@astram/guard 0.4.0 → 0.5.0

package/dist/identity/auth-facts.controller.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * AuthFactsController — the framework-DEFAULT `/identity/auth-facts` + `/identity/permissions-version`
+ * endpoints backing the frontend's permission-gated nav (the SDK's fact projection). Both are
+ * `@Public()` at the route level but SELF-SCOPED: principalId + tenantId come ONLY from the resolved
+ * bearer-token Principal (never a query/body param). Missing/invalid token → 401; an authorization
+ * store outage → 503 (never swallowed into an empty projection / fabricated version — that would
+ * fail-OPEN by letting a stale/empty view read as authoritative).
+ *
+ * FRAMEWORK-OWNED: mounted by the auth surface when `auth: true`; the consumer implements nothing.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthFactsController = void 0;
+const common_1 = require("@nestjs/common");
+const classification_decorator_js_1 = require("../enforcement/classification.decorator.js");
+const tokens_js_1 = require("../request-auth/tokens.js");
+const request_principal_js_1 = require("../request-auth/request-principal.js");
+const tokens_js_2 = require("../auth/tokens.js");
+const permission_facts_adapter_js_1 = require("./permission-facts.adapter.js");
+let AuthFactsController = class AuthFactsController {
+    tokenBinder;
+    facts;
+    constructor(tokenBinder, facts) {
+        this.tokenBinder = tokenBinder;
+        this.facts = facts;
+    }
+    async getAuthFacts(authorization) {
+        const principal = await this.authenticate(authorization);
+        if (this.facts === undefined || this.facts === null) {
+            throw new common_1.HttpException({ error: 'authorization_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+        try {
+            return await this.facts.projectFor(principal.id, principal.tenantId, principal.isRoot);
+        }
+        catch (err) {
+            if (err instanceof permission_facts_adapter_js_1.AuthorizationUnavailableError) {
+                throw new common_1.HttpException({ error: 'authorization_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+            }
+            throw err;
+        }
+    }
+    async getPermissionsVersion(authorization) {
+        const principal = await this.authenticate(authorization);
+        if (this.facts === undefined || this.facts === null) {
+            throw new common_1.HttpException({ error: 'authorization_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+        }
+        try {
+            const version = await this.facts.currentVersionFor(principal.id, principal.tenantId);
+            return { version };
+        }
+        catch (err) {
+            if (err instanceof permission_facts_adapter_js_1.AuthorizationUnavailableError) {
+                throw new common_1.HttpException({ error: 'authorization_unavailable' }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+            }
+            throw err;
+        }
+    }
+    /** Resolve the bearer token → the caller's own Principal, or throw a generic 401. */
+    async authenticate(authorization) {
+        if (this.tokenBinder === undefined || this.tokenBinder === null) {
+            throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
+        }
+        const principal = await (0, request_principal_js_1.resolveRequestPrincipal)(authorization, this.tokenBinder);
+        if (principal === null) {
+            throw new common_1.HttpException({ error: 'unauthorized' }, common_1.HttpStatus.UNAUTHORIZED);
+        }
+        return principal;
+    }
+};
+exports.AuthFactsController = AuthFactsController;
+__decorate([
+    (0, classification_decorator_js_1.Public)(),
+    (0, common_1.Get)('auth-facts'),
+    __param(0, (0, common_1.Headers)('authorization')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AuthFactsController.prototype, "getAuthFacts", null);
+__decorate([
+    (0, classification_decorator_js_1.Public)(),
+    (0, common_1.Get)('permissions-version'),
+    __param(0, (0, common_1.Headers)('authorization')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AuthFactsController.prototype, "getPermissionsVersion", null);
+exports.AuthFactsController = AuthFactsController = __decorate([
+    (0, common_1.Controller)('identity'),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(tokens_js_2.SHIELD_PERMISSION_FACTS)),
+    __metadata("design:paramtypes", [Object, Object])
+], AuthFactsController);

package/dist/identity/identity-actions.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The fixed action vocabulary + module key for the framework's @astram/identity objects.
+ * Engine ObjectTypes carry no action list, so actions are synthesized here — the ONE source
+ * the module-registry bridge derives from. Permission keys are `identity:<typeKey>:<action>`.
+ * (Ported from astram3. `cross_tenant_grant` gets its own override — see below — every other
+ * type uses the CRUD verbs.)
+ */
+export declare const MODULE_KEY = "identity";
+export declare const IDENTITY_ACTIONS: readonly ["read", "create", "update", "delete"];
+export type IdentityAction = (typeof IDENTITY_ACTIONS)[number];
+/**
+ * `cross_tenant_grant`'s action vocabulary — NOT the CRUD verbs above. This is a
+ * framework-owned, authority-only object type (never CRUD'd through the RecordEngine);
+ * its three actions are the who-may-grant lifecycle questions the app's `authorize`
+ * closure answers for `CrossTenantGrantWriter` (offer -> 'share', accept -> 'accept',
+ * revoke -> 'revoke'). Mirrors astram3's `authz/actions.ts`'s `CROSS_TENANT_GRANT_ACTIONS`.
+ */
+export declare const CROSS_TENANT_GRANT_ACTIONS: readonly ["share", "accept", "revoke"];
+export type CrossTenantGrantAction = (typeof CROSS_TENANT_GRANT_ACTIONS)[number];
+/** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
+export declare function actionsFor(typeKey: string): readonly string[];
+//# sourceMappingURL=identity-actions.d.ts.map

package/dist/identity/identity-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAUjF,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}

package/dist/identity/identity-actions.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
+exports.actionsFor = actionsFor;
+/**
+ * The fixed action vocabulary + module key for the framework's @astram/identity objects.
+ * Engine ObjectTypes carry no action list, so actions are synthesized here — the ONE source
+ * the module-registry bridge derives from. Permission keys are `identity:<typeKey>:<action>`.
+ * (Ported from astram3. `cross_tenant_grant` gets its own override — see below — every other
+ * type uses the CRUD verbs.)
+ */
+exports.MODULE_KEY = 'identity';
+exports.IDENTITY_ACTIONS = ['read', 'create', 'update', 'delete'];
+/**
+ * `cross_tenant_grant`'s action vocabulary — NOT the CRUD verbs above. This is a
+ * framework-owned, authority-only object type (never CRUD'd through the RecordEngine);
+ * its three actions are the who-may-grant lifecycle questions the app's `authorize`
+ * closure answers for `CrossTenantGrantWriter` (offer -> 'share', accept -> 'accept',
+ * revoke -> 'revoke'). Mirrors astram3's `authz/actions.ts`'s `CROSS_TENANT_GRANT_ACTIONS`.
+ */
+exports.CROSS_TENANT_GRANT_ACTIONS = ['share', 'accept', 'revoke'];
+/**
+ * Per-type action-vocabulary override. Every type not listed here defaults to
+ * {@link IDENTITY_ACTIONS} (the CRUD verbs).
+ */
+const ACTIONS_BY_TYPE = {
+    cross_tenant_grant: exports.CROSS_TENANT_GRANT_ACTIONS,
+};
+/** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
+function actionsFor(typeKey) {
+    return ACTIONS_BY_TYPE[typeKey] ?? exports.IDENTITY_ACTIONS;
+}

package/dist/identity/module-registry.bridge.d.ts

@@ -0,0 +1,4 @@
+import type { ModuleRegistry } from '@astram/core';
+import type { ObjectTypeInput } from '@astram/engine';
+export declare function buildIdentityModuleRegistry(inputs: readonly ObjectTypeInput[]): ModuleRegistry;
+//# sourceMappingURL=module-registry.bridge.d.ts.map

package/dist/identity/module-registry.bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CA4B9F"}

package/dist/identity/module-registry.bridge.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildIdentityModuleRegistry = buildIdentityModuleRegistry;
+/**
+ * Bridge: engine ObjectTypes → a populated core ModuleRegistry. Ported from astram3 (framework
+ * now owns identity). Engine ObjectTypes describe physical tables; core's gates + the
+ * permission-facts projection need object types + ACTIONS + tiers + planes. ObjectTypes carry no
+ * action list, so we synthesize per-type actions (actionsFor). Every action is `gated` — nothing
+ * open unless reclassified. `register()` throws on duplicate typeKey/permissionKey.
+ */
+const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+const identity_actions_js_1 = require("./identity-actions.js");
+function toObjectType(input) {
+    return typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
+}
+function buildIdentityModuleRegistry(inputs) {
+    const regs = inputs.map(toObjectType);
+    const objectTypes = regs.map((r) => {
+        const a = r.access ?? {};
+        const access = {
+            ...(a.owned !== undefined ? { owned: a.owned } : {}),
+            ...(a.tenantScoped !== undefined ? { tenantScoped: a.tenantScoped } : {}),
+            ...(a.system !== undefined ? { system: a.system } : {}),
+        };
+        return {
+            typeKey: r.typeKey,
+            label: r.typeKey,
+            fields: r.fields.map((f) => ({ key: f.key, label: f.key })),
+            ...(Object.keys(access).length > 0 ? { access } : {}),
+        };
+    });
+    const actions = regs.flatMap((r) => (0, identity_actions_js_1.actionsFor)(r.typeKey).map((actionKey) => ({
+        actionKey,
+        typeKey: r.typeKey,
+        tier: 'gated',
+        plane: r.access?.plane ?? 'data',
+    })));
+    const metadata = { moduleKey: identity_actions_js_1.MODULE_KEY, objectTypes, actions };
+    const registry = (0, core_1.createModuleRegistry)();
+    registry.register(metadata);
+    return registry;
+}

package/dist/identity/permission-facts.adapter.d.ts

@@ -0,0 +1,47 @@
+/**
+ * MariaDbPermissionFactsAdapter — the framework-DEFAULT source of a caller's coarse permission
+ * facts, backing `GET /identity/auth-facts` + `/identity/permissions-version`. Reads role ids from
+ * the caller's active in-effect postings (`shield_app`), the granted permission keys for those
+ * roles (`shield_authz.role_permission`), and the per-tenant permission version
+ * (`shield_authz.authz_permission_version`). Projects to `{ action, allowed:true }` facts (an
+ * absent fact is the fail-closed deny). A store outage THROWS AuthorizationUnavailableError —
+ * never a fabricated empty projection (that would silently read as "you have no grants").
+ */
+import type { Pool } from 'mariadb';
+export interface AuthFactDto {
+    readonly action: string;
+    readonly allowed: boolean;
+    readonly resource?: string;
+    readonly reasonCode?: string;
+}
+export interface AuthFactProjection {
+    readonly principalId: string;
+    readonly facts: readonly AuthFactDto[];
+    readonly projectedAt: number;
+    readonly permissionsVersion?: number;
+}
+/** A store/dependency outage while computing facts — the controller maps this to 503. */
+export declare class AuthorizationUnavailableError extends Error {
+    constructor(message?: string);
+}
+export declare class MariaDbPermissionFactsAdapter {
+    private readonly pool;
+    private readonly listActions;
+    private readonly controlPlaneKeys;
+    private readonly now;
+    constructor(pool: Pool, listActions: () => readonly string[], controlPlaneKeys: readonly string[], now?: () => number);
+    projectFor(principalId: string, tenantId: string, isRoot: boolean): Promise<AuthFactProjection>;
+    currentVersionFor(_principalId: string, tenantId: string): Promise<number>;
+    private readRoleIdsForTenant;
+    private readGrantKeys;
+    private readVersion;
+    /**
+     * Expand wildcard grant keys against the registry's declared actions:
+     *   'identity' / 'identity:*'      → every 'identity:' action
+     *   'identity:company:*'           → every 'identity:company:<action>'
+     * Exact keys pass through. Bounded to listActions() so a wildcard can never grant an
+     * action that does not exist.
+     */
+    private expandGrantKeys;
+}
+//# sourceMappingURL=permission-facts.adapter.d.ts.map

package/dist/identity/permission-facts.adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAMD,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAGzC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAqB/F,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAcpB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}

package/dist/identity/permission-facts.adapter.js

@@ -0,0 +1,108 @@
+"use strict";
+/**
+ * MariaDbPermissionFactsAdapter — the framework-DEFAULT source of a caller's coarse permission
+ * facts, backing `GET /identity/auth-facts` + `/identity/permissions-version`. Reads role ids from
+ * the caller's active in-effect postings (`shield_app`), the granted permission keys for those
+ * roles (`shield_authz.role_permission`), and the per-tenant permission version
+ * (`shield_authz.authz_permission_version`). Projects to `{ action, allowed:true }` facts (an
+ * absent fact is the fail-closed deny). A store outage THROWS AuthorizationUnavailableError —
+ * never a fabricated empty projection (that would silently read as "you have no grants").
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbPermissionFactsAdapter = exports.AuthorizationUnavailableError = void 0;
+/** A store/dependency outage while computing facts — the controller maps this to 503. */
+class AuthorizationUnavailableError extends Error {
+    constructor(message = 'authorization_unavailable') {
+        super(message);
+        this.name = 'AuthorizationUnavailableError';
+    }
+}
+exports.AuthorizationUnavailableError = AuthorizationUnavailableError;
+class MariaDbPermissionFactsAdapter {
+    pool;
+    listActions;
+    controlPlaneKeys;
+    now;
+    constructor(pool, listActions, controlPlaneKeys, now = Date.now) {
+        this.pool = pool;
+        this.listActions = listActions;
+        this.controlPlaneKeys = controlPlaneKeys;
+        this.now = now;
+    }
+    async projectFor(principalId, tenantId, isRoot) {
+        try {
+            const roleIds = await this.readRoleIdsForTenant(principalId, tenantId);
+            const granted = roleIds.length > 0 ? await this.readGrantKeys(roleIds) : [];
+            const expanded = this.expandGrantKeys(granted);
+            const keys = isRoot
+                ? [...new Set([...expanded, ...this.controlPlaneKeys])]
+                : expanded;
+            const permissionsVersion = await this.readVersion(tenantId);
+            return {
+                principalId,
+                facts: keys.map((action) => ({ action, allowed: true })),
+                projectedAt: this.now(),
+                permissionsVersion,
+            };
+        }
+        catch (err) {
+            if (err instanceof AuthorizationUnavailableError)
+                throw err;
+            throw new AuthorizationUnavailableError(err.message);
+        }
+    }
+    async currentVersionFor(_principalId, tenantId) {
+        try {
+            return await this.readVersion(tenantId);
+        }
+        catch (err) {
+            if (err instanceof AuthorizationUnavailableError)
+                throw err;
+            throw new AuthorizationUnavailableError(err.message);
+        }
+    }
+    async readRoleIdsForTenant(userUuid, companyUuid) {
+        const nowMs = this.now();
+        const rows = (await this.pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
+         FROM \`shield_app\`.\`company_membership\` cm
+         JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+        WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1
+          AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
+          AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [userUuid, companyUuid, nowMs, nowMs]));
+        return rows.map((r) => r.role_uuid);
+    }
+    async readGrantKeys(roleIds) {
+        const placeholders = roleIds.map(() => '?').join(', ');
+        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`shield_authz\`.\`role_permission\` WHERE rp_role_uuid IN (${placeholders})`, [...roleIds]));
+        return rows.map((r) => r.rp_perm_key);
+    }
+    async readVersion(tenantId) {
+        const rows = (await this.pool.query('SELECT apv_version FROM `shield_authz`.`authz_permission_version` WHERE apv_tenant_uuid = ? LIMIT 1', [tenantId]));
+        return rows[0] !== undefined ? Number(rows[0].apv_version) : 0;
+    }
+    /**
+     * Expand wildcard grant keys against the registry's declared actions:
+     *   'identity' / 'identity:*'      → every 'identity:' action
+     *   'identity:company:*'           → every 'identity:company:<action>'
+     * Exact keys pass through. Bounded to listActions() so a wildcard can never grant an
+     * action that does not exist.
+     */
+    expandGrantKeys(grantKeys) {
+        const all = this.listActions();
+        const out = new Set();
+        for (const key of grantKeys) {
+            if (key.endsWith(':*') || key.indexOf(':') === -1) {
+                const prefix = key.endsWith(':*') ? key.slice(0, -1) : `${key}:`; // 'identity:*'→'identity:' ; 'identity'→'identity:'
+                for (const a of all)
+                    if (a.startsWith(prefix))
+                        out.add(a);
+            }
+            else {
+                if (all.includes(key))
+                    out.add(key);
+            }
+        }
+        return [...out];
+    }
+}
+exports.MariaDbPermissionFactsAdapter = MariaDbPermissionFactsAdapter;

package/dist/index.d.ts

@@ -14,6 +14,9 @@
  * Depends on `@astram/core` (workspace); PEER-depends on `@nestjs/common`,
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
+export { guardMigrationsDir } from './migrations-dir.js';
+export { buildIdentityModuleRegistry } from './identity/module-registry.bridge.js';
+export { MODULE_KEY, IDENTITY_ACTIONS, actionsFor } from './identity/identity-actions.js';
 export { ShieldModule, SHIELD_DECISION_AUTHORITY, type ShieldModuleOptions, type ShieldModuleAsyncOptions, type RecordAuthorizationInputs, } from './module/shield.module.js';
 export { Public, Classified, CLASSIFICATION_METADATA, DEFAULT_CLASSIFIED_ACTION, normalizeClassification, } from './enforcement/classification.decorator.js';
 export type { Classification } from './enforcement/classification.decorator.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAMhD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAMhD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -16,8 +16,26 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = void 0;
-exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = void 0;
+exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsFor = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
+exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = void 0;
+exports.AccountController = exports.generateRecoveryCodes = void 0;
+// Framework authz migrations (shield_authz DDL — permission / role_permission /
+// authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
+var migrations_dir_js_1 = require("./migrations-dir.js");
+Object.defineProperty(exports, "guardMigrationsDir", { enumerable: true, get: function () { return migrations_dir_js_1.guardMigrationsDir; } });
+// The identity module-registry BRIDGE (engine ObjectTypes → a populated core
+// ModuleRegistry) + the identity action vocabulary. Exported so `@astram/identity`
+// (which depends on `@astram/guard` — the sanctioned graph direction) can build the
+// registry from its OWN `identityObjects` and project the permission-key universe it
+// passes back into `ShieldModule.forRoot({ identityActionKeys, identityControlPlaneKeys })`.
+// Guard NEVER imports `@astram/identity`; the keys reach the auth-facts adapter ONLY as
+// runtime option values the consumer threads in.
+var module_registry_bridge_js_1 = require("./identity/module-registry.bridge.js");
+Object.defineProperty(exports, "buildIdentityModuleRegistry", { enumerable: true, get: function () { return module_registry_bridge_js_1.buildIdentityModuleRegistry; } });
+var identity_actions_js_1 = require("./identity/identity-actions.js");
+Object.defineProperty(exports, "MODULE_KEY", { enumerable: true, get: function () { return identity_actions_js_1.MODULE_KEY; } });
+Object.defineProperty(exports, "IDENTITY_ACTIONS", { enumerable: true, get: function () { return identity_actions_js_1.IDENTITY_ACTIONS; } });
+Object.defineProperty(exports, "actionsFor", { enumerable: true, get: function () { return identity_actions_js_1.actionsFor; } });
 // The single registration seam.
 var shield_module_js_1 = require("./module/shield.module.js");
 Object.defineProperty(exports, "ShieldModule", { enumerable: true, get: function () { return shield_module_js_1.ShieldModule; } });

package/dist/migrations-dir.d.ts

@@ -0,0 +1,2 @@
+export declare const guardMigrationsDir: string;
+//# sourceMappingURL=migrations-dir.d.ts.map

package/dist/migrations-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations-dir.d.ts","sourceRoot":"","sources":["../src/migrations-dir.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,kBAAkB,EAAE,MAA4C,CAAC"}

package/dist/migrations-dir.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardMigrationsDir = void 0;
+/**
+ * Absolute path to the framework authz migration files (`packages/guard/migrations`).
+ *
+ * The consuming app resolves this (via `@astram/migrate`) to MERGE guard's authz migrations
+ * with @astram/identity's + its own. Resolved relative to THIS compiled module's directory:
+ * `dist/migrations-dir.js` → `../migrations` (the migrations dir sits beside `dist/`, at the
+ * package root, published via package.json `files`).
+ */
+const node_path_1 = require("node:path");
+exports.guardMigrationsDir = (0, node_path_1.join)(__dirname, '..', 'migrations');

package/dist/module/shield-tokens.d.ts

@@ -10,6 +10,11 @@
  * ADR-0001 decision entry both the global enforcement guard and the engine's
  * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
  * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ *
+ * DEFINED IN `@astram/core` and RE-EXPORTED here for back-compat — moved there so
+ * `@astram/engine` can consume the same token WITHOUT importing `@astram/guard` (which
+ * depends on engine — a guard-local token created an engine ↔ guard cycle). Both packages
+ * now import the ONE symbol from core, so it stays a single DI identity across the app.
  */
-export declare const SHIELD_DECISION_AUTHORITY: unique symbol;
+export { SHIELD_DECISION_AUTHORITY } from '@astram/core';
 //# sourceMappingURL=shield-tokens.d.ts.map

package/dist/module/shield-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield-tokens.d.ts","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC"}
+{"version":3,"file":"shield-tokens.d.ts","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC"}

package/dist/module/shield-tokens.js

@@ -13,5 +13,11 @@ exports.SHIELD_DECISION_AUTHORITY = void 0;
  * ADR-0001 decision entry both the global enforcement guard and the engine's
  * permission-gate stage consult. Provided app-wide by `ShieldModule.forRoot()`
  * (default: the deny-by-default stub; overridable via the `decisionAuthority` option).
+ *
+ * DEFINED IN `@astram/core` and RE-EXPORTED here for back-compat — moved there so
+ * `@astram/engine` can consume the same token WITHOUT importing `@astram/guard` (which
+ * depends on engine — a guard-local token created an engine ↔ guard cycle). Both packages
+ * now import the ONE symbol from core, so it stays a single DI identity across the app.
  */
-exports.SHIELD_DECISION_AUTHORITY = Symbol('SHIELD_DECISION_AUTHORITY');
+var core_1 = require("@astram/core");
+Object.defineProperty(exports, "SHIELD_DECISION_AUTHORITY", { enumerable: true, get: function () { return core_1.SHIELD_DECISION_AUTHORITY; } });

package/dist/module/shield.module.d.ts

@@ -138,6 +138,14 @@ export interface ShieldModuleOptions {
      * `auth: true`.
      */
     readonly rootIds?: readonly string[];
+    /**
+     * The identity permission-key universe for the auth-facts projection. Pass
+     * `identityAuthActionKeys` from `@astram/identity` when `auth: true` to light up the
+     * permission-gated admin nav. Only consulted when `auth: true`.
+     */
+    readonly identityActionKeys?: readonly string[];
+    /** The control-plane subset — pass `identityControlPlaneKeys` from `@astram/identity`. */
+    readonly identityControlPlaneKeys?: readonly string[];
     /**
      * OPTIONAL eager session-facts projector (ADR-0011) — see
      * {@link AuthModuleOptions.sessionFactsProjector}. Threaded straight through to
@@ -224,6 +232,15 @@ export interface ShieldModuleAsyncOptions {
      * then threaded exactly like the static case. Only consulted when `auth: true`.
      */
     readonly rootIds?: readonly string[];
+    /**
+     * The identity permission-key universe for the auth-facts projection — see
+     * {@link ShieldModuleOptions.identityActionKeys}. STATIC here (like the other seams): a
+     * registration-time collaborator threaded into the statically-composed {@link AuthModule}
+     * import. Only consulted when `auth: true`.
+     */
+    readonly identityActionKeys?: readonly string[];
+    /** The control-plane subset — see {@link ShieldModuleOptions.identityControlPlaneKeys}. */
+    readonly identityControlPlaneKeys?: readonly string[];
     /**
      * OPTIONAL eager session-facts projector — see {@link ShieldModuleOptions.sessionFactsProjector}.
      * STATIC here (like the other seams): a registration-time collaborator threaded into the

package/dist/module/shield.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAIrC,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAyFvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAiFhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAqFtE"}
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAIrC,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAyFvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAuFhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CA2FtE"}

package/dist/module/shield.module.js

@@ -188,6 +188,12 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.mfaDeviceStore ? { mfaDeviceStore: options.mfaDeviceStore } : {}),
                 ...(options.totpVerifier ? { totpVerifier: options.totpVerifier } : {}),
                 ...(options.rootIds ? { rootIds: options.rootIds } : {}),
+                ...(options.identityActionKeys
+                    ? { identityActionKeys: options.identityActionKeys }
+                    : {}),
+                ...(options.identityControlPlaneKeys
+                    ? { identityControlPlaneKeys: options.identityControlPlaneKeys }
+                    : {}),
                 ...(options.sessionFactsProjector
                     ? { sessionFactsProjector: options.sessionFactsProjector }
                     : {}),
@@ -293,6 +299,12 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.mfaDeviceStore ? { mfaDeviceStore: options.mfaDeviceStore } : {}),
                 ...(options.totpVerifier ? { totpVerifier: options.totpVerifier } : {}),
                 ...(options.rootIds ? { rootIds: options.rootIds } : {}),
+                ...(options.identityActionKeys
+                    ? { identityActionKeys: options.identityActionKeys }
+                    : {}),
+                ...(options.identityControlPlaneKeys
+                    ? { identityControlPlaneKeys: options.identityControlPlaneKeys }
+                    : {}),
                 ...(options.sessionFactsProjector
                     ? { sessionFactsProjector: options.sessionFactsProjector }
                     : {}),