@astram/guard 0.4.0 → 0.5.0

package/dist/authentication/mariadb-profile-writer.d.ts

@@ -0,0 +1,18 @@
+/**
+ * MariaDbProfileWriter — the framework-DEFAULT ProfileWriter (backs PATCH /account/profile). Updates
+ * ONLY the supplied columns on shield_app.users, then re-reads via MariaDbProfileResolver so the returned
+ * display profile has ONE source of truth (names, never UUIDs). Fail-closed: throws if the re-read is null.
+ */
+import type { Pool } from 'mariadb';
+import type { ProfileWriter } from '../auth/ports/profile-writer.js';
+import type { CurrentUserProfile } from '../auth/profile-resolver.js';
+export declare class MariaDbProfileWriter implements ProfileWriter {
+    private readonly pool;
+    private readonly resolver;
+    constructor(pool: Pool);
+    update(principalId: string, changes: {
+        name?: string;
+        email?: string;
+    }): Promise<CurrentUserProfile>;
+}
+//# sourceMappingURL=mariadb-profile-writer.d.ts.map

package/dist/authentication/mariadb-profile-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAOtE,qBAAa,oBAAqB,YAAW,aAAa;IAE5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;gBACrB,IAAI,EAAE,IAAI;IAIjC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA0B3G"}

package/dist/authentication/mariadb-profile-writer.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbProfileWriter = void 0;
+const mariadb_profile_resolver_js_1 = require("./mariadb-profile-resolver.js");
+class MariaDbProfileWriter {
+    pool;
+    resolver;
+    constructor(pool) {
+        this.pool = pool;
+        this.resolver = new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool);
+    }
+    async update(principalId, changes) {
+        const sets = [];
+        const params = [];
+        if (changes.name !== undefined) {
+            sets.push('u_username = ?');
+            params.push(changes.name);
+        }
+        if (changes.email !== undefined) {
+            sets.push('u_email = ?');
+            params.push(changes.email);
+        }
+        if (sets.length > 0) {
+            params.push(principalId);
+            await this.pool.query(`UPDATE \`shield_app\`.\`users\` SET ${sets.join(', ')} WHERE u_uuid = ?`, params);
+        }
+        // Resolve the caller's active company so the re-read profile is tenant-correct.
+        const active = (await this.pool.query("SELECT cm_company_uuid FROM `shield_app`.`company_membership` WHERE cm_user_uuid = ? AND cm_is_active = 1 AND cm_status = 'active' LIMIT 1", [principalId]));
+        const tenantId = active[0]?.cm_company_uuid ?? '';
+        const profile = await this.resolver.resolve({ kind: 'user', id: principalId, tenantId, roleIds: [], isRoot: false });
+        if (profile === null)
+            throw new Error('profile_unavailable'); // fail-closed: never a partial write result
+        return profile;
+    }
+}
+exports.MariaDbProfileWriter = MariaDbProfileWriter;

package/dist/authentication/mariadb-recovery-code-store.d.ts

@@ -0,0 +1,47 @@
+/**
+ * MariaDbRecoveryCodeStore — the framework-DEFAULT RecoveryCodeStore (backs
+ * POST /account/mfa/recovery-codes/regenerate + recovery-code login), persisted in
+ * `shield_identity`.`mfa_recovery_code` (one row per Argon2-hashed one-time recovery
+ * code, PK `(mrc_principal_id, mrc_code_hash)`).
+ *
+ * The framework hands this store ALREADY-HASHED codes (Argon2), so `replaceAll` never
+ * sees the raw codes — it only wipes-then-inserts hashes. `consume` receives the RAW
+ * code the user presents; because Argon2 hashes are salted and NOT queryable by
+ * plaintext, it loads the principal's UNCONSUMED rows and verifies the raw code against
+ * each hash with the injected hasher until one matches, then atomically marks THAT row
+ * consumed (single-use). A conditional `UPDATE … WHERE mrc_consumed_at_ms IS NULL` with
+ * an `affectedRows === 1` race guard makes the mark single-winner: two concurrent
+ * consumes of the same code both verify, but only one wins the UPDATE; the loser treats
+ * it as already-consumed → `false`. Every query is parameterized (never string-built).
+ *
+ * SECURITY — never logs the raw code or a hash; a hash mismatch resolves to "not this
+ * code" (fail-closed), never a thrown error. A genuine store outage (the `query` call
+ * rejecting) propagates rather than being swallowed to `false`.
+ */
+import type { Pool } from 'mariadb';
+import type { PasswordHasher } from '@astram/core';
+import type { RecoveryCodeStore } from '../auth/ports/recovery-code-store.js';
+export declare class MariaDbRecoveryCodeStore implements RecoveryCodeStore {
+    private readonly pool;
+    /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
+    private readonly hasher;
+    private readonly now;
+    constructor(pool: Pool, 
+    /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
+    hasher: PasswordHasher, now?: () => number);
+    /**
+     * Replace the principal's entire recovery-code set with `codeHashes` (already
+     * Argon2-hashed). Wipes any prior codes first, then inserts the new batch. Passing
+     * an empty array simply wipes (used when MFA is disabled).
+     */
+    replaceAll(principalId: string, codeHashes: readonly string[]): Promise<void>;
+    /**
+     * Consume one of the principal's recovery codes by RAW value. Loads the unconsumed
+     * hashes, verifies the raw code against each, and on the first match atomically marks
+     * that row consumed (single-use, `affectedRows === 1` race guard). Returns `true` iff
+     * a code was matched AND won the consume; `false` for empty input, no match, an
+     * already-consumed code, or a lost race.
+     */
+    consume(principalId: string, rawCode: string): Promise<boolean>;
+}
+//# sourceMappingURL=mariadb-recovery-code-store.d.ts.map

package/dist/authentication/mariadb-recovery-code-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-recovery-code-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-recovery-code-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAM9E,qBAAa,wBAAyB,YAAW,iBAAiB;IAE9D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI;IAC3B,+EAA+E;IAC9D,MAAM,EAAE,cAAc,EACtB,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnF;;;;;;OAMG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAqBtE"}

package/dist/authentication/mariadb-recovery-code-store.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbRecoveryCodeStore = void 0;
+class MariaDbRecoveryCodeStore {
+    pool;
+    hasher;
+    now;
+    constructor(pool, 
+    /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
+    hasher, now = Date.now) {
+        this.pool = pool;
+        this.hasher = hasher;
+        this.now = now;
+    }
+    /**
+     * Replace the principal's entire recovery-code set with `codeHashes` (already
+     * Argon2-hashed). Wipes any prior codes first, then inserts the new batch. Passing
+     * an empty array simply wipes (used when MFA is disabled).
+     */
+    async replaceAll(principalId, codeHashes) {
+        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_recovery_code\` WHERE mrc_principal_id = ?`, [principalId]);
+        const createdAt = this.now();
+        for (const hash of codeHashes) {
+            await this.pool.query(`INSERT INTO \`shield_identity\`.\`mfa_recovery_code\`
+           (mrc_principal_id, mrc_code_hash, mrc_consumed_at_ms, mrc_created_at_ms)
+         VALUES (?, ?, NULL, ?)`, [principalId, hash, createdAt]);
+        }
+    }
+    /**
+     * Consume one of the principal's recovery codes by RAW value. Loads the unconsumed
+     * hashes, verifies the raw code against each, and on the first match atomically marks
+     * that row consumed (single-use, `affectedRows === 1` race guard). Returns `true` iff
+     * a code was matched AND won the consume; `false` for empty input, no match, an
+     * already-consumed code, or a lost race.
+     */
+    async consume(principalId, rawCode) {
+        if (typeof rawCode !== 'string' || rawCode.length === 0)
+            return false;
+        const rows = (await this.pool.query(`SELECT mrc_code_hash FROM \`shield_identity\`.\`mfa_recovery_code\`
+        WHERE mrc_principal_id = ? AND mrc_consumed_at_ms IS NULL`, [principalId]));
+        for (const row of rows) {
+            if (await this.hasher.verify(row.mrc_code_hash, rawCode)) {
+                const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_recovery_code\`
+              SET mrc_consumed_at_ms = ?
+            WHERE mrc_principal_id = ? AND mrc_code_hash = ? AND mrc_consumed_at_ms IS NULL`, [this.now(), principalId, row.mrc_code_hash]));
+                // Single-use guard: only the UPDATE that flips NULL→consumed wins.
+                return res.affectedRows === 1;
+            }
+        }
+        return false;
+    }
+}
+exports.MariaDbRecoveryCodeStore = MariaDbRecoveryCodeStore;

package/dist/authentication/mariadb-reset-token-store.d.ts

@@ -0,0 +1,26 @@
+/**
+ * MariaDbResetTokenStore — the framework-DEFAULT ResetTokenStore (backs POST /auth/forgot-password
+ * + /auth/reset-password), persisted in `shield_identity`.`password_reset_token`. The framework
+ * hashes the raw reset token (SHA-256) BEFORE it reaches this store, so the store never sees the
+ * raw token — only its hash (the primary key).
+ *
+ * SINGLE-USE + TTL: `consume` returns the principal id IFF the token is both unexpired AND
+ * unconsumed, then atomically marks it consumed. It is a SELECT-then-conditional-UPDATE with an
+ * `affectedRows` race guard: two concurrent consumes of the same token both pass the SELECT, but
+ * only ONE wins the `UPDATE … WHERE prt_consumed_at_ms IS NULL` (affectedRows === 1); the loser
+ * (affectedRows === 0) is treated as already-consumed → `null`. Unknown/expired/already-consumed
+ * tokens all return `null` too — never a distinguishing throw (anti-enumeration). A genuine store
+ * outage (the `query` call rejecting) propagates rather than being swallowed to `null`. Every
+ * query is parameterized (never string-built); the token hash is never logged.
+ */
+import type { Pool } from 'mariadb';
+import type { ResetTokenStore } from '../auth/ports/reset-token-store.js';
+export declare class MariaDbResetTokenStore implements ResetTokenStore {
+    private readonly pool;
+    private readonly now;
+    constructor(pool: Pool, now?: () => number);
+    issue(principalId: string, tokenHash: string, expiresAtMs: number): Promise<void>;
+    consume(tokenHash: string): Promise<string | null>;
+    invalidateAllForPrincipal(principalId: string): Promise<void>;
+}
+//# sourceMappingURL=mariadb-reset-token-store.d.ts.map

package/dist/authentication/mariadb-reset-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-reset-token-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-reset-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAM1E,qBAAa,sBAAuB,YAAW,eAAe;IAE1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0BlD,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpE"}

package/dist/authentication/mariadb-reset-token-store.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbResetTokenStore = void 0;
+class MariaDbResetTokenStore {
+    pool;
+    now;
+    constructor(pool, now = Date.now) {
+        this.pool = pool;
+        this.now = now;
+    }
+    async issue(principalId, tokenHash, expiresAtMs) {
+        await this.pool.query(`INSERT INTO \`shield_identity\`.\`password_reset_token\`
+         (prt_token_hash, prt_principal_id, prt_expires_at_ms, prt_consumed_at_ms, prt_created_at_ms)
+       VALUES (?, ?, ?, NULL, ?)`, [tokenHash, principalId, expiresAtMs, this.now()]);
+    }
+    async consume(tokenHash) {
+        const now = this.now();
+        // 1) Find an unexpired, unconsumed token for this hash.
+        const rows = (await this.pool.query(`SELECT prt_principal_id
+         FROM \`shield_identity\`.\`password_reset_token\`
+        WHERE prt_token_hash = ? AND prt_consumed_at_ms IS NULL AND prt_expires_at_ms > ?
+        LIMIT 1`, [tokenHash, now]));
+        const principalId = rows[0]?.prt_principal_id;
+        if (principalId === undefined)
+            return null;
+        // 2) Atomically claim it (single-use). The `IS NULL` guard + affectedRows check means a
+        //    concurrent consume can never both succeed — the loser sees 0 rows and returns null.
+        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`password_reset_token\`
+          SET prt_consumed_at_ms = ?
+        WHERE prt_token_hash = ? AND prt_consumed_at_ms IS NULL`, [now, tokenHash]));
+        if (res.affectedRows !== 1)
+            return null; // lost the race → treat as consumed
+        return principalId;
+    }
+    async invalidateAllForPrincipal(principalId) {
+        // Burn every outstanding (unconsumed) token for the principal after a successful reset, so a
+        // second still-valid link cannot re-reset.
+        await this.pool.query(`UPDATE \`shield_identity\`.\`password_reset_token\`
+          SET prt_consumed_at_ms = ?
+        WHERE prt_principal_id = ? AND prt_consumed_at_ms IS NULL`, [this.now(), principalId]);
+    }
+}
+exports.MariaDbResetTokenStore = MariaDbResetTokenStore;

package/dist/authentication/mariadb-session-sweeper.d.ts

@@ -0,0 +1,33 @@
+/**
+ * MariaDbSessionSweeper — the framework-DEFAULT SessionSweeper (backs the best-effort
+ * calls from POST /account/change-password + /auth/reset-password), revoking a
+ * principal's durable sessions in `shield_identity`.`session` after a credential
+ * change.
+ *
+ *  - revokeAllForPrincipal → after a password RESET (kill every session).
+ *  - revokeOthersForPrincipal → after an authenticated CHANGE-password (kill every
+ *    session except the caller's current one, so the actor stays signed in).
+ *
+ * WHY WE ALSO DROP THE REDIS LIVENESS KEY: flipping the durable `session` row to
+ * 'revoked' makes the session non-rotatable (refresh is rejected), but an
+ * outstanding ACCESS token's per-request liveness is gated on the Redis key the
+ * `SessionTokenBinder` owns (see its SESSION-LIVENESS GATE in `resolve()`). The
+ * durable row alone does not reach that key, so a still-valid access token would
+ * survive until its TTL. To make revocation IMMEDIATE, we also drop the liveness
+ * key for each revoked session via `binder.unbindSession` — the SAME mechanism
+ * logout uses.
+ *
+ * The binder is passed in at construction time rather than DI-resolved here (this
+ * class is a plain adapter; wiring lives with the consumer).
+ */
+import type { Pool } from 'mariadb';
+import type { SessionSweeper } from '../auth/ports/session-sweeper.js';
+import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+export declare class MariaDbSessionSweeper implements SessionSweeper {
+    private readonly pool;
+    private readonly binder;
+    constructor(pool: Pool, binder: SessionTokenBinder);
+    revokeAllForPrincipal(principalId: string): Promise<void>;
+    revokeOthersForPrincipal(principalId: string, keepSessionId: string): Promise<void>;
+}
+//# sourceMappingURL=mariadb-session-sweeper.d.ts.map

package/dist/authentication/mariadb-session-sweeper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-session-sweeper.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-session-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAMlF,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,kBAAkB;IAGvC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzD,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB1F"}

package/dist/authentication/mariadb-session-sweeper.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * MariaDbSessionSweeper — the framework-DEFAULT SessionSweeper (backs the best-effort
+ * calls from POST /account/change-password + /auth/reset-password), revoking a
+ * principal's durable sessions in `shield_identity`.`session` after a credential
+ * change.
+ *
+ *  - revokeAllForPrincipal → after a password RESET (kill every session).
+ *  - revokeOthersForPrincipal → after an authenticated CHANGE-password (kill every
+ *    session except the caller's current one, so the actor stays signed in).
+ *
+ * WHY WE ALSO DROP THE REDIS LIVENESS KEY: flipping the durable `session` row to
+ * 'revoked' makes the session non-rotatable (refresh is rejected), but an
+ * outstanding ACCESS token's per-request liveness is gated on the Redis key the
+ * `SessionTokenBinder` owns (see its SESSION-LIVENESS GATE in `resolve()`). The
+ * durable row alone does not reach that key, so a still-valid access token would
+ * survive until its TTL. To make revocation IMMEDIATE, we also drop the liveness
+ * key for each revoked session via `binder.unbindSession` — the SAME mechanism
+ * logout uses.
+ *
+ * The binder is passed in at construction time rather than DI-resolved here (this
+ * class is a plain adapter; wiring lives with the consumer).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbSessionSweeper = void 0;
+class MariaDbSessionSweeper {
+    pool;
+    binder;
+    constructor(pool, binder) {
+        this.pool = pool;
+        this.binder = binder;
+    }
+    async revokeAllForPrincipal(principalId) {
+        const rows = (await this.pool.query(`SELECT s_session_id
+         FROM \`shield_identity\`.\`session\`
+        WHERE s_principal_id = ? AND s_status = 'active'`, [principalId]));
+        await this.pool.query(`UPDATE \`shield_identity\`.\`session\`
+          SET s_status = 'revoked'
+        WHERE s_principal_id = ? AND s_status = 'active'`, [principalId]);
+        // Drop each revoked session's Redis liveness key so outstanding access tokens die
+        // immediately, not at their TTL.
+        for (const { s_session_id } of rows) {
+            await this.binder.unbindSession(s_session_id);
+        }
+    }
+    async revokeOthersForPrincipal(principalId, keepSessionId) {
+        const rows = (await this.pool.query(`SELECT s_session_id
+         FROM \`shield_identity\`.\`session\`
+        WHERE s_principal_id = ? AND s_status = 'active' AND s_session_id <> ?`, [principalId, keepSessionId]));
+        await this.pool.query(`UPDATE \`shield_identity\`.\`session\`
+          SET s_status = 'revoked'
+        WHERE s_principal_id = ? AND s_status = 'active' AND s_session_id <> ?`, [principalId, keepSessionId]);
+        // Only the OTHER sessions are unbound — the kept (current) session's liveness key
+        // is never touched, so the actor stays signed in after a change-password.
+        for (const { s_session_id } of rows) {
+            await this.binder.unbindSession(s_session_id);
+        }
+    }
+}
+exports.MariaDbSessionSweeper = MariaDbSessionSweeper;

package/dist/config/app-config.d.ts

@@ -147,12 +147,11 @@ export declare const SCHEMA_SVC_POOL_HARD_CAP = 2;
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
  *   workers                       ← POOL_WORKERS
- *   maxConnections                ← DB_MAX_CONNECTIONS
+ *   maxConnections                ← APP_DB_MAX_CONNECTIONS
  *   headroom                      ← POOL_HEADROOM
  *   perAccountMax.shield_core     ← POOL_MAX_CORE
  *   perAccountMax.shield_app_crud ← POOL_MAX_APP_CRUD
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
- * (Legacy `SHIELD_`-prefixed names are still read as a fallback — see {@link readEnv}.)
  */
 export declare function loadPoolBudget(env?: NodeJS.ProcessEnv): PoolBudgetConfig;
 /** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
@@ -162,9 +161,9 @@ export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
 /**
  * Build the runtime {@link DbConfig} from env with documented defaults.
  * Field ↔ env name:
- *   host     ← DB_HOST      port     ← DB_PORT
- *   user     ← DB_USER      password ← DB_PASSWORD (secret)
- *   database ← DB_NAME    (legacy SHIELD_DB_* still read as a fallback)
+ *   host     ← APP_DB_HOST      port     ← APP_DB_PORT
+ *   user     ← APP_DB_USER      password ← APP_DB_PASSWORD (secret)
+ *   database ← APP_DB_NAME
  * The password defaults to '' when absent — a live connection then fails at
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
@@ -174,7 +173,7 @@ export declare function loadDbConfig(env?: NodeJS.ProcessEnv): DbConfig;
 /**
  * Build the {@link RedisConfig} from env. Prefers `REDIS_URL`; falls back
  * to composing `redis://host:port` from `REDIS_HOST`/`REDIS_PORT`, else the
- * documented default. (Legacy `SHIELD_REDIS_*` names still read as a fallback.)
+ * documented default.
  */
 export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
 /**
@@ -186,7 +185,6 @@ export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
  *   accessTtlMs          ← ACCESS_TTL_MS
  *   refreshIdleMs        ← REFRESH_IDLE_MS
  *   refreshAbsoluteCapMs ← REFRESH_ABSOLUTE_CAP_MS
- * (Legacy `SHIELD_`-prefixed names still read as a fallback.)
  */
 export declare function loadSessionLifetimes(env?: NodeJS.ProcessEnv): SessionLifetimeOverrides;
 /**

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoD1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}

package/dist/config/app-config.js

@@ -48,22 +48,21 @@ function parsePositiveInt(raw, fallback) {
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
  *   workers                       ← POOL_WORKERS
- *   maxConnections                ← DB_MAX_CONNECTIONS
+ *   maxConnections                ← APP_DB_MAX_CONNECTIONS
  *   headroom                      ← POOL_HEADROOM
  *   perAccountMax.shield_core     ← POOL_MAX_CORE
  *   perAccountMax.shield_app_crud ← POOL_MAX_APP_CRUD
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
- * (Legacy `SHIELD_`-prefixed names are still read as a fallback — see {@link readEnv}.)
  */
 function loadPoolBudget(env = process.env) {
     return {
-        workers: parsePositiveInt(readEnv(env, 'POOL_WORKERS'), exports.DEFAULT_POOL_BUDGET.workers),
-        maxConnections: parsePositiveInt(readEnv(env, 'DB_MAX_CONNECTIONS'), exports.DEFAULT_POOL_BUDGET.maxConnections),
-        headroom: parsePositiveInt(readEnv(env, 'POOL_HEADROOM'), exports.DEFAULT_POOL_BUDGET.headroom),
+        workers: parsePositiveInt(env.POOL_WORKERS, exports.DEFAULT_POOL_BUDGET.workers),
+        maxConnections: parsePositiveInt(env.APP_DB_MAX_CONNECTIONS, exports.DEFAULT_POOL_BUDGET.maxConnections),
+        headroom: parsePositiveInt(env.POOL_HEADROOM, exports.DEFAULT_POOL_BUDGET.headroom),
         perAccountMax: {
-            shield_core: parsePositiveInt(readEnv(env, 'POOL_MAX_CORE'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_core),
-            shield_app_crud: parsePositiveInt(readEnv(env, 'POOL_MAX_APP_CRUD'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_app_crud),
-            shield_schema_svc: parsePositiveInt(readEnv(env, 'POOL_MAX_SCHEMA_SVC'), exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_schema_svc),
+            shield_core: parsePositiveInt(env.POOL_MAX_CORE, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_core),
+            shield_app_crud: parsePositiveInt(env.POOL_MAX_APP_CRUD, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_app_crud),
+            shield_schema_svc: parsePositiveInt(env.POOL_MAX_SCHEMA_SVC, exports.DEFAULT_POOL_BUDGET.perAccountMax.shield_schema_svc),
         },
     };
 }
@@ -81,36 +80,6 @@ exports.DEFAULT_DB_CONFIG = {
 };
 /** Documented default Redis url (local docker substrate). */
 exports.DEFAULT_REDIS_URL = 'redis://localhost:6379';
-/**
- * Read a consumer-facing env var by its CURRENT (unprefixed) name, falling back to
- * the LEGACY `SHIELD_`-prefixed name for one deprecation window. The framework's
- * public config vars were debranded from `SHIELD_*` to bare names (e.g.
- * `SHIELD_DB_HOST` → `DB_HOST`); reading both keeps existing `.env` files (which may
- * still set `SHIELD_*`) working unchanged. The new name wins when both are set.
- * A non-blank legacy value emits a one-time deprecation warning (never logs secrets —
- * only the var NAME). Internal DI-token symbols (`Symbol('SHIELD_...')`) are unrelated
- * and unchanged.
- */
-const legacyEnvWarned = new Set();
-function readEnv(env, name) {
-    const current = env[name];
-    if (current !== undefined && current.trim() !== '')
-        return current;
-    const legacyName = `SHIELD_${name}`;
-    const legacy = env[legacyName];
-    if (legacy !== undefined && legacy.trim() !== '') {
-        if (!legacyEnvWarned.has(legacyName)) {
-            legacyEnvWarned.add(legacyName);
-            // eslint-disable-next-line no-console
-            console.warn(`[astram] env var '${legacyName}' is deprecated — rename it to '${name}'. ` +
-                `The SHIELD_ prefix will be removed in a future release.`);
-        }
-        return legacy;
-    }
-    // Return whichever was present-but-blank (so parseString applies its own fallback),
-    // preferring the current name.
-    return current ?? legacy;
-}
 /** Read a string from env with a fallback (trims; blank ⇒ fallback). */
 function parseString(raw, fallback) {
     if (raw === undefined || raw.trim() === '')
@@ -132,9 +101,9 @@ function parseOptionalPositiveInt(raw) {
 /**
  * Build the runtime {@link DbConfig} from env with documented defaults.
  * Field ↔ env name:
- *   host     ← DB_HOST      port     ← DB_PORT
- *   user     ← DB_USER      password ← DB_PASSWORD (secret)
- *   database ← DB_NAME    (legacy SHIELD_DB_* still read as a fallback)
+ *   host     ← APP_DB_HOST      port     ← APP_DB_PORT
+ *   user     ← APP_DB_USER      password ← APP_DB_PASSWORD (secret)
+ *   database ← APP_DB_NAME
  * The password defaults to '' when absent — a live connection then fails at
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
@@ -142,25 +111,25 @@ function parseOptionalPositiveInt(raw) {
  */
 function loadDbConfig(env = process.env) {
     return {
-        host: parseString(readEnv(env, 'DB_HOST'), exports.DEFAULT_DB_CONFIG.host),
-        port: parsePort(readEnv(env, 'DB_PORT'), exports.DEFAULT_DB_CONFIG.port),
-        user: parseString(readEnv(env, 'DB_USER'), exports.DEFAULT_DB_CONFIG.user),
-        password: parseString(readEnv(env, 'DB_PASSWORD'), ''),
-        database: parseString(readEnv(env, 'DB_NAME'), exports.DEFAULT_DB_CONFIG.database),
+        host: parseString(env.APP_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
+        port: parsePort(env.APP_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
+        user: parseString(env.APP_DB_USER, exports.DEFAULT_DB_CONFIG.user),
+        password: parseString(env.APP_DB_PASSWORD, ''),
+        database: parseString(env.APP_DB_NAME, exports.DEFAULT_DB_CONFIG.database),
     };
 }
 /**
  * Build the {@link RedisConfig} from env. Prefers `REDIS_URL`; falls back
  * to composing `redis://host:port` from `REDIS_HOST`/`REDIS_PORT`, else the
- * documented default. (Legacy `SHIELD_REDIS_*` names still read as a fallback.)
+ * documented default.
  */
 function loadRedisConfig(env = process.env) {
-    const explicit = readEnv(env, 'REDIS_URL');
+    const explicit = env.REDIS_URL;
     if (explicit !== undefined && explicit.trim() !== '') {
         return { url: explicit.trim() };
     }
-    const host = readEnv(env, 'REDIS_HOST');
-    const port = readEnv(env, 'REDIS_PORT');
+    const host = env.REDIS_HOST;
+    const port = env.REDIS_PORT;
     if ((host !== undefined && host.trim() !== '') || (port !== undefined && port.trim() !== '')) {
         const h = parseString(host, 'localhost');
         const p = parsePort(port, 6379);
@@ -177,13 +146,12 @@ function loadRedisConfig(env = process.env) {
  *   accessTtlMs          ← ACCESS_TTL_MS
  *   refreshIdleMs        ← REFRESH_IDLE_MS
  *   refreshAbsoluteCapMs ← REFRESH_ABSOLUTE_CAP_MS
- * (Legacy `SHIELD_`-prefixed names still read as a fallback.)
  */
 function loadSessionLifetimes(env = process.env) {
     const overrides = {};
-    const access = parseOptionalPositiveInt(readEnv(env, 'ACCESS_TTL_MS'));
-    const idle = parseOptionalPositiveInt(readEnv(env, 'REFRESH_IDLE_MS'));
-    const cap = parseOptionalPositiveInt(readEnv(env, 'REFRESH_ABSOLUTE_CAP_MS'));
+    const access = parseOptionalPositiveInt(env.ACCESS_TTL_MS);
+    const idle = parseOptionalPositiveInt(env.REFRESH_IDLE_MS);
+    const cap = parseOptionalPositiveInt(env.REFRESH_ABSOLUTE_CAP_MS);
     if (access !== undefined)
         overrides.accessTtlMs = access;
     if (idle !== undefined)
@@ -199,7 +167,7 @@ function loadSessionLifetimes(env = process.env) {
  * the key's value.
  */
 function loadRefreshHmacKey(env = process.env) {
-    return parseString(readEnv(env, 'REFRESH_HMAC_KEY'), '');
+    return parseString(env.REFRESH_HMAC_KEY, '');
 }
 /**
  * ⛔ FAIL-CLOSED GATE for the refresh-token HMAC key. Called by the auth
@@ -220,8 +188,7 @@ function assertRefreshHmacKey(key) {
     if (typeof key !== 'string' || key.trim() === '') {
         throw new Error('Astram auth composition: REFRESH_HMAC_KEY is required and must be ' +
             'non-empty (fail-closed — refusing to compose auth with a blank refresh-token ' +
-            'HMAC key). Set it from your secrets manager; never commit the value. ' +
-            '(The legacy env var name SHIELD_REFRESH_HMAC_KEY is still accepted.)');
+            'HMAC key). Set it from your secrets manager; never commit the value.');
     }
     return key;
 }

package/dist/identity/auth-facts.controller.d.ts

@@ -0,0 +1,24 @@
+/**
+ * AuthFactsController — the framework-DEFAULT `/identity/auth-facts` + `/identity/permissions-version`
+ * endpoints backing the frontend's permission-gated nav (the SDK's fact projection). Both are
+ * `@Public()` at the route level but SELF-SCOPED: principalId + tenantId come ONLY from the resolved
+ * bearer-token Principal (never a query/body param). Missing/invalid token → 401; an authorization
+ * store outage → 503 (never swallowed into an empty projection / fabricated version — that would
+ * fail-OPEN by letting a stale/empty view read as authoritative).
+ *
+ * FRAMEWORK-OWNED: mounted by the auth surface when `auth: true`; the consumer implements nothing.
+ */
+import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import { type AuthFactProjection, type MariaDbPermissionFactsAdapter } from './permission-facts.adapter.js';
+export declare class AuthFactsController {
+    private readonly tokenBinder;
+    private readonly facts;
+    constructor(tokenBinder: SessionTokenBinder | undefined, facts: MariaDbPermissionFactsAdapter | undefined);
+    getAuthFacts(authorization?: string): Promise<AuthFactProjection>;
+    getPermissionsVersion(authorization?: string): Promise<{
+        version: number;
+    }>;
+    /** Resolve the bearer token → the caller's own Principal, or throw a generic 401. */
+    private authenticate;
+}
+//# sourceMappingURL=auth-facts.controller.d.ts.map

package/dist/identity/auth-facts.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-facts.controller.d.ts","sourceRoot":"","sources":["../../src/identity/auth-facts.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAGlF,OAAO,EAAiC,KAAK,kBAAkB,EAAE,KAAK,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE3I,qBACa,mBAAmB;IAEqB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADD,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAC/C,KAAK,EAAE,6BAA6B,GAAG,SAAS;IAK1G,YAAY,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiB3F,qBAAqB,CAA2B,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAgB3G,qFAAqF;YACvE,YAAY;CAU3B"}