@astram/guard 0.20.2 → 0.22.0

package/dist/internal.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MariaDbMfaResetter = exports.accountUnlockKeys = exports.AdminControlUnavailableError = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_REDIS = exports.AttemptLimiter = exports.MariaDbCredentialProvisioner = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
+exports.MariaDbMfaResetter = exports.accountUnlockKeys = exports.AdminControlUnavailableError = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_REDIS = exports.AttemptLimiter = exports.MariaDbCredentialProvisioner = exports.SHIELD_AUDIT_SEALER_POOL = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
 /**
  * @astram/guard/internal — framework-composition and test surface (Phase 8 #5).
  *
@@ -14,6 +14,13 @@ var persistence_module_js_1 = require("./auth/persistence.module.js");
 Object.defineProperty(exports, "PersistenceModule", { enumerable: true, get: function () { return persistence_module_js_1.PersistenceModule; } });
 var tokens_js_1 = require("./auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_1.SHIELD_DB_POOL; } });
+/**
+ * Test surface only (G-026 spec 5.D): the audit sealer's own pool token. `PersistenceModule` does
+ * not export it (only the sealer injects it); a spec that stubs `SHIELD_DB_POOL` overrides this
+ * one too, else a real one-connection pool is opened for the sealer.
+ */
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_AUDIT_SEALER_POOL", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUDIT_SEALER_POOL; } });
 var mariadb_credential_provisioner_js_1 = require("./authentication/mariadb-credential-provisioner.js");
 Object.defineProperty(exports, "MariaDbCredentialProvisioner", { enumerable: true, get: function () { return mariadb_credential_provisioner_js_1.MariaDbCredentialProvisioner; } });
 /**
@@ -24,40 +31,40 @@ Object.defineProperty(exports, "MariaDbCredentialProvisioner", { enumerable: tru
  */
 var attempt_limiter_js_1 = require("./auth/rate-limit/attempt-limiter.js");
 Object.defineProperty(exports, "AttemptLimiter", { enumerable: true, get: function () { return attempt_limiter_js_1.AttemptLimiter; } });
-var tokens_js_2 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
 var tokens_js_3 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_ATTEMPT_LIMITER_FACTORY", { enumerable: true, get: function () { return tokens_js_3.SHIELD_ATTEMPT_LIMITER_FACTORY; } });
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_3.SHIELD_REDIS; } });
+var tokens_js_4 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_ATTEMPT_LIMITER_FACTORY", { enumerable: true, get: function () { return tokens_js_4.SHIELD_ATTEMPT_LIMITER_FACTORY; } });
 /**
  * For `@astram/identity` only (R12.1, B-3): the token identity binds its default auth audit sink
  * under, so guard's auth surface records to `audit_log` when the app supplies no `auditSink`.
  */
-var tokens_js_4 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_DEFAULT_AUTH_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_4.SHIELD_DEFAULT_AUTH_AUDIT_SINK; } });
+var tokens_js_5 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_DEFAULT_AUTH_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_5.SHIELD_DEFAULT_AUTH_AUDIT_SINK; } });
 /**
  * For `@astram/identity` only (auth capabilities R2): the token identity binds `true` when its
  * security-policy feature is registered, which turns guard's mandatory-2FA evaluation on.
  */
-var tokens_js_5 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_POLICY_FEATURE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_MFA_POLICY_FEATURE; } });
-/** Test surface (auth capabilities R2): the guard's mandatory-2FA service token (`null` when off). */
 var tokens_js_6 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT", { enumerable: true, get: function () { return tokens_js_6.SHIELD_MFA_REQUIREMENT; } });
+Object.defineProperty(exports, "SHIELD_MFA_POLICY_FEATURE", { enumerable: true, get: function () { return tokens_js_6.SHIELD_MFA_POLICY_FEATURE; } });
+/** Test surface (auth capabilities R2): the guard's mandatory-2FA service token (`null` when off). */
+var tokens_js_7 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_REQUIREMENT; } });
 /**
  * For `@astram/identity` only (auth capabilities R11.3): the guard's MariaDB mandatory-2FA source
  * token; identity's users list falls back to its batched confirmed-device read when the policy
  * feature is off.
  */
-var tokens_js_7 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT_SOURCE", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_REQUIREMENT_SOURCE; } });
+var tokens_js_8 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT_SOURCE", { enumerable: true, get: function () { return tokens_js_8.SHIELD_MFA_REQUIREMENT_SOURCE; } });
 /**
  * For `@astram/identity` only (auth capabilities R11, B-5): the admin sign-in controls. The step-up
  * (the admin's own TOTP on their `mfa:pid` budget), the account unlocker (login, MFA, recovery and
  * CAPTCHA account counters) and the MFA resetter identity builds over its runtime pool.
  */
-var tokens_js_8 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_ADMIN_STEP_UP", { enumerable: true, get: function () { return tokens_js_8.SHIELD_ADMIN_STEP_UP; } });
-Object.defineProperty(exports, "SHIELD_ACCOUNT_UNLOCKER", { enumerable: true, get: function () { return tokens_js_8.SHIELD_ACCOUNT_UNLOCKER; } });
+var tokens_js_9 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_ADMIN_STEP_UP", { enumerable: true, get: function () { return tokens_js_9.SHIELD_ADMIN_STEP_UP; } });
+Object.defineProperty(exports, "SHIELD_ACCOUNT_UNLOCKER", { enumerable: true, get: function () { return tokens_js_9.SHIELD_ACCOUNT_UNLOCKER; } });
 var admin_signin_controls_js_1 = require("./auth/admin-signin-controls.js");
 Object.defineProperty(exports, "AdminControlUnavailableError", { enumerable: true, get: function () { return admin_signin_controls_js_1.AdminControlUnavailableError; } });
 Object.defineProperty(exports, "accountUnlockKeys", { enumerable: true, get: function () { return admin_signin_controls_js_1.accountUnlockKeys; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.20.2",
+  "version": "0.22.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -36,8 +36,8 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.5.4",
-    "@astram/core": "1.11.0",
-    "@astram/engine": "0.13.0"
+    "@astram/engine": "0.15.0",
+    "@astram/core": "1.12.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -45,7 +45,7 @@
     "@nestjs/platform-express": "^11",
     "reflect-metadata": "^0.2",
     "rxjs": "^7",
-    "@astram/messaging": "^0.1.5"
+    "@astram/messaging": "^0.1.7"
   },
   "peerDependenciesMeta": {
     "@astram/messaging": {
@@ -68,7 +68,7 @@
     "typescript": "^5.7.0",
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8",
-    "@astram/messaging": "0.1.5"
+    "@astram/messaging": "0.1.7"
   },
   "repository": {
     "type": "git",