@astram/guard 0.21.0 → 0.23.0

package/dist/boot/boot-sequence.d.ts

@@ -1,6 +1,6 @@
 import { type OnApplicationBootstrap } from '@nestjs/common';
 import type { FrameworkSchemas } from '@astram/core';
-import { type AppConfig, type PoolBudgetConfig } from '../config/app-config.js';
+import { type AppConfig, type PoolBudgetConfig, type PoolTuning } from '../config/app-config.js';
 /**
  * Boot sequence extension point (Infrastructure layer — ADR-0018).
  *
@@ -11,7 +11,7 @@ import { type AppConfig, type PoolBudgetConfig } from '../config/app-config.js';
  * ───────────────────────────────────────────────────────────────────────────
  * ADR-0018 connection-pool assertion (FILLED).
  * {@link assertConnectionPoolReady} computes the connection budget
- *   workers × Σ(per-account runtime pool max) + headroom ≤ maxConnections
+ *   workers × (Σ(per-account runtime pool max) + 1 audit sealer) + headroom ≤ maxConnections
  * and THROWS (fail-closed, abort boot) on violation, so a pool config that
  * would exceed MariaDB's `max_connections` is caught at boot, never under load.
  * ───────────────────────────────────────────────────────────────────────────
@@ -35,6 +35,11 @@ export declare class BootSequence implements OnApplicationBootstrap {
 }
 /** The boot log line naming the resolved framework databases (names only, spec 5.E). */
 export declare function frameworkDatabasesLogLine(s: FrameworkSchemas): string;
+/**
+ * The boot log line with the effective pool idle settings (G-026 spec 5.N), numbers only, e.g.
+ * `DB pools: minIdle=1 idleTimeout=600s queryTimeout=off leakDetection=off sealer=1`.
+ */
+export declare function poolTuningLogLine(t: PoolTuning): string;
 /**
  * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
  * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the

package/dist/boot/boot-sequence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAKrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAsC5D"}
+{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAe7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAKrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CA0C5D"}

package/dist/boot/boot-sequence.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BootSequence = void 0;
 exports.frameworkDatabasesLogLine = frameworkDatabasesLogLine;
+exports.poolTuningLogLine = poolTuningLogLine;
 exports.shieldDbNameIgnoredWarning = shieldDbNameIgnoredWarning;
 exports.assertPoolBudget = assertPoolBudget;
 const common_1 = require("@nestjs/common");
@@ -29,7 +30,7 @@ const app_config_js_1 = require("../config/app-config.js");
  * ───────────────────────────────────────────────────────────────────────────
  * ADR-0018 connection-pool assertion (FILLED).
  * {@link assertConnectionPoolReady} computes the connection budget
- *   workers × Σ(per-account runtime pool max) + headroom ≤ maxConnections
+ *   workers × (Σ(per-account runtime pool max) + 1 audit sealer) + headroom ≤ maxConnections
  * and THROWS (fail-closed, abort boot) on violation, so a pool config that
  * would exceed MariaDB's `max_connections` is caught at boot, never under load.
  * ───────────────────────────────────────────────────────────────────────────
@@ -44,6 +45,8 @@ let BootSequence = class BootSequence {
         // configurable-framework-db spec 5.E: the resolved database names, once per boot. Names
         // only — never a user, password, host or connection string.
         this.logger.log(frameworkDatabasesLogLine((0, app_config_js_1.frameworkSchemasOf)(this.config)));
+        // G-026 spec 5.N: the effective pool idle settings, numbers only.
+        this.logger.log(poolTuningLogLine((0, app_config_js_1.poolTuningOf)(this.config)));
         // Spec 5.C/AC-1: SHIELD_DB_NAME is read only in the single layout; say so when it is ignored.
         const ignored = shieldDbNameIgnoredWarning(process.env);
         if (ignored !== undefined)
@@ -81,6 +84,16 @@ function frameworkDatabasesLogLine(s) {
     return (`Shield databases: namespace=${s.namespace} app=${s.app} identity=${s.identity} ` +
         `authz=${s.authz} audit=${s.audit}`);
 }
+/**
+ * The boot log line with the effective pool idle settings (G-026 spec 5.N), numbers only, e.g.
+ * `DB pools: minIdle=1 idleTimeout=600s queryTimeout=off leakDetection=off sealer=1`.
+ */
+function poolTuningLogLine(t) {
+    const ms = (v) => (v === undefined ? 'off' : `${v}ms`);
+    return (`DB pools: minIdle=${t.minimumIdle} idleTimeout=${t.idleTimeoutS}s ` +
+        `queryTimeout=${ms(t.queryTimeoutMs)} leakDetection=${ms(t.leakDetectionMs)} ` +
+        `sealer=${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS}`);
+}
 /**
  * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
  * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
@@ -113,7 +126,8 @@ function assertPoolBudget(cfg) {
     if (!e.withinUserBudget) {
         throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): single layout needs ' +
             `${e.requiredConnections} connections (workers(${cfg.workers}) × ` +
-            `${e.perWorkerConnections} + headroom(${cfg.headroom})) but the account allows ` +
+            `${e.perWorkerConnections} (audit sealer's ${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS} per worker ` +
+            `included) + headroom(${cfg.headroom})) but the account allows ` +
             `${cfg.maxUserConnections} (APP_DB_MAX_USER_CONNECTIONS). Reduce POOL_MAX_CORE, ` +
             'POOL_MAX_ENGINE, APP_AUTHZ_POOL_MAX, POOL_WORKERS or POOL_HEADROOM, or raise ' +
             'MAX_USER_CONNECTIONS on the account (ADR-0041).');
@@ -122,11 +136,14 @@ function assertPoolBudget(cfg) {
         throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): required ' +
             `connections ${e.requiredConnections} exceed max_connections ` +
             `${cfg.maxConnections}. Budget = workers(${cfg.workers}) × ` +
-            `Σ(per-account pool max)(${e.perWorkerConnections}) + headroom(` +
+            `(Σ(per-account pool max) + audit sealer ${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS})` +
+            `(${e.perWorkerConnections}) + headroom(` +
             `${cfg.headroom}) = ${e.requiredConnections} > ${cfg.maxConnections}. ` +
+            `The audit sealer's own pool counts ${app_config_js_1.AUDIT_SEALER_POOL_CONNECTIONS} per worker. ` +
             (cfg.layout === 'single'
                 ? 'Single layout: one account opens POOL_MAX_CORE + POOL_MAX_ENGINE (unset ⇒ ' +
-                    'APP_DB_MAX_CONNECTIONS, else 10) + APP_AUTHZ_POOL_MAX per worker; set POOL_MAX_ENGINE ' +
+                    'APP_DB_MAX_CONNECTIONS, else 10) + APP_AUTHZ_POOL_MAX + 1 (audit sealer) per worker; ' +
+                    'set POOL_MAX_ENGINE ' +
                     'explicitly, lower a pool cap or the worker count, or raise max_connections.'
                 : 'Reduce a per-account pool cap, the worker count, or raise ' +
                     'max_connections (and MariaDB my.cnf) to restore the budget.'));

package/dist/completeness/catalog-reconciler.d.ts

@@ -1,4 +1,5 @@
 import type { OperationInventory, ModuleRegistry } from '@astram/core';
+import type { PermissionText } from '@astram/engine';
 import type { CatalogStore, ReconcileReport } from './ports/catalog-store.js';
 /** A @Classified route could not be gated (stranded or key-not-registered). Boot must
  *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
@@ -15,7 +16,21 @@ export declare class CatalogReconciler {
      * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
      * marks orphaned any stored row with no registered action, reactivates revived ones.
      * Idempotent. Returns a report for logging + /health/catalog.
+     *
+     * G-027 (spec §5E): `opts.text` (from `permissionTextByKey`) supplies label, description
+     * and caution; a key without text gets the engine's generated label. An insert stamps
+     * `firstSeenAt`/`lastActivatedAt = nowIso` and `firstSeenVersion = opts.release ?? null`;
+     * a reactivation stamps `lastActivatedAt` only. First-seen fields are never sent anywhere
+     * but the insert (spec §11, §13). A registered row whose text differs from `opts.text` is
+     * rewritten through ONE `store.updateText` call (skipped when the store lacks it).
      */
-    reconcile(registry: ModuleRegistry, store: CatalogStore, nowIso: string): Promise<ReconcileReport>;
+    reconcile(registry: ModuleRegistry, store: CatalogStore, nowIso: string, opts?: ReconcileOptions): Promise<ReconcileReport>;
+}
+/** Options of {@link CatalogReconciler.reconcile} (G-027, spec §5E). */
+export interface ReconcileOptions {
+    /** Permission key → code text (`permissionTextByKey`). Absent ⇒ generated labels, no relabel. */
+    readonly text?: ReadonlyMap<string, PermissionText>;
+    /** The app release (`APP_RELEASE`) stamped as `firstSeenVersion` on insert; absent ⇒ null. */
+    readonly release?: string | null;
 }
 //# sourceMappingURL=catalog-reconciler.d.ts.map

package/dist/completeness/catalog-reconciler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-reconciler.d.ts","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E;iFACiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAgB5E;;;;OAIG;IACG,SAAS,CACb,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC;CAoC5B"}
+{"version":3,"file":"catalog-reconciler.d.ts","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,KAAK,EAEV,YAAY,EAEZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC;iFACiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAgB5E;;;;;;;;;;;OAWG;IACG,SAAS,CACb,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,eAAe,CAAC;CA2D5B;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACpD,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC"}

package/dist/completeness/catalog-reconciler.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CatalogReconciler = exports.CatalogGatabilityError = void 0;
 // astram-framework/packages/guard/src/completeness/catalog-reconciler.ts
 const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+const identity_actions_js_1 = require("../identity/identity-actions.js");
 /** A @Classified route could not be gated (stranded or key-not-registered). Boot must
  *  abort — an ungatable route may never serve traffic (ADR-0002 fail-closed). */
 class CatalogGatabilityError extends Error {
@@ -32,43 +34,105 @@ class CatalogReconciler {
      * CRON — mutating. Auto-adds an ACTIVE catalog row per registered non-public action,
      * marks orphaned any stored row with no registered action, reactivates revived ones.
      * Idempotent. Returns a report for logging + /health/catalog.
+     *
+     * G-027 (spec §5E): `opts.text` (from `permissionTextByKey`) supplies label, description
+     * and caution; a key without text gets the engine's generated label. An insert stamps
+     * `firstSeenAt`/`lastActivatedAt = nowIso` and `firstSeenVersion = opts.release ?? null`;
+     * a reactivation stamps `lastActivatedAt` only. First-seen fields are never sent anywhere
+     * but the insert (spec §11, §13). A registered row whose text differs from `opts.text` is
+     * rewritten through ONE `store.updateText` call (skipped when the store lacks it).
      */
-    async reconcile(registry, store, nowIso) {
+    async reconcile(registry, store, nowIso, opts) {
+        const text = opts?.text;
+        const release = opts?.release ?? null;
         const stored = await store.listPermissions();
         const storedByKey = new Map(stored.map((r) => [r.permissionKey, r]));
         const registered = registry.listActions().filter((a) => a.tier !== 'public');
         const registeredKeys = new Set(registered.map((a) => a.permissionKey));
-        // code → catalog: add missing rows; revive orphaned-but-now-registered.
+        // code → catalog: add missing rows; revive orphaned-but-now-registered; queue text rewrites.
         const added = [];
         const reactivated = [];
+        const textUpdates = [];
         for (const a of registered) {
             const key = a.permissionKey;
             const existing = storedByKey.get(key);
             if (!existing) {
+                const t = text?.get(key) ?? generatedText(registry, a.action.typeKey, a.action.actionKey);
                 const inserted = await store.upsertPermission({
                     permissionKey: key,
                     moduleKey: a.moduleKey,
                     typeKey: a.action.typeKey,
                     action: a.action.actionKey,
-                    label: `${a.action.actionKey} ${a.action.typeKey}`,
+                    label: t.label,
                     tier: a.tier,
+                    description: t.description,
+                    caution: t.caution,
+                    firstSeenAt: nowIso,
+                    firstSeenVersion: release,
+                    lastActivatedAt: nowIso,
                 });
                 if (inserted)
                     added.push(key);
+                continue;
             }
-            else if (existing.status === 'orphaned') {
+            if (existing.status === 'orphaned')
                 reactivated.push(key);
+            const t = text?.get(key);
+            if (t && textDiffers(existing, t)) {
+                textUpdates.push({
+                    permissionKey: key,
+                    label: t.label,
+                    description: t.description,
+                    caution: t.caution,
+                });
             }
         }
         if (reactivated.length)
-            await store.markActive(reactivated);
+            await store.markActive(reactivated, nowIso);
+        const relabelled = [];
+        if (textUpdates.length && store.updateText) {
+            await store.updateText(textUpdates);
+            relabelled.push(...textUpdates.map((u) => u.permissionKey));
+        }
         // catalog → code: mark orphaned any active stored row with no registered action.
         const orphaned = stored
             .filter((r) => r.status === 'active' && !registeredKeys.has(r.permissionKey))
             .map((r) => r.permissionKey);
         if (orphaned.length)
             await store.markOrphaned(orphaned);
-        return { added, orphaned, reactivated, at: nowIso };
+        return { added, orphaned, reactivated, relabelled, at: nowIso };
     }
 }
 exports.CatalogReconciler = CatalogReconciler;
+/** Stored vs code text, with absent/undefined normalised to null. */
+function textDiffers(row, t) {
+    return (row.label !== t.label ||
+        (row.description ?? null) !== (t.description ?? null) ||
+        (row.caution ?? null) !== (t.caution ?? null));
+}
+/**
+ * The engine's generated text for a key with no text map entry (spec §10): engine
+ * `permissionTextOf` over a one-action declaration, the type label taken from the registry
+ * descriptor when it differs from the typeKey (the bridge sets `reg.label ?? typeKey`), else
+ * the humanized typeKey. A registry the engine rules cannot describe (e.g. a non-engine
+ * module's reserved action or an out-of-limits label) keeps the pre-G-027 label.
+ */
+function generatedText(registry, typeKey, actionKey) {
+    const descriptorLabel = registry.resolveObjectType(typeKey)?.label;
+    const label = descriptorLabel && descriptorLabel !== typeKey ? descriptorLabel : undefined;
+    const isCrud = identity_actions_js_1.IDENTITY_ACTIONS.includes(actionKey);
+    try {
+        const [t] = (0, engine_1.permissionTextOf)({
+            typeKey,
+            ...(label !== undefined ? { label } : {}),
+            ...(isCrud ? {} : { crudActions: false, actions: [actionKey] }),
+        }).filter((p) => p.action === actionKey);
+        if (t)
+            return t;
+    }
+    catch (err) {
+        if (!(err instanceof engine_1.RegistrationError))
+            throw err;
+    }
+    return { label: `${actionKey} ${typeKey}`, description: null, caution: null };
+}

package/dist/completeness/ports/catalog-store.d.ts

@@ -3,6 +3,12 @@
  * the consumer app supplies the implementation (ADR-0003 — guard does no DB). A row is
  * keyed by its permission key (`moduleKey:typeKey:actionKey`); `status` is the soft
  * active/orphaned marker (never hard-delete).
+ *
+ * G-027 (permission text + first seen): the text and date fields are OPTIONAL and additive,
+ * so a store written before them keeps compiling. `firstSeenAt`/`firstSeenVersion` are
+ * written once, by the insert, and never changed afterwards (insert-only; the reconciler never
+ * asks the store to update them). Dates are ISO strings; `null` = unknown (e.g. a key that
+ * existed before tracking).
  */
 export interface CatalogPermissionRow {
     readonly permissionKey: string;
@@ -12,22 +18,51 @@ export interface CatalogPermissionRow {
     readonly label: string;
     readonly tier: string;
     readonly status: 'active' | 'orphaned';
+    /** What holding the permission lets a person do (plain text). */
+    readonly description?: string | null;
+    /** Optional warning shown to whoever grants it (plain text). */
+    readonly caution?: string | null;
+    /** When the key was first catalogued (ISO); insert-only. */
+    readonly firstSeenAt?: string | null;
+    /** The app release (`APP_RELEASE`) that first catalogued the key; insert-only. */
+    readonly firstSeenVersion?: string | null;
+    /** When the key last became active (insert or orphaned → active), ISO. */
+    readonly lastActivatedAt?: string | null;
+}
+/** One text rewrite the reconciler asks for (code text replaces stored text, G-027). */
+export interface CatalogTextUpdate {
+    readonly permissionKey: string;
+    readonly label: string;
+    readonly description: string | null;
+    readonly caution: string | null;
 }
 /** The result of one mutating reconcile pass — surfaced via /health/catalog + logged. */
 export interface ReconcileReport {
     readonly added: readonly string[];
     readonly orphaned: readonly string[];
     readonly reactivated: readonly string[];
+    readonly relabelled: readonly string[];
     readonly at: string;
 }
 export interface CatalogStore {
     /** All catalog rows (both active + orphaned). */
     listPermissions(): Promise<CatalogPermissionRow[]>;
-    /** Idempotent insert of an ACTIVE row (no-op if the key already exists as active). */
+    /**
+     * Idempotent insert of an ACTIVE row (no-op if the key already exists). Insert-only: an
+     * existing row is never updated here, so its first-seen fields keep their first values.
+     */
     upsertPermission(row: Omit<CatalogPermissionRow, 'status'>): Promise<boolean>;
     /** Mark keys orphaned (soft). No-op for keys already orphaned. */
     markOrphaned(keys: readonly string[]): Promise<void>;
-    /** Flip keys orphaned → active (a route returned). */
-    markActive(keys: readonly string[]): Promise<void>;
+    /**
+     * Flip keys orphaned → active (a route returned). With `nowIso`, stamp `lastActivatedAt`;
+     * never touch `firstSeenAt`/`firstSeenVersion`.
+     */
+    markActive(keys: readonly string[], nowIso?: string): Promise<void>;
+    /**
+     * OPTIONAL (G-027): rewrite label/description/caution of existing rows to the code's text.
+     * Writes only those three fields. A store without it still reconciles (no relabelling).
+     */
+    updateText?(rows: readonly CatalogTextUpdate[]): Promise<void>;
 }
 //# sourceMappingURL=catalog-store.d.ts.map

package/dist/completeness/ports/catalog-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-store.d.ts","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnD,sFAAsF;IACtF,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,sDAAsD;IACtD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}
+{"version":3,"file":"catalog-store.d.ts","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IACvC,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,kFAAkF;IAClF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnD;;;OAGG;IACH,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;OAGG;IACH,UAAU,CAAC,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE"}

package/dist/config/app-config.d.ts

@@ -11,7 +11,7 @@
  *
  * ─────────────────────────────────────────────────────────────────────────────
  * ADR-0018 budget (the invariant this config feeds):
- *   workers × Σ(per-account RUNTIME pool max) + headroom ≤ maxConnections
+ *   workers × (Σ(per-account RUNTIME pool max) + 1 audit sealer) + headroom ≤ maxConnections
  *
  * "Runtime" pools are the pools each PM2 cluster worker holds open: shield_core,
  * shield_app_crud, shield_schema_svc. The deploy/ops accounts (migrate, backup,
@@ -20,7 +20,7 @@
  *
  * Defaults below agree byte-for-byte with infra/mariadb/conf.d/my.cnf
  * (max_connections=250) and the local docker-compose substrate:
- *   8 × (12 + 8 + 1) + 40 = 208 ≤ 250  ✓
+ *   8 × (12 + 8 + 1 + 1 sealer) + 40 = 216 ≤ 250  ✓ (G-026: the sealer's own 1-connection pool)
  * ─────────────────────────────────────────────────────────────────────────────
  */
 import type { FrameworkSchemas, SecretsProvider } from '@astram/core';
@@ -81,6 +81,13 @@ export interface AppConfig {
      * from `process.env` once at boot. Provided app-wide under `FRAMEWORK_SCHEMAS`.
      */
     readonly schemas?: FrameworkSchemas;
+    /**
+     * G-026 (db-pool-idle spec 5.A, 5.C): the idle and timeout settings every framework pool applies
+     * (`POOL_MIN_IDLE`, `POOL_IDLE_TIMEOUT_S`, `APP_DB_QUERY_TIMEOUT_MS`, `POOL_LEAK_DETECTION_MS`),
+     * filled by {@link loadAppConfig}. Optional so hand-built configs keep compiling; absent ⇒ the
+     * pool factories read {@link loadPoolTuning}`(process.env)` once at boot.
+     */
+    readonly poolTuning?: PoolTuning;
 }
 /**
  * The resolved framework database names for a config: `config.schemas`, else resolved from
@@ -219,6 +226,41 @@ export declare const SCHEMA_SVC_POOL_HARD_CAP = 2;
  * unset NODE_ENV is treated as "not dev").
  */
 export declare function isDevOrTestNodeEnv(raw: string | undefined): boolean;
+/**
+ * G-026 (db-pool-idle spec 5.A, section 10): the idle and timeout settings of the framework pools.
+ * Caps are unchanged (they stay in {@link PoolBudgetConfig}); these only decide how many idle
+ * connections a pool keeps and how long a statement may run.
+ */
+export interface PoolTuning {
+    /** `POOL_MIN_IDLE` (default 1, 0–1000): idle connections kept; each pool caps it at its own cap. */
+    readonly minimumIdle: number;
+    /** `POOL_IDLE_TIMEOUT_S` (default 600, 10–3600): seconds before an idle connection above the minimum closes. */
+    readonly idleTimeoutS: number;
+    /**
+     * `APP_DB_QUERY_TIMEOUT_MS` (unset ⇒ off, 1000–3600000): the session `max_statement_time` of every
+     * request-serving pool. Never applied to the audit sealer pool; framework lock waits opt out
+     * per statement (`withoutStatementTimeout`).
+     */
+    readonly queryTimeoutMs?: number;
+    /** `POOL_LEAK_DETECTION_MS` (unset ⇒ off, 1000–600000): log a connection held longer than this. */
+    readonly leakDetectionMs?: number;
+}
+/** Section 10 defaults: one idle connection per pool, closed after 10 idle minutes. */
+export declare const DEFAULT_POOL_MIN_IDLE = 1;
+export declare const DEFAULT_POOL_IDLE_TIMEOUT_S = 600;
+/**
+ * Read the pool idle and timeout settings (db-pool-idle spec 5.A). Pure; every framework pool uses
+ * this one loader (no pool reads the variables itself). A set but invalid or out-of-range value
+ * throws naming the variable; blank or unset gives the default (off for the two optional ones).
+ */
+export declare function loadPoolTuning(env?: NodeJS.ProcessEnv): PoolTuning;
+/** The tuning for a config: `config.poolTuning`, else read from `process.env` (call at boot only). */
+export declare function poolTuningOf(config: Pick<AppConfig, 'poolTuning'>): PoolTuning;
+/**
+ * The audit sealer's own pool (db-pool-idle spec 5.D): one connection per worker, always counted
+ * in the budget (5.F), whether or not `auth: true` starts the sealer.
+ */
+export declare const AUDIT_SEALER_POOL_CONNECTIONS = 1;
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
@@ -393,7 +435,7 @@ export declare const DEFAULT_OBJECT_STORAGE_MAX_BYTES: number;
 export declare function loadObjectStorageConfig(env?: NodeJS.ProcessEnv, options?: LoadObjectStorageConfigOptions): ObjectStorageConfig | undefined;
 /** Result of evaluating a {@link PoolBudgetConfig} against the ADR-0018 budget. */
 export interface PoolBudgetEvaluation {
-    /** Σ(per-account runtime pool max) for a single worker. */
+    /** Σ(per-account runtime pool max) + the audit sealer's 1, for a single worker. */
     readonly perWorkerConnections: number;
     /** workers × perWorkerConnections — total runtime connections at full load. */
     readonly runtimeConnections: number;

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA4CrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CA0BV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAc7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAyB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AA2BD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gHAAgH;IAChH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,mGAAmG;IACnG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAsB/C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAwB/E;AAED,sGAAsG;AACtG,wBAAgB,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,UAAU,CAE9E;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA4CrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CA0BV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAe7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CA0B9E"}

package/dist/config/app-config.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
+exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.AUDIT_SEALER_POOL_CONNECTIONS = exports.DEFAULT_POOL_IDLE_TIMEOUT_S = exports.DEFAULT_POOL_MIN_IDLE = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
 exports.frameworkSchemasOf = frameworkSchemasOf;
 exports.isDevOrTestNodeEnv = isDevOrTestNodeEnv;
+exports.loadPoolTuning = loadPoolTuning;
+exports.poolTuningOf = poolTuningOf;
 exports.loadPoolBudget = loadPoolBudget;
 exports.loadDbConfig = loadDbConfig;
 exports.loadDbTlsConfig = loadDbTlsConfig;
@@ -99,6 +101,51 @@ function strictOptionalPoolInt(raw, name) {
         throw new Error(`${name} must be a positive integer`);
     return n;
 }
+/** Section 10 defaults: one idle connection per pool, closed after 10 idle minutes. */
+exports.DEFAULT_POOL_MIN_IDLE = 1;
+exports.DEFAULT_POOL_IDLE_TIMEOUT_S = 600;
+/**
+ * A tuning variable: unset or blank gives `undefined`; otherwise plain digits (surrounding
+ * whitespace allowed) within `[min, max]`, or it throws naming the variable and the range, never the
+ * value (fail closed, Shield #1, core 70-secrets).
+ */
+function strictOptionalRangeInt(raw, name, min, max) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const t = raw.trim();
+    const n = /^[0-9]+$/.test(t) ? Number(t) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < min || n > max) {
+        throw new Error(`${name} must be an integer ${min}–${max}`);
+    }
+    return n;
+}
+/**
+ * Read the pool idle and timeout settings (db-pool-idle spec 5.A). Pure; every framework pool uses
+ * this one loader (no pool reads the variables itself). A set but invalid or out-of-range value
+ * throws naming the variable; blank or unset gives the default (off for the two optional ones).
+ */
+function loadPoolTuning(env = process.env) {
+    const minimumIdle = strictOptionalRangeInt(env.POOL_MIN_IDLE, 'POOL_MIN_IDLE', 0, 1000) ?? exports.DEFAULT_POOL_MIN_IDLE;
+    const idleTimeoutS = strictOptionalRangeInt(env.POOL_IDLE_TIMEOUT_S, 'POOL_IDLE_TIMEOUT_S', 10, 3600) ??
+        exports.DEFAULT_POOL_IDLE_TIMEOUT_S;
+    const queryTimeoutMs = strictOptionalRangeInt(env.APP_DB_QUERY_TIMEOUT_MS, 'APP_DB_QUERY_TIMEOUT_MS', 1000, 3_600_000);
+    const leakDetectionMs = strictOptionalRangeInt(env.POOL_LEAK_DETECTION_MS, 'POOL_LEAK_DETECTION_MS', 1000, 600_000);
+    return {
+        minimumIdle,
+        idleTimeoutS,
+        ...(queryTimeoutMs !== undefined ? { queryTimeoutMs } : {}),
+        ...(leakDetectionMs !== undefined ? { leakDetectionMs } : {}),
+    };
+}
+/** The tuning for a config: `config.poolTuning`, else read from `process.env` (call at boot only). */
+function poolTuningOf(config) {
+    return config.poolTuning ?? loadPoolTuning(process.env);
+}
+/**
+ * The audit sealer's own pool (db-pool-idle spec 5.D): one connection per worker, always counted
+ * in the budget (5.F), whether or not `auth: true` starts the sealer.
+ */
+exports.AUDIT_SEALER_POOL_CONNECTIONS = 1;
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
@@ -362,6 +409,7 @@ function loadAppConfig(env = process.env) {
         lifetimes: loadSessionLifetimes(env),
         loginIpLimit: loadLoginIpLimit(env),
         ...(refreshReplayWindowMs !== undefined ? { refreshReplayWindowMs } : {}),
+        poolTuning: loadPoolTuning(env),
     };
 }
 /**
@@ -479,11 +527,12 @@ function parseStorageMaxBytes(raw) {
  */
 function evaluatePoolBudget(cfg) {
     // Single layout (AC-12): one account opens core + engine + authz; app_crud/schema_svc are never opened.
-    const perWorkerConnections = cfg.layout === 'single'
+    // Both layouts add the audit sealer's own pool (G-026 spec 5.F: 1 per worker, always counted).
+    const perWorkerConnections = (cfg.layout === 'single'
         ? cfg.perAccountMax.shield_core + (cfg.engineMax ?? 10) + (cfg.authzMax ?? 4)
         : cfg.perAccountMax.shield_core +
             cfg.perAccountMax.shield_app_crud +
-            cfg.perAccountMax.shield_schema_svc;
+            cfg.perAccountMax.shield_schema_svc) + exports.AUDIT_SEALER_POOL_CONNECTIONS;
     const runtimeConnections = cfg.workers * perWorkerConnections;
     const requiredConnections = runtimeConnections + cfg.headroom;
     const slack = cfg.maxConnections - requiredConnections;

package/dist/identity/module-registry.bridge.d.ts

@@ -1,4 +1,12 @@
 import type { ModuleRegistry } from '@astram/core';
-import type { ObjectTypeInput } from '@astram/engine';
+import type { ObjectTypeInput, PermissionText } from '@astram/engine';
 export declare function buildIdentityModuleRegistry(inputs: readonly ObjectTypeInput[]): ModuleRegistry;
+/**
+ * G-027 (spec §5D): the permission text of every action of the given types, keyed by the SAME
+ * permission key {@link buildIdentityModuleRegistry} registers (`MODULE_KEY` + core
+ * `derivePermissionKey`). Engine `permissionTextOf` gives the text in `effectiveActions` order
+ * (= {@link actionsOf}); declared text wins, else the generated label. Throws engine's
+ * `RegistrationError` on invalid text, like the registry build.
+ */
+export declare function permissionTextByKey(inputs: readonly ObjectTypeInput[]): ReadonlyMap<string, PermissionText>;
 //# sourceMappingURL=module-registry.bridge.d.ts.map

package/dist/identity/module-registry.bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CA+B9F"}
+{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AASlF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CAgC9F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,eAAe,EAAE,GACjC,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAQrC"}

package/dist/identity/module-registry.bridge.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildIdentityModuleRegistry = buildIdentityModuleRegistry;
+exports.permissionTextByKey = permissionTextByKey;
 /**
  * Bridge: engine ObjectTypes → a populated core ModuleRegistry. Ported from astram3 (framework
  * now owns identity). Engine ObjectTypes describe physical tables; core's gates + the
@@ -25,7 +26,8 @@ function buildIdentityModuleRegistry(inputs) {
         const access = (0, core_access_js_1.coreAccessOf)(r.access);
         return {
             typeKey: r.typeKey,
-            label: r.typeKey,
+            // G-027: the type's declared human name, else its typeKey (core contract unchanged).
+            label: r.label ?? r.typeKey,
             fields: r.fields.map((f) => {
                 const ref = (0, engine_1.referencedTypeOf)(f);
                 return { key: f.key, label: f.key, ...(ref ? { referencesTypeKey: ref } : {}) };
@@ -48,3 +50,19 @@ function buildIdentityModuleRegistry(inputs) {
     registry.register(metadata);
     return registry;
 }
+/**
+ * G-027 (spec §5D): the permission text of every action of the given types, keyed by the SAME
+ * permission key {@link buildIdentityModuleRegistry} registers (`MODULE_KEY` + core
+ * `derivePermissionKey`). Engine `permissionTextOf` gives the text in `effectiveActions` order
+ * (= {@link actionsOf}); declared text wins, else the generated label. Throws engine's
+ * `RegistrationError` on invalid text, like the registry build.
+ */
+function permissionTextByKey(inputs) {
+    const out = new Map();
+    for (const reg of inputs.map(toObjectType)) {
+        for (const t of (0, engine_1.permissionTextOf)(reg)) {
+            out.set((0, core_1.derivePermissionKey)(identity_actions_js_1.MODULE_KEY, reg.typeKey, t.action), t);
+        }
+    }
+    return out;
+}

package/dist/index.d.ts

@@ -15,7 +15,8 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 export { guardMigrationsDir } from './migrations-dir.js';
-export { buildIdentityModuleRegistry } from './identity/module-registry.bridge.js';
+export { buildIdentityModuleRegistry, permissionTextByKey, } from './identity/module-registry.bridge.js';
+export type { PermissionText } from '@astram/engine';
 export { MODULE_KEY, IDENTITY_ACTIONS, CROSS_TENANT_GRANT_ACTIONS, RECORD_SHARE_ACTIONS, SERVICE_ACCOUNT_ACTIONS, actionsFor, actionsOf, } from './identity/identity-actions.js';
 export { ShieldModule, SHIELD_DECISION_AUTHORITY, SHIELD_RECORD_AUTHORIZATION, type ShieldModuleOptions, type ShieldModuleAsyncOptions, type RecordAuthorizationInputs, } from './module/shield.module.js';
 export { Public, Classified, CLASSIFICATION_METADATA, DEFAULT_CLASSIFIED_ACTION, normalizeClassification, } from './enforcement/classification.decorator.js';
@@ -23,7 +24,8 @@ export type { Classification } from './enforcement/classification.decorator.js';
 export { UuidPipe, uuidField, optionalUuidField, uuidArrayField } from './enforcement/uuid.pipe.js';
 export { OperationInventoryScanner } from './completeness/operation-inventory-scanner.js';
 export { CatalogReconciler, CatalogGatabilityError } from './completeness/catalog-reconciler.js';
-export type { CatalogStore, CatalogPermissionRow, ReconcileReport, } from './completeness/ports/catalog-store.js';
+export type { ReconcileOptions } from './completeness/catalog-reconciler.js';
+export type { CatalogStore, CatalogPermissionRow, CatalogTextUpdate, ReconcileReport, } from './completeness/ports/catalog-store.js';
 export { SHIELD_SESSION_TOKEN_BINDER, SHIELD_SERVICE_AUTHENTICATOR, } from './request-auth/tokens.js';
 export { SessionTokenBinder } from './request-auth/session-token-binder.js';
 export type { BoundPrincipalClaims, SessionTokenBinderOptions, } from './request-auth/session-token-binder.js';
@@ -70,10 +72,11 @@ export { FrameworkMigrationLedgerCheck, MigrationLedgerRegistry, SHIELD_MIGRATIO
 export { APP_CONFIG } from './config/config.module.js';
 export { FRAMEWORK_SCHEMAS } from './config/config.module.js';
 export type { FrameworkSchemaNames } from './config/framework-schema-names.js';
-export { frameworkSchemasOf, loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, loadLoginIpLimit, loadRefreshReplayWindowMs, DEFAULT_LOGIN_IP_LIMIT, isDevOrTestNodeEnv, type LoginIpLimitConfig, loadDbTlsConfig, type DbTlsConfig, } from './config/app-config.js';
+export { frameworkSchemasOf, loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, loadLoginIpLimit, loadRefreshReplayWindowMs, DEFAULT_LOGIN_IP_LIMIT, isDevOrTestNodeEnv, type LoginIpLimitConfig, loadDbTlsConfig, type DbTlsConfig, loadPoolTuning, type PoolTuning, } from './config/app-config.js';
 export { rootIdsFromEnv } from './config/root-ids-from-env.js';
 export { ORG_BOOTSTRAP_PRINCIPAL_ID, assertNoReservedRootId, RESERVED_OPERATION_PRINCIPALS, reservedOperationPrincipal, type ReservedOperationPrincipal, } from './config/reserved-principal-ids.js';
 export { mariadbSslOption } from './auth/connections.js';
+export { mariadbPoolTuningOptions, withoutStatementTimeout, type MariadbPoolTuningOptions, type MariadbPoolTuningOptionsOpts, } from './auth/connections.js';
 export { SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_CHANGE_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_MESSAGE_DISPATCHER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
 export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
 export { resolveSignInWith, DEFAULT_SIGN_IN_WITH, type SignInMethod, } from './authentication/sign-in-with.js';