@astram/guard 0.20.2 → 0.22.0

package/dist/audit/audit-chain-sealer.d.ts

@@ -16,7 +16,7 @@ export declare const AUDIT_SEAL_STUCK = 200;
 /** The logger surface the sealer uses (Nest `Logger` shape). */
 export type AuditSealerLogger = Pick<LoggerService, 'log' | 'warn' | 'error'>;
 export interface AuditChainSealerOptions {
-    /** `SHIELD_DB_POOL`. Only `getConnection()` is used: every statement runs on the lock's session. */
+    /** `SHIELD_AUDIT_SEALER_POOL` (G-026). Only `getConnection()` is used: every statement runs on the lock's session. */
     readonly pool: Pool;
     /** Resolved framework database names (`FRAMEWORK_SCHEMAS`). */
     readonly schemas: FrameworkSchemas;

package/dist/audit/audit-chain-sealer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-chain-sealer.d.ts","sourceRoot":"","sources":["../../src/audit/audit-chain-sealer.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,EASL,KAAK,KAAK,EACV,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,iDAAiD;AACjD,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,0CAA0C;AAC1C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAOpC,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE9E,MAAM,WAAW,uBAAuB;IACtC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAyDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASxD;AAUD,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAOxF;AAOD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,8FAA8F;IAC9F,OAAO,CAAC,aAAa,CAAqB;IAC1C,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,oDAAoD;IACpD,OAAO,CAAC,cAAc,CAAS;IAC/B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAA6B;gBAE/B,OAAO,EAAE,uBAAuB;IAa5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,OAAO,CAAC,gBAAgB;YAQV,QAAQ;IAwCtB,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAWxB,2FAA2F;YAC7E,eAAe;IAa7B;;;;;OAKG;YACW,cAAc;IA0H5B,wFAAwF;YAC1E,SAAS;IAyDvB,2FAA2F;YAC7E,UAAU;IAmExB,2FAA2F;IAC3F,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,OAAO;CAMhB"}
+{"version":3,"file":"audit-chain-sealer.d.ts","sourceRoot":"","sources":["../../src/audit/audit-chain-sealer.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,EASL,KAAK,KAAK,EACV,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,iDAAiD;AACjD,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,0CAA0C;AAC1C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAOpC,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE9E,MAAM,WAAW,uBAAuB;IACtC,sHAAsH;IACtH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAyDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASxD;AAUD,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAOxF;AAOD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,8FAA8F;IAC9F,OAAO,CAAC,aAAa,CAAqB;IAC1C,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,oDAAoD;IACpD,OAAO,CAAC,cAAc,CAAS;IAC/B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAA6B;gBAE/B,OAAO,EAAE,uBAAuB;IAa5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,OAAO,CAAC,gBAAgB;YAQV,QAAQ;IAwCtB,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAWxB,2FAA2F;YAC7E,eAAe;IAa7B;;;;;OAKG;YACW,cAAc;IA0H5B,wFAAwF;YAC1E,SAAS;IAyDvB,2FAA2F;YAC7E,UAAU;IAmExB,2FAA2F;IAC3F,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,OAAO;CAMhB"}

package/dist/audit/audit-sealer.service.d.ts

@@ -13,8 +13,12 @@
  *   probe repeats every sweep period (1 h) and starts or stops the ticks. Never throws.
  * - Ticks never overlap: the next one is scheduled only after the previous settled. A
  *   rejected tick is logged by error class only and the loop continues.
- * - Shutdown (`onModuleDestroy`, which runs before the pool is ended, and
- *   `onApplicationShutdown`): stops the timers and waits for an in-flight tick. Idempotent.
+ * - Pool (G-026 spec 5.D, 5.E): the service owns its pool, the one-connection
+ *   `SHIELD_AUDIT_SEALER_POOL` (never `SHIELD_DB_POOL`), and ends it in `stop()`.
+ * - Shutdown (`onModuleDestroy`, Nest `close()` step 1, while the HTTP server still serves, and
+ *   `onApplicationShutdown`): stops the timers, waits for the in-flight probe and tick, then ends
+ *   its own pool exactly once (best-effort, never throws). Idempotent: both hooks share one stop.
+ *   `SHIELD_DB_POOL` is closed later by `ConnectionLifecycle` (`onApplicationShutdown`).
  * - Every timer is `unref()`'d: the sealer never keeps a process alive. Nothing here touches
  *   the request path (Shield #12).
  */
@@ -46,11 +50,14 @@ export declare class AuditSealerService implements OnApplicationBootstrap, OnMod
     private probeTimer;
     private inFlightTick;
     private inFlightProbe;
+    private stopping;
     constructor(pool: Pool, schemas: FrameworkSchemas, options?: AuditSealerServiceOptions);
     onApplicationBootstrap(): Promise<void>;
     onModuleDestroy(): Promise<void>;
     onApplicationShutdown(): Promise<void>;
+    /** One stop for both hooks: the pool is ended once, after the last probe and tick settled. */
     private stop;
+    private drainAndEnd;
     /** Probe once (never overlapping, never throwing) and start or stop the ticks. */
     private runProbe;
     private probe;

package/dist/audit/audit-sealer.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-sealer.service.d.ts","sourceRoot":"","sources":["../../src/audit/audit-sealer.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,WAAW,yBAAyB;IACxC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CAChD;AAID,qBACa,kBACX,YAAW,sBAAsB,EAAE,eAAe,EAAE,qBAAqB;IAevE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAd1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,aAAa,CAA4B;gBAG9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,gBAAgB,EAC1C,OAAO,GAAE,yBAA8B;IAenC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI9B,IAAI;IAWlB,kFAAkF;IAClF,OAAO,CAAC,QAAQ;YAwBF,KAAK;IA4BnB,4FAA4F;IAC5F,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,OAAO;CAehB"}
+{"version":3,"file":"audit-sealer.service.d.ts","sourceRoot":"","sources":["../../src/audit/audit-sealer.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,WAAW,yBAAyB;IACxC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CAChD;AAID,qBACa,kBACX,YAAW,sBAAsB,EAAE,eAAe,EAAE,qBAAqB;IAgBvE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAA4B;gBAGzB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,gBAAgB,EAC1C,OAAO,GAAE,yBAA8B;IAenC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5C,8FAA8F;IAC9F,OAAO,CAAC,IAAI;YAKE,WAAW;IAiBzB,kFAAkF;IAClF,OAAO,CAAC,QAAQ;YAwBF,KAAK;IA4BnB,4FAA4F;IAC5F,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,OAAO;CAehB"}

package/dist/audit/audit-sealer.service.js

@@ -25,8 +25,12 @@ exports.AuditSealerService = void 0;
  *   probe repeats every sweep period (1 h) and starts or stops the ticks. Never throws.
  * - Ticks never overlap: the next one is scheduled only after the previous settled. A
  *   rejected tick is logged by error class only and the loop continues.
- * - Shutdown (`onModuleDestroy`, which runs before the pool is ended, and
- *   `onApplicationShutdown`): stops the timers and waits for an in-flight tick. Idempotent.
+ * - Pool (G-026 spec 5.D, 5.E): the service owns its pool, the one-connection
+ *   `SHIELD_AUDIT_SEALER_POOL` (never `SHIELD_DB_POOL`), and ends it in `stop()`.
+ * - Shutdown (`onModuleDestroy`, Nest `close()` step 1, while the HTTP server still serves, and
+ *   `onApplicationShutdown`): stops the timers, waits for the in-flight probe and tick, then ends
+ *   its own pool exactly once (best-effort, never throws). Idempotent: both hooks share one stop.
+ *   `SHIELD_DB_POOL` is closed later by `ConnectionLifecycle` (`onApplicationShutdown`).
  * - Every timer is `unref()`'d: the sealer never keeps a process alive. Nothing here touches
  *   the request path (Shield #12).
  */
@@ -49,6 +53,7 @@ let AuditSealerService = class AuditSealerService {
     probeTimer;
     inFlightTick;
     inFlightProbe;
+    stopping;
     constructor(pool, schemas, options = {}) {
         this.pool = pool;
         this.schemas = schemas;
@@ -79,7 +84,12 @@ let AuditSealerService = class AuditSealerService {
     async onApplicationShutdown() {
         await this.stop();
     }
-    async stop() {
+    /** One stop for both hooks: the pool is ended once, after the last probe and tick settled. */
+    stop() {
+        this.stopping ??= this.drainAndEnd();
+        return this.stopping;
+    }
+    async drainAndEnd() {
         this.stopped = true;
         this.active = false;
         if (this.tickTimer !== undefined)
@@ -88,8 +98,15 @@ let AuditSealerService = class AuditSealerService {
             clearInterval(this.probeTimer);
         this.tickTimer = undefined;
         this.probeTimer = undefined;
+        // Neither rejects (both catch internally); no new probe or tick starts once `stopped` is set.
         await this.inFlightProbe;
         await this.inFlightTick;
+        try {
+            await this.pool.end();
+        }
+        catch {
+            // best-effort — a pool already ending (or a stub without end()) never fails shutdown.
+        }
     }
     /** Probe once (never overlapping, never throwing) and start or stop the ticks. */
     runProbe() {

package/dist/auth/connections.d.ts

@@ -5,10 +5,12 @@
  * credentials, hot state) flows through the two connections created here.
  *
  * WHY a separate helper (not inline in the provider factory): a Nest `useFactory`
- * value provider is NOT itself lifecycle-aware — `onModuleDestroy` only fires on
+ * value provider is NOT itself lifecycle-aware — lifecycle hooks only fire on
  * PROVIDER CLASSES with that method. So the pool/redis are created by the pure
  * factories below, and a tiny {@link ConnectionLifecycle} provider (a class Nest
- * WILL call `onModuleDestroy` on) holds their handles and closes them on shutdown.
+ * WILL call `onApplicationShutdown` on) holds their handles and closes them on
+ * shutdown, after the HTTP server has closed (G-026 spec 5.O). The audit sealer's
+ * own pool ({@link createAuditSealerPool}) is ended by the sealer itself.
  * This keeps `SHIELD_DB_POOL` / `SHIELD_REDIS` as the raw driver objects the
  * adapters expect (`new MariaDbSessionRecordStore(pool)` etc.) while still getting
  * graceful teardown.
@@ -21,11 +23,46 @@
  * ADR-0018: the pool cap is taken from the connection-pool budget
  * (`config.pool.perAccountMax.shield_core`), NOT a duplicate knob.
  */
-import { type OnModuleDestroy } from '@nestjs/common';
-import { type Pool } from 'mariadb';
+import { type OnApplicationShutdown } from '@nestjs/common';
+import { type Pool, type PoolConfig } from 'mariadb';
 import Redis from 'ioredis';
-import { type AppConfig, type DbTlsConfig } from '../config/app-config.js';
+import { type AppConfig, type DbTlsConfig, type PoolTuning } from '../config/app-config.js';
 import { isLoopbackHost } from '../config/loopback-host.js';
+/** The `mariadb` driver pool options {@link mariadbPoolTuningOptions} returns (G-026 spec 5.B). */
+export interface MariadbPoolTuningOptions {
+    /** Idle connections kept (capped at the pool's `connectionLimit` when one is given). */
+    readonly minimumIdle: number;
+    /** Seconds (the driver's unit). */
+    readonly idleTimeout: number;
+    /** Ms; session `max_statement_time`, set once per connection. Omitted when off. */
+    readonly queryTimeout?: number;
+    /** Ms; the driver logs a connection held longer. Omitted when off. */
+    readonly leakDetectionTimeout?: number;
+}
+export interface MariadbPoolTuningOptionsOpts {
+    /** The pool's cap: `minimumIdle` is capped at it (the driver applies the same `Math.min`). */
+    readonly connectionLimit?: number;
+    /** Default true. `false` omits `queryTimeout` (the audit sealer pool, spec 5.D). */
+    readonly queryTimeout?: boolean;
+}
+/**
+ * Map {@link PoolTuning} to `mariadb` pool options (G-026 spec 5.B). Every framework pool spreads
+ * it (guard core, the audit sealer, identity's engine and authz pools), the same way they spread
+ * {@link mariadbSslOption}. Options that are off are omitted, so the driver default stays.
+ *
+ * Never sets `resetAfterUse`: a reset on release would drop the session `max_statement_time`
+ * the query timeout relies on (the driver default is off, and the framework sets it nowhere).
+ */
+export declare function mariadbPoolTuningOptions(tuning: PoolTuning, opts?: MariadbPoolTuningOptionsOpts): MariadbPoolTuningOptions;
+/**
+ * Run one fixed framework statement with no statement time limit (G-026 spec 5.L): returns
+ * `SET STATEMENT max_statement_time=0 FOR <sql>`, so `APP_DB_QUERY_TIMEOUT_MS` never cuts a
+ * framework `GET_LOCK` wait (each keeps its own lock timeout).
+ *
+ * ⛔ For fixed framework SQL literals only, never for SQL built from input. Values still travel
+ * as `?` parameters of the wrapped statement.
+ */
+export declare function withoutStatementTimeout(sql: string): string;
 /**
  * Create the ONE live `mariadb` {@link Pool} for the `shield_core` account from
  * {@link AppConfig}. The `connectionLimit` comes from the ADR-0018 budget
@@ -36,8 +73,24 @@ import { isLoopbackHost } from '../config/loopback-host.js';
  * a wrong/blank password fails LOUD at connect time, which is the correct place
  * for a runtime credential error. The host/port/user/database always have
  * documented defaults, so the descriptor is always well-formed.
+ *
+ * G-026 (spec 5.C): idle and timeout settings from `config.poolTuning`
+ * ({@link mariadbPoolTuningOptions}).
  */
 export declare function createDbPool(config: AppConfig): Pool;
+/** The options {@link createDbPool} passes to `mariadb.createPool` (exported for tests). */
+export declare function dbPoolOptions(config: AppConfig): PoolConfig;
+/**
+ * The audit sealer's own pool (G-026 spec 5.D): same account, database, TLS and idle settings as
+ * {@link createDbPool}, capped at one connection (the sealer holds one per tick). A sealer that
+ * borrowed from the core pool every interval would keep the core pool's FIFO idle queue from ever
+ * reaching the idle timeout. No `queryTimeout`: `APP_DB_QUERY_TIMEOUT_MS` never cuts a sealer
+ * statement (Shield #6). Leak detection applies (it only logs). Internal: provided under
+ * `SHIELD_AUDIT_SEALER_POOL` and ended by `AuditSealerService.stop()`.
+ */
+export declare function createAuditSealerPool(config: AppConfig): Pool;
+/** The options {@link createAuditSealerPool} passes to `mariadb.createPool` (exported for tests). */
+export declare function auditSealerPoolOptions(config: AppConfig): PoolConfig;
 export { isLoopbackHost };
 /**
  * The boot warning for a production pool to a remote MariaDB without TLS (Phase 16), or
@@ -66,14 +119,19 @@ export declare function createRedisClient(config: AppConfig): Redis;
 /**
  * Lifecycle-aware holder that owns the pool + redis handles and closes them on
  * app shutdown. Provided ALONGSIDE the two raw-connection providers so Nest calls
- * `onModuleDestroy` here (value providers get no lifecycle callback). The teardown
+ * `onApplicationShutdown` here (value providers get no lifecycle callback). The teardown
  * is best-effort + idempotent: a close error is swallowed so shutdown never hangs
  * or throws, and both connections are always attempted.
+ *
+ * G-026 spec 5.O: the close runs in `onApplicationShutdown` (Nest `close()` step 4), after every
+ * `onModuleDestroy` and after the HTTP server closed and its in-flight requests finished, so a
+ * request still being served while the jobs drain (step 1) never meets a closed pool or Redis.
+ * Nothing happens in `onModuleDestroy`.
  */
-export declare class ConnectionLifecycle implements OnModuleDestroy {
+export declare class ConnectionLifecycle implements OnApplicationShutdown {
     private readonly pool;
     private readonly redis;
     constructor(pool: Pool, redis: Redis);
-    onModuleDestroy(): Promise<void>;
+    onApplicationShutdown(): Promise<void>;
 }
 //# sourceMappingURL=connections.d.ts.map

package/dist/auth/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/auth/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiBpD;AAMD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CASpB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,GAAG,SAAS,GAC3B;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,CAgB1D;AAED;;;;;;GAMG;AACH,qBACa,mBAAoB,YAAW,eAAe;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK;IAGzB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;CAavC"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/auth/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAsB,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAgB,EAAE,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,mGAAmG;AACnG,MAAM,WAAW,wBAAwB;IACvC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,4BAAiC,GACtC,wBAAwB,CAgB1B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAIpD;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAO3D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAE7D;AAED,qGAAqG;AACrG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAOpE;AAMD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CASpB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,GAAG,SAAS,GAC3B;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,CAgB1D;AAED;;;;;;;;;;;GAWG;AACH,qBACa,mBAAoB,YAAW,qBAAqB;IAE7D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK;IAGzB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7C"}

package/dist/auth/connections.js

@@ -6,10 +6,12 @@
  * credentials, hot state) flows through the two connections created here.
  *
  * WHY a separate helper (not inline in the provider factory): a Nest `useFactory`
- * value provider is NOT itself lifecycle-aware — `onModuleDestroy` only fires on
+ * value provider is NOT itself lifecycle-aware — lifecycle hooks only fire on
  * PROVIDER CLASSES with that method. So the pool/redis are created by the pure
  * factories below, and a tiny {@link ConnectionLifecycle} provider (a class Nest
- * WILL call `onModuleDestroy` on) holds their handles and closes them on shutdown.
+ * WILL call `onApplicationShutdown` on) holds their handles and closes them on
+ * shutdown, after the HTTP server has closed (G-026 spec 5.O). The audit sealer's
+ * own pool ({@link createAuditSealerPool}) is ended by the sealer itself.
  * This keeps `SHIELD_DB_POOL` / `SHIELD_REDIS` as the raw driver objects the
  * adapters expect (`new MariaDbSessionRecordStore(pool)` etc.) while still getting
  * graceful teardown.
@@ -36,7 +38,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConnectionLifecycle = exports.isLoopbackHost = void 0;
+exports.mariadbPoolTuningOptions = mariadbPoolTuningOptions;
+exports.withoutStatementTimeout = withoutStatementTimeout;
 exports.createDbPool = createDbPool;
+exports.dbPoolOptions = dbPoolOptions;
+exports.createAuditSealerPool = createAuditSealerPool;
+exports.auditSealerPoolOptions = auditSealerPoolOptions;
 exports.dbTlsBootWarning = dbTlsBootWarning;
 exports.mariadbSslOption = mariadbSslOption;
 exports.createRedisClient = createRedisClient;
@@ -47,6 +54,57 @@ const ioredis_1 = __importDefault(require("ioredis"));
 const app_config_js_1 = require("../config/app-config.js");
 const loopback_host_js_1 = require("../config/loopback-host.js");
 Object.defineProperty(exports, "isLoopbackHost", { enumerable: true, get: function () { return loopback_host_js_1.isLoopbackHost; } });
+/**
+ * Map {@link PoolTuning} to `mariadb` pool options (G-026 spec 5.B). Every framework pool spreads
+ * it (guard core, the audit sealer, identity's engine and authz pools), the same way they spread
+ * {@link mariadbSslOption}. Options that are off are omitted, so the driver default stays.
+ *
+ * Never sets `resetAfterUse`: a reset on release would drop the session `max_statement_time`
+ * the query timeout relies on (the driver default is off, and the framework sets it nowhere).
+ */
+function mariadbPoolTuningOptions(tuning, opts = {}) {
+    const minimumIdle = opts.connectionLimit === undefined
+        ? tuning.minimumIdle
+        : Math.min(tuning.minimumIdle, opts.connectionLimit);
+    const withQueryTimeout = opts.queryTimeout !== false;
+    return {
+        minimumIdle,
+        idleTimeout: tuning.idleTimeoutS,
+        ...(withQueryTimeout && tuning.queryTimeoutMs !== undefined
+            ? { queryTimeout: tuning.queryTimeoutMs }
+            : {}),
+        ...(tuning.leakDetectionMs !== undefined
+            ? { leakDetectionTimeout: tuning.leakDetectionMs }
+            : {}),
+    };
+}
+/**
+ * Run one fixed framework statement with no statement time limit (G-026 spec 5.L): returns
+ * `SET STATEMENT max_statement_time=0 FOR <sql>`, so `APP_DB_QUERY_TIMEOUT_MS` never cuts a
+ * framework `GET_LOCK` wait (each keeps its own lock timeout).
+ *
+ * ⛔ For fixed framework SQL literals only, never for SQL built from input. Values still travel
+ * as `?` parameters of the wrapped statement.
+ */
+function withoutStatementTimeout(sql) {
+    return `SET STATEMENT max_statement_time=0 FOR ${sql}`;
+}
+/** The account, database, connect and TLS options every guard pool shares. */
+function basePoolOptions(config) {
+    const { db } = config;
+    return {
+        host: db.host,
+        port: db.port,
+        user: db.user,
+        password: db.password,
+        database: db.database,
+        // Fail fast on an unreachable DB rather than hanging the boot indefinitely.
+        connectTimeout: 10_000,
+        // All platform timestamps are UTC (parity with the session adapters).
+        timezone: 'Z',
+        ...withSsl(mariadbSslOption(db.tls)),
+    };
+}
 /**
  * Create the ONE live `mariadb` {@link Pool} for the `shield_core` account from
  * {@link AppConfig}. The `connectionLimit` comes from the ADR-0018 budget
@@ -57,25 +115,44 @@ Object.defineProperty(exports, "isLoopbackHost", { enumerable: true, get: functi
  * a wrong/blank password fails LOUD at connect time, which is the correct place
  * for a runtime credential error. The host/port/user/database always have
  * documented defaults, so the descriptor is always well-formed.
+ *
+ * G-026 (spec 5.C): idle and timeout settings from `config.poolTuning`
+ * ({@link mariadbPoolTuningOptions}).
  */
 function createDbPool(config) {
-    const { db, pool } = config;
     const tlsWarning = dbTlsBootWarning(config);
     if (tlsWarning !== undefined)
         dbBootLogger.warn(tlsWarning);
-    return mariadb_1.default.createPool({
-        host: db.host,
-        port: db.port,
-        user: db.user,
-        password: db.password,
-        database: db.database,
-        connectionLimit: pool.perAccountMax.shield_core,
-        // Fail fast on an unreachable DB rather than hanging the boot indefinitely.
-        connectTimeout: 10_000,
-        // All platform timestamps are UTC (parity with the session adapters).
-        timezone: 'Z',
-        ...withSsl(mariadbSslOption(db.tls)),
-    });
+    return mariadb_1.default.createPool(dbPoolOptions(config));
+}
+/** The options {@link createDbPool} passes to `mariadb.createPool` (exported for tests). */
+function dbPoolOptions(config) {
+    const connectionLimit = config.pool.perAccountMax.shield_core;
+    return {
+        ...basePoolOptions(config),
+        connectionLimit,
+        ...mariadbPoolTuningOptions((0, app_config_js_1.poolTuningOf)(config), { connectionLimit }),
+    };
+}
+/**
+ * The audit sealer's own pool (G-026 spec 5.D): same account, database, TLS and idle settings as
+ * {@link createDbPool}, capped at one connection (the sealer holds one per tick). A sealer that
+ * borrowed from the core pool every interval would keep the core pool's FIFO idle queue from ever
+ * reaching the idle timeout. No `queryTimeout`: `APP_DB_QUERY_TIMEOUT_MS` never cuts a sealer
+ * statement (Shield #6). Leak detection applies (it only logs). Internal: provided under
+ * `SHIELD_AUDIT_SEALER_POOL` and ended by `AuditSealerService.stop()`.
+ */
+function createAuditSealerPool(config) {
+    return mariadb_1.default.createPool(auditSealerPoolOptions(config));
+}
+/** The options {@link createAuditSealerPool} passes to `mariadb.createPool` (exported for tests). */
+function auditSealerPoolOptions(config) {
+    const connectionLimit = app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS;
+    return {
+        ...basePoolOptions(config),
+        connectionLimit,
+        ...mariadbPoolTuningOptions((0, app_config_js_1.poolTuningOf)(config), { connectionLimit, queryTimeout: false }),
+    };
 }
 const dbBootLogger = new common_1.Logger('ShieldAuth');
 /**
@@ -138,9 +215,14 @@ function createRedisClient(config) {
 /**
  * Lifecycle-aware holder that owns the pool + redis handles and closes them on
  * app shutdown. Provided ALONGSIDE the two raw-connection providers so Nest calls
- * `onModuleDestroy` here (value providers get no lifecycle callback). The teardown
+ * `onApplicationShutdown` here (value providers get no lifecycle callback). The teardown
  * is best-effort + idempotent: a close error is swallowed so shutdown never hangs
  * or throws, and both connections are always attempted.
+ *
+ * G-026 spec 5.O: the close runs in `onApplicationShutdown` (Nest `close()` step 4), after every
+ * `onModuleDestroy` and after the HTTP server closed and its in-flight requests finished, so a
+ * request still being served while the jobs drain (step 1) never meets a closed pool or Redis.
+ * Nothing happens in `onModuleDestroy`.
  */
 let ConnectionLifecycle = class ConnectionLifecycle {
     pool;
@@ -149,7 +231,7 @@ let ConnectionLifecycle = class ConnectionLifecycle {
         this.pool = pool;
         this.redis = redis;
     }
-    async onModuleDestroy() {
+    async onApplicationShutdown() {
         // Close both; never let one failure prevent the other, never throw.
         try {
             await this.pool.end();

package/dist/auth/persistence.module.d.ts

@@ -8,10 +8,15 @@
  * ─────────────────────────────────────────────────────────────────────────────
  * Team B (connection + composition) OWNS this file. The two factories create the
  * real driver objects; the {@link ConnectionLifecycle} provider (a class Nest
- * invokes `onModuleDestroy` on) closes them on shutdown — a value provider is not
- * itself lifecycle-aware, so the teardown lives in that holder (see
- * `connections.ts`). Both connections are exported so AuthModule can inject the
- * pool (credential resolver + session record store) and the redis (hot store).
+ * invokes `onApplicationShutdown` on, after the HTTP server has closed; G-026 spec 5.O)
+ * closes them on shutdown — a value provider is not itself lifecycle-aware, so the
+ * teardown lives in that holder (see `connections.ts`). Both connections are exported
+ * so AuthModule can inject the pool (credential resolver + session record store) and
+ * the redis (hot store).
+ *
+ *   SHIELD_AUDIT_SEALER_POOL — {@link createAuditSealerPool}: the audit sealer's own
+ *     one-connection pool (G-026 spec 5.D), NOT exported; only the sealer injects it and
+ *     its `stop()` ends it.
  *
  *   SHIELD_DB_POOL  — {@link createDbPool}: `mariadb.createPool` for the
  *     `shield_core` account from `config.db`, `connectionLimit` from the ADR-0018
@@ -33,8 +38,8 @@
 import { type DynamicModule } from '@nestjs/common';
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
- * Opt-in: only imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder, the audit sealer and its
+ * own pool (not exported). Opt-in: only imported when auth is wired.
  */
 export declare class PersistenceModule {
     static forRoot(): DynamicModule;

package/dist/auth/persistence.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA2D3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAOhC"}
+{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA6E3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAahC"}

package/dist/auth/persistence.module.js

@@ -9,10 +9,15 @@
  * ─────────────────────────────────────────────────────────────────────────────
  * Team B (connection + composition) OWNS this file. The two factories create the
  * real driver objects; the {@link ConnectionLifecycle} provider (a class Nest
- * invokes `onModuleDestroy` on) closes them on shutdown — a value provider is not
- * itself lifecycle-aware, so the teardown lives in that holder (see
- * `connections.ts`). Both connections are exported so AuthModule can inject the
- * pool (credential resolver + session record store) and the redis (hot store).
+ * invokes `onApplicationShutdown` on, after the HTTP server has closed; G-026 spec 5.O)
+ * closes them on shutdown — a value provider is not itself lifecycle-aware, so the
+ * teardown lives in that holder (see `connections.ts`). Both connections are exported
+ * so AuthModule can inject the pool (credential resolver + session record store) and
+ * the redis (hot store).
+ *
+ *   SHIELD_AUDIT_SEALER_POOL — {@link createAuditSealerPool}: the audit sealer's own
+ *     one-connection pool (G-026 spec 5.D), NOT exported; only the sealer injects it and
+ *     its `stop()` ends it.
  *
  *   SHIELD_DB_POOL  — {@link createDbPool}: `mariadb.createPool` for the
  *     `shield_core` account from `config.db`, `connectionLimit` from the ADR-0018
@@ -69,37 +74,55 @@ const redisProvider = {
 };
 /**
  * The lifecycle holder — injects the two connections and closes them on shutdown
- * (`onModuleDestroy`). A value-provider connection gets no lifecycle callback, so
- * this class is where graceful teardown happens.
+ * (`onApplicationShutdown`, after the HTTP server has closed; G-026 spec 5.O). A
+ * value-provider connection gets no lifecycle callback, so this class is where
+ * graceful teardown happens.
  */
 const lifecycleProvider = {
     provide: connections_js_1.ConnectionLifecycle,
     useFactory: (pool, redis) => new connections_js_1.ConnectionLifecycle(pool, redis),
     inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
 };
+/**
+ * The audit sealer's own pool (G-026 spec 5.D): one connection, no query timeout. Registered
+ * beside the sealer, so it exists exactly when the sealer does (this module, `auth: true`).
+ * Not exported. Ended by the sealer's `stop()` after its last tick settled.
+ */
+const auditSealerPoolProvider = {
+    provide: tokens_js_1.SHIELD_AUDIT_SEALER_POOL,
+    useFactory: (config) => (0, connections_js_1.createAuditSealerPool)(config),
+    inject: [config_module_js_1.APP_CONFIG],
+};
 /**
  * The deferred audit sealer (audit-chain-store SPEC §5.H): registered here so it exists
  * exactly when {@link SHIELD_DB_POOL} does. `AUDIT_SEAL_*` is read now, so an invalid value
  * fails the boot (SPEC §13). It ticks only once its table probe finds `audit_log` and
- * `audit_chain`; a stub or unreachable pool leaves it idle (never a boot failure).
+ * `audit_chain`; a stub or unreachable pool leaves it idle (never a boot failure). It runs on
+ * its own pool ({@link SHIELD_AUDIT_SEALER_POOL}), never on {@link SHIELD_DB_POOL} (G-026).
  */
 const auditSealerProvider = {
     provide: audit_sealer_service_js_1.AuditSealerService,
     useFactory: (pool, config) => new audit_sealer_service_js_1.AuditSealerService(pool, (0, app_config_js_1.frameworkSchemasOf)(config), {
         config: (0, audit_seal_config_js_1.loadAuditSealConfig)(process.env),
     }),
-    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+    inject: [tokens_js_1.SHIELD_AUDIT_SEALER_POOL, config_module_js_1.APP_CONFIG],
 };
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
- * Opt-in: only imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder, the audit sealer and its
+ * own pool (not exported). Opt-in: only imported when auth is wired.
  */
 let PersistenceModule = PersistenceModule_1 = class PersistenceModule {
     static forRoot() {
         return {
             module: PersistenceModule_1,
-            providers: [dbPoolProvider, redisProvider, lifecycleProvider, auditSealerProvider],
+            providers: [
+                dbPoolProvider,
+                redisProvider,
+                lifecycleProvider,
+                auditSealerPoolProvider,
+                auditSealerProvider,
+            ],
             exports: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
         };
     }

package/dist/auth/tokens.d.ts

@@ -30,6 +30,12 @@ export { SHIELD_PASSWORD_HASHER } from '../authentication/argon2id-password-hash
  * {@link SHIELD_SESSION_RECORD_STORE} factory. Disposed on app shutdown.
  */
 export declare const SHIELD_DB_POOL: unique symbol;
+/**
+ * Internal (G-026 spec 5.D): the audit sealer's own one-connection `mariadb` `Pool`, same account
+ * and database as {@link SHIELD_DB_POOL}, no query timeout. Provided by `PersistenceModule` (not
+ * exported from it); only `AuditSealerService` injects it, and its `stop()` ends it.
+ */
+export declare const SHIELD_AUDIT_SEALER_POOL: unique symbol;
 /**
  * The ONE live `ioredis` client (the hot session tier, ADR-0013). **Provided by
  * Team B** (the persistence factory). **Consumed by** the

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AACrE,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AACzE,eAAO,MAAM,mBAAmB,eAAgC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AACrE,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AACzE,eAAO,MAAM,mBAAmB,eAAgC,CAAC"}

package/dist/auth/tokens.js

@@ -23,8 +23,8 @@
  * ADR-0003: no framework/DB/crypto imports here — just Symbols (+ one re-export).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_SIGN_IN_WITH = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
-exports.SHIELD_CAPTCHA_GATE = exports.SHIELD_CAPTCHA_VERIFIER = exports.SHIELD_CAPTCHA_CONFIG = void 0;
+exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_SIGN_IN_WITH = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_AUDIT_SEALER_POOL = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.SHIELD_CAPTCHA_GATE = exports.SHIELD_CAPTCHA_VERIFIER = exports.SHIELD_CAPTCHA_CONFIG = exports.SHIELD_MFA_POLICY_FEATURE = void 0;
 var argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
 /**
@@ -35,6 +35,12 @@ Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get
  * {@link SHIELD_SESSION_RECORD_STORE} factory. Disposed on app shutdown.
  */
 exports.SHIELD_DB_POOL = Symbol('SHIELD_DB_POOL');
+/**
+ * Internal (G-026 spec 5.D): the audit sealer's own one-connection `mariadb` `Pool`, same account
+ * and database as {@link SHIELD_DB_POOL}, no query timeout. Provided by `PersistenceModule` (not
+ * exported from it); only `AuditSealerService` injects it, and its `stop()` ends it.
+ */
+exports.SHIELD_AUDIT_SEALER_POOL = Symbol('SHIELD_AUDIT_SEALER_POOL');
 /**
  * The ONE live `ioredis` client (the hot session tier, ADR-0013). **Provided by
  * Team B** (the persistence factory). **Consumed by** the

package/dist/authentication/mariadb-email-address-changer.d.ts

@@ -6,7 +6,8 @@
  * paths share one collision rule and one login-hint rule.
  *
  * `change` (one MariaDB transaction, lock-then-recheck):
- *   0. `GET_LOCK('shield_email_change')` — serialises email changes. The locked collision reads
+ *   0. `GET_LOCK('shield_email_change')` — serialises email changes (run via
+ *      `withoutStatementTimeout`, so only its own 10 s timeout ends the wait). The locked collision reads
  *      below look up a value that is normally ABSENT; under REPEATABLE READ that takes a gap lock
  *      on `uq_users_email` (migration 021, KI #87) and on the `ic_identity_hint` PK. Gap locks do
  *      not conflict with each other but block the other side's insert into the gap, so two

package/dist/authentication/mariadb-email-address-changer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAqB7C,qBAAa,0BAA2B,YAAW,mBAAmB;IASlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,uBAAuB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA6BxD,YAAY;CAqE3B"}
+{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAqB7C,qBAAa,0BAA2B,YAAW,mBAAmB;IASlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,uBAAuB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA+BxD,YAAY;CAqE3B"}

package/dist/authentication/mariadb-email-address-changer.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbEmailAddressChanger = void 0;
+const connections_js_1 = require("../auth/connections.js");
 const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** Seconds to wait for the email-change named lock before giving up (caller → 503). */
 const LOCK_TIMEOUT_S = 10;
@@ -48,9 +49,8 @@ class MariaDbEmailAddressChanger {
         const conn = await this.pool.getConnection();
         let locked = false;
         try {
-            const got = (await conn.query("SELECT GET_LOCK('shield_email_change', ?) AS got", [
-                LOCK_TIMEOUT_S,
-            ]));
+            // G-026 spec 5.L: the wait ends only by its own LOCK_TIMEOUT_S, never by APP_DB_QUERY_TIMEOUT_MS.
+            const got = (await conn.query((0, connections_js_1.withoutStatementTimeout)("SELECT GET_LOCK('shield_email_change', ?) AS got"), [LOCK_TIMEOUT_S]));
             if (Number(got[0]?.got ?? 0) !== 1)
                 throw new Error('email change lock unavailable');
             locked = true;