ * WHY THIS EXISTS (the flagged framework gap): the Core session layer mints an
+ * OPAQUE access token and never stores it — the hot session record is keyed by
+ * `sessionId` and carries only `principalId` + `tenantId` (no roles). There is no
+ * access-token → session mapping. Rather than change the frozen Core session
+ * contract (Article 1), this guard-side adapter writes a SEPARATE binding entry at
+ * establish/rotate time and reads it per request. Zero Core changes.
+ *
+ * The binding: `shield:at:<accessToken>` → JSON {@link BoundPrincipalClaims}
+ * ({ id, tenantId, roleIds, kind }), TTL = the access-token lifetime. The token
+ * stays fully opaque (carries no data itself); the mapping is server-side, so the
+ * session is server-REVOCABLE (drop the key) and the read is FAIL-CLOSED (absent or
+ * Redis-unavailable → no principal → the guard denies).
+ *
+ * ⛔ SECURITY: the access token is used only as a Redis key here; it is never logged
+ * and the stored value carries no secret (claims only — ids, not credentials).
+ */
+import type Redis from 'ioredis';
+import type { CoarseGrants } from '@astram/core';
+/** The principal claims carried in the access-token binding (enough to re-mint). */
+export interface BoundPrincipalClaims {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly roleIds: readonly string[];
+    readonly kind: string;
+    /**
+     * Root status, captured from the LOGIN-TIME Principal (the identity broker's
+     * server-side allowlist decided it at login). Carried here so a genuine root
+     * stays root on later requests, and — critically — a normal user can NEVER
+     * become one on the request path (it is read from the binding, never inferred).
+     */
+    readonly isRoot: boolean;
+    /** The bound session id (for server-side revoke correlation). */
+    readonly sessionId: string;
+    /**
+     * The ENFORCED-RE-ENROLL flag (spec §4). `true` when the session was established
+     * via a lower-assurance recovery-code login: the enforcement gate then restricts
+     * the session to the "re-secure" allowlist until a fresh device is confirmed.
+     * A normal (TOTP/password) login binds `false`.
+     *
+     * ⚠ AUTHORITATIVE SOURCE = the SESSION-CLAIMS entry, not the per-access-token
+     * entry. `resolve()` reads this field from the session-claims entry (which it
+     * already fetches for the liveness gate) so that {@link SessionTokenBinder.clearReenroll}
+     * — which can only key by `sessionId` — flips it for EVERY live access token of the
+     * session at once (device-confirm re-secures the whole session, not one token). The
+     * access token itself is never re-minted; only this bound claim changes.
+     */
+    readonly mustReenroll: boolean;
+    /**
+     * OPTIONAL cached coarse grants (ADR-0011 eager-projection hot path). When the auth
+     * surface has a {@link import('../auth/ports/session-facts-projector.js').SessionFactsProjector}
+     * wired, it computes the principal's {@link CoarseGrants} at login/refresh and stores
+     * them HERE, so the enforcement guard can hand them to gate 5 as the request's
+     * `cachedFacts` (serving the coarse decision from cache instead of a DB reload when the
+     * cached version is still fresh).
+     *
+     * ⛔ ABSENT (undefined) is the DEFAULT and the fail-closed state: no projector wired,
+     * a legacy/old binding, or a malformed slot → `resolve()` returns claims WITHOUT this
+     * field → the guard enters the ALS with `cachedFacts: null` → gate 5 DB-reloads (today's
+     * behavior). It is NEVER inferred; only a genuine projection sets it. A missing/malformed
+     * `cachedFacts` slot is treated as absent (see `resolve()`), never fabricated.
+     */
+    readonly cachedFacts?: CoarseGrants;
+}
+export declare class SessionTokenBinder {
+    private readonly redis;
+    constructor(redis: Redis);
+    /**
+     * Bind an access token to its principal claims for `ttlMs` (the access-token
+     * lifetime). Called right after `SessionAuthority.establish` in the auth
+     * controller (it holds both the freshly-minted access token and the Principal).
+     * ALSO writes a session-id → claims entry so a later `rebindOnRotate` can carry the
+     * full claims (roles/kind/root) forward across a token rotation, where the
+     * durable session row alone lacks them.
+     */
+    bind(accessToken: string, claims: BoundPrincipalClaims, ttlMs: number): Promise<void>;
+    /**
+     * On refresh/rotate the controller has the NEW access token + the session, but not
+     * the full Principal (roles/kind/root live only in the binding, not the
+     * durable session row). Re-bind by reading the session-claims entry and writing the
+     * new access-token binding with the SAME claims. Returns true if it carried claims
+     * forward, false if the session-claims entry was gone (then the caller has nothing
+     * to bind — a later request will 401 and the user re-logs in; fail-closed).
+     *
+     * `freshFacts` (ADR-0011 eager projection at REFRESH):
+     *   - `undefined` (omitted, the default) → carry whatever `cachedFacts` the session
+     *     already had FORWARD unchanged (no re-projection). Existing callers that pass no
+     *     facts behave EXACTLY as before.
+     *   - a {@link CoarseGrants} → REPLACE `cachedFacts` with this freshly-projected value
+     *     (a refresh re-reads the current grants so the cache stays warm past the version
+     *     the login projected at).
+     *   - `null` → STRIP `cachedFacts` (a projection that yielded nothing → the next
+     *     request DB-reloads; fail-closed).
+     */
+    rebindOnRotate(newAccessToken: string, sessionId: string, ttlMs: number, freshFacts?: CoarseGrants | null): Promise<boolean>;
+    /**
+     * Resolve an access token to its bound claims, or `null` if the binding is
+     * absent/expired. Fail-closed: any Redis error → `null` (the caller denies), never
+     * a thrown 500 that could be mistaken for allow. The token is opaque; an unknown
+     * token simply has no key.
+     */
+    resolve(accessToken: string): Promise<BoundPrincipalClaims | null>;
+    /**
+     * Clear the ENFORCED-RE-ENROLL flag for a session — the re-secure is complete
+     * (a fresh device was confirmed, spec §4.3). Rewrites the session-claims entry with
+     * `mustReenroll: false`, preserving its remaining TTL, so the LIVE access token's
+     * next {@link SessionTokenBinder.resolve} sees `false` (the token is NOT re-minted;
+     * only the bound claim flips). Keyed by `sessionId` because the caller (the account
+     * controller on device-confirm) has the session id from its own claims, and this must
+     * apply to every outstanding access token of the session at once.
+     *
+     * Best-effort + fail-closed on the LOAD: if the session-claims entry is gone (logged
+     * out) or Redis is unavailable, there is nothing to clear (the session is already
+     * dead / will re-deny) — we simply return. Idempotent.
+     */
+    clearReenroll(sessionId: string): Promise<void>;
+    /** Drop an access-token binding. Idempotent. */
+    unbind(accessToken: string): Promise<void>;
+    /**
+     * Drop the session-claims entry on logout/revoke, so a rotate after logout cannot
+     * re-mint a binding (defense-in-depth: the session is already revoked, but this
+     * removes the claims cushion too). The per-access-token bindings expire by TTL.
+     */
+    unbindSession(sessionId: string): Promise<void>;
+}
+//# sourceMappingURL=session-token-binder.d.ts.map

package/dist/request-auth/session-token-binder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token-binder.d.ts","sourceRoot":"","sources":["../../src/request-auth/session-token-binder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAKjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;CACrC;AA0CD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK;IAEzC;;;;;;;OAOG;IACG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3F;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,YAAY,GAAG,IAAI,GAC/B,OAAO,CAAC,OAAO,CAAC;IAgCnB;;;;;OAKG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA8DxE;;;;;;;;;;;;OAYG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BrD,gDAAgD;IAC1C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOtD"}

package/dist/request-auth/session-token-binder.js

@@ -0,0 +1,277 @@
+"use strict";
+/**
+ * SessionTokenBinder — binds an opaque access token to its session's principal
+ * claims, so the request-auth layer can turn a bearer token on a later request
+ * back into a `Principal`.
+ *
+ * WHY THIS EXISTS (the flagged framework gap): the Core session layer mints an
+ * OPAQUE access token and never stores it — the hot session record is keyed by
+ * `sessionId` and carries only `principalId` + `tenantId` (no roles). There is no
+ * access-token → session mapping. Rather than change the frozen Core session
+ * contract (Article 1), this guard-side adapter writes a SEPARATE binding entry at
+ * establish/rotate time and reads it per request. Zero Core changes.
+ *
+ * The binding: `shield:at:<accessToken>` → JSON {@link BoundPrincipalClaims}
+ * ({ id, tenantId, roleIds, kind }), TTL = the access-token lifetime. The token
+ * stays fully opaque (carries no data itself); the mapping is server-side, so the
+ * session is server-REVOCABLE (drop the key) and the read is FAIL-CLOSED (absent or
+ * Redis-unavailable → no principal → the guard denies).
+ *
+ * ⛔ SECURITY: the access token is used only as a Redis key here; it is never logged
+ * and the stored value carries no secret (claims only — ids, not credentials).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionTokenBinder = void 0;
+/**
+ * Structurally validate a value pulled from the (untrusted) Redis payload as
+ * {@link CoarseGrants}. Returns the parsed facts or `undefined` — a `null`/junk/legacy
+ * slot is treated as ABSENT (fail-closed → the request path DB-reloads), NEVER fabricated.
+ * Mirrors core gate 5's own defensive `asCoarseGrants` probe so a hostile payload can't
+ * sneak a non-string key or a non-number version into the cache.
+ */
+function parseCachedFacts(slot) {
+    if (slot === null || typeof slot !== 'object')
+        return undefined;
+    const c = slot;
+    if (typeof c.permissionsVersion !== 'number')
+        return undefined;
+    if (!Array.isArray(c.grantedPermissionKeys))
+        return undefined;
+    for (const k of c.grantedPermissionKeys)
+        if (typeof k !== 'string')
+            return undefined;
+    return {
+        permissionsVersion: c.permissionsVersion,
+        grantedPermissionKeys: [...c.grantedPermissionKeys],
+    };
+}
+/** Return the claims with any `cachedFacts` slot removed (absent → gate 5 DB-reloads). */
+function stripCachedFacts(claims) {
+    if (!('cachedFacts' in claims))
+        return claims;
+    const { cachedFacts: _drop, ...rest } = claims;
+    return rest;
+}
+/** Redis key prefix for the access-token → claims binding. */
+const AT_KEY_PREFIX = 'shield:at:';
+/** Redis key prefix for the session-id → claims binding (survives token rotation). */
+const SESS_CLAIMS_PREFIX = 'shield:sessclaims:';
+function atKey(accessToken) {
+    return `${AT_KEY_PREFIX}${accessToken}`;
+}
+function sessClaimsKey(sessionId) {
+    return `${SESS_CLAIMS_PREFIX}${sessionId}`;
+}
+class SessionTokenBinder {
+    redis;
+    constructor(redis) {
+        this.redis = redis;
+    }
+    /**
+     * Bind an access token to its principal claims for `ttlMs` (the access-token
+     * lifetime). Called right after `SessionAuthority.establish` in the auth
+     * controller (it holds both the freshly-minted access token and the Principal).
+     * ALSO writes a session-id → claims entry so a later `rebindOnRotate` can carry the
+     * full claims (roles/kind/root) forward across a token rotation, where the
+     * durable session row alone lacks them.
+     */
+    async bind(accessToken, claims, ttlMs) {
+        const payload = JSON.stringify(claims);
+        await this.redis.set(atKey(accessToken), payload, 'PX', ttlMs);
+        // The session-claims entry gets a longer TTL cushion so it survives across
+        // multiple short-lived access tokens within one session's lifetime.
+        await this.redis.set(sessClaimsKey(claims.sessionId), payload, 'PX', Math.max(ttlMs * 4, ttlMs));
+    }
+    /**
+     * On refresh/rotate the controller has the NEW access token + the session, but not
+     * the full Principal (roles/kind/root live only in the binding, not the
+     * durable session row). Re-bind by reading the session-claims entry and writing the
+     * new access-token binding with the SAME claims. Returns true if it carried claims
+     * forward, false if the session-claims entry was gone (then the caller has nothing
+     * to bind — a later request will 401 and the user re-logs in; fail-closed).
+     *
+     * `freshFacts` (ADR-0011 eager projection at REFRESH):
+     *   - `undefined` (omitted, the default) → carry whatever `cachedFacts` the session
+     *     already had FORWARD unchanged (no re-projection). Existing callers that pass no
+     *     facts behave EXACTLY as before.
+     *   - a {@link CoarseGrants} → REPLACE `cachedFacts` with this freshly-projected value
+     *     (a refresh re-reads the current grants so the cache stays warm past the version
+     *     the login projected at).
+     *   - `null` → STRIP `cachedFacts` (a projection that yielded nothing → the next
+     *     request DB-reloads; fail-closed).
+     */
+    async rebindOnRotate(newAccessToken, sessionId, ttlMs, freshFacts) {
+        let raw;
+        try {
+            raw = await this.redis.get(sessClaimsKey(sessionId));
+        }
+        catch {
+            return false;
+        }
+        if (raw === null)
+            return false;
+        // Default: carry the existing payload forward byte-for-byte (facts unchanged).
+        let payload = raw;
+        if (freshFacts !== undefined) {
+            // A refresh-time projection was supplied → rewrite the `cachedFacts` slot on the
+            // carried-forward claims. A parse failure here is treated as "nothing to update"
+            // and we carry the original payload forward (fail-safe: never drop the whole
+            // binding on a transient JSON hiccup — a later request re-projects/DB-reloads).
+            try {
+                const parsed = JSON.parse(raw);
+                const next = freshFacts === null ? stripCachedFacts(parsed) : { ...parsed, cachedFacts: freshFacts };
+                payload = JSON.stringify(next);
+            }
+            catch {
+                payload = raw;
+            }
+        }
+        await this.redis.set(atKey(newAccessToken), payload, 'PX', ttlMs);
+        // Refresh the session-claims TTL cushion too (with the same, possibly-updated payload).
+        await this.redis.set(sessClaimsKey(sessionId), payload, 'PX', Math.max(ttlMs * 4, ttlMs));
+        return true;
+    }
+    /**
+     * Resolve an access token to its bound claims, or `null` if the binding is
+     * absent/expired. Fail-closed: any Redis error → `null` (the caller denies), never
+     * a thrown 500 that could be mistaken for allow. The token is opaque; an unknown
+     * token simply has no key.
+     */
+    async resolve(accessToken) {
+        let raw;
+        try {
+            raw = await this.redis.get(atKey(accessToken));
+        }
+        catch {
+            return null; // Redis unavailable → fail closed.
+        }
+        if (raw === null)
+            return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+        if (typeof parsed?.id !== 'string' ||
+            typeof parsed?.tenantId !== 'string' ||
+            !Array.isArray(parsed?.roleIds) ||
+            typeof parsed?.kind !== 'string' ||
+            typeof parsed?.isRoot !== 'boolean' ||
+            typeof parsed?.sessionId !== 'string' ||
+            typeof parsed?.mustReenroll !== 'boolean') {
+            return null; // malformed → fail closed.
+        }
+        // Normalize the OPTIONAL cached-facts slot (ADR-0011): a malformed/legacy/absent
+        // slot is scrubbed to `undefined` (→ the guard enters the ALS with `cachedFacts:
+        // null` → gate 5 DB-reloads). Present + well-formed → the validated CoarseGrants.
+        // Never fabricated. Rebuild the object so a malformed slot cannot ride through.
+        const cachedFacts = parseCachedFacts(parsed.cachedFacts);
+        parsed = cachedFacts === undefined
+            ? stripCachedFacts(parsed)
+            : { ...parsed, cachedFacts };
+        // SESSION-LIVENESS GATE: the per-token binding alone is not enough — a logout
+        // revokes the session but cannot reach every outstanding access-token key. So we
+        // ALSO require the session-claims entry (which `unbindSession` deletes on logout)
+        // to still exist. Gone → the session was revoked → deny (fail-closed), even if the
+        // token binding lingers until its TTL. This makes logout an IMMEDIATE token kill.
+        let liveness;
+        try {
+            liveness = await this.redis.get(sessClaimsKey(parsed.sessionId));
+        }
+        catch {
+            return null; // Redis unavailable → fail closed.
+        }
+        if (liveness === null)
+            return null; // session revoked (logout) → deny.
+        // MUST-REENROLL is read from the SESSION-CLAIMS entry (the one we just fetched for
+        // liveness), NOT the per-token entry — so `clearReenroll(sessionId)` (which cannot
+        // know each outstanding access token) flips it for the LIVE token on the very next
+        // request. The token stays the same; only this bound claim changes. A malformed or
+        // legacy session-claims entry that lacks the flag is treated as `false` (default
+        // safe: an old binding predating this field must not spuriously lock a session).
+        let mustReenroll = parsed.mustReenroll;
+        try {
+            const sess = JSON.parse(liveness);
+            mustReenroll = sess?.mustReenroll === true;
+        }
+        catch {
+            mustReenroll = false; // unparseable session-claims → treat as not-reenroll.
+        }
+        return mustReenroll === parsed.mustReenroll ? parsed : { ...parsed, mustReenroll };
+    }
+    /**
+     * Clear the ENFORCED-RE-ENROLL flag for a session — the re-secure is complete
+     * (a fresh device was confirmed, spec §4.3). Rewrites the session-claims entry with
+     * `mustReenroll: false`, preserving its remaining TTL, so the LIVE access token's
+     * next {@link SessionTokenBinder.resolve} sees `false` (the token is NOT re-minted;
+     * only the bound claim flips). Keyed by `sessionId` because the caller (the account
+     * controller on device-confirm) has the session id from its own claims, and this must
+     * apply to every outstanding access token of the session at once.
+     *
+     * Best-effort + fail-closed on the LOAD: if the session-claims entry is gone (logged
+     * out) or Redis is unavailable, there is nothing to clear (the session is already
+     * dead / will re-deny) — we simply return. Idempotent.
+     */
+    async clearReenroll(sessionId) {
+        let raw;
+        try {
+            raw = await this.redis.get(sessClaimsKey(sessionId));
+        }
+        catch {
+            return; // Redis unavailable → nothing to do (the gate re-evaluates next request).
+        }
+        if (raw === null)
+            return; // session revoked/expired → nothing to clear.
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return; // malformed → leave as-is (resolve() already fails it closed).
+        }
+        if (parsed.mustReenroll === false)
+            return; // already clear — idempotent no-op.
+        // Preserve the remaining TTL so clearing the flag never extends the session life.
+        let ttlMs;
+        try {
+            ttlMs = await this.redis.pttl(sessClaimsKey(sessionId));
+        }
+        catch {
+            return;
+        }
+        if (ttlMs <= 0)
+            return; // expired/no-expiry between get and pttl → leave it.
+        const updated = { ...parsed, mustReenroll: false };
+        try {
+            await this.redis.set(sessClaimsKey(sessionId), JSON.stringify(updated), 'PX', ttlMs);
+        }
+        catch {
+            // best-effort; a failed clear just means the next re-secure attempt retries.
+        }
+    }
+    /** Drop an access-token binding. Idempotent. */
+    async unbind(accessToken) {
+        try {
+            await this.redis.del(atKey(accessToken));
+        }
+        catch {
+            // best-effort; the TTL expires the key regardless.
+        }
+    }
+    /**
+     * Drop the session-claims entry on logout/revoke, so a rotate after logout cannot
+     * re-mint a binding (defense-in-depth: the session is already revoked, but this
+     * removes the claims cushion too). The per-access-token bindings expire by TTL.
+     */
+    async unbindSession(sessionId) {
+        try {
+            await this.redis.del(sessClaimsKey(sessionId));
+        }
+        catch {
+            // best-effort; TTL cleans up regardless.
+        }
+    }
+}
+exports.SessionTokenBinder = SessionTokenBinder;

package/dist/request-auth/tokens.d.ts

@@ -0,0 +1,14 @@
+/**
+ * DI tokens for the request-auth layer. Declared standalone (no module import) so
+ * the enforcement guard and the auth wiring can both depend on them without cycles.
+ */
+/**
+ * The {@link import('./session-token-binder.js').SessionTokenBinder} — binds an
+ * opaque access token to its principal claims (server-side), so the enforcement
+ * guard can turn a request's bearer token into a `Principal`. Provided only when
+ * `auth: true` (it needs the live Redis client). ABSENT on the enforcement-only
+ * boot — the guard injects it `@Optional()` and denies classified routes when it is
+ * missing (fail-closed).
+ */
+export declare const SHIELD_SESSION_TOKEN_BINDER: unique symbol;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/request-auth/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/request-auth/tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC"}

package/dist/request-auth/tokens.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * DI tokens for the request-auth layer. Declared standalone (no module import) so
+ * the enforcement guard and the auth wiring can both depend on them without cycles.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHIELD_SESSION_TOKEN_BINDER = void 0;
+/**
+ * The {@link import('./session-token-binder.js').SessionTokenBinder} — binds an
+ * opaque access token to its principal claims (server-side), so the enforcement
+ * guard can turn a request's bearer token into a `Principal`. Provided only when
+ * `auth: true` (it needs the live Redis client). ABSENT on the enforcement-only
+ * boot — the guard injects it `@Optional()` and denies classified routes when it is
+ * missing (fail-closed).
+ */
+exports.SHIELD_SESSION_TOKEN_BINDER = Symbol('SHIELD_SESSION_TOKEN_BINDER');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -23,7 +23,7 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.4.0",
-    "@astram/core": "0.1.0"
+    "@astram/core": "1.0.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",