@astram/guard 0.4.1 → 0.5.0

package/dist/auth/auth.module.d.ts

@@ -173,6 +173,12 @@ export interface AuthModuleOptions {
      * behavior unchanged). Only meaningful under `auth: true`.
      */
     readonly rootIds?: readonly string[];
+    /** The identity permission-key universe (for auth-facts wildcard expansion). Supplied by the
+     *  consumer from `@astram/identity`'s `identityAuthActionKeys` (guard never imports identity).
+     *  Absent → the adapter gets `[]` (wildcards expand to nothing; exact grants still resolve). */
+    readonly identityActionKeys?: readonly string[];
+    /** The control-plane subset (root gets these grant-independently). From `identityControlPlaneKeys`. */
+    readonly identityControlPlaneKeys?: readonly string[];
     /**
      * OPTIONAL eager session-facts projector (ADR-0011, the {@link SessionFactsProjector}
      * port). Threaded exactly like the other seams: supplied → bound app-wide under

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AAkDtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAyUD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAgED;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA6F/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AA8DtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAiVD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAuHD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAkH/D"}

package/dist/auth/auth.module.js

@@ -113,6 +113,17 @@ const app_config_js_1 = require("../config/app-config.js");
 const config_module_js_1 = require("../config/config.module.js");
 const argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 const mariadb_credential_resolver_js_1 = require("../authentication/mariadb-credential-resolver.js");
+const mariadb_profile_resolver_js_1 = require("../authentication/mariadb-profile-resolver.js");
+const mariadb_credential_writer_js_1 = require("../authentication/mariadb-credential-writer.js");
+const mariadb_profile_writer_js_1 = require("../authentication/mariadb-profile-writer.js");
+const mariadb_reset_token_store_js_1 = require("../authentication/mariadb-reset-token-store.js");
+const mariadb_recovery_code_store_js_1 = require("../authentication/mariadb-recovery-code-store.js");
+const mariadb_mfa_device_store_js_1 = require("../authentication/mariadb-mfa-device-store.js");
+const mariadb_session_sweeper_js_1 = require("../authentication/mariadb-session-sweeper.js");
+const log_email_sender_js_1 = require("../authentication/log-email-sender.js");
+const mariadb_or_totp_verifier_js_1 = require("../authentication/mariadb-or-totp-verifier.js");
+const permission_facts_adapter_js_1 = require("../identity/permission-facts.adapter.js");
+const auth_facts_controller_js_1 = require("../identity/auth-facts.controller.js");
 const index_js_1 = require("../session/index.js");
 const persistence_module_js_1 = require("./persistence.module.js");
 const auth_controller_js_1 = require("./auth.controller.js");
@@ -380,9 +391,15 @@ const sessionAuthorityProvider = {
 const authenticatorProvider = {
     provide: tokens_js_1.SHIELD_AUTHENTICATOR,
     // async: loads the core factories lazily (CJS→ESM, see loadCore()); Nest awaits it.
-    useFactory: async (hasher, resolver, totpOverride, rootIds) => {
+    useFactory: async (hasher, resolver, totpOverride, rootIds, mfaDeviceStore) => {
         const { createAuthenticator, createIdentityBroker, createTotpFactorVerifier } = await loadCore();
-        const totp = resolveTotpVerifier(totpOverride, createTotpFactorVerifier({ hmacSha1: exports.hmacSha1 }));
+        // The login totp verifier is ALWAYS the OR-across-devices wrapper: it delegates
+        // to the resolved base (the consumer `totpOverride` when supplied, else the
+        // framework's single-secret RFC-6238 verifier) per device secret, so a
+        // principal's multiple confirmed devices OR-match. A consumer override still wins
+        // (it's the base inside the OR-wrap); multi-device works by default.
+        const base = resolveTotpVerifier(totpOverride, createTotpFactorVerifier({ hmacSha1: exports.hmacSha1 }));
+        const totp = new mariadb_or_totp_verifier_js_1.OrTotpVerifier(base, mfaDeviceStore);
         return createAuthenticator({
             hasher,
             resolver,
@@ -399,6 +416,7 @@ const authenticatorProvider = {
         tokens_js_1.SHIELD_CREDENTIAL_RESOLVER,
         tokens_js_1.SHIELD_TOTP_VERIFIER_OVERRIDE,
         tokens_js_1.SHIELD_ROOT_IDS,
+        tokens_js_1.SHIELD_MFA_DEVICE_STORE,
     ],
 };
 /**
@@ -438,13 +456,28 @@ const totpVerifierProvider = {
     },
 };
 /**
- * Bind the OPTIONAL current-user profile resolver. When the consumer supplies one it
- * is a value provider under {@link SHIELD_PROFILE_RESOLVER}; when absent we bind
- * `null` so the `@Optional()` injection in the controller resolves cleanly to
- * "no seam" (→ `/auth/me` returns 501). Always provided so the DI token exists.
+ * Bind the current-user profile resolver backing `GET /auth/me`.
+ *
+ * DEFAULT (no consumer override): a `useFactory` that constructs the framework's
+ * {@link MariaDbProfileResolver} injected with the live {@link SHIELD_DB_POOL} — it
+ * names the signed-in user/company/roles from the framework-owned `@astram/identity`
+ * org tables in `shield_app`. This is the paved-road default (mirrors
+ * {@link makeCredentialResolverProvider}): `/auth/me` resolves out of the box, so the
+ * historical honest-501 is now the fail-closed path only when the resolver truly can't
+ * name a profile (deleted user → 404; store outage → 500), never the default.
+ *
+ * OVERRIDE: when the consumer supplies a `profileResolver` through
+ * {@link ShieldModuleOptions.profileResolver} → {@link AuthModule.forRoot}, the token
+ * binds that instance verbatim so `/auth/me` reads the consumer's OWN org schema.
  */
 function makeProfileResolverProvider(override) {
-    return { provide: tokens_js_1.SHIELD_PROFILE_RESOLVER, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_PROFILE_RESOLVER, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_PROFILE_RESOLVER,
+            useFactory: (pool) => new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool),
+            inject: [tokens_js_1.SHIELD_DB_POOL],
+        };
 }
 /**
  * Bind each OPTIONAL account/credential-surface seam. Same pattern as
@@ -453,25 +486,63 @@ function makeProfileResolverProvider(override) {
  * resolves cleanly to "no seam" (→ 501). Always provided so the DI token exists.
  */
 function makeCredentialWriterProvider(override) {
-    return { provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER,
+            useFactory: (pool) => new mariadb_credential_writer_js_1.MariaDbCredentialWriter(pool),
+            inject: [tokens_js_1.SHIELD_DB_POOL],
+        };
 }
 function makeResetTokenStoreProvider(override) {
-    return { provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE,
+            useFactory: (pool) => new mariadb_reset_token_store_js_1.MariaDbResetTokenStore(pool),
+            inject: [tokens_js_1.SHIELD_DB_POOL],
+        };
 }
 function makeEmailSenderProvider(override) {
-    return { provide: tokens_js_1.SHIELD_EMAIL_SENDER, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_EMAIL_SENDER, useValue: override }
+        : { provide: tokens_js_1.SHIELD_EMAIL_SENDER, useFactory: () => new log_email_sender_js_1.LogEmailSender() };
 }
 function makeRecoveryCodeStoreProvider(override) {
-    return { provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE,
+            useFactory: (pool, hasher) => new mariadb_recovery_code_store_js_1.MariaDbRecoveryCodeStore(pool, hasher),
+            inject: [tokens_js_1.SHIELD_DB_POOL, argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER],
+        };
 }
 function makeProfileWriterProvider(override) {
-    return { provide: tokens_js_1.SHIELD_PROFILE_WRITER, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_PROFILE_WRITER, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_PROFILE_WRITER,
+            useFactory: (pool) => new mariadb_profile_writer_js_1.MariaDbProfileWriter(pool),
+            inject: [tokens_js_1.SHIELD_DB_POOL],
+        };
 }
 function makeSessionSweeperProvider(override) {
-    return { provide: tokens_js_1.SHIELD_SESSION_SWEEPER, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_SESSION_SWEEPER, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_SESSION_SWEEPER,
+            useFactory: (pool, binder) => new mariadb_session_sweeper_js_1.MariaDbSessionSweeper(pool, binder),
+            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER],
+        };
 }
 function makeMfaDeviceStoreProvider(override) {
-    return { provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE, useValue: override ?? null };
+    return override
+        ? { provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE, useValue: override }
+        : {
+            provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE,
+            useFactory: (pool) => new mariadb_mfa_device_store_js_1.MariaDbMfaDeviceStore(pool),
+            inject: [tokens_js_1.SHIELD_DB_POOL],
+        };
 }
 function makeAuditSinkProvider(override) {
     return { provide: tokens_js_1.SHIELD_AUDIT_SINK, useValue: override ?? null };
@@ -511,6 +582,13 @@ let AuthModule = AuthModule_1 = class AuthModule {
      * EXACTLY unchanged (zero behavior change for existing consumers).
      */
     static forRoot(options = {}) {
+        // The identity permission-key universe for the auth-facts projection. SAFE
+        // DEFAULT: absent → `[]` (the adapter's wildcard expansion yields nothing, exact
+        // grants still resolve — never a crash). The consumer supplies these from
+        // `@astram/identity`'s `identityAuthActionKeys` / `identityControlPlaneKeys`
+        // through `ShieldModule.forRoot` — guard NEVER imports `@astram/identity`.
+        const identityActionKeys = options.identityActionKeys ?? [];
+        const identityControlPlaneKeys = options.identityControlPlaneKeys ?? [];
         return {
             module: AuthModule_1,
             imports: [persistence_module_js_1.PersistenceModule.forRoot()],
@@ -518,7 +596,9 @@ let AuthModule = AuthModule_1 = class AuthModule {
             // Team C's four `@Public()` /auth/* endpoints. Registered here (integration
             // wiring) so the routes exist the moment auth is opted in — the controller
             // injects the two composed engines (below) + PendingMfaStore.
-            controllers: [auth_controller_js_1.AuthController, account_controller_js_1.AccountController],
+            // AuthFactsController serves the framework-default `/identity/auth-facts` +
+            // `/identity/permissions-version` (over the SHIELD_PERMISSION_FACTS adapter below).
+            controllers: [auth_controller_js_1.AuthController, account_controller_js_1.AccountController, auth_facts_controller_js_1.AuthFactsController],
             providers: [
                 passwordHasherProvider,
                 makeCredentialResolverProvider(options.credentialResolver),
@@ -545,6 +625,17 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // The eager session-facts projector (ADR-0011; null when absent → the auth
                 // controller omits cachedFacts → gate 5 DB-reloads). Consumed by AuthController.
                 makeSessionFactsProjectorProvider(options.sessionFactsProjector),
+                // The framework-DEFAULT permission-facts adapter backing AuthFactsController
+                // (`/identity/auth-facts` + `/identity/permissions-version`). Reads role grants +
+                // per-tenant version from the pool; expands `identity:*` wildcards against the
+                // supplied action-key universe (empty when the consumer didn't pass keys — wildcards
+                // then expand to nothing, exact grants still resolve) and unions root's control-plane
+                // keys. The keys are CLOSED-OVER option values (never a guard→identity import).
+                {
+                    provide: tokens_js_1.SHIELD_PERMISSION_FACTS,
+                    useFactory: (pool) => new permission_facts_adapter_js_1.MariaDbPermissionFactsAdapter(pool, () => identityActionKeys, identityControlPlaneKeys),
+                    inject: [tokens_js_1.SHIELD_DB_POOL],
+                },
                 // The reset-link base URL value the forgot-password handler composes into the
                 // emailed link (framework-owned URL composition; EmailSender stays dumb).
                 resetLinkBaseUrlProvider,

package/dist/auth/tokens.d.ts

@@ -233,4 +233,13 @@ export declare const SHIELD_FORGOT_HINT_LIMITER: unique symbol;
  * `req.ip`.
  */
 export declare const SHIELD_RESET_LIMITER: unique symbol;
+/**
+ * The `MariaDbPermissionFactsAdapter` (`../identity/permission-facts.adapter.ts`) — the
+ * framework-DEFAULT source of a caller's coarse permission facts, backing
+ * `GET /identity/auth-facts` + `GET /identity/permissions-version`
+ * ({@link AuthFactsController}). Consumed `@Optional()`: absent → those routes fail
+ * closed with a `503 authorization_unavailable` (never a fabricated empty projection
+ * or version, which would fail-OPEN).
+ */
+export declare const SHIELD_PERMISSION_FACTS: unique symbol;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAW3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAUvF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,eAA2B,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,YAAY,eAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAW3E;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,eAA4B,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAUvF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AAErE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,eAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,eAAoC,CAAC"}

package/dist/auth/tokens.js

@@ -23,7 +23,7 @@
  * ADR-0003: no framework/DB/crypto imports here — just Symbols (+ one re-export).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
+exports.SHIELD_PERMISSION_FACTS = exports.SHIELD_RESET_LIMITER = exports.SHIELD_FORGOT_HINT_LIMITER = exports.SHIELD_FORGOT_LIMITER = exports.SHIELD_RECOVERY_LIMITER = exports.SHIELD_LOGIN_LIMITER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.SHIELD_ROOT_IDS = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_TOTP_VERIFIER = exports.SHIELD_RESET_LINK_BASE_URL = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.SHIELD_PASSWORD_HASHER = void 0;
 var argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
 /**
@@ -252,3 +252,12 @@ exports.SHIELD_FORGOT_HINT_LIMITER = Symbol('SHIELD_FORGOT_HINT_LIMITER');
  * `req.ip`.
  */
 exports.SHIELD_RESET_LIMITER = Symbol('SHIELD_RESET_LIMITER');
+/**
+ * The `MariaDbPermissionFactsAdapter` (`../identity/permission-facts.adapter.ts`) — the
+ * framework-DEFAULT source of a caller's coarse permission facts, backing
+ * `GET /identity/auth-facts` + `GET /identity/permissions-version`
+ * ({@link AuthFactsController}). Consumed `@Optional()`: absent → those routes fail
+ * closed with a `503 authorization_unavailable` (never a fabricated empty projection
+ * or version, which would fail-OPEN).
+ */
+exports.SHIELD_PERMISSION_FACTS = Symbol('SHIELD_PERMISSION_FACTS');

package/dist/authentication/log-email-sender.d.ts

@@ -0,0 +1,13 @@
+/**
+ * LogEmailSender — the framework DEV-DEFAULT EmailSender. Does NOT deliver mail; it LOGS the outgoing
+ * message (recipient + subject + link) so forgot/reset-password works end-to-end in development with no
+ * external provider. A real SMTP/SendGrid sender stays a consumer override for production. Never throws
+ * (a logging failure must not fail the forgot-password flow, which is fail-closed/no-op-safe by design).
+ */
+import type { EmailSender, EmailMessage } from '../auth/ports/email-sender.js';
+export declare class LogEmailSender implements EmailSender {
+    private readonly log;
+    constructor(log?: (msg: string) => void);
+    send(message: EmailMessage): Promise<void>;
+}
+//# sourceMappingURL=log-email-sender.d.ts.map

package/dist/authentication/log-email-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-email-sender.d.ts","sourceRoot":"","sources":["../../src/authentication/log-email-sender.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE/E,qBAAa,cAAe,YAAW,WAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAA4B;IACzE,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD"}

package/dist/authentication/log-email-sender.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LogEmailSender = void 0;
+class LogEmailSender {
+    log;
+    constructor(log = (m) => console.log(m)) {
+        this.log = log;
+    }
+    async send(message) {
+        this.log(`[astram][dev-email] (NOT delivered — dev LogEmailSender) to=${message.to} subject=${message.subject}\n${message.text ?? message.html ?? ''}`);
+    }
+}
+exports.LogEmailSender = LogEmailSender;

package/dist/authentication/mariadb-credential-writer.d.ts

@@ -0,0 +1,16 @@
+/**
+ * MariaDbCredentialWriter — the framework-DEFAULT CredentialWriter (backs POST /account/change-password
+ * + password reset). Writes ONLY the Argon2id encoded hash to shield_identity.identity_credential; never
+ * plaintext, never logs the hash. Auto-wired on auth:true; a consumer override still wins. Mirrors
+ * MariaDbCredentialResolver (same pool, same table).
+ */
+import type { Pool } from 'mariadb';
+import type { CredentialWriter } from '../auth/ports/credential-writer.js';
+export declare class MariaDbCredentialWriter implements CredentialWriter {
+    private readonly pool;
+    private readonly now;
+    constructor(pool: Pool, now?: () => number);
+    setPassword(principalId: string, passwordHash: string): Promise<void>;
+    getPasswordHash(principalId: string): Promise<string | null>;
+}
+//# sourceMappingURL=mariadb-credential-writer.d.ts.map

package/dist/authentication/mariadb-credential-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-credential-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAI3E,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAhC,IAAI,EAAE,IAAI,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAEhF,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAOnE"}

package/dist/authentication/mariadb-credential-writer.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbCredentialWriter = void 0;
+class MariaDbCredentialWriter {
+    pool;
+    now;
+    constructor(pool, now = Date.now) {
+        this.pool = pool;
+        this.now = now;
+    }
+    async setPassword(principalId, passwordHash) {
+        await this.pool.query('UPDATE `shield_identity`.`identity_credential` SET ic_password_hash = ?, ic_updated_at_ms = ? WHERE ic_principal_id = ?', [passwordHash, this.now(), principalId]);
+    }
+    async getPasswordHash(principalId) {
+        const rows = (await this.pool.query('SELECT ic_password_hash FROM `shield_identity`.`identity_credential` WHERE ic_principal_id = ? LIMIT 1', [principalId]));
+        return rows[0]?.ic_password_hash ?? null;
+    }
+}
+exports.MariaDbCredentialWriter = MariaDbCredentialWriter;

package/dist/authentication/mariadb-mfa-device-store.d.ts

@@ -0,0 +1,16 @@
+import type { Pool } from 'mariadb';
+import type { MfaDevice, MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+export declare class MariaDbMfaDeviceStore implements MfaDeviceStore {
+    private readonly pool;
+    constructor(pool: Pool);
+    listAll(principalId: string): Promise<MfaDevice[]>;
+    listConfirmedSecrets(principalId: string): Promise<string[]>;
+    getSecret(principalId: string, deviceId: string): Promise<string | null>;
+    begin(principalId: string, name: string, secret: string): Promise<string>;
+    confirm(principalId: string, deviceId: string): Promise<boolean>;
+    rename(principalId: string, deviceId: string, name: string): Promise<MfaDevice | null>;
+    remove(principalId: string, deviceId: string): Promise<boolean>;
+    countConfirmed(principalId: string): Promise<number>;
+    stampUsed(secret: string): Promise<void>;
+}
+//# sourceMappingURL=mariadb-mfa-device-store.d.ts.map

package/dist/authentication/mariadb-mfa-device-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-mfa-device-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-device-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAuBnF,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASlD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS5D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASxE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAShE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAetF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}

package/dist/authentication/mariadb-mfa-device-store.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbMfaDeviceStore = void 0;
+/**
+ * MariaDbMfaDeviceStore — the framework-DEFAULT MfaDeviceStore (multi-device MFA).
+ * Persists a principal's N TOTP authenticator devices in `shield_identity`.`mfa_device`
+ * (the secure credential schema — a device secret is server-side verifier material,
+ * ADR-0014). Each device has its OWN base32 secret; the login OR-match (any confirmed
+ * device satisfies the factor) lives in the resolver bundle + the consumer's OR-verifier,
+ * NOT here — this class is pure persistence. Backs all `GET/POST/PATCH/DELETE
+ * /account/mfa/devices*` routes.
+ *
+ * All queries are parameterized. `begin` self-prunes the caller's stale PENDING rows (a
+ * `begin` that is never confirmed) before inserting, so pending rows can't accumulate —
+ * no cron needed. `listConfirmedSecrets` / `countConfirmed` filter to
+ * `md_confirmed_at_ms IS NOT NULL`, so a pending device never satisfies a login nor
+ * counts toward "MFA enabled". Device ids are `crypto.randomUUID()` (never a hard-coded
+ * UUID).
+ *
+ * SECURITY — the display shape {@link MfaDevice} NEVER carries `md_secret`; only
+ * {@link listConfirmedSecrets} and {@link getSecret} return secrets, and both are
+ * server-side-only callers (login bundle, confirm-time code check). `stampUsed` is
+ * best-effort (wrapped in try/catch) — a stamp failure must never fail a login. Every
+ * other method's genuine store outage propagates (fails loud), never swallowed.
+ */
+const node_crypto_1 = require("node:crypto");
+/** Pending-device TTL — a `begin` never confirmed within this window is self-pruned. */
+const PENDING_TTL_MS = 15 * 60 * 1000;
+/** Map a DB row → the display shape (NO secret). BIGINT columns arrive as bigint → Number. */
+const toDevice = (r) => ({
+    id: r.md_id,
+    name: r.md_name,
+    createdAtMs: Number(r.md_created_at_ms),
+    lastUsedAtMs: r.md_last_used_at_ms == null ? null : Number(r.md_last_used_at_ms),
+    confirmed: r.md_confirmed_at_ms != null,
+});
+class MariaDbMfaDeviceStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async listAll(principalId) {
+        const rows = (await this.pool.query(`SELECT md_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms
+         FROM \`shield_identity\`.\`mfa_device\` WHERE md_principal_id = ? ORDER BY md_created_at_ms ASC`, [principalId]));
+        return rows.map(toDevice);
+    }
+    async listConfirmedSecrets(principalId) {
+        const rows = (await this.pool.query(`SELECT md_secret FROM \`shield_identity\`.\`mfa_device\`
+        WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL`, [principalId]));
+        return rows.map((r) => r.md_secret);
+    }
+    async getSecret(principalId, deviceId) {
+        const rows = (await this.pool.query(`SELECT md_secret FROM \`shield_identity\`.\`mfa_device\`
+        WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
+        return rows[0]?.md_secret ?? null;
+    }
+    async begin(principalId, name, secret) {
+        // Prune the caller's stale pending rows first (self-pruning; no cron).
+        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\`
+        WHERE md_principal_id = ? AND md_confirmed_at_ms IS NULL AND md_created_at_ms < ?`, [principalId, Date.now() - PENDING_TTL_MS]);
+        const id = (0, node_crypto_1.randomUUID)();
+        await this.pool.query(`INSERT INTO \`shield_identity\`.\`mfa_device\`
+         (md_id, md_principal_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms)
+       VALUES (?, ?, ?, ?, ?, NULL, NULL)`, [id, principalId, name, secret, Date.now()]);
+        return id;
+    }
+    async confirm(principalId, deviceId) {
+        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_confirmed_at_ms = ?
+        WHERE md_id = ? AND md_principal_id = ? AND md_confirmed_at_ms IS NULL`, [Date.now(), deviceId, principalId]));
+        return res.affectedRows === 1;
+    }
+    async rename(principalId, deviceId, name) {
+        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_name = ?
+        WHERE md_id = ? AND md_principal_id = ?`, [name, deviceId, principalId]));
+        if (res.affectedRows !== 1)
+            return null;
+        const rows = (await this.pool.query(`SELECT md_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms
+         FROM \`shield_identity\`.\`mfa_device\` WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
+        return rows[0] ? toDevice(rows[0]) : null;
+    }
+    async remove(principalId, deviceId) {
+        const res = (await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\` WHERE md_id = ? AND md_principal_id = ?`, [deviceId, principalId]));
+        return res.affectedRows === 1;
+    }
+    async countConfirmed(principalId) {
+        const rows = (await this.pool.query(`SELECT COUNT(*) AS c FROM \`shield_identity\`.\`mfa_device\`
+        WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL`, [principalId]));
+        return Number(rows[0]?.c ?? 0);
+    }
+    async stampUsed(secret) {
+        try {
+            await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_last_used_at_ms = ? WHERE md_secret = ?`, [Date.now(), secret]);
+        }
+        catch {
+            // best-effort; a stamp failure must never fail a login.
+        }
+    }
+}
+exports.MariaDbMfaDeviceStore = MariaDbMfaDeviceStore;

package/dist/authentication/mariadb-or-totp-verifier.d.ts

@@ -0,0 +1,31 @@
+/**
+ * OrTotpVerifier — the framework-DEFAULT `totp` {@link FactorVerifier} for multi-device
+ * MFA. The core authenticator treats one verifier per factor, and multiple
+ * `RequiredFactor`s of the same factor as AND — the OPPOSITE of "match ANY device". So
+ * the OR-match lives here: the caller bundles a principal's N confirmed device secrets
+ * into ONE required-factor whose `secret` is the newline-joined bundle, and this
+ * verifier unpacks the bundle and returns `{ satisfied: true }` if the presented code
+ * matches ANY device secret — delegating the RFC-6238 arithmetic per secret to the
+ * wrapped BASE single-secret verifier.
+ *
+ * On a match it best-effort stamps `stampUsed` for the matched device (matched by its
+ * unique secret — the verify signature is `(credential, secret)` and carries no
+ * principalId; secrets are high-entropy random so the match is exact). The stamp is
+ * fire-and-forget: a stamp failure must NEVER fail a login.
+ */
+import type { Credential, FactorVerdict, FactorVerifier } from '@astram/core';
+import type { MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+export declare class OrTotpVerifier implements FactorVerifier {
+    /** The single-secret RFC-6238 TOTP verifier (delegated to per device secret). */
+    private readonly base;
+    /** The device store — only `stampUsed` is needed (best-effort last-used stamp). */
+    private readonly devices;
+    readonly factor: "totp";
+    constructor(
+    /** The single-secret RFC-6238 TOTP verifier (delegated to per device secret). */
+    base: FactorVerifier, 
+    /** The device store — only `stampUsed` is needed (best-effort last-used stamp). */
+    devices: Pick<MfaDeviceStore, 'stampUsed'>);
+    verify(credential: Credential, bundledSecret: string): Promise<FactorVerdict>;
+}
+//# sourceMappingURL=mariadb-or-totp-verifier.d.ts.map

package/dist/authentication/mariadb-or-totp-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-or-totp-verifier.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-or-totp-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAExE,qBAAa,cAAe,YAAW,cAAc;IAIjD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,QAAQ,CAAC,MAAM,EAAG,MAAM,CAAU;;IAGhC,iFAAiF;IAChE,IAAI,EAAE,cAAc;IACrC,mFAAmF;IAClE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC;IAGvD,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAgBpF"}

package/dist/authentication/mariadb-or-totp-verifier.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * OrTotpVerifier — the framework-DEFAULT `totp` {@link FactorVerifier} for multi-device
+ * MFA. The core authenticator treats one verifier per factor, and multiple
+ * `RequiredFactor`s of the same factor as AND — the OPPOSITE of "match ANY device". So
+ * the OR-match lives here: the caller bundles a principal's N confirmed device secrets
+ * into ONE required-factor whose `secret` is the newline-joined bundle, and this
+ * verifier unpacks the bundle and returns `{ satisfied: true }` if the presented code
+ * matches ANY device secret — delegating the RFC-6238 arithmetic per secret to the
+ * wrapped BASE single-secret verifier.
+ *
+ * On a match it best-effort stamps `stampUsed` for the matched device (matched by its
+ * unique secret — the verify signature is `(credential, secret)` and carries no
+ * principalId; secrets are high-entropy random so the match is exact). The stamp is
+ * fire-and-forget: a stamp failure must NEVER fail a login.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrTotpVerifier = void 0;
+class OrTotpVerifier {
+    base;
+    devices;
+    factor = 'totp';
+    constructor(
+    /** The single-secret RFC-6238 TOTP verifier (delegated to per device secret). */
+    base, 
+    /** The device store — only `stampUsed` is needed (best-effort last-used stamp). */
+    devices) {
+        this.base = base;
+        this.devices = devices;
+    }
+    async verify(credential, bundledSecret) {
+        const secrets = String(bundledSecret ?? '')
+            .split('\n')
+            .map((s) => s.trim())
+            .filter(Boolean);
+        for (const secret of secrets) {
+            const verdict = await this.base.verify(credential, secret);
+            if (verdict.satisfied) {
+                // Best-effort last-used stamp for the device whose secret verified; never
+                // awaited into the deny path (a stamp failure must not fail the login).
+                void this.devices.stampUsed(secret);
+                return { satisfied: true };
+            }
+        }
+        return { satisfied: false };
+    }
+}
+exports.OrTotpVerifier = OrTotpVerifier;

package/dist/authentication/mariadb-profile-resolver.d.ts

@@ -0,0 +1,24 @@
+/**
+ * MariaDbProfileResolver — the framework-DEFAULT ProfileResolver backing `GET /auth/me`
+ * (the seam opened in `../auth/profile-resolver.ts`). Turns an authenticated Principal into
+ * the signed-in user's DISPLAY profile (name / company name / role names) by reading the
+ * framework-owned `@astram/identity` org tables in `shield_app`.
+ *
+ * FRAMEWORK-OWNED (no consumer resolver): auto-wired as the default when `auth: true`, exactly
+ * like MariaDbCredentialResolver. A consumer-supplied `profileResolver` still overrides it.
+ *
+ * ⛔ NEVER-SHOW-UUIDS: returns display NAMES for name/company.name/roles[].name. The bare `id`
+ * fields are machine-only (keys/routing). CONTRACT: null = no resolvable profile (deleted user →
+ * endpoint 404s); a store OUTAGE THROWS (fail-closed → endpoint 500, never a partial profile).
+ */
+import type { Pool } from 'mariadb';
+import type { Principal } from '@astram/core';
+import type { CurrentUserProfile, ProfileResolver } from '../auth/profile-resolver.js';
+export declare class MariaDbProfileResolver implements ProfileResolver {
+    private readonly pool;
+    private readonly now;
+    constructor(pool: Pool, now?: () => number);
+    resolve(principal: Principal): Promise<CurrentUserProfile | null>;
+    private resolveRoleNames;
+}
+//# sourceMappingURL=mariadb-profile-resolver.d.ts.map

package/dist/authentication/mariadb-profile-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-profile-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAe,MAAM,6BAA6B,CAAC;AAMpG,qBAAa,sBAAuB,YAAW,eAAe;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAhC,IAAI,EAAE,IAAI,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAEhF,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;YA4BzD,gBAAgB;CAc/B"}

package/dist/authentication/mariadb-profile-resolver.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * MariaDbProfileResolver — the framework-DEFAULT ProfileResolver backing `GET /auth/me`
+ * (the seam opened in `../auth/profile-resolver.ts`). Turns an authenticated Principal into
+ * the signed-in user's DISPLAY profile (name / company name / role names) by reading the
+ * framework-owned `@astram/identity` org tables in `shield_app`.
+ *
+ * FRAMEWORK-OWNED (no consumer resolver): auto-wired as the default when `auth: true`, exactly
+ * like MariaDbCredentialResolver. A consumer-supplied `profileResolver` still overrides it.
+ *
+ * ⛔ NEVER-SHOW-UUIDS: returns display NAMES for name/company.name/roles[].name. The bare `id`
+ * fields are machine-only (keys/routing). CONTRACT: null = no resolvable profile (deleted user →
+ * endpoint 404s); a store OUTAGE THROWS (fail-closed → endpoint 500, never a partial profile).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MariaDbProfileResolver = void 0;
+class MariaDbProfileResolver {
+    pool;
+    now;
+    constructor(pool, now = Date.now) {
+        this.pool = pool;
+        this.now = now;
+    }
+    async resolve(principal) {
+        const userUuid = principal.id;
+        const companyUuid = principal.tenantId;
+        const users = (await this.pool.query('SELECT u_username, u_email FROM `shield_app`.`users` WHERE u_uuid = ? LIMIT 1', [userUuid]));
+        const user = users[0];
+        if (!user)
+            return null; // deleted user → no profile (never id-leak; endpoint 404s)
+        const companies = (await this.pool.query('SELECT c_name FROM `shield_app`.`companies` WHERE c_uuid = ? LIMIT 1', [companyUuid]));
+        const companyName = companies[0]?.c_name ?? '(unknown company)';
+        const roles = await this.resolveRoleNames(userUuid, companyUuid);
+        return {
+            id: userUuid,
+            name: user.u_username,
+            ...(user.u_email ? { email: user.u_email } : {}),
+            company: { id: companyUuid, name: companyName },
+            roles,
+        };
+    }
+    async resolveRoleNames(userUuid, companyUuid) {
+        const nowMs = this.now();
+        const rows = (await this.pool.query(`SELECT DISTINCT r.r_uuid, r.r_name
+         FROM \`shield_app\`.\`membership_posting\` mp
+         JOIN \`shield_app\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+         JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = mp.mp_role_uuid
+        WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ?
+          AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
+          AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [userUuid, companyUuid, nowMs, nowMs]));
+        return rows.map((r) => ({ id: r.r_uuid, name: r.r_name }));
+    }
+}
+exports.MariaDbProfileResolver = MariaDbProfileResolver;