@astram/guard 0.20.2 → 0.21.0

package/dist/authz/operation-marker-check.d.ts

@@ -8,6 +8,12 @@
  * (`decide`) passes the attribute through ONLY when `operationOf(principal)` exists and its
  * `operationKey` and `stepKey` equal the marker's; in every other case it is removed before the
  * inner `decide()`, so the baseline decision stands (Shield #1, #9).
+ *
+ * G-025 (ADR-0048): the same seal for the separation-of-duties facts. Gate 6 reads
+ * `shield.separationOfDuties`; only a facts object the engine built
+ * (`isEngineSeparationOfDutiesFacts`, a module-private WeakSet) passes. Any other value is
+ * removed, so a bound action then fails closed (`separation_of_duties_unverified`) instead of a
+ * forged empty set skipping the rule.
  */
 import type { DecisionAuthority } from '@astram/core';
 export declare function withOperationMarkerCheck(inner: DecisionAuthority): DecisionAuthority;

package/dist/authz/operation-marker-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation-marker-check.d.ts","sourceRoot":"","sources":["../../src/authz/operation-marker-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAKtD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,CAoBpF"}
+{"version":3,"file":"operation-marker-check.d.ts","sourceRoot":"","sources":["../../src/authz/operation-marker-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAMtD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,iBAAiB,CA2BpF"}

package/dist/authz/operation-marker-check.js

@@ -3,22 +3,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.withOperationMarkerCheck = withOperationMarkerCheck;
 const engine_1 = require("@astram/engine");
 const MARKER = 'shield.delegation';
+const SOD_FACTS = 'shield.separationOfDuties';
 function withOperationMarkerCheck(inner) {
     return {
         decide: (principal, action, resource, context) => {
             const attributes = context.attributes;
-            if (attributes === undefined || !(MARKER in attributes)) {
+            if (attributes === undefined || !(MARKER in attributes || SOD_FACTS in attributes)) {
                 return inner.decide(principal, action, resource, context);
             }
-            const raw = attributes[MARKER];
-            const binding = (0, engine_1.operationOf)(principal);
-            const { operationKey, stepKey } = typeof raw === 'object' && raw !== null ? raw : {};
-            const genuine = binding !== undefined &&
-                binding.operationKey === operationKey &&
-                binding.stepKey === stepKey;
-            if (genuine)
-                return inner.decide(principal, action, resource, context);
-            const { [MARKER]: _forged, ...rest } = attributes;
+            // Either key is present (own or inherited): forward an own-property copy, so an inherited
+            // key never reaches core (review R3 #3), and only genuine own values survive.
+            const rest = { ...attributes };
+            if (Object.hasOwn(rest, MARKER)) {
+                const raw = rest[MARKER];
+                const binding = (0, engine_1.operationOf)(principal);
+                const { operationKey, stepKey } = typeof raw === 'object' && raw !== null ? raw : {};
+                const genuine = binding !== undefined &&
+                    binding.operationKey === operationKey &&
+                    binding.stepKey === stepKey;
+                if (!genuine)
+                    delete rest[MARKER];
+            }
+            if (Object.hasOwn(rest, SOD_FACTS) && !(0, engine_1.isEngineSeparationOfDutiesFacts)(rest[SOD_FACTS])) {
+                delete rest[SOD_FACTS];
+            }
             return inner.decide(principal, action, resource, { ...context, attributes: rest });
         },
     };

package/dist/identity/module-registry.bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CAwB9F"}
+{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CA+B9F"}

package/dist/identity/module-registry.bridge.js

@@ -8,7 +8,8 @@ exports.buildIdentityModuleRegistry = buildIdentityModuleRegistry;
  * are its declared vocabulary (`actionsOf` = engine `effectiveActions`, ADR-0038): CRUD plus
  * extras, or exactly the declared list for `crudActions: false`; an invalid declaration throws
  * `RegistrationError` here. Every action is `gated` with the type's `access.plane` — nothing
- * open unless reclassified. `register()` throws on duplicate typeKey/permissionKey.
+ * open unless reclassified. G-025: field descriptors carry `referencesTypeKey` (engine
+ * `referencedTypeOf`) and types carry their separation-of-duties action lists. `register()` throws on duplicate typeKey/permissionKey.
  */
 const core_1 = require("@astram/core");
 const engine_1 = require("@astram/engine");
@@ -25,8 +26,15 @@ function buildIdentityModuleRegistry(inputs) {
         return {
             typeKey: r.typeKey,
             label: r.typeKey,
-            fields: r.fields.map((f) => ({ key: f.key, label: f.key })),
+            fields: r.fields.map((f) => {
+                const ref = (0, engine_1.referencedTypeOf)(f);
+                return { key: f.key, label: f.key, ...(ref ? { referencesTypeKey: ref } : {}) };
+            }),
             ...(Object.keys(access).length > 0 ? { access } : {}),
+            // Separation of duties (G-025): only the action lists reach core.
+            ...(r.separationOfDuties?.length
+                ? { separationOfDuties: r.separationOfDuties.map((d) => ({ actions: [...d.actions] })) }
+                : {}),
         };
     });
     const actions = regs.flatMap((r) => (0, identity_actions_js_1.actionsOf)(r).map((actionKey) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -36,8 +36,8 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.5.4",
-    "@astram/core": "1.11.0",
-    "@astram/engine": "0.13.0"
+    "@astram/core": "1.12.0",
+    "@astram/engine": "0.14.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -45,7 +45,7 @@
     "@nestjs/platform-express": "^11",
     "reflect-metadata": "^0.2",
     "rxjs": "^7",
-    "@astram/messaging": "^0.1.5"
+    "@astram/messaging": "^0.1.6"
   },
   "peerDependenciesMeta": {
     "@astram/messaging": {
@@ -68,7 +68,7 @@
     "typescript": "^5.7.0",
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8",
-    "@astram/messaging": "0.1.5"
+    "@astram/messaging": "0.1.6"
   },
   "repository": {
     "type": "git",