@astram/guard 0.21.0 → 0.22.0

package/dist/audit/audit-chain-sealer.d.ts

@@ -16,7 +16,7 @@ export declare const AUDIT_SEAL_STUCK = 200;
 /** The logger surface the sealer uses (Nest `Logger` shape). */
 export type AuditSealerLogger = Pick<LoggerService, 'log' | 'warn' | 'error'>;
 export interface AuditChainSealerOptions {
-    /** `SHIELD_DB_POOL`. Only `getConnection()` is used: every statement runs on the lock's session. */
+    /** `SHIELD_AUDIT_SEALER_POOL` (G-026). Only `getConnection()` is used: every statement runs on the lock's session. */
     readonly pool: Pool;
     /** Resolved framework database names (`FRAMEWORK_SCHEMAS`). */
     readonly schemas: FrameworkSchemas;

package/dist/audit/audit-chain-sealer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-chain-sealer.d.ts","sourceRoot":"","sources":["../../src/audit/audit-chain-sealer.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,EASL,KAAK,KAAK,EACV,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,iDAAiD;AACjD,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,0CAA0C;AAC1C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAOpC,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE9E,MAAM,WAAW,uBAAuB;IACtC,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAyDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASxD;AAUD,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAOxF;AAOD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,8FAA8F;IAC9F,OAAO,CAAC,aAAa,CAAqB;IAC1C,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,oDAAoD;IACpD,OAAO,CAAC,cAAc,CAAS;IAC/B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAA6B;gBAE/B,OAAO,EAAE,uBAAuB;IAa5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,OAAO,CAAC,gBAAgB;YAQV,QAAQ;IAwCtB,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAWxB,2FAA2F;YAC7E,eAAe;IAa7B;;;;;OAKG;YACW,cAAc;IA0H5B,wFAAwF;YAC1E,SAAS;IAyDvB,2FAA2F;YAC7E,UAAU;IAmExB,2FAA2F;IAC3F,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,OAAO;CAMhB"}
+{"version":3,"file":"audit-chain-sealer.d.ts","sourceRoot":"","sources":["../../src/audit/audit-chain-sealer.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,EASL,KAAK,KAAK,EACV,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,QAAc,CAAC;AAClD,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,iDAAiD;AACjD,eAAO,MAAM,eAAe,OAAO,CAAC;AACpC,wCAAwC;AACxC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,0CAA0C;AAC1C,eAAO,MAAM,kBAAkB,MAAM,CAAC;AACtC,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAOpC,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;AAE9E,MAAM,WAAW,uBAAuB;IACtC,sHAAsH;IACtH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAyDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASxD;AAUD,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,GAAG,MAAM,CAOxF;AAOD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,8FAA8F;IAC9F,OAAO,CAAC,aAAa,CAAqB;IAC1C,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,oDAAoD;IACpD,OAAO,CAAC,cAAc,CAAS;IAC/B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAA6B;gBAE/B,OAAO,EAAE,uBAAuB;IAa5C;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgD3B,OAAO,CAAC,gBAAgB;YAQV,QAAQ;IAwCtB,4FAA4F;IAC5F,OAAO,CAAC,gBAAgB;IAWxB,2FAA2F;YAC7E,eAAe;IAa7B;;;;;OAKG;YACW,cAAc;IA0H5B,wFAAwF;YAC1E,SAAS;IAyDvB,2FAA2F;YAC7E,UAAU;IAmExB,2FAA2F;IAC3F,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,OAAO;CAMhB"}

package/dist/audit/audit-sealer.service.d.ts

@@ -13,8 +13,12 @@
  *   probe repeats every sweep period (1 h) and starts or stops the ticks. Never throws.
  * - Ticks never overlap: the next one is scheduled only after the previous settled. A
  *   rejected tick is logged by error class only and the loop continues.
- * - Shutdown (`onModuleDestroy`, which runs before the pool is ended, and
- *   `onApplicationShutdown`): stops the timers and waits for an in-flight tick. Idempotent.
+ * - Pool (G-026 spec 5.D, 5.E): the service owns its pool, the one-connection
+ *   `SHIELD_AUDIT_SEALER_POOL` (never `SHIELD_DB_POOL`), and ends it in `stop()`.
+ * - Shutdown (`onModuleDestroy`, Nest `close()` step 1, while the HTTP server still serves, and
+ *   `onApplicationShutdown`): stops the timers, waits for the in-flight probe and tick, then ends
+ *   its own pool exactly once (best-effort, never throws). Idempotent: both hooks share one stop.
+ *   `SHIELD_DB_POOL` is closed later by `ConnectionLifecycle` (`onApplicationShutdown`).
  * - Every timer is `unref()`'d: the sealer never keeps a process alive. Nothing here touches
  *   the request path (Shield #12).
  */
@@ -46,11 +50,14 @@ export declare class AuditSealerService implements OnApplicationBootstrap, OnMod
     private probeTimer;
     private inFlightTick;
     private inFlightProbe;
+    private stopping;
     constructor(pool: Pool, schemas: FrameworkSchemas, options?: AuditSealerServiceOptions);
     onApplicationBootstrap(): Promise<void>;
     onModuleDestroy(): Promise<void>;
     onApplicationShutdown(): Promise<void>;
+    /** One stop for both hooks: the pool is ended once, after the last probe and tick settled. */
     private stop;
+    private drainAndEnd;
     /** Probe once (never overlapping, never throwing) and start or stop the ticks. */
     private runProbe;
     private probe;

package/dist/audit/audit-sealer.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-sealer.service.d.ts","sourceRoot":"","sources":["../../src/audit/audit-sealer.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,WAAW,yBAAyB;IACxC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CAChD;AAID,qBACa,kBACX,YAAW,sBAAsB,EAAE,eAAe,EAAE,qBAAqB;IAevE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAd1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,aAAa,CAA4B;gBAG9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,gBAAgB,EAC1C,OAAO,GAAE,yBAA8B;IAenC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI9B,IAAI;IAWlB,kFAAkF;IAClF,OAAO,CAAC,QAAQ;YAwBF,KAAK;IA4BnB,4FAA4F;IAC5F,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,OAAO;CAehB"}
+{"version":3,"file":"audit-sealer.service.d.ts","sourceRoot":"","sources":["../../src/audit/audit-sealer.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,WAAW,yBAAyB;IACxC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,CAAC;CAChD;AAID,qBACa,kBACX,YAAW,sBAAsB,EAAE,eAAe,EAAE,qBAAqB;IAgBvE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,YAAY,CAA4B;IAChD,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,QAAQ,CAA4B;gBAGzB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,gBAAgB,EAC1C,OAAO,GAAE,yBAA8B;IAenC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5C,8FAA8F;IAC9F,OAAO,CAAC,IAAI;YAKE,WAAW;IAiBzB,kFAAkF;IAClF,OAAO,CAAC,QAAQ;YAwBF,KAAK;IA4BnB,4FAA4F;IAC5F,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,OAAO;CAehB"}

package/dist/audit/audit-sealer.service.js

@@ -25,8 +25,12 @@ exports.AuditSealerService = void 0;
  *   probe repeats every sweep period (1 h) and starts or stops the ticks. Never throws.
  * - Ticks never overlap: the next one is scheduled only after the previous settled. A
  *   rejected tick is logged by error class only and the loop continues.
- * - Shutdown (`onModuleDestroy`, which runs before the pool is ended, and
- *   `onApplicationShutdown`): stops the timers and waits for an in-flight tick. Idempotent.
+ * - Pool (G-026 spec 5.D, 5.E): the service owns its pool, the one-connection
+ *   `SHIELD_AUDIT_SEALER_POOL` (never `SHIELD_DB_POOL`), and ends it in `stop()`.
+ * - Shutdown (`onModuleDestroy`, Nest `close()` step 1, while the HTTP server still serves, and
+ *   `onApplicationShutdown`): stops the timers, waits for the in-flight probe and tick, then ends
+ *   its own pool exactly once (best-effort, never throws). Idempotent: both hooks share one stop.
+ *   `SHIELD_DB_POOL` is closed later by `ConnectionLifecycle` (`onApplicationShutdown`).
  * - Every timer is `unref()`'d: the sealer never keeps a process alive. Nothing here touches
  *   the request path (Shield #12).
  */
@@ -49,6 +53,7 @@ let AuditSealerService = class AuditSealerService {
     probeTimer;
     inFlightTick;
     inFlightProbe;
+    stopping;
     constructor(pool, schemas, options = {}) {
         this.pool = pool;
         this.schemas = schemas;
@@ -79,7 +84,12 @@ let AuditSealerService = class AuditSealerService {
     async onApplicationShutdown() {
         await this.stop();
     }
-    async stop() {
+    /** One stop for both hooks: the pool is ended once, after the last probe and tick settled. */
+    stop() {
+        this.stopping ??= this.drainAndEnd();
+        return this.stopping;
+    }
+    async drainAndEnd() {
         this.stopped = true;
         this.active = false;
         if (this.tickTimer !== undefined)
@@ -88,8 +98,15 @@ let AuditSealerService = class AuditSealerService {
             clearInterval(this.probeTimer);
         this.tickTimer = undefined;
         this.probeTimer = undefined;
+        // Neither rejects (both catch internally); no new probe or tick starts once `stopped` is set.
         await this.inFlightProbe;
         await this.inFlightTick;
+        try {
+            await this.pool.end();
+        }
+        catch {
+            // best-effort — a pool already ending (or a stub without end()) never fails shutdown.
+        }
     }
     /** Probe once (never overlapping, never throwing) and start or stop the ticks. */
     runProbe() {

package/dist/auth/connections.d.ts

@@ -5,10 +5,12 @@
  * credentials, hot state) flows through the two connections created here.
  *
  * WHY a separate helper (not inline in the provider factory): a Nest `useFactory`
- * value provider is NOT itself lifecycle-aware — `onModuleDestroy` only fires on
+ * value provider is NOT itself lifecycle-aware — lifecycle hooks only fire on
  * PROVIDER CLASSES with that method. So the pool/redis are created by the pure
  * factories below, and a tiny {@link ConnectionLifecycle} provider (a class Nest
- * WILL call `onModuleDestroy` on) holds their handles and closes them on shutdown.
+ * WILL call `onApplicationShutdown` on) holds their handles and closes them on
+ * shutdown, after the HTTP server has closed (G-026 spec 5.O). The audit sealer's
+ * own pool ({@link createAuditSealerPool}) is ended by the sealer itself.
  * This keeps `SHIELD_DB_POOL` / `SHIELD_REDIS` as the raw driver objects the
  * adapters expect (`new MariaDbSessionRecordStore(pool)` etc.) while still getting
  * graceful teardown.
@@ -21,11 +23,46 @@
  * ADR-0018: the pool cap is taken from the connection-pool budget
  * (`config.pool.perAccountMax.shield_core`), NOT a duplicate knob.
  */
-import { type OnModuleDestroy } from '@nestjs/common';
-import { type Pool } from 'mariadb';
+import { type OnApplicationShutdown } from '@nestjs/common';
+import { type Pool, type PoolConfig } from 'mariadb';
 import Redis from 'ioredis';
-import { type AppConfig, type DbTlsConfig } from '../config/app-config.js';
+import { type AppConfig, type DbTlsConfig, type PoolTuning } from '../config/app-config.js';
 import { isLoopbackHost } from '../config/loopback-host.js';
+/** The `mariadb` driver pool options {@link mariadbPoolTuningOptions} returns (G-026 spec 5.B). */
+export interface MariadbPoolTuningOptions {
+    /** Idle connections kept (capped at the pool's `connectionLimit` when one is given). */
+    readonly minimumIdle: number;
+    /** Seconds (the driver's unit). */
+    readonly idleTimeout: number;
+    /** Ms; session `max_statement_time`, set once per connection. Omitted when off. */
+    readonly queryTimeout?: number;
+    /** Ms; the driver logs a connection held longer. Omitted when off. */
+    readonly leakDetectionTimeout?: number;
+}
+export interface MariadbPoolTuningOptionsOpts {
+    /** The pool's cap: `minimumIdle` is capped at it (the driver applies the same `Math.min`). */
+    readonly connectionLimit?: number;
+    /** Default true. `false` omits `queryTimeout` (the audit sealer pool, spec 5.D). */
+    readonly queryTimeout?: boolean;
+}
+/**
+ * Map {@link PoolTuning} to `mariadb` pool options (G-026 spec 5.B). Every framework pool spreads
+ * it (guard core, the audit sealer, identity's engine and authz pools), the same way they spread
+ * {@link mariadbSslOption}. Options that are off are omitted, so the driver default stays.
+ *
+ * Never sets `resetAfterUse`: a reset on release would drop the session `max_statement_time`
+ * the query timeout relies on (the driver default is off, and the framework sets it nowhere).
+ */
+export declare function mariadbPoolTuningOptions(tuning: PoolTuning, opts?: MariadbPoolTuningOptionsOpts): MariadbPoolTuningOptions;
+/**
+ * Run one fixed framework statement with no statement time limit (G-026 spec 5.L): returns
+ * `SET STATEMENT max_statement_time=0 FOR <sql>`, so `APP_DB_QUERY_TIMEOUT_MS` never cuts a
+ * framework `GET_LOCK` wait (each keeps its own lock timeout).
+ *
+ * ⛔ For fixed framework SQL literals only, never for SQL built from input. Values still travel
+ * as `?` parameters of the wrapped statement.
+ */
+export declare function withoutStatementTimeout(sql: string): string;
 /**
  * Create the ONE live `mariadb` {@link Pool} for the `shield_core` account from
  * {@link AppConfig}. The `connectionLimit` comes from the ADR-0018 budget
@@ -36,8 +73,24 @@ import { isLoopbackHost } from '../config/loopback-host.js';
  * a wrong/blank password fails LOUD at connect time, which is the correct place
  * for a runtime credential error. The host/port/user/database always have
  * documented defaults, so the descriptor is always well-formed.
+ *
+ * G-026 (spec 5.C): idle and timeout settings from `config.poolTuning`
+ * ({@link mariadbPoolTuningOptions}).
  */
 export declare function createDbPool(config: AppConfig): Pool;
+/** The options {@link createDbPool} passes to `mariadb.createPool` (exported for tests). */
+export declare function dbPoolOptions(config: AppConfig): PoolConfig;
+/**
+ * The audit sealer's own pool (G-026 spec 5.D): same account, database, TLS and idle settings as
+ * {@link createDbPool}, capped at one connection (the sealer holds one per tick). A sealer that
+ * borrowed from the core pool every interval would keep the core pool's FIFO idle queue from ever
+ * reaching the idle timeout. No `queryTimeout`: `APP_DB_QUERY_TIMEOUT_MS` never cuts a sealer
+ * statement (Shield #6). Leak detection applies (it only logs). Internal: provided under
+ * `SHIELD_AUDIT_SEALER_POOL` and ended by `AuditSealerService.stop()`.
+ */
+export declare function createAuditSealerPool(config: AppConfig): Pool;
+/** The options {@link createAuditSealerPool} passes to `mariadb.createPool` (exported for tests). */
+export declare function auditSealerPoolOptions(config: AppConfig): PoolConfig;
 export { isLoopbackHost };
 /**
  * The boot warning for a production pool to a remote MariaDB without TLS (Phase 16), or
@@ -66,14 +119,19 @@ export declare function createRedisClient(config: AppConfig): Redis;
 /**
  * Lifecycle-aware holder that owns the pool + redis handles and closes them on
  * app shutdown. Provided ALONGSIDE the two raw-connection providers so Nest calls
- * `onModuleDestroy` here (value providers get no lifecycle callback). The teardown
+ * `onApplicationShutdown` here (value providers get no lifecycle callback). The teardown
  * is best-effort + idempotent: a close error is swallowed so shutdown never hangs
  * or throws, and both connections are always attempted.
+ *
+ * G-026 spec 5.O: the close runs in `onApplicationShutdown` (Nest `close()` step 4), after every
+ * `onModuleDestroy` and after the HTTP server closed and its in-flight requests finished, so a
+ * request still being served while the jobs drain (step 1) never meets a closed pool or Redis.
+ * Nothing happens in `onModuleDestroy`.
  */
-export declare class ConnectionLifecycle implements OnModuleDestroy {
+export declare class ConnectionLifecycle implements OnApplicationShutdown {
     private readonly pool;
     private readonly redis;
     constructor(pool: Pool, redis: Redis);
-    onModuleDestroy(): Promise<void>;
+    onApplicationShutdown(): Promise<void>;
 }
 //# sourceMappingURL=connections.d.ts.map

package/dist/auth/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/auth/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiBpD;AAMD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CASpB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,GAAG,SAAS,GAC3B;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,CAgB1D;AAED;;;;;;GAMG;AACH,qBACa,mBAAoB,YAAW,eAAe;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK;IAGzB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;CAavC"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/auth/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAsB,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAgB,EAAE,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,mGAAmG;AACnG,MAAM,WAAW,wBAAwB;IACvC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,4BAA4B;IAC3C,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,4BAAiC,GACtC,wBAAwB,CAgB1B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAIpD;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAO3D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAE7D;AAED,qGAAqG;AACrG,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAOpE;AAMD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CASpB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,GAAG,SAAS,GAC3B;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,CAgB1D;AAED;;;;;;;;;;;GAWG;AACH,qBACa,mBAAoB,YAAW,qBAAqB;IAE7D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK;IAGzB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7C"}

package/dist/auth/connections.js

@@ -6,10 +6,12 @@
  * credentials, hot state) flows through the two connections created here.
  *
  * WHY a separate helper (not inline in the provider factory): a Nest `useFactory`
- * value provider is NOT itself lifecycle-aware — `onModuleDestroy` only fires on
+ * value provider is NOT itself lifecycle-aware — lifecycle hooks only fire on
  * PROVIDER CLASSES with that method. So the pool/redis are created by the pure
  * factories below, and a tiny {@link ConnectionLifecycle} provider (a class Nest
- * WILL call `onModuleDestroy` on) holds their handles and closes them on shutdown.
+ * WILL call `onApplicationShutdown` on) holds their handles and closes them on
+ * shutdown, after the HTTP server has closed (G-026 spec 5.O). The audit sealer's
+ * own pool ({@link createAuditSealerPool}) is ended by the sealer itself.
  * This keeps `SHIELD_DB_POOL` / `SHIELD_REDIS` as the raw driver objects the
  * adapters expect (`new MariaDbSessionRecordStore(pool)` etc.) while still getting
  * graceful teardown.
@@ -36,7 +38,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConnectionLifecycle = exports.isLoopbackHost = void 0;
+exports.mariadbPoolTuningOptions = mariadbPoolTuningOptions;
+exports.withoutStatementTimeout = withoutStatementTimeout;
 exports.createDbPool = createDbPool;
+exports.dbPoolOptions = dbPoolOptions;
+exports.createAuditSealerPool = createAuditSealerPool;
+exports.auditSealerPoolOptions = auditSealerPoolOptions;
 exports.dbTlsBootWarning = dbTlsBootWarning;
 exports.mariadbSslOption = mariadbSslOption;
 exports.createRedisClient = createRedisClient;
@@ -47,6 +54,57 @@ const ioredis_1 = __importDefault(require("ioredis"));
 const app_config_js_1 = require("../config/app-config.js");
 const loopback_host_js_1 = require("../config/loopback-host.js");
 Object.defineProperty(exports, "isLoopbackHost", { enumerable: true, get: function () { return loopback_host_js_1.isLoopbackHost; } });
+/**
+ * Map {@link PoolTuning} to `mariadb` pool options (G-026 spec 5.B). Every framework pool spreads
+ * it (guard core, the audit sealer, identity's engine and authz pools), the same way they spread
+ * {@link mariadbSslOption}. Options that are off are omitted, so the driver default stays.
+ *
+ * Never sets `resetAfterUse`: a reset on release would drop the session `max_statement_time`
+ * the query timeout relies on (the driver default is off, and the framework sets it nowhere).
+ */
+function mariadbPoolTuningOptions(tuning, opts = {}) {
+    const minimumIdle = opts.connectionLimit === undefined
+        ? tuning.minimumIdle
+        : Math.min(tuning.minimumIdle, opts.connectionLimit);
+    const withQueryTimeout = opts.queryTimeout !== false;
+    return {
+        minimumIdle,
+        idleTimeout: tuning.idleTimeoutS,
+        ...(withQueryTimeout && tuning.queryTimeoutMs !== undefined
+            ? { queryTimeout: tuning.queryTimeoutMs }
+            : {}),
+        ...(tuning.leakDetectionMs !== undefined
+            ? { leakDetectionTimeout: tuning.leakDetectionMs }
+            : {}),
+    };
+}
+/**
+ * Run one fixed framework statement with no statement time limit (G-026 spec 5.L): returns
+ * `SET STATEMENT max_statement_time=0 FOR <sql>`, so `APP_DB_QUERY_TIMEOUT_MS` never cuts a
+ * framework `GET_LOCK` wait (each keeps its own lock timeout).
+ *
+ * ⛔ For fixed framework SQL literals only, never for SQL built from input. Values still travel
+ * as `?` parameters of the wrapped statement.
+ */
+function withoutStatementTimeout(sql) {
+    return `SET STATEMENT max_statement_time=0 FOR ${sql}`;
+}
+/** The account, database, connect and TLS options every guard pool shares. */
+function basePoolOptions(config) {
+    const { db } = config;
+    return {
+        host: db.host,
+        port: db.port,
+        user: db.user,
+        password: db.password,
+        database: db.database,
+        // Fail fast on an unreachable DB rather than hanging the boot indefinitely.
+        connectTimeout: 10_000,
+        // All platform timestamps are UTC (parity with the session adapters).
+        timezone: 'Z',
+        ...withSsl(mariadbSslOption(db.tls)),
+    };
+}
 /**
  * Create the ONE live `mariadb` {@link Pool} for the `shield_core` account from
  * {@link AppConfig}. The `connectionLimit` comes from the ADR-0018 budget
@@ -57,25 +115,44 @@ Object.defineProperty(exports, "isLoopbackHost", { enumerable: true, get: functi
  * a wrong/blank password fails LOUD at connect time, which is the correct place
  * for a runtime credential error. The host/port/user/database always have
  * documented defaults, so the descriptor is always well-formed.
+ *
+ * G-026 (spec 5.C): idle and timeout settings from `config.poolTuning`
+ * ({@link mariadbPoolTuningOptions}).
  */
 function createDbPool(config) {
-    const { db, pool } = config;
     const tlsWarning = dbTlsBootWarning(config);
     if (tlsWarning !== undefined)
         dbBootLogger.warn(tlsWarning);
-    return mariadb_1.default.createPool({
-        host: db.host,
-        port: db.port,
-        user: db.user,
-        password: db.password,
-        database: db.database,
-        connectionLimit: pool.perAccountMax.shield_core,
-        // Fail fast on an unreachable DB rather than hanging the boot indefinitely.
-        connectTimeout: 10_000,
-        // All platform timestamps are UTC (parity with the session adapters).
-        timezone: 'Z',
-        ...withSsl(mariadbSslOption(db.tls)),
-    });
+    return mariadb_1.default.createPool(dbPoolOptions(config));
+}
+/** The options {@link createDbPool} passes to `mariadb.createPool` (exported for tests). */
+function dbPoolOptions(config) {
+    const connectionLimit = config.pool.perAccountMax.shield_core;
+    return {
+        ...basePoolOptions(config),
+        connectionLimit,
+        ...mariadbPoolTuningOptions((0, app_config_js_1.poolTuningOf)(config), { connectionLimit }),
+    };
+}
+/**
+ * The audit sealer's own pool (G-026 spec 5.D): same account, database, TLS and idle settings as
+ * {@link createDbPool}, capped at one connection (the sealer holds one per tick). A sealer that
+ * borrowed from the core pool every interval would keep the core pool's FIFO idle queue from ever
+ * reaching the idle timeout. No `queryTimeout`: `APP_DB_QUERY_TIMEOUT_MS` never cuts a sealer
+ * statement (Shield #6). Leak detection applies (it only logs). Internal: provided under
+ * `SHIELD_AUDIT_SEALER_POOL` and ended by `AuditSealerService.stop()`.
+ */
+function createAuditSealerPool(config) {
+    return mariadb_1.default.createPool(auditSealerPoolOptions(config));
+}
+/** The options {@link createAuditSealerPool} passes to `mariadb.createPool` (exported for tests). */
+function auditSealerPoolOptions(config) {
+    const connectionLimit = app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS;
+    return {
+        ...basePoolOptions(config),
+        connectionLimit,
+        ...mariadbPoolTuningOptions((0, app_config_js_1.poolTuningOf)(config), { connectionLimit, queryTimeout: false }),
+    };
 }
 const dbBootLogger = new common_1.Logger('ShieldAuth');
 /**
@@ -138,9 +215,14 @@ function createRedisClient(config) {
 /**
  * Lifecycle-aware holder that owns the pool + redis handles and closes them on
  * app shutdown. Provided ALONGSIDE the two raw-connection providers so Nest calls
- * `onModuleDestroy` here (value providers get no lifecycle callback). The teardown
+ * `onApplicationShutdown` here (value providers get no lifecycle callback). The teardown
  * is best-effort + idempotent: a close error is swallowed so shutdown never hangs
  * or throws, and both connections are always attempted.
+ *
+ * G-026 spec 5.O: the close runs in `onApplicationShutdown` (Nest `close()` step 4), after every
+ * `onModuleDestroy` and after the HTTP server closed and its in-flight requests finished, so a
+ * request still being served while the jobs drain (step 1) never meets a closed pool or Redis.
+ * Nothing happens in `onModuleDestroy`.
  */
 let ConnectionLifecycle = class ConnectionLifecycle {
     pool;
@@ -149,7 +231,7 @@ let ConnectionLifecycle = class ConnectionLifecycle {
         this.pool = pool;
         this.redis = redis;
     }
-    async onModuleDestroy() {
+    async onApplicationShutdown() {
         // Close both; never let one failure prevent the other, never throw.
         try {
             await this.pool.end();

package/dist/auth/persistence.module.d.ts

@@ -8,10 +8,15 @@
  * ─────────────────────────────────────────────────────────────────────────────
  * Team B (connection + composition) OWNS this file. The two factories create the
  * real driver objects; the {@link ConnectionLifecycle} provider (a class Nest
- * invokes `onModuleDestroy` on) closes them on shutdown — a value provider is not
- * itself lifecycle-aware, so the teardown lives in that holder (see
- * `connections.ts`). Both connections are exported so AuthModule can inject the
- * pool (credential resolver + session record store) and the redis (hot store).
+ * invokes `onApplicationShutdown` on, after the HTTP server has closed; G-026 spec 5.O)
+ * closes them on shutdown — a value provider is not itself lifecycle-aware, so the
+ * teardown lives in that holder (see `connections.ts`). Both connections are exported
+ * so AuthModule can inject the pool (credential resolver + session record store) and
+ * the redis (hot store).
+ *
+ *   SHIELD_AUDIT_SEALER_POOL — {@link createAuditSealerPool}: the audit sealer's own
+ *     one-connection pool (G-026 spec 5.D), NOT exported; only the sealer injects it and
+ *     its `stop()` ends it.
  *
  *   SHIELD_DB_POOL  — {@link createDbPool}: `mariadb.createPool` for the
  *     `shield_core` account from `config.db`, `connectionLimit` from the ADR-0018
@@ -33,8 +38,8 @@
 import { type DynamicModule } from '@nestjs/common';
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
- * Opt-in: only imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder, the audit sealer and its
+ * own pool (not exported). Opt-in: only imported when auth is wired.
  */
 export declare class PersistenceModule {
     static forRoot(): DynamicModule;

package/dist/auth/persistence.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA2D3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAOhC"}
+{"version":3,"file":"persistence.module.d.ts","sourceRoot":"","sources":["../../src/auth/persistence.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AA6E3E;;;;GAIG;AACH,qBACa,iBAAiB;IAC5B,MAAM,CAAC,OAAO,IAAI,aAAa;CAahC"}

package/dist/auth/persistence.module.js

@@ -9,10 +9,15 @@
  * ─────────────────────────────────────────────────────────────────────────────
  * Team B (connection + composition) OWNS this file. The two factories create the
  * real driver objects; the {@link ConnectionLifecycle} provider (a class Nest
- * invokes `onModuleDestroy` on) closes them on shutdown — a value provider is not
- * itself lifecycle-aware, so the teardown lives in that holder (see
- * `connections.ts`). Both connections are exported so AuthModule can inject the
- * pool (credential resolver + session record store) and the redis (hot store).
+ * invokes `onApplicationShutdown` on, after the HTTP server has closed; G-026 spec 5.O)
+ * closes them on shutdown — a value provider is not itself lifecycle-aware, so the
+ * teardown lives in that holder (see `connections.ts`). Both connections are exported
+ * so AuthModule can inject the pool (credential resolver + session record store) and
+ * the redis (hot store).
+ *
+ *   SHIELD_AUDIT_SEALER_POOL — {@link createAuditSealerPool}: the audit sealer's own
+ *     one-connection pool (G-026 spec 5.D), NOT exported; only the sealer injects it and
+ *     its `stop()` ends it.
  *
  *   SHIELD_DB_POOL  — {@link createDbPool}: `mariadb.createPool` for the
  *     `shield_core` account from `config.db`, `connectionLimit` from the ADR-0018
@@ -69,37 +74,55 @@ const redisProvider = {
 };
 /**
  * The lifecycle holder — injects the two connections and closes them on shutdown
- * (`onModuleDestroy`). A value-provider connection gets no lifecycle callback, so
- * this class is where graceful teardown happens.
+ * (`onApplicationShutdown`, after the HTTP server has closed; G-026 spec 5.O). A
+ * value-provider connection gets no lifecycle callback, so this class is where
+ * graceful teardown happens.
  */
 const lifecycleProvider = {
     provide: connections_js_1.ConnectionLifecycle,
     useFactory: (pool, redis) => new connections_js_1.ConnectionLifecycle(pool, redis),
     inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
 };
+/**
+ * The audit sealer's own pool (G-026 spec 5.D): one connection, no query timeout. Registered
+ * beside the sealer, so it exists exactly when the sealer does (this module, `auth: true`).
+ * Not exported. Ended by the sealer's `stop()` after its last tick settled.
+ */
+const auditSealerPoolProvider = {
+    provide: tokens_js_1.SHIELD_AUDIT_SEALER_POOL,
+    useFactory: (config) => (0, connections_js_1.createAuditSealerPool)(config),
+    inject: [config_module_js_1.APP_CONFIG],
+};
 /**
  * The deferred audit sealer (audit-chain-store SPEC §5.H): registered here so it exists
  * exactly when {@link SHIELD_DB_POOL} does. `AUDIT_SEAL_*` is read now, so an invalid value
  * fails the boot (SPEC §13). It ticks only once its table probe finds `audit_log` and
- * `audit_chain`; a stub or unreachable pool leaves it idle (never a boot failure).
+ * `audit_chain`; a stub or unreachable pool leaves it idle (never a boot failure). It runs on
+ * its own pool ({@link SHIELD_AUDIT_SEALER_POOL}), never on {@link SHIELD_DB_POOL} (G-026).
  */
 const auditSealerProvider = {
     provide: audit_sealer_service_js_1.AuditSealerService,
     useFactory: (pool, config) => new audit_sealer_service_js_1.AuditSealerService(pool, (0, app_config_js_1.frameworkSchemasOf)(config), {
         config: (0, audit_seal_config_js_1.loadAuditSealConfig)(process.env),
     }),
-    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+    inject: [tokens_js_1.SHIELD_AUDIT_SEALER_POOL, config_module_js_1.APP_CONFIG],
 };
 /**
  * The persistence module. `forRoot()` returns the two connection providers (both
- * exported so AuthModule can inject them), the shutdown holder and the audit sealer.
- * Opt-in: only imported when auth is wired.
+ * exported so AuthModule can inject them), the shutdown holder, the audit sealer and its
+ * own pool (not exported). Opt-in: only imported when auth is wired.
  */
 let PersistenceModule = PersistenceModule_1 = class PersistenceModule {
     static forRoot() {
         return {
             module: PersistenceModule_1,
-            providers: [dbPoolProvider, redisProvider, lifecycleProvider, auditSealerProvider],
+            providers: [
+                dbPoolProvider,
+                redisProvider,
+                lifecycleProvider,
+                auditSealerPoolProvider,
+                auditSealerProvider,
+            ],
             exports: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_REDIS],
         };
     }

package/dist/auth/tokens.d.ts

@@ -30,6 +30,12 @@ export { SHIELD_PASSWORD_HASHER } from '../authentication/argon2id-password-hash
  * {@link SHIELD_SESSION_RECORD_STORE} factory. Disposed on app shutdown.
  */
 export declare const SHIELD_DB_POOL: unique symbol;
+/**
+ * Internal (G-026 spec 5.D): the audit sealer's own one-connection `mariadb` `Pool`, same account
+ * and database as {@link SHIELD_DB_POOL}, no query timeout. Provided by `PersistenceModule` (not
+ * exported from it); only `AuditSealerService` injects it, and its `stop()` ends it.
+ */
+export declare const SHIELD_AUDIT_SEALER_POOL: unique symbol;
 /**
  * The ONE live `ioredis` client (the hot session tier, ADR-0013). **Provided by
  * Team B** (the persistence factory). **Consumed by** the

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AACrE,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AACzE,eAAO,MAAM,mBAAmB,eAAgC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAWnF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,iGAAiG;AACjG,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAU7E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,eAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AACrE,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AACzE,eAAO,MAAM,mBAAmB,eAAgC,CAAC"}

package/dist/auth/tokens.js

@@ -23,8 +23,8 @@
  * ADR-0003: no framework/DB/crypto imports here — just Symbols (+ one re-export).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_SIGN_IN_WITH = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
-exports.SHIELD_CAPTCHA_GATE = exports.SHIELD_CAPTCHA_VERIFIER = exports.SHIELD_CAPTCHA_CONFIG = void 0;
+exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_SIGN_IN_WITH = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_IP_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_MEMBERSHIP_CHECKER = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_DELIVERY = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_CONFIRM_EMAIL_LIMITER = exports.SHIELD_EMAIL_CHANGE_LIMITER = exports.SHIELD_EMAIL_CHANGE_LINK_BASE_URL = exports.SHIELD_EMAIL_ADDRESS_CHANGER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_RECENT_ROTATION_STORE = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_AUDIT_SEALER_POOL = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.SHIELD_CAPTCHA_GATE = exports.SHIELD_CAPTCHA_VERIFIER = exports.SHIELD_CAPTCHA_CONFIG = exports.SHIELD_MFA_POLICY_FEATURE = void 0;
 var argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
 /**
@@ -35,6 +35,12 @@ Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get
  * {@link SHIELD_SESSION_RECORD_STORE} factory. Disposed on app shutdown.
  */
 exports.SHIELD_DB_POOL = Symbol('SHIELD_DB_POOL');
+/**
+ * Internal (G-026 spec 5.D): the audit sealer's own one-connection `mariadb` `Pool`, same account
+ * and database as {@link SHIELD_DB_POOL}, no query timeout. Provided by `PersistenceModule` (not
+ * exported from it); only `AuditSealerService` injects it, and its `stop()` ends it.
+ */
+exports.SHIELD_AUDIT_SEALER_POOL = Symbol('SHIELD_AUDIT_SEALER_POOL');
 /**
  * The ONE live `ioredis` client (the hot session tier, ADR-0013). **Provided by
  * Team B** (the persistence factory). **Consumed by** the

package/dist/authentication/mariadb-email-address-changer.d.ts

@@ -6,7 +6,8 @@
  * paths share one collision rule and one login-hint rule.
  *
  * `change` (one MariaDB transaction, lock-then-recheck):
- *   0. `GET_LOCK('shield_email_change')` — serialises email changes. The locked collision reads
+ *   0. `GET_LOCK('shield_email_change')` — serialises email changes (run via
+ *      `withoutStatementTimeout`, so only its own 10 s timeout ends the wait). The locked collision reads
  *      below look up a value that is normally ABSENT; under REPEATABLE READ that takes a gap lock
  *      on `uq_users_email` (migration 021, KI #87) and on the `ic_identity_hint` PK. Gap locks do
  *      not conflict with each other but block the other side's insert into the gap, so two

package/dist/authentication/mariadb-email-address-changer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAqB7C,qBAAa,0BAA2B,YAAW,mBAAmB;IASlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,uBAAuB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA6BxD,YAAY;CAqE3B"}
+{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAqB7C,qBAAa,0BAA2B,YAAW,mBAAmB;IASlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,uBAAuB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA+BxD,YAAY;CAqE3B"}

package/dist/authentication/mariadb-email-address-changer.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbEmailAddressChanger = void 0;
+const connections_js_1 = require("../auth/connections.js");
 const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** Seconds to wait for the email-change named lock before giving up (caller → 503). */
 const LOCK_TIMEOUT_S = 10;
@@ -48,9 +49,8 @@ class MariaDbEmailAddressChanger {
         const conn = await this.pool.getConnection();
         let locked = false;
         try {
-            const got = (await conn.query("SELECT GET_LOCK('shield_email_change', ?) AS got", [
-                LOCK_TIMEOUT_S,
-            ]));
+            // G-026 spec 5.L: the wait ends only by its own LOCK_TIMEOUT_S, never by APP_DB_QUERY_TIMEOUT_MS.
+            const got = (await conn.query((0, connections_js_1.withoutStatementTimeout)("SELECT GET_LOCK('shield_email_change', ?) AS got"), [LOCK_TIMEOUT_S]));
             if (Number(got[0]?.got ?? 0) !== 1)
                 throw new Error('email change lock unavailable');
             locked = true;

package/dist/boot/boot-sequence.d.ts

@@ -1,6 +1,6 @@
 import { type OnApplicationBootstrap } from '@nestjs/common';
 import type { FrameworkSchemas } from '@astram/core';
-import { type AppConfig, type PoolBudgetConfig } from '../config/app-config.js';
+import { type AppConfig, type PoolBudgetConfig, type PoolTuning } from '../config/app-config.js';
 /**
  * Boot sequence extension point (Infrastructure layer — ADR-0018).
  *
@@ -11,7 +11,7 @@ import { type AppConfig, type PoolBudgetConfig } from '../config/app-config.js';
  * ───────────────────────────────────────────────────────────────────────────
  * ADR-0018 connection-pool assertion (FILLED).
  * {@link assertConnectionPoolReady} computes the connection budget
- *   workers × Σ(per-account runtime pool max) + headroom ≤ maxConnections
+ *   workers × (Σ(per-account runtime pool max) + 1 audit sealer) + headroom ≤ maxConnections
  * and THROWS (fail-closed, abort boot) on violation, so a pool config that
  * would exceed MariaDB's `max_connections` is caught at boot, never under load.
  * ───────────────────────────────────────────────────────────────────────────
@@ -35,6 +35,11 @@ export declare class BootSequence implements OnApplicationBootstrap {
 }
 /** The boot log line naming the resolved framework databases (names only, spec 5.E). */
 export declare function frameworkDatabasesLogLine(s: FrameworkSchemas): string;
+/**
+ * The boot log line with the effective pool idle settings (G-026 spec 5.N), numbers only, e.g.
+ * `DB pools: minIdle=1 idleTimeout=600s queryTimeout=off leakDetection=off sealer=1`.
+ */
+export declare function poolTuningLogLine(t: PoolTuning): string;
 /**
  * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
  * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the

package/dist/boot/boot-sequence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAKrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAsC5D"}
+{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAe7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAKrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CA0C5D"}

package/dist/boot/boot-sequence.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BootSequence = void 0;
 exports.frameworkDatabasesLogLine = frameworkDatabasesLogLine;
+exports.poolTuningLogLine = poolTuningLogLine;
 exports.shieldDbNameIgnoredWarning = shieldDbNameIgnoredWarning;
 exports.assertPoolBudget = assertPoolBudget;
 const common_1 = require("@nestjs/common");
@@ -29,7 +30,7 @@ const app_config_js_1 = require("../config/app-config.js");
  * ───────────────────────────────────────────────────────────────────────────
  * ADR-0018 connection-pool assertion (FILLED).
  * {@link assertConnectionPoolReady} computes the connection budget
- *   workers × Σ(per-account runtime pool max) + headroom ≤ maxConnections
+ *   workers × (Σ(per-account runtime pool max) + 1 audit sealer) + headroom ≤ maxConnections
  * and THROWS (fail-closed, abort boot) on violation, so a pool config that
  * would exceed MariaDB's `max_connections` is caught at boot, never under load.
  * ───────────────────────────────────────────────────────────────────────────
@@ -44,6 +45,8 @@ let BootSequence = class BootSequence {
         // configurable-framework-db spec 5.E: the resolved database names, once per boot. Names
         // only — never a user, password, host or connection string.
         this.logger.log(frameworkDatabasesLogLine((0, app_config_js_1.frameworkSchemasOf)(this.config)));
+        // G-026 spec 5.N: the effective pool idle settings, numbers only.
+        this.logger.log(poolTuningLogLine((0, app_config_js_1.poolTuningOf)(this.config)));
         // Spec 5.C/AC-1: SHIELD_DB_NAME is read only in the single layout; say so when it is ignored.
         const ignored = shieldDbNameIgnoredWarning(process.env);
         if (ignored !== undefined)
@@ -81,6 +84,16 @@ function frameworkDatabasesLogLine(s) {
     return (`Shield databases: namespace=${s.namespace} app=${s.app} identity=${s.identity} ` +
         `authz=${s.authz} audit=${s.audit}`);
 }
+/**
+ * The boot log line with the effective pool idle settings (G-026 spec 5.N), numbers only, e.g.
+ * `DB pools: minIdle=1 idleTimeout=600s queryTimeout=off leakDetection=off sealer=1`.
+ */
+function poolTuningLogLine(t) {
+    const ms = (v) => (v === undefined ? 'off' : `${v}ms`);
+    return (`DB pools: minIdle=${t.minimumIdle} idleTimeout=${t.idleTimeoutS}s ` +
+        `queryTimeout=${ms(t.queryTimeoutMs)} leakDetection=${ms(t.leakDetectionMs)} ` +
+        `sealer=${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS}`);
+}
 /**
  * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
  * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
@@ -113,7 +126,8 @@ function assertPoolBudget(cfg) {
     if (!e.withinUserBudget) {
         throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): single layout needs ' +
             `${e.requiredConnections} connections (workers(${cfg.workers}) × ` +
-            `${e.perWorkerConnections} + headroom(${cfg.headroom})) but the account allows ` +
+            `${e.perWorkerConnections} (audit sealer's ${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS} per worker ` +
+            `included) + headroom(${cfg.headroom})) but the account allows ` +
             `${cfg.maxUserConnections} (APP_DB_MAX_USER_CONNECTIONS). Reduce POOL_MAX_CORE, ` +
             'POOL_MAX_ENGINE, APP_AUTHZ_POOL_MAX, POOL_WORKERS or POOL_HEADROOM, or raise ' +
             'MAX_USER_CONNECTIONS on the account (ADR-0041).');
@@ -122,11 +136,14 @@ function assertPoolBudget(cfg) {
         throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): required ' +
             `connections ${e.requiredConnections} exceed max_connections ` +
             `${cfg.maxConnections}. Budget = workers(${cfg.workers}) × ` +
-            `Σ(per-account pool max)(${e.perWorkerConnections}) + headroom(` +
+            `(Σ(per-account pool max) + audit sealer ${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS})` +
+            `(${e.perWorkerConnections}) + headroom(` +
             `${cfg.headroom}) = ${e.requiredConnections} > ${cfg.maxConnections}. ` +
+            `The audit sealer's own pool counts ${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS} per worker. ` +
             (cfg.layout === 'single'
                 ? 'Single layout: one account opens POOL_MAX_CORE + POOL_MAX_ENGINE (unset ⇒ ' +
-                    'APP_DB_MAX_CONNECTIONS, else 10) + APP_AUTHZ_POOL_MAX per worker; set POOL_MAX_ENGINE ' +
+                    'APP_DB_MAX_CONNECTIONS, else 10) + APP_AUTHZ_POOL_MAX + 1 (audit sealer) per worker; ' +
+                    'set POOL_MAX_ENGINE ' +
                     'explicitly, lower a pool cap or the worker count, or raise max_connections.'
                 : 'Reduce a per-account pool cap, the worker count, or raise ' +
                     'max_connections (and MariaDB my.cnf) to restore the budget.'));

package/dist/config/app-config.d.ts

@@ -11,7 +11,7 @@
  *
  * ─────────────────────────────────────────────────────────────────────────────
  * ADR-0018 budget (the invariant this config feeds):
- *   workers × Σ(per-account RUNTIME pool max) + headroom ≤ maxConnections
+ *   workers × (Σ(per-account RUNTIME pool max) + 1 audit sealer) + headroom ≤ maxConnections
  *
  * "Runtime" pools are the pools each PM2 cluster worker holds open: shield_core,
  * shield_app_crud, shield_schema_svc. The deploy/ops accounts (migrate, backup,
@@ -20,7 +20,7 @@
  *
  * Defaults below agree byte-for-byte with infra/mariadb/conf.d/my.cnf
  * (max_connections=250) and the local docker-compose substrate:
- *   8 × (12 + 8 + 1) + 40 = 208 ≤ 250  ✓
+ *   8 × (12 + 8 + 1 + 1 sealer) + 40 = 216 ≤ 250  ✓ (G-026: the sealer's own 1-connection pool)
  * ─────────────────────────────────────────────────────────────────────────────
  */
 import type { FrameworkSchemas, SecretsProvider } from '@astram/core';
@@ -81,6 +81,13 @@ export interface AppConfig {
      * from `process.env` once at boot. Provided app-wide under `FRAMEWORK_SCHEMAS`.
      */
     readonly schemas?: FrameworkSchemas;
+    /**
+     * G-026 (db-pool-idle spec 5.A, 5.C): the idle and timeout settings every framework pool applies
+     * (`POOL_MIN_IDLE`, `POOL_IDLE_TIMEOUT_S`, `APP_DB_QUERY_TIMEOUT_MS`, `POOL_LEAK_DETECTION_MS`),
+     * filled by {@link loadAppConfig}. Optional so hand-built configs keep compiling; absent ⇒ the
+     * pool factories read {@link loadPoolTuning}`(process.env)` once at boot.
+     */
+    readonly poolTuning?: PoolTuning;
 }
 /**
  * The resolved framework database names for a config: `config.schemas`, else resolved from
@@ -219,6 +226,41 @@ export declare const SCHEMA_SVC_POOL_HARD_CAP = 2;
  * unset NODE_ENV is treated as "not dev").
  */
 export declare function isDevOrTestNodeEnv(raw: string | undefined): boolean;
+/**
+ * G-026 (db-pool-idle spec 5.A, section 10): the idle and timeout settings of the framework pools.
+ * Caps are unchanged (they stay in {@link PoolBudgetConfig}); these only decide how many idle
+ * connections a pool keeps and how long a statement may run.
+ */
+export interface PoolTuning {
+    /** `POOL_MIN_IDLE` (default 1, 0–1000): idle connections kept; each pool caps it at its own cap. */
+    readonly minimumIdle: number;
+    /** `POOL_IDLE_TIMEOUT_S` (default 600, 10–3600): seconds before an idle connection above the minimum closes. */
+    readonly idleTimeoutS: number;
+    /**
+     * `APP_DB_QUERY_TIMEOUT_MS` (unset ⇒ off, 1000–3600000): the session `max_statement_time` of every
+     * request-serving pool. Never applied to the audit sealer pool; framework lock waits opt out
+     * per statement (`withoutStatementTimeout`).
+     */
+    readonly queryTimeoutMs?: number;
+    /** `POOL_LEAK_DETECTION_MS` (unset ⇒ off, 1000–600000): log a connection held longer than this. */
+    readonly leakDetectionMs?: number;
+}
+/** Section 10 defaults: one idle connection per pool, closed after 10 idle minutes. */
+export declare const DEFAULT_POOL_MIN_IDLE = 1;
+export declare const DEFAULT_POOL_IDLE_TIMEOUT_S = 600;
+/**
+ * Read the pool idle and timeout settings (db-pool-idle spec 5.A). Pure; every framework pool uses
+ * this one loader (no pool reads the variables itself). A set but invalid or out-of-range value
+ * throws naming the variable; blank or unset gives the default (off for the two optional ones).
+ */
+export declare function loadPoolTuning(env?: NodeJS.ProcessEnv): PoolTuning;
+/** The tuning for a config: `config.poolTuning`, else read from `process.env` (call at boot only). */
+export declare function poolTuningOf(config: Pick<AppConfig, 'poolTuning'>): PoolTuning;
+/**
+ * The audit sealer's own pool (db-pool-idle spec 5.D): one connection per worker, always counted
+ * in the budget (5.F), whether or not `auth: true` starts the sealer.
+ */
+export declare const AUDIT_SEALER_POOL_CONNECTIONS = 1;
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
@@ -393,7 +435,7 @@ export declare const DEFAULT_OBJECT_STORAGE_MAX_BYTES: number;
 export declare function loadObjectStorageConfig(env?: NodeJS.ProcessEnv, options?: LoadObjectStorageConfigOptions): ObjectStorageConfig | undefined;
 /** Result of evaluating a {@link PoolBudgetConfig} against the ADR-0018 budget. */
 export interface PoolBudgetEvaluation {
-    /** Σ(per-account runtime pool max) for a single worker. */
+    /** Σ(per-account runtime pool max) + the audit sealer's 1, for a single worker. */
     readonly perWorkerConnections: number;
     /** workers × perWorkerConnections — total runtime connections at full load. */
     readonly runtimeConnections: number;

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA4CrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CA0BV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAc7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAyB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AA2BD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gHAAgH;IAChH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,mGAAmG;IACnG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAsB/C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAwB/E;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,UAAU,CAE9E;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA4CrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CA0BV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAe7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CA0B9E"}

package/dist/config/app-config.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
+exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.AUDIT_SEALER_POOL_CONNECTIONS = exports.DEFAULT_POOL_IDLE_TIMEOUT_S = exports.DEFAULT_POOL_MIN_IDLE = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
 exports.frameworkSchemasOf = frameworkSchemasOf;
 exports.isDevOrTestNodeEnv = isDevOrTestNodeEnv;
+exports.loadPoolTuning = loadPoolTuning;
+exports.poolTuningOf = poolTuningOf;
 exports.loadPoolBudget = loadPoolBudget;
 exports.loadDbConfig = loadDbConfig;
 exports.loadDbTlsConfig = loadDbTlsConfig;
@@ -99,6 +101,51 @@ function strictOptionalPoolInt(raw, name) {
         throw new Error(`${name} must be a positive integer`);
     return n;
 }
+/** Section 10 defaults: one idle connection per pool, closed after 10 idle minutes. */
+exports.DEFAULT_POOL_MIN_IDLE = 1;
+exports.DEFAULT_POOL_IDLE_TIMEOUT_S = 600;
+/**
+ * A tuning variable: unset or blank gives `undefined`; otherwise plain digits (surrounding
+ * whitespace allowed) within `[min, max]`, or it throws naming the variable and the range, never the
+ * value (fail closed, Shield #1, core 70-secrets).
+ */
+function strictOptionalRangeInt(raw, name, min, max) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const t = raw.trim();
+    const n = /^[0-9]+$/.test(t) ? Number(t) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < min || n > max) {
+        throw new Error(`${name} must be an integer ${min}–${max}`);
+    }
+    return n;
+}
+/**
+ * Read the pool idle and timeout settings (db-pool-idle spec 5.A). Pure; every framework pool uses
+ * this one loader (no pool reads the variables itself). A set but invalid or out-of-range value
+ * throws naming the variable; blank or unset gives the default (off for the two optional ones).
+ */
+function loadPoolTuning(env = process.env) {
+    const minimumIdle = strictOptionalRangeInt(env.POOL_MIN_IDLE, 'POOL_MIN_IDLE', 0, 1000) ?? exports.DEFAULT_POOL_MIN_IDLE;
+    const idleTimeoutS = strictOptionalRangeInt(env.POOL_IDLE_TIMEOUT_S, 'POOL_IDLE_TIMEOUT_S', 10, 3600) ??
+        exports.DEFAULT_POOL_IDLE_TIMEOUT_S;
+    const queryTimeoutMs = strictOptionalRangeInt(env.APP_DB_QUERY_TIMEOUT_MS, 'APP_DB_QUERY_TIMEOUT_MS', 1000, 3_600_000);
+    const leakDetectionMs = strictOptionalRangeInt(env.POOL_LEAK_DETECTION_MS, 'POOL_LEAK_DETECTION_MS', 1000, 600_000);
+    return {
+        minimumIdle,
+        idleTimeoutS,
+        ...(queryTimeoutMs !== undefined ? { queryTimeoutMs } : {}),
+        ...(leakDetectionMs !== undefined ? { leakDetectionMs } : {}),
+    };
+}
+/** The tuning for a config: `config.poolTuning`, else read from `process.env` (call at boot only). */
+function poolTuningOf(config) {
+    return config.poolTuning ?? loadPoolTuning(process.env);
+}
+/**
+ * The audit sealer's own pool (db-pool-idle spec 5.D): one connection per worker, always counted
+ * in the budget (5.F), whether or not `auth: true` starts the sealer.
+ */
+exports.AUDIT_SEALER_POOL_CONNECTIONS = 1;
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
@@ -362,6 +409,7 @@ function loadAppConfig(env = process.env) {
         lifetimes: loadSessionLifetimes(env),
         loginIpLimit: loadLoginIpLimit(env),
         ...(refreshReplayWindowMs !== undefined ? { refreshReplayWindowMs } : {}),
+        poolTuning: loadPoolTuning(env),
     };
 }
 /**
@@ -479,11 +527,12 @@ function parseStorageMaxBytes(raw) {
  */
 function evaluatePoolBudget(cfg) {
     // Single layout (AC-12): one account opens core + engine + authz; app_crud/schema_svc are never opened.
-    const perWorkerConnections = cfg.layout === 'single'
+    // Both layouts add the audit sealer's own pool (G-026 spec 5.F: 1 per worker, always counted).
+    const perWorkerConnections = (cfg.layout === 'single'
         ? cfg.perAccountMax.shield_core + (cfg.engineMax ?? 10) + (cfg.authzMax ?? 4)
         : cfg.perAccountMax.shield_core +
             cfg.perAccountMax.shield_app_crud +
-            cfg.perAccountMax.shield_schema_svc;
+            cfg.perAccountMax.shield_schema_svc) + exports.AUDIT_SEALER_POOL_CONNECTIONS;
     const runtimeConnections = cfg.workers * perWorkerConnections;
     const requiredConnections = runtimeConnections + cfg.headroom;
     const slack = cfg.maxConnections - requiredConnections;

package/dist/index.d.ts

@@ -70,10 +70,11 @@ export { FrameworkMigrationLedgerCheck, MigrationLedgerRegistry, SHIELD_MIGRATIO
 export { APP_CONFIG } from './config/config.module.js';
 export { FRAMEWORK_SCHEMAS } from './config/config.module.js';
 export type { FrameworkSchemaNames } from './config/framework-schema-names.js';
-export { frameworkSchemasOf, loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, loadLoginIpLimit, loadRefreshReplayWindowMs, DEFAULT_LOGIN_IP_LIMIT, isDevOrTestNodeEnv, type LoginIpLimitConfig, loadDbTlsConfig, type DbTlsConfig, } from './config/app-config.js';
+export { frameworkSchemasOf, loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, loadLoginIpLimit, loadRefreshReplayWindowMs, DEFAULT_LOGIN_IP_LIMIT, isDevOrTestNodeEnv, type LoginIpLimitConfig, loadDbTlsConfig, type DbTlsConfig, loadPoolTuning, type PoolTuning, } from './config/app-config.js';
 export { rootIdsFromEnv } from './config/root-ids-from-env.js';
 export { ORG_BOOTSTRAP_PRINCIPAL_ID, assertNoReservedRootId, RESERVED_OPERATION_PRINCIPALS, reservedOperationPrincipal, type ReservedOperationPrincipal, } from './config/reserved-principal-ids.js';
 export { mariadbSslOption } from './auth/connections.js';
+export { mariadbPoolTuningOptions, withoutStatementTimeout, type MariadbPoolTuningOptions, type MariadbPoolTuningOptionsOpts, } from './auth/connections.js';
 export { SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_CHANGE_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_MESSAGE_DISPATCHER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
 export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
 export { resolveSignInWith, DEFAULT_SIGN_IN_WITH, type SignInMethod, } from './authentication/sign-in-with.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAEtB,6BAA6B,EAC7B,0BAA0B,EAC1B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAezD,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,EACT,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAIvB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAOvD,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG9E,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,0BAA0B,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,UAAU,EACV,SAAS,GACV,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,yBAAyB,EAGzB,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAInF,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EACL,UAAU,EACV,uBAAuB,EACvB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gCAAgC,EAChC,KAAK,mBAAmB,EACxB,KAAK,8BAA8B,GACpC,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EAExB,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,gCAAgC,EAChC,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,EAEvB,eAAe,EACf,KAAK,WAAW,EAGhB,cAAc,EACd,KAAK,UAAU,GAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAEtB,6BAA6B,EAC7B,0BAA0B,EAC1B,KAAK,0BAA0B,GAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,GAClC,MAAM,uBAAuB,CAAC;AAe/B,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EAExB,+BAA+B,EAC/B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAIvD,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,EACT,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAIvB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAOvD,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mDAAmD,CAAC;AAC/F,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG9E,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,+BAA+B,EAC/B,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -18,9 +18,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wasResolvedFromSecretRef = exports.assertNoUnresolvedSecretRefs = exports.createSecretsProviderFromEnv = exports.resolveBootSecrets = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.resolveAuthLinkBaseUrls = exports.CredentialExistsError = exports.isLockedHash = exports.lockedPasswordHash = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.uuidArrayField = exports.optionalUuidField = exports.uuidField = exports.UuidPipe = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_RECORD_AUTHORIZATION = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsOf = exports.actionsFor = exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
 exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.loadAuditSealConfig = exports.NodeSha256Hash = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
-exports.SHIELD_REDIS = exports.mariadbSslOption = exports.reservedOperationPrincipal = exports.RESERVED_OPERATION_PRINCIPALS = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = void 0;
-exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.SHIELD_CAPTCHA_GATE = exports.RECAPTCHA_SITEVERIFY_URL = exports.RecaptchaVerifier = exports.TURNSTILE_SITEVERIFY_URL = exports.TurnstileVerifier = exports.MAX_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_MIN_SCORE = exports.DEFAULT_CAPTCHA_THRESHOLD = exports.CAPTCHA_FAIL_MODES = exports.CAPTCHA_MODES = exports.CAPTCHA_ENDPOINTS = exports.loadCaptchaConfig = exports.SHIELD_SIGN_IN_WITH = exports.DEFAULT_SIGN_IN_WITH = exports.resolveSignInWith = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = void 0;
-exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = void 0;
+exports.mariadbSslOption = exports.reservedOperationPrincipal = exports.RESERVED_OPERATION_PRINCIPALS = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadPoolTuning = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = void 0;
+exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.SHIELD_CAPTCHA_GATE = exports.RECAPTCHA_SITEVERIFY_URL = exports.RecaptchaVerifier = exports.TURNSTILE_SITEVERIFY_URL = exports.TurnstileVerifier = exports.MAX_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_MIN_SCORE = exports.DEFAULT_CAPTCHA_THRESHOLD = exports.CAPTCHA_FAIL_MODES = exports.CAPTCHA_MODES = exports.CAPTCHA_ENDPOINTS = exports.loadCaptchaConfig = exports.SHIELD_SIGN_IN_WITH = exports.DEFAULT_SIGN_IN_WITH = exports.resolveSignInWith = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.withoutStatementTimeout = exports.mariadbPoolTuningOptions = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -376,6 +376,9 @@ Object.defineProperty(exports, "DEFAULT_LOGIN_IP_LIMIT", { enumerable: true, get
 Object.defineProperty(exports, "isDevOrTestNodeEnv", { enumerable: true, get: function () { return app_config_js_2.isDevOrTestNodeEnv; } });
 // Phase 16 (additive): TLS to MariaDB (APP_DB_TLS / APP_DB_TLS_CA).
 Object.defineProperty(exports, "loadDbTlsConfig", { enumerable: true, get: function () { return app_config_js_2.loadDbTlsConfig; } });
+// G-026 (additive): pool idle and timeout settings (POOL_MIN_IDLE, POOL_IDLE_TIMEOUT_S,
+// APP_DB_QUERY_TIMEOUT_MS, POOL_LEAK_DETECTION_MS); identity's pools read them through this.
+Object.defineProperty(exports, "loadPoolTuning", { enumerable: true, get: function () { return app_config_js_2.loadPoolTuning; } });
 // G-009 R9: platform-root ids from `SHIELD_ROOT_IDS` (strict canonical uuids, fail closed).
 var root_ids_from_env_js_1 = require("./config/root-ids-from-env.js");
 Object.defineProperty(exports, "rootIdsFromEnv", { enumerable: true, get: function () { return root_ids_from_env_js_1.rootIdsFromEnv; } });
@@ -388,6 +391,11 @@ Object.defineProperty(exports, "reservedOperationPrincipal", { enumerable: true,
 // Phase 16: the driver `ssl` option every framework pool uses (identity's pools build on it).
 var connections_js_1 = require("./auth/connections.js");
 Object.defineProperty(exports, "mariadbSslOption", { enumerable: true, get: function () { return connections_js_1.mariadbSslOption; } });
+// G-026: the pool tuning options every framework pool spreads, and the per-statement opt-out of
+// the query timeout for fixed framework lock waits.
+var connections_js_2 = require("./auth/connections.js");
+Object.defineProperty(exports, "mariadbPoolTuningOptions", { enumerable: true, get: function () { return connections_js_2.mariadbPoolTuningOptions; } });
+Object.defineProperty(exports, "withoutStatementTimeout", { enumerable: true, get: function () { return connections_js_2.withoutStatementTimeout; } });
 // ---------------------------------------------------------------------------
 // Phase 0b Auth surface (framework-owned login → session, spec §2/§3/§4).
 //

package/dist/internal.d.ts

@@ -9,6 +9,12 @@
  */
 export { PersistenceModule } from './auth/persistence.module.js';
 export { SHIELD_DB_POOL } from './auth/tokens.js';
+/**
+ * Test surface only (G-026 spec 5.D): the audit sealer's own pool token. `PersistenceModule` does
+ * not export it (only the sealer injects it); a spec that stubs `SHIELD_DB_POOL` overrides this
+ * one too, else a real one-connection pool is opened for the sealer.
+ */
+export { SHIELD_AUDIT_SEALER_POOL } from './auth/tokens.js';
 export { MariaDbCredentialProvisioner } from './authentication/mariadb-credential-provisioner.js';
 /**
  * For `@astram/identity`'s invite rate limits only (G-010, spec P-5), not app use: guard's

package/dist/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE;;;GAGG;AACH,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE;;;GAGG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,sGAAsG;AACtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D;;;;GAIG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACjE;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,0CAA0C,CAAC;AAClD,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,sCAAsC,CAAC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD;;;;GAIG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAC;AAClG;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE;;;GAGG;AACH,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE;;;GAGG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,sGAAsG;AACtG,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D;;;;GAIG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACjE;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,0CAA0C,CAAC;AAClD,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,sCAAsC,CAAC"}

package/dist/internal.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MariaDbMfaResetter = exports.accountUnlockKeys = exports.AdminControlUnavailableError = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_REDIS = exports.AttemptLimiter = exports.MariaDbCredentialProvisioner = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
+exports.MariaDbMfaResetter = exports.accountUnlockKeys = exports.AdminControlUnavailableError = exports.SHIELD_ACCOUNT_UNLOCKER = exports.SHIELD_ADMIN_STEP_UP = exports.SHIELD_MFA_REQUIREMENT_SOURCE = exports.SHIELD_MFA_REQUIREMENT = exports.SHIELD_MFA_POLICY_FEATURE = exports.SHIELD_DEFAULT_AUTH_AUDIT_SINK = exports.SHIELD_ATTEMPT_LIMITER_FACTORY = exports.SHIELD_REDIS = exports.AttemptLimiter = exports.MariaDbCredentialProvisioner = exports.SHIELD_AUDIT_SEALER_POOL = exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
 /**
  * @astram/guard/internal — framework-composition and test surface (Phase 8 #5).
  *
@@ -14,6 +14,13 @@ var persistence_module_js_1 = require("./auth/persistence.module.js");
 Object.defineProperty(exports, "PersistenceModule", { enumerable: true, get: function () { return persistence_module_js_1.PersistenceModule; } });
 var tokens_js_1 = require("./auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_1.SHIELD_DB_POOL; } });
+/**
+ * Test surface only (G-026 spec 5.D): the audit sealer's own pool token. `PersistenceModule` does
+ * not export it (only the sealer injects it); a spec that stubs `SHIELD_DB_POOL` overrides this
+ * one too, else a real one-connection pool is opened for the sealer.
+ */
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_AUDIT_SEALER_POOL", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUDIT_SEALER_POOL; } });
 var mariadb_credential_provisioner_js_1 = require("./authentication/mariadb-credential-provisioner.js");
 Object.defineProperty(exports, "MariaDbCredentialProvisioner", { enumerable: true, get: function () { return mariadb_credential_provisioner_js_1.MariaDbCredentialProvisioner; } });
 /**
@@ -24,40 +31,40 @@ Object.defineProperty(exports, "MariaDbCredentialProvisioner", { enumerable: tru
  */
 var attempt_limiter_js_1 = require("./auth/rate-limit/attempt-limiter.js");
 Object.defineProperty(exports, "AttemptLimiter", { enumerable: true, get: function () { return attempt_limiter_js_1.AttemptLimiter; } });
-var tokens_js_2 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
 var tokens_js_3 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_ATTEMPT_LIMITER_FACTORY", { enumerable: true, get: function () { return tokens_js_3.SHIELD_ATTEMPT_LIMITER_FACTORY; } });
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_3.SHIELD_REDIS; } });
+var tokens_js_4 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_ATTEMPT_LIMITER_FACTORY", { enumerable: true, get: function () { return tokens_js_4.SHIELD_ATTEMPT_LIMITER_FACTORY; } });
 /**
  * For `@astram/identity` only (R12.1, B-3): the token identity binds its default auth audit sink
  * under, so guard's auth surface records to `audit_log` when the app supplies no `auditSink`.
  */
-var tokens_js_4 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_DEFAULT_AUTH_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_4.SHIELD_DEFAULT_AUTH_AUDIT_SINK; } });
+var tokens_js_5 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_DEFAULT_AUTH_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_5.SHIELD_DEFAULT_AUTH_AUDIT_SINK; } });
 /**
  * For `@astram/identity` only (auth capabilities R2): the token identity binds `true` when its
  * security-policy feature is registered, which turns guard's mandatory-2FA evaluation on.
  */
-var tokens_js_5 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_POLICY_FEATURE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_MFA_POLICY_FEATURE; } });
-/** Test surface (auth capabilities R2): the guard's mandatory-2FA service token (`null` when off). */
 var tokens_js_6 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT", { enumerable: true, get: function () { return tokens_js_6.SHIELD_MFA_REQUIREMENT; } });
+Object.defineProperty(exports, "SHIELD_MFA_POLICY_FEATURE", { enumerable: true, get: function () { return tokens_js_6.SHIELD_MFA_POLICY_FEATURE; } });
+/** Test surface (auth capabilities R2): the guard's mandatory-2FA service token (`null` when off). */
+var tokens_js_7 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_REQUIREMENT; } });
 /**
  * For `@astram/identity` only (auth capabilities R11.3): the guard's MariaDB mandatory-2FA source
  * token; identity's users list falls back to its batched confirmed-device read when the policy
  * feature is off.
  */
-var tokens_js_7 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT_SOURCE", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_REQUIREMENT_SOURCE; } });
+var tokens_js_8 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_REQUIREMENT_SOURCE", { enumerable: true, get: function () { return tokens_js_8.SHIELD_MFA_REQUIREMENT_SOURCE; } });
 /**
  * For `@astram/identity` only (auth capabilities R11, B-5): the admin sign-in controls. The step-up
  * (the admin's own TOTP on their `mfa:pid` budget), the account unlocker (login, MFA, recovery and
  * CAPTCHA account counters) and the MFA resetter identity builds over its runtime pool.
  */
-var tokens_js_8 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_ADMIN_STEP_UP", { enumerable: true, get: function () { return tokens_js_8.SHIELD_ADMIN_STEP_UP; } });
-Object.defineProperty(exports, "SHIELD_ACCOUNT_UNLOCKER", { enumerable: true, get: function () { return tokens_js_8.SHIELD_ACCOUNT_UNLOCKER; } });
+var tokens_js_9 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_ADMIN_STEP_UP", { enumerable: true, get: function () { return tokens_js_9.SHIELD_ADMIN_STEP_UP; } });
+Object.defineProperty(exports, "SHIELD_ACCOUNT_UNLOCKER", { enumerable: true, get: function () { return tokens_js_9.SHIELD_ACCOUNT_UNLOCKER; } });
 var admin_signin_controls_js_1 = require("./auth/admin-signin-controls.js");
 Object.defineProperty(exports, "AdminControlUnavailableError", { enumerable: true, get: function () { return admin_signin_controls_js_1.AdminControlUnavailableError; } });
 Object.defineProperty(exports, "accountUnlockKeys", { enumerable: true, get: function () { return admin_signin_controls_js_1.accountUnlockKeys; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -36,8 +36,8 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.5.4",
-    "@astram/core": "1.12.0",
-    "@astram/engine": "0.14.0"
+    "@astram/engine": "0.15.0",
+    "@astram/core": "1.12.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -45,7 +45,7 @@
     "@nestjs/platform-express": "^11",
     "reflect-metadata": "^0.2",
     "rxjs": "^7",
-    "@astram/messaging": "^0.1.6"
+    "@astram/messaging": "^0.1.7"
   },
   "peerDependenciesMeta": {
     "@astram/messaging": {
@@ -68,7 +68,7 @@
     "typescript": "^5.7.0",
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8",
-    "@astram/messaging": "0.1.6"
+    "@astram/messaging": "0.1.7"
   },
   "repository": {
     "type": "git",