@astram/guard 0.22.0 → 0.24.0

package/dist/index.js

@@ -16,11 +16,11 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.wasResolvedFromSecretRef = exports.assertNoUnresolvedSecretRefs = exports.createSecretsProviderFromEnv = exports.resolveBootSecrets = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.resolveAuthLinkBaseUrls = exports.CredentialExistsError = exports.isLockedHash = exports.lockedPasswordHash = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.uuidArrayField = exports.optionalUuidField = exports.uuidField = exports.UuidPipe = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_RECORD_AUTHORIZATION = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsOf = exports.actionsFor = exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
-exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.loadAuditSealConfig = exports.NodeSha256Hash = exports.NodeSha256Digest = exports.S3ObjectStore = void 0;
-exports.mariadbSslOption = exports.reservedOperationPrincipal = exports.RESERVED_OPERATION_PRINCIPALS = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadPoolTuning = exports.loadDbTlsConfig = exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = void 0;
-exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.SHIELD_CAPTCHA_GATE = exports.RECAPTCHA_SITEVERIFY_URL = exports.RecaptchaVerifier = exports.TURNSTILE_SITEVERIFY_URL = exports.TurnstileVerifier = exports.MAX_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_MIN_SCORE = exports.DEFAULT_CAPTCHA_THRESHOLD = exports.CAPTCHA_FAIL_MODES = exports.CAPTCHA_MODES = exports.CAPTCHA_ENDPOINTS = exports.loadCaptchaConfig = exports.SHIELD_SIGN_IN_WITH = exports.DEFAULT_SIGN_IN_WITH = exports.resolveSignInWith = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.withoutStatementTimeout = exports.mariadbPoolTuningOptions = void 0;
-exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = void 0;
+exports.assertNoUnresolvedSecretRefs = exports.createSecretsProviderFromEnv = exports.resolveBootSecrets = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.resolveAuthLinkBaseUrls = exports.CredentialExistsError = exports.isLockedHash = exports.lockedPasswordHash = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.uuidArrayField = exports.optionalUuidField = exports.uuidField = exports.UuidPipe = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_RECORD_AUTHORIZATION = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsOf = exports.actionsFor = exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.permissionTextByKey = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
+exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.RedisRecentRotationStore = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.loadObjectStorageConfig = exports.SHIELD_FILE_INGEST = exports.SHIELD_OBJECT_STORE = exports.FILE_INTAKE_DEFAULT_MAX_BYTES = exports.FILE_INTAKE_REQUEST_KEY = exports.FileIntake = exports.ObjectStoreBootCheck = exports.SHIELD_NOTIFICATIONS = exports.loadNotificationConfig = exports.NotificationUnavailableError = exports.NotificationValidationError = exports.NotificationKindError = exports.NOTIFICATION_CATEGORIES = exports.NotificationService = exports.loadAuditSealConfig = exports.NodeSha256Hash = exports.NodeSha256Digest = exports.S3ObjectStore = exports.wasResolvedFromSecretRef = void 0;
+exports.isDevOrTestNodeEnv = exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadRefreshReplayWindowMs = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.frameworkSchemasOf = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = exports.resolveMigrationLedgerCheck = exports.resolveMigrationLedger = exports.frameworkMigrationIds = exports.assertFrameworkMigrationsApplied = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = exports.MigrationLedgerRegistry = exports.FrameworkMigrationLedgerCheck = exports.frameworkDatabasesLogLine = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = void 0;
+exports.maskEmail = exports.isEmailShaped = exports.canonicalEmail = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.SHIELD_CAPTCHA_GATE = exports.RECAPTCHA_SITEVERIFY_URL = exports.RecaptchaVerifier = exports.TURNSTILE_SITEVERIFY_URL = exports.TurnstileVerifier = exports.MAX_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_TIMEOUT_MS = exports.DEFAULT_CAPTCHA_MIN_SCORE = exports.DEFAULT_CAPTCHA_THRESHOLD = exports.CAPTCHA_FAIL_MODES = exports.CAPTCHA_MODES = exports.CAPTCHA_ENDPOINTS = exports.loadCaptchaConfig = exports.SHIELD_SIGN_IN_WITH = exports.DEFAULT_SIGN_IN_WITH = exports.resolveSignInWith = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_MESSAGE_DISPATCHER = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_EMAIL_CHANGE_TOKEN_STORE = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.withoutStatementTimeout = exports.mariadbPoolTuningOptions = exports.mariadbSslOption = exports.reservedOperationPrincipal = exports.RESERVED_OPERATION_PRINCIPALS = exports.assertNoReservedRootId = exports.ORG_BOOTSTRAP_PRINCIPAL_ID = exports.rootIdsFromEnv = exports.loadPoolTuning = exports.loadDbTlsConfig = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.ConfirmEmailController = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.ProfileNameTakenError = exports.maskPhone = exports.MAX_MESSAGE_SEND_TIMEOUT_MS = exports.DEFAULT_MESSAGE_SEND_TIMEOUT_MS = exports.EMAIL_PROVIDER_VALUES = exports.loadMessageConfig = exports.MariaDbEmailAddressChanger = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -34,6 +34,7 @@ Object.defineProperty(exports, "guardMigrationsDir", { enumerable: true, get: fu
 // runtime option values the consumer threads in.
 var module_registry_bridge_js_1 = require("./identity/module-registry.bridge.js");
 Object.defineProperty(exports, "buildIdentityModuleRegistry", { enumerable: true, get: function () { return module_registry_bridge_js_1.buildIdentityModuleRegistry; } });
+Object.defineProperty(exports, "permissionTextByKey", { enumerable: true, get: function () { return module_registry_bridge_js_1.permissionTextByKey; } });
 var identity_actions_js_1 = require("./identity/identity-actions.js");
 Object.defineProperty(exports, "MODULE_KEY", { enumerable: true, get: function () { return identity_actions_js_1.MODULE_KEY; } });
 Object.defineProperty(exports, "IDENTITY_ACTIONS", { enumerable: true, get: function () { return identity_actions_js_1.IDENTITY_ACTIONS; } });
@@ -160,6 +161,19 @@ var node_sha256_hash_js_1 = require("./audit/node-sha256-hash.js");
 Object.defineProperty(exports, "NodeSha256Hash", { enumerable: true, get: function () { return node_sha256_hash_js_1.NodeSha256Hash; } });
 var audit_seal_config_js_1 = require("./audit/audit-seal-config.js");
 Object.defineProperty(exports, "loadAuditSealConfig", { enumerable: true, get: function () { return audit_seal_config_js_1.loadAuditSealConfig; } });
+// Notification store (G-027 step 2, notification-store SPEC §5B, §5C, §5F): post notices under
+// kinds registered in `ShieldModule.forRoot({ notificationKinds })`; bound with `auth: true`.
+var notification_service_js_1 = require("./notifications/notification.service.js");
+Object.defineProperty(exports, "NotificationService", { enumerable: true, get: function () { return notification_service_js_1.NotificationService; } });
+var ports_js_1 = require("./notifications/ports.js");
+Object.defineProperty(exports, "NOTIFICATION_CATEGORIES", { enumerable: true, get: function () { return ports_js_1.NOTIFICATION_CATEGORIES; } });
+Object.defineProperty(exports, "NotificationKindError", { enumerable: true, get: function () { return ports_js_1.NotificationKindError; } });
+Object.defineProperty(exports, "NotificationValidationError", { enumerable: true, get: function () { return ports_js_1.NotificationValidationError; } });
+Object.defineProperty(exports, "NotificationUnavailableError", { enumerable: true, get: function () { return ports_js_1.NotificationUnavailableError; } });
+var notification_config_js_1 = require("./config/notification-config.js");
+Object.defineProperty(exports, "loadNotificationConfig", { enumerable: true, get: function () { return notification_config_js_1.loadNotificationConfig; } });
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_NOTIFICATIONS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_NOTIFICATIONS; } });
 var object_store_boot_check_js_1 = require("./storage/object-store-boot-check.js");
 Object.defineProperty(exports, "ObjectStoreBootCheck", { enumerable: true, get: function () { return object_store_boot_check_js_1.ObjectStoreBootCheck; } });
 var file_intake_interceptor_js_1 = require("./storage/file-intake.interceptor.js");
@@ -310,12 +324,12 @@ var permission_version_cache_js_1 = require("./authz/permission-version-cache.js
 Object.defineProperty(exports, "RedisPermissionVersionCache", { enumerable: true, get: function () { return permission_version_cache_js_1.RedisPermissionVersionCache; } });
 Object.defineProperty(exports, "PERMISSION_VERSION_KEY_PREFIX", { enumerable: true, get: function () { return permission_version_cache_js_1.PERMISSION_VERSION_KEY_PREFIX; } });
 Object.defineProperty(exports, "DEFAULT_PERMISSION_VERSION_TTL_MS", { enumerable: true, get: function () { return permission_version_cache_js_1.DEFAULT_PERMISSION_VERSION_TTL_MS; } });
-var tokens_js_2 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_PERMISSION_VERSION_CACHE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PERMISSION_VERSION_CACHE; } });
+var tokens_js_3 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_PERMISSION_VERSION_CACHE", { enumerable: true, get: function () { return tokens_js_3.SHIELD_PERMISSION_VERSION_CACHE; } });
 // Durable session restrictions (Phase 3B review P1): the recovery-login re-enroll marker on the
 // durable session + the account status the refresh-time rebuild checks.
-var tokens_js_3 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SESSION_RESTRICTIONS", { enumerable: true, get: function () { return tokens_js_3.SHIELD_SESSION_RESTRICTIONS; } });
+var tokens_js_4 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_RESTRICTIONS", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SESSION_RESTRICTIONS; } });
 var session_restriction_store_js_1 = require("./session/session-restriction-store.js");
 Object.defineProperty(exports, "MariaDbSessionRestrictionStore", { enumerable: true, get: function () { return session_restriction_store_js_1.MariaDbSessionRestrictionStore; } });
 // The LIST-FORM sibling (Task 2.2): the engine-facing `ListScopeFn` the module wiring hands
@@ -408,38 +422,38 @@ Object.defineProperty(exports, "withoutStatementTimeout", { enumerable: true, ge
 // Shared DI provider tokens (the seams the teams bind/consume — see tokens.ts for
 // who provides/consumes each). The raw pool token `SHIELD_DB_POOL` is NOT here (Phase 8 #5):
 // it is on `@astram/guard/internal`, with the `PersistenceModule` that provides it.
-var tokens_js_4 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_4.SHIELD_REDIS; } });
-Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_CREDENTIAL_RESOLVER; } });
-Object.defineProperty(exports, "SHIELD_PROFILE_RESOLVER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_PROFILE_RESOLVER; } });
-Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_4.SHIELD_AUTHENTICATOR; } });
-Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SESSION_AUTHORITY; } });
+var tokens_js_5 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_5.SHIELD_REDIS; } });
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_5.SHIELD_CREDENTIAL_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_RESOLVER", { enumerable: true, get: function () { return tokens_js_5.SHIELD_PROFILE_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_5.SHIELD_AUTHENTICATOR; } });
+Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_5.SHIELD_SESSION_AUTHORITY; } });
 // Account & credential-surface seams (forgot/reset, change-password, MFA
 // enrollment, profile edit) — all OPTIONAL, consumer-plugged through
 // ShieldModule.forRoot. See tokens.ts for who provides/consumes each.
-Object.defineProperty(exports, "SHIELD_CREDENTIAL_WRITER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_CREDENTIAL_WRITER; } });
-Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_RESET_TOKEN_STORE; } });
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_WRITER", { enumerable: true, get: function () { return tokens_js_5.SHIELD_CREDENTIAL_WRITER; } });
+Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_RESET_TOKEN_STORE; } });
 // Phase 12 (KI #14): the self-service email-change token store (framework default).
-Object.defineProperty(exports, "SHIELD_EMAIL_CHANGE_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_EMAIL_CHANGE_TOKEN_STORE; } });
-Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_EMAIL_SENDER; } });
-Object.defineProperty(exports, "SHIELD_MESSAGE_DISPATCHER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_MESSAGE_DISPATCHER; } });
-Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_RECOVERY_CODE_STORE; } });
-Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_PROFILE_WRITER; } });
-Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SESSION_SWEEPER; } });
+Object.defineProperty(exports, "SHIELD_EMAIL_CHANGE_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_EMAIL_CHANGE_TOKEN_STORE; } });
+Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_5.SHIELD_EMAIL_SENDER; } });
+Object.defineProperty(exports, "SHIELD_MESSAGE_DISPATCHER", { enumerable: true, get: function () { return tokens_js_5.SHIELD_MESSAGE_DISPATCHER; } });
+Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_RECOVERY_CODE_STORE; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_5.SHIELD_PROFILE_WRITER; } });
+Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_5.SHIELD_SESSION_SWEEPER; } });
 // The auth-surface audit sink seam (the first auth audit event — recovery login).
-Object.defineProperty(exports, "SHIELD_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_4.SHIELD_AUDIT_SINK; } });
+Object.defineProperty(exports, "SHIELD_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_5.SHIELD_AUDIT_SINK; } });
 // The multi-device MFA store seam (multiple independent authenticator devices).
-Object.defineProperty(exports, "SHIELD_MFA_DEVICE_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_MFA_DEVICE_STORE; } });
+Object.defineProperty(exports, "SHIELD_MFA_DEVICE_STORE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_MFA_DEVICE_STORE; } });
 // The login totp-verifier OVERRIDE seam (Phase 2 — plug an OR-matching verifier).
-Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_TOTP_VERIFIER_OVERRIDE; } });
+Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: true, get: function () { return tokens_js_5.SHIELD_TOTP_VERIFIER_OVERRIDE; } });
 // The credential-store contract (skeleton — Team A implements the SELECT).
 var mariadb_credential_resolver_js_1 = require("./authentication/mariadb-credential-resolver.js");
 Object.defineProperty(exports, "MariaDbCredentialResolver", { enumerable: true, get: function () { return mariadb_credential_resolver_js_1.MariaDbCredentialResolver; } });
 var sign_in_with_js_1 = require("./authentication/sign-in-with.js");
 Object.defineProperty(exports, "resolveSignInWith", { enumerable: true, get: function () { return sign_in_with_js_1.resolveSignInWith; } });
 Object.defineProperty(exports, "DEFAULT_SIGN_IN_WITH", { enumerable: true, get: function () { return sign_in_with_js_1.DEFAULT_SIGN_IN_WITH; } });
-var tokens_js_5 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SIGN_IN_WITH", { enumerable: true, get: function () { return tokens_js_5.SHIELD_SIGN_IN_WITH; } });
+var tokens_js_6 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SIGN_IN_WITH", { enumerable: true, get: function () { return tokens_js_6.SHIELD_SIGN_IN_WITH; } });
 var captcha_config_js_1 = require("./config/captcha-config.js");
 Object.defineProperty(exports, "loadCaptchaConfig", { enumerable: true, get: function () { return captcha_config_js_1.loadCaptchaConfig; } });
 Object.defineProperty(exports, "CAPTCHA_ENDPOINTS", { enumerable: true, get: function () { return captcha_config_js_1.CAPTCHA_ENDPOINTS; } });
@@ -455,8 +469,8 @@ Object.defineProperty(exports, "TURNSTILE_SITEVERIFY_URL", { enumerable: true, g
 var recaptcha_verifier_js_1 = require("./captcha/recaptcha-verifier.js");
 Object.defineProperty(exports, "RecaptchaVerifier", { enumerable: true, get: function () { return recaptcha_verifier_js_1.RecaptchaVerifier; } });
 Object.defineProperty(exports, "RECAPTCHA_SITEVERIFY_URL", { enumerable: true, get: function () { return recaptcha_verifier_js_1.RECAPTCHA_SITEVERIFY_URL; } });
-var tokens_js_6 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_CAPTCHA_GATE", { enumerable: true, get: function () { return tokens_js_6.SHIELD_CAPTCHA_GATE; } });
+var tokens_js_7 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_CAPTCHA_GATE", { enumerable: true, get: function () { return tokens_js_7.SHIELD_CAPTCHA_GATE; } });
 // The composition module skeletons (Team B fills the factory bodies; the
 // integration owner imports AuthModule into ShieldModule — see auth.module.ts /
 // DONE.md).
@@ -494,10 +508,10 @@ var recipient_mask_js_1 = require("./messaging/recipient-mask.js");
 Object.defineProperty(exports, "maskPhone", { enumerable: true, get: function () { return recipient_mask_js_1.maskPhone; } });
 var profile_writer_js_1 = require("./auth/ports/profile-writer.js");
 Object.defineProperty(exports, "ProfileNameTakenError", { enumerable: true, get: function () { return profile_writer_js_1.ProfileNameTakenError; } });
-var tokens_js_7 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_7.SHIELD_SESSION_FACTS_PROJECTOR; } });
 var tokens_js_8 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SCOPE_SUBTREE_RESOLVER", { enumerable: true, get: function () { return tokens_js_8.SHIELD_SCOPE_SUBTREE_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_8.SHIELD_SESSION_FACTS_PROJECTOR; } });
+var tokens_js_9 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SCOPE_SUBTREE_RESOLVER", { enumerable: true, get: function () { return tokens_js_9.SHIELD_SCOPE_SUBTREE_RESOLVER; } });
 // The framework-owned `/auth/*` HTTP controller (Team C) + its pending-MFA store.
 // The controller CONSUMES SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY and the
 // PendingMfaStore. It is EXPORTED so AuthModule (Team B) / the integration owner
@@ -514,10 +528,10 @@ var mfa_step_up_js_1 = require("./auth/mfa-step-up.js");
 Object.defineProperty(exports, "CredentialMfaStepUp", { enumerable: true, get: function () { return mfa_step_up_js_1.CredentialMfaStepUp; } });
 Object.defineProperty(exports, "credentialFingerprint", { enumerable: true, get: function () { return mfa_step_up_js_1.credentialFingerprint; } });
 Object.defineProperty(exports, "challengeMatches", { enumerable: true, get: function () { return mfa_step_up_js_1.challengeMatches; } });
-var tokens_js_9 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_MFA_LIMITER", { enumerable: true, get: function () { return tokens_js_9.SHIELD_MFA_LIMITER; } });
-Object.defineProperty(exports, "SHIELD_MFA_STEP_UP", { enumerable: true, get: function () { return tokens_js_9.SHIELD_MFA_STEP_UP; } });
-Object.defineProperty(exports, "SHIELD_LOGIN_TOTP_VERIFIER", { enumerable: true, get: function () { return tokens_js_9.SHIELD_LOGIN_TOTP_VERIFIER; } });
+var tokens_js_10 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_LIMITER", { enumerable: true, get: function () { return tokens_js_10.SHIELD_MFA_LIMITER; } });
+Object.defineProperty(exports, "SHIELD_MFA_STEP_UP", { enumerable: true, get: function () { return tokens_js_10.SHIELD_MFA_STEP_UP; } });
+Object.defineProperty(exports, "SHIELD_LOGIN_TOTP_VERIFIER", { enumerable: true, get: function () { return tokens_js_10.SHIELD_LOGIN_TOTP_VERIFIER; } });
 // The pure TOTP-enrollment helpers (Phase 4 MFA). Re-exported for consumers/tests
 // that need them; the multi-device MFA routes (Phase 3) reuse them to mint a device
 // secret + provisioning URI + recovery codes. (The old in-memory

package/dist/module/shield.module.d.ts

@@ -20,6 +20,7 @@ import type { SignInMethod } from '../authentication/sign-in-with.js';
 export { SHIELD_DECISION_AUTHORITY, SHIELD_RECORD_AUTHORIZATION };
 import { type ShieldStorageOption } from '../storage/storage.providers.js';
 import type { ShieldCaptchaOption } from '../captcha/captcha.providers.js';
+import type { NotificationKindRegistration } from '../notifications/ports.js';
 export type { RecordAuthorizationInputs } from '../authz/wire-record-authorization.js';
 /**
  * Options for {@link ShieldModule.forRoot}. Intentionally minimal (ADR-0023 §7 —
@@ -227,6 +228,15 @@ export interface ShieldModuleOptions {
      * pinged at boot (fail closed). `SHIELD_FILE_INGEST` (used by `FileIntake`) is always bound.
      */
     readonly storage?: ShieldStorageOption;
+    /**
+     * G-027 step 2 (notification-store SPEC §5C): the kinds app code may post notices under, each
+     * `{ kind, category: 'announcement' | 'personal' }`. Kind pattern
+     * `^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$`, ≤ 64 characters, `shield.` reserved for the framework.
+     * Validated at registration (also without `auth`); a bad, duplicate or `shield.` entry fails the
+     * boot naming the kind. `NotificationService.post` (`SHIELD_NOTIFICATIONS`, `auth: true`)
+     * refuses any other kind and takes the category from here.
+     */
+    readonly notificationKinds?: readonly NotificationKindRegistration[];
 }
 /** Async variant of {@link ShieldModuleOptions} (DI-computed config). */
 export interface ShieldModuleAsyncOptions {
@@ -342,6 +352,8 @@ export interface ShieldModuleAsyncOptions {
     readonly captcha?: ShieldCaptchaOption;
     /** See {@link ShieldModuleOptions.storage}. STATIC here (registration-time, like `auth`). */
     readonly storage?: ShieldStorageOption;
+    /** See {@link ShieldModuleOptions.notificationKinds}. STATIC here (registration-time). */
+    readonly notificationKinds?: readonly NotificationKindRegistration[];
 }
 /**
  * `ShieldModule` — the SINGLE registration seam (ADR-0023 §4).

package/dist/module/shield.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAoB,MAAM,cAAc,CAAC;AAQzF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AASzE,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAsC5F,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,CAAC;AAElE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAI3E,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AA6JvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,+FAA+F;IAC/F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,4FAA4F;IAC5F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC;AAYD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAsHhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAkItE"}
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAoB,MAAM,cAAc,CAAC;AAQzF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AASzE,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAsC5F,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,CAAC;AAElE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAK9E,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AA6JvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtE;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,+FAA+F;IAC/F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,4FAA4F;IAC5F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,0FAA0F;IAC1F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;CACtE;AAYD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IA4HhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAsItE"}

package/dist/module/shield.module.js

@@ -87,6 +87,7 @@ Object.defineProperty(exports, "SHIELD_DECISION_AUTHORITY", { enumerable: true,
 Object.defineProperty(exports, "SHIELD_RECORD_AUTHORIZATION", { enumerable: true, get: function () { return shield_tokens_js_1.SHIELD_RECORD_AUTHORIZATION; } });
 // FILE_STORAGE SPEC §6: the `storage` option (S3 adapter loaded lazily inside the provider).
 const storage_providers_js_1 = require("../storage/storage.providers.js");
+const notification_service_js_1 = require("../notifications/notification.service.js");
 /**
  * A `Function`-wrapped dynamic `import()` that survives the CommonJS **build** — the same
  * shim as auth.module.ts's `evalImport`. Under `module: commonjs`, `tsc` would rewrite a
@@ -229,6 +230,9 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
     static forRoot(options = {}) {
         // G-009 N4: a reserved operation principal is never a root, however `rootIds` was built.
         (0, reserved_principal_ids_js_1.assertNoReservedRootId)(options.rootIds);
+        // G-027 step 2: a bad `notificationKinds` entry fails the boot naming the kind, with or
+        // without auth (AuthModule re-validates the same list when it composes).
+        (0, notification_service_js_1.resolveNotificationKinds)(options.notificationKinds);
         const config = options.config ?? loadEnvAppConfig();
         // ADR-0035: with auth on and no explicit projector, sessions cache the facts the framework-built
         // authority decides on (attached when the authority is built; inactive until then).
@@ -286,6 +290,9 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                     : {}),
                 ...(options.signInWith !== undefined ? { signInWith: options.signInWith } : {}),
                 ...(options.captcha !== undefined ? { captcha: options.captcha } : {}),
+                ...(options.notificationKinds !== undefined
+                    ? { notificationKinds: options.notificationKinds }
+                    : {}),
             })
             : undefined;
         return {
@@ -346,6 +353,7 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
      */
     static forRootAsync(options) {
         (0, reserved_principal_ids_js_1.assertNoReservedRootId)(options.rootIds); // G-009 N4 (the static allowlist; see forRoot)
+        (0, notification_service_js_1.resolveNotificationKinds)(options.notificationKinds); // G-027 step 2 (see forRoot)
         const optionsToken = Symbol('SHIELD_MODULE_OPTIONS');
         const asyncOptionsProvider = {
             provide: optionsToken,
@@ -427,6 +435,9 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                     : {}),
                 ...(options.signInWith !== undefined ? { signInWith: options.signInWith } : {}),
                 ...(options.captcha !== undefined ? { captcha: options.captcha } : {}),
+                ...(options.notificationKinds !== undefined
+                    ? { notificationKinds: options.notificationKinds }
+                    : {}),
             })
             : undefined;
         return {

package/dist/notifications/mariadb-notification-store.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `MariaDbNotificationStore` — the framework-default {@link NotificationStore} (notification-store
+ * SPEC §5A) over `<ns>_identity.user_notification` (identity migration 108), on guard's core pool
+ * (`<ns>_core`, DML on `<ns>_identity`). Database names are resolved at construction, never per
+ * request; every statement is parameterized.
+ *
+ * Tenant wall (core 50 #4, #7; Shield #4): every per-user statement filters `un_user_uuid = ?
+ * AND un_tenant_id = ?`, including the post-insert count. `purge` is the one statement that is
+ * not per-user: it is the retention sweep over the whole table, bounded by `LIMIT`.
+ *
+ * `insertMany` is ONE multi-row `INSERT … ON DUPLICATE KEY UPDATE un_dedupe_key = un_dedupe_key`:
+ * a repeated `(user, tenant, dedupe key)` is a no-op on `uq_un_dedupe`; never `INSERT IGNORE`
+ * (that would also hide FK and data errors). The inserted count is NOT read from `affectedRows`:
+ * the `mariadb` driver connects with `CLIENT_FOUND_ROWS` by default (`foundRows` defaults to true,
+ * `lib/config/connection-options.js`), so an ODKU row left unchanged reports 1, the same as an
+ * insert. Instead the store counts its own freshly generated `un_uuid`s right after the insert, on
+ * the same `query` (the caller's transaction when given, so it sees its own uncommitted rows).
+ */
+import type { Pool } from 'mariadb';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
+import { type NotificationCategory, type NotificationInsert, type NotificationListQuery, type NotificationListResult, type NotificationRetentionPolicy, type NotificationStore, type NotificationUnreadCounts, type NotificationWriteOptions } from './ports.js';
+/** Rows per `insertMany` statement (the `post` recipient cap, SPEC §10). */
+export declare const NOTIFICATION_INSERT_MAX_ROWS = 1000;
+export declare class MariaDbNotificationStore implements NotificationStore {
+    private readonly pool;
+    /** `<identity>`.`user_notification`, resolved at construction. */
+    private readonly table;
+    constructor(pool: Pick<Pool, 'query'>, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
+    list(userId: string, tenantId: string, query: NotificationListQuery): Promise<NotificationListResult>;
+    countUnread(userId: string, tenantId: string): Promise<NotificationUnreadCounts>;
+    markRead(userId: string, tenantId: string, uuid: string, nowMs: number): Promise<boolean>;
+    markAllRead(userId: string, tenantId: string, category: NotificationCategory | undefined, nowMs: number): Promise<number>;
+    insertMany(rows: readonly NotificationInsert[], opts?: NotificationWriteOptions): Promise<number>;
+    purge(nowMs: number, policy: NotificationRetentionPolicy, maxRows: number): Promise<number>;
+}
+//# sourceMappingURL=mariadb-notification-store.d.ts.map

package/dist/notifications/mariadb-notification-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-notification-store.d.ts","sourceRoot":"","sources":["../../src/notifications/mariadb-notification-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAE3B,KAAK,2BAA2B,EAEhC,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAIpB,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAgDjD,qBAAa,wBAAyB,YAAW,iBAAiB;IAK9D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,kEAAkE;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;IAC1C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,IAAI,CACR,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC;IA2B5B,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAchF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBzF,WAAW,CACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAWZ,UAAU,CACd,IAAI,EAAE,SAAS,kBAAkB,EAAE,EACnC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,MAAM,CAAC;IAuDZ,KAAK,CACT,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,2BAA2B,EACnC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;CAiBnB"}

package/dist/notifications/mariadb-notification-store.js

@@ -0,0 +1,151 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbNotificationStore = exports.NOTIFICATION_INSERT_MAX_ROWS = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
+const ports_js_1 = require("./ports.js");
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** Rows per `insertMany` statement (the `post` recipient cap, SPEC §10). */
+exports.NOTIFICATION_INSERT_MAX_ROWS = 1000;
+const SELECT_COLUMNS = 'un_uuid, un_category, un_kind, un_title, un_body, un_link, un_created_at_ms, un_read_at_ms';
+function isCategory(v) {
+    return ports_js_1.NOTIFICATION_CATEGORIES.includes(v);
+}
+/** BIGINT columns may arrive as bigint; the epoch-ms range fits a safe integer. */
+const toRow = (r) => ({
+    uuid: String(r.un_uuid),
+    // The column carries a CHECK constraint; an unexpected value is still never passed on raw.
+    category: isCategory(r.un_category) ? r.un_category : 'personal',
+    kind: r.un_kind,
+    title: r.un_title,
+    body: r.un_body ?? null,
+    link: r.un_link ?? null,
+    createdAtMs: Number(r.un_created_at_ms),
+    readAtMs: r.un_read_at_ms == null ? null : Number(r.un_read_at_ms),
+});
+function affected(res) {
+    return Number(res?.affectedRows ?? 0);
+}
+function countOf(rows) {
+    const first = Array.isArray(rows) ? rows[0] : undefined;
+    return Number(first?.c ?? 0);
+}
+function assertPositiveInteger(name, v, max) {
+    if (!Number.isSafeInteger(v) || v < 1 || (max !== undefined && v > max)) {
+        throw new RangeError(`MariaDbNotificationStore: ${name} is out of range`);
+    }
+}
+class MariaDbNotificationStore {
+    pool;
+    /** `<identity>`.`user_notification`, resolved at construction. */
+    table;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
+        this.pool = pool;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'user_notification');
+    }
+    async list(userId, tenantId, query) {
+        assertPositiveInteger('page', query.page);
+        assertPositiveInteger('limit', query.limit, 100);
+        const where = ['un_user_uuid = ?', 'un_tenant_id = ?'];
+        const params = [userId, tenantId];
+        if (query.category !== undefined) {
+            where.push('un_category = ?');
+            params.push(query.category);
+        }
+        if (query.unreadOnly)
+            where.push('un_read_at_ms IS NULL');
+        const clause = where.join(' AND ');
+        const total = countOf(await this.pool.query(`SELECT COUNT(*) AS c FROM ${this.table} WHERE ${clause}`, params));
+        if (total === 0)
+            return { total: 0, rows: [] };
+        const offset = (query.page - 1) * query.limit;
+        if (!Number.isSafeInteger(offset)) {
+            throw new RangeError('MariaDbNotificationStore: page is out of range');
+        }
+        const rows = (await this.pool.query(`SELECT ${SELECT_COLUMNS} FROM ${this.table} WHERE ${clause}
+        ORDER BY un_created_at_ms DESC, un_uuid DESC LIMIT ? OFFSET ?`, [...params, query.limit, offset]));
+        return { total, rows: rows.map(toRow) };
+    }
+    async countUnread(userId, tenantId) {
+        const rows = (await this.pool.query(`SELECT un_category, COUNT(*) AS c FROM ${this.table}
+        WHERE un_user_uuid = ? AND un_tenant_id = ? AND un_read_at_ms IS NULL
+        GROUP BY un_category`, [userId, tenantId]));
+        const counts = { announcement: 0, personal: 0 };
+        for (const r of rows) {
+            if (isCategory(r.un_category))
+                counts[r.un_category] = Number(r.c);
+        }
+        return counts;
+    }
+    async markRead(userId, tenantId, uuid, nowMs) {
+        const res = await this.pool.query(`UPDATE ${this.table} SET un_read_at_ms = ?
+        WHERE un_uuid = ? AND un_user_uuid = ? AND un_tenant_id = ? AND un_read_at_ms IS NULL`, [nowMs, uuid, userId, tenantId]);
+        if (affected(res) > 0)
+            return true;
+        // Already read (the first read time is kept) or not this caller's notice in this tenant.
+        const rows = (await this.pool.query(`SELECT 1 AS found FROM ${this.table}
+        WHERE un_uuid = ? AND un_user_uuid = ? AND un_tenant_id = ? LIMIT 1`, [uuid, userId, tenantId]));
+        return rows.length > 0;
+    }
+    async markAllRead(userId, tenantId, category, nowMs) {
+        const params = [nowMs, userId, tenantId];
+        let sql = `UPDATE ${this.table} SET un_read_at_ms = ?
+        WHERE un_user_uuid = ? AND un_tenant_id = ? AND un_read_at_ms IS NULL`;
+        if (category !== undefined) {
+            sql += ' AND un_category = ?';
+            params.push(category);
+        }
+        return affected(await this.pool.query(sql, params));
+    }
+    async insertMany(rows, opts = {}) {
+        if (rows.length === 0)
+            return 0;
+        if (rows.length > exports.NOTIFICATION_INSERT_MAX_ROWS) {
+            throw new RangeError('MariaDbNotificationStore: too many rows for one insert');
+        }
+        const run = opts.query ?? ((sql, params) => this.pool.query(sql, params));
+        const params = [];
+        for (const r of rows) {
+            params.push(r.uuid, r.tenantId, r.userId, r.category, r.kind, r.title, r.body, r.link, r.dedupeKey, r.createdAtMs);
+        }
+        const values = rows.map(() => '(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)').join(', ');
+        await run(`INSERT INTO ${this.table}
+         (un_uuid, un_tenant_id, un_user_uuid, un_category, un_kind, un_title, un_body, un_link,
+          un_dedupe_key, un_created_at_ms, un_read_at_ms)
+       VALUES ${values}
+       ON DUPLICATE KEY UPDATE un_dedupe_key = un_dedupe_key`, params);
+        // Count the rows that landed (see the file header: affectedRows cannot tell an ODKU no-op from
+        // an insert). Grouped by tenant so every statement stays tenant- and user-scoped.
+        const byTenant = new Map();
+        for (const r of rows) {
+            const group = byTenant.get(r.tenantId);
+            if (group)
+                group.push(r);
+            else
+                byTenant.set(r.tenantId, [r]);
+        }
+        let inserted = 0;
+        for (const [tenantId, group] of byTenant) {
+            const users = [...new Set(group.map((r) => r.userId))];
+            const marks = (n) => new Array(n).fill('?').join(', ');
+            inserted += countOf(await run(`SELECT COUNT(*) AS c FROM ${this.table}
+            WHERE un_tenant_id = ? AND un_user_uuid IN (${marks(users.length)})
+              AND un_uuid IN (${marks(group.length)})`, [tenantId, ...users, ...group.map((r) => r.uuid)]));
+        }
+        return inserted;
+    }
+    async purge(nowMs, policy, maxRows) {
+        assertPositiveInteger('maxRows', maxRows);
+        const readCutoff = nowMs - policy.readDays * DAY_MS;
+        const maxCutoff = nowMs - policy.maxDays * DAY_MS;
+        // `maxDays ≥ readDays` (loader rule) ⇒ maxCutoff ≤ readCutoff, so the leading range keeps the
+        // statement on `idx_un_created`: read notices older than the read retention, and every notice
+        // older than the max retention.
+        const lead = Math.max(readCutoff, maxCutoff);
+        return affected(await this.pool.query(`DELETE FROM ${this.table}
+          WHERE un_created_at_ms < ? AND (un_read_at_ms IS NOT NULL OR un_created_at_ms < ?)
+          ORDER BY un_created_at_ms LIMIT ?`, [lead, maxCutoff, maxRows]));
+    }
+}
+exports.MariaDbNotificationStore = MariaDbNotificationStore;

package/dist/notifications/notification-retention.job.d.ts

@@ -0,0 +1,52 @@
+/**
+ * `NotificationRetentionJob` — deletes expired notices (notification-store SPEC §5E, §10, §11).
+ *
+ * Registered with `ShieldModule.forRoot({ auth: true })` beside the store, over guard's core pool
+ * `SHIELD_DB_POOL` (it does not own the pool: `ConnectionLifecycle` ends it in
+ * `onApplicationShutdown`, after this job stopped).
+ *
+ * - First pass {@link NOTIFICATION_RETENTION_FIRST_RUN_MS} after bootstrap, then one pass every
+ *   {@link NOTIFICATION_RETENTION_INTERVAL_MS} (hourly), scheduled only after the previous pass
+ *   settled, so passes never overlap.
+ * - One pass = one `purge` of at most {@link NOTIFICATION_RETENTION_BATCH} rows: read notices older
+ *   than `NOTIFICATION_READ_RETENTION_DAYS`, any notice older than `NOTIFICATION_MAX_RETENTION_DAYS`.
+ * - A failed pass is logged by error class only (never the driver message) and retried at the next
+ *   interval; nothing here throws into Nest, so it never blocks boot (a missing table, migration
+ *   108 not applied, is just a logged pass).
+ * - Every timer is `unref()`'d. `onModuleDestroy` (Nest `close()` step 1) clears the timer and
+ *   waits for a running pass. Off the request path (Shield #12).
+ */
+import { type OnApplicationBootstrap, type OnModuleDestroy } from '@nestjs/common';
+import type { NotificationRetentionPolicy, NotificationStore } from './ports.js';
+export declare const NOTIFICATION_RETENTION_FIRST_RUN_MS = 5000;
+export declare const NOTIFICATION_RETENTION_INTERVAL_MS: number;
+export declare const NOTIFICATION_RETENTION_BATCH = 5000;
+export interface NotificationRetentionLogger {
+    log(message: string): void;
+    error(message: string): void;
+}
+export interface NotificationRetentionJobOptions {
+    /** Default `Date.now`. */
+    readonly now?: () => number;
+    /** Default `new Logger('Shield')`. */
+    readonly logger?: NotificationRetentionLogger;
+}
+export declare class NotificationRetentionJob implements OnApplicationBootstrap, OnModuleDestroy {
+    private readonly store;
+    private readonly policy;
+    private readonly now;
+    private readonly logger;
+    private stopped;
+    private timer;
+    private inFlight;
+    constructor(store: Pick<NotificationStore, 'purge'>, policy: NotificationRetentionPolicy, options?: NotificationRetentionJobOptions);
+    onApplicationBootstrap(): void;
+    onModuleDestroy(): Promise<void>;
+    /**
+     * One retention pass; resolves to the deleted count, or `null` when the pass failed (logged).
+     * Exposed for tests and operators; the timer calls it hourly.
+     */
+    runOnce(): Promise<number | null>;
+    private schedule;
+}
+//# sourceMappingURL=notification-retention.job.d.ts.map

package/dist/notifications/notification-retention.job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-retention.job.d.ts","sourceRoot":"","sources":["../../src/notifications/notification-retention.job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEjF,eAAO,MAAM,mCAAmC,OAAQ,CAAC;AACzD,eAAO,MAAM,kCAAkC,QAAiB,CAAC;AACjE,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,+BAA+B;IAC9C,0BAA0B;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,CAAC;CAC/C;AAED,qBACa,wBAAyB,YAAW,sBAAsB,EAAE,eAAe;IAQpF,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,QAAQ,CAA4B;gBAGzB,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,EACvC,MAAM,EAAE,2BAA2B,EACpD,OAAO,GAAE,+BAAoC;IAM/C,sBAAsB,IAAI,IAAI;IAIxB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAavC,OAAO,CAAC,QAAQ;CAcjB"}