@astram/guard 0.4.0 → 0.4.1

package/dist/config/app-config.d.ts

@@ -147,12 +147,11 @@ export declare const SCHEMA_SVC_POOL_HARD_CAP = 2;
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
  *   workers                       ← POOL_WORKERS
- *   maxConnections                ← DB_MAX_CONNECTIONS
+ *   maxConnections                ← APP_DB_MAX_CONNECTIONS
  *   headroom                      ← POOL_HEADROOM
  *   perAccountMax.shield_core     ← POOL_MAX_CORE
  *   perAccountMax.shield_app_crud ← POOL_MAX_APP_CRUD
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
- * (Legacy `SHIELD_`-prefixed names are still read as a fallback — see {@link readEnv}.)
  */
 export declare function loadPoolBudget(env?: NodeJS.ProcessEnv): PoolBudgetConfig;
 /** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
@@ -162,9 +161,9 @@ export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
 /**
  * Build the runtime {@link DbConfig} from env with documented defaults.
  * Field ↔ env name:
- *   host     ← DB_HOST      port     ← DB_PORT
- *   user     ← DB_USER      password ← DB_PASSWORD (secret)
- *   database ← DB_NAME    (legacy SHIELD_DB_* still read as a fallback)
+ *   host     ← APP_DB_HOST      port     ← APP_DB_PORT
+ *   user     ← APP_DB_USER      password ← APP_DB_PASSWORD (secret)
+ *   database ← APP_DB_NAME
  * The password defaults to '' when absent — a live connection then fails at
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
@@ -174,7 +173,7 @@ export declare function loadDbConfig(env?: NodeJS.ProcessEnv): DbConfig;
 /**
  * Build the {@link RedisConfig} from env. Prefers `REDIS_URL`; falls back
  * to composing `redis://host:port` from `REDIS_HOST`/`REDIS_PORT`, else the
- * documented default. (Legacy `SHIELD_REDIS_*` names still read as a fallback.)
+ * documented default.
  */
 export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
 /**
@@ -186,7 +185,6 @@ export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
  *   accessTtlMs          ← ACCESS_TTL_MS
  *   refreshIdleMs        ← REFRESH_IDLE_MS
  *   refreshAbsoluteCapMs ← REFRESH_ABSOLUTE_CAP_MS
- * (Legacy `SHIELD_`-prefixed names still read as a fallback.)
  */
 export declare function loadSessionLifetimes(env?: NodeJS.ProcessEnv): SessionLifetimeOverrides;
 /**

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoD1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}

package/dist/config/app-config.js

@@ -48,22 +48,21 @@ function parsePositiveInt(raw, fallback) {
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
  *   workers                       ← POOL_WORKERS
- *   maxConnections                ← DB_MAX_CONNECTIONS
+ *   maxConnections                ← APP_DB_MAX_CONNECTIONS
  *   headroom                      ← POOL_HEADROOM
  *   perAccountMax.shield_core     ← POOL_MAX_CORE
  *   perAccountMax.shield_app_crud ← POOL_MAX_APP_CRUD
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
- * (Legacy `SHIELD_`-prefixed names are still read as a fallback — see {@link readEnv}.)
  */
 function loadPoolBudget(env = process.env) {
     return {
-        workers: parsePositiveInt(readEnv(env, 'POOL_WORKERS'), exports.DEFAULT_POOL_BUDGET.workers),
-        maxConnections: parsePositiveInt(readEnv(env, 'DB_MAX_CONNECTIONS'), exports.DEFAULT_POOL_BUDGET.maxConnections),
-        headroom: parsePositiveInt(readEnv(env, 'POOL_HEADROOM'), exports.DEFAULT_POOL_BUDGET.headroom),
+        workers: parsePositiveInt(env.POOL_WORKERS, exports.DEFAULT_POOL_BUDGET.workers),
+        maxConnections: parsePositiveInt(env.APP_DB_MAX_CONNECTIONS, exports.DEFAULT_POOL_BUDGET.maxConnections),
+        headroom: parsePositiveInt(env.POOL_HEADROOM, exports.DEFAULT_POOL_BUDGET.headroom),
         perAccountMax: {
-            shield_core: parsePositiveInt(readEnv(env, 'POOL_MAX_CORE'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_core),
-            shield_app_crud: parsePositiveInt(readEnv(env, 'POOL_MAX_APP_CRUD'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_app_crud),
-            shield_schema_svc: parsePositiveInt(readEnv(env, 'POOL_MAX_SCHEMA_SVC'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_schema_svc),
+            shield_core: parsePositiveInt(env.POOL_MAX_CORE, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_core),
+            shield_app_crud: parsePositiveInt(env.POOL_MAX_APP_CRUD, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_app_crud),
+            shield_schema_svc: parsePositiveInt(env.POOL_MAX_SCHEMA_SVC, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_schema_svc),
         },
     };
 }
@@ -81,36 +80,6 @@ exports.DEFAULT_DB_CONFIG = {
 };
 /** Documented default Redis url (local docker substrate). */
 exports.DEFAULT_REDIS_URL = 'redis://localhost:6379';
-/**
- * Read a consumer-facing env var by its CURRENT (unprefixed) name, falling back to
- * the LEGACY `SHIELD_`-prefixed name for one deprecation window. The framework's
- * public config vars were debranded from `SHIELD_*` to bare names (e.g.
- * `SHIELD_DB_HOST` → `DB_HOST`); reading both keeps existing `.env` files (which may
- * still set `SHIELD_*`) working unchanged. The new name wins when both are set.
- * A non-blank legacy value emits a one-time deprecation warning (never logs secrets —
- * only the var NAME). Internal DI-token symbols (`Symbol('SHIELD_...')`) are unrelated
- * and unchanged.
- */
-const legacyEnvWarned = new Set();
-function readEnv(env, name) {
-    const current = env[name];
-    if (current !== undefined && current.trim() !== '')
-        return current;
-    const legacyName = `SHIELD_${name}`;
-    const legacy = env[legacyName];
-    if (legacy !== undefined && legacy.trim() !== '') {
-        if (!legacyEnvWarned.has(legacyName)) {
-            legacyEnvWarned.add(legacyName);
-            // eslint-disable-next-line no-console
-            console.warn(`[astram] env var '${legacyName}' is deprecated — rename it to '${name}'. ` +
-                `The SHIELD_ prefix will be removed in a future release.`);
-        }
-        return legacy;
-    }
-    // Return whichever was present-but-blank (so parseString applies its own fallback),
-    // preferring the current name.
-    return current ?? legacy;
-}
 /** Read a string from env with a fallback (trims; blank ⇒ fallback). */
 function parseString(raw, fallback) {
     if (raw === undefined || raw.trim() === '')
@@ -132,9 +101,9 @@ function parseOptionalPositiveInt(raw) {
 /**
  * Build the runtime {@link DbConfig} from env with documented defaults.
  * Field ↔ env name:
- *   host     ← DB_HOST      port     ← DB_PORT
- *   user     ← DB_USER      password ← DB_PASSWORD (secret)
- *   database ← DB_NAME    (legacy SHIELD_DB_* still read as a fallback)
+ *   host     ← APP_DB_HOST      port     ← APP_DB_PORT
+ *   user     ← APP_DB_USER      password ← APP_DB_PASSWORD (secret)
+ *   database ← APP_DB_NAME
  * The password defaults to '' when absent — a live connection then fails at
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
@@ -142,25 +111,25 @@ function parseOptionalPositiveInt(raw) {
  */
 function loadDbConfig(env = process.env) {
     return {
-        host: parseString(readEnv(env, 'DB_HOST'), exports.DEFAULT_DB_CONFIG.host),
-        port: parsePort(readEnv(env, 'DB_PORT'), exports.DEFAULT_DB_CONFIG.port),
-        user: parseString(readEnv(env, 'DB_USER'), exports.DEFAULT_DB_CONFIG.user),
-        password: parseString(readEnv(env, 'DB_PASSWORD'), ''),
-        database: parseString(readEnv(env, 'DB_NAME'), exports.DEFAULT_DB_CONFIG.database),
+        host: parseString(env.APP_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
+        port: parsePort(env.APP_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
+        user: parseString(env.APP_DB_USER, exports.DEFAULT_DB_CONFIG.user),
+        password: parseString(env.APP_DB_PASSWORD, ''),
+        database: parseString(env.APP_DB_NAME, exports.DEFAULT_DB_CONFIG.database),
     };
 }
 /**
  * Build the {@link RedisConfig} from env. Prefers `REDIS_URL`; falls back
  * to composing `redis://host:port` from `REDIS_HOST`/`REDIS_PORT`, else the
- * documented default. (Legacy `SHIELD_REDIS_*` names still read as a fallback.)
+ * documented default.
  */
 function loadRedisConfig(env = process.env) {
-    const explicit = readEnv(env, 'REDIS_URL');
+    const explicit = env.REDIS_URL;
     if (explicit !== undefined && explicit.trim() !== '') {
         return { url: explicit.trim() };
     }
-    const host = readEnv(env, 'REDIS_HOST');
-    const port = readEnv(env, 'REDIS_PORT');
+    const host = env.REDIS_HOST;
+    const port = env.REDIS_PORT;
     if ((host !== undefined && host.trim() !== '') || (port !== undefined && port.trim() !== '')) {
         const h = parseString(host, 'localhost');
         const p = parsePort(port, 6379);
@@ -177,13 +146,12 @@ function loadRedisConfig(env = process.env) {
  *   accessTtlMs          ← ACCESS_TTL_MS
  *   refreshIdleMs        ← REFRESH_IDLE_MS
  *   refreshAbsoluteCapMs ← REFRESH_ABSOLUTE_CAP_MS
- * (Legacy `SHIELD_`-prefixed names still read as a fallback.)
  */
 function loadSessionLifetimes(env = process.env) {
     const overrides = {};
-    const access = parseOptionalPositiveInt(readEnv(env, 'ACCESS_TTL_MS'));
-    const idle = parseOptionalPositiveInt(readEnv(env, 'REFRESH_IDLE_MS'));
-    const cap = parseOptionalPositiveInt(readEnv(env, 'REFRESH_ABSOLUTE_CAP_MS'));
+    const access = parseOptionalPositiveInt(env.ACCESS_TTL_MS);
+    const idle = parseOptionalPositiveInt(env.REFRESH_IDLE_MS);
+    const cap = parseOptionalPositiveInt(env.REFRESH_ABSOLUTE_CAP_MS);
     if (access !== undefined)
         overrides.accessTtlMs = access;
     if (idle !== undefined)
@@ -199,7 +167,7 @@ function loadSessionLifetimes(env = process.env) {
  * the key's value.
  */
 function loadRefreshHmacKey(env = process.env) {
-    return parseString(readEnv(env, 'REFRESH_HMAC_KEY'), '');
+    return parseString(env.REFRESH_HMAC_KEY, '');
 }
 /**
  * ⛔ FAIL-CLOSED GATE for the refresh-token HMAC key. Called by the auth
@@ -220,8 +188,7 @@ function assertRefreshHmacKey(key) {
     if (typeof key !== 'string' || key.trim() === '') {
         throw new Error('Astram auth composition: REFRESH_HMAC_KEY is required and must be ' +
             'non-empty (fail-closed — refusing to compose auth with a blank refresh-token ' +
-            'HMAC key). Set it from your secrets manager; never commit the value. ' +
-            '(The legacy env var name SHIELD_REFRESH_HMAC_KEY is still accepted.)');
+            'HMAC key). Set it from your secrets manager; never commit the value.');
     }
     return key;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",