@astram/guard 0.5.1 → 0.7.0

package/dist/config/app-config.js

@@ -8,7 +8,9 @@ exports.loadSessionLifetimes = loadSessionLifetimes;
 exports.loadRefreshHmacKey = loadRefreshHmacKey;
 exports.assertRefreshHmacKey = assertRefreshHmacKey;
 exports.loadAppConfig = loadAppConfig;
+exports.loadAppConfigAsync = loadAppConfigAsync;
 exports.evaluatePoolBudget = evaluatePoolBudget;
+const core_1 = require("@astram/core");
 /** Documented MVP single-node defaults (see the class doc + my.cnf). */
 exports.DEFAULT_POOL_BUDGET = {
     workers: 8,
@@ -214,6 +216,26 @@ function loadAppConfig(env = process.env) {
         lifetimes: loadSessionLifetimes(env),
     };
 }
+/**
+ * ADR-0032 secrets integration — build the {@link AppConfig} AFTER resolving any `secret-ref:<path>`
+ * env references via the injected `SecretsProvider`, so an app can hold only REFERENCES in its env
+ * (safe to commit/log) and the real credentials are fetched at boot.
+ *
+ * - With a `provider`: every `secret-ref:` value in `env` is resolved (fail-closed — a missing
+ *   reference aborts boot; a value is never logged), producing a resolved env the pure
+ *   {@link loadAppConfig} consumes unchanged.
+ * - Without a `provider`: identical to `loadAppConfig(env)` — literal env, unchanged behaviour
+ *   (backward compatible; references would pass through as literals, which fail loudly at connect
+ *   time rather than silently — the operator is expected to wire a provider when using references).
+ *
+ * The core resolver (`resolveSecretRefs`) does the work; this is the guard-side boot seam.
+ */
+async function loadAppConfigAsync(provider, env = process.env) {
+    if (provider === undefined)
+        return loadAppConfig(env);
+    const resolved = await (0, core_1.resolveSecretRefs)(env, provider);
+    return loadAppConfig(resolved);
+}
 /**
  * Evaluate a pool budget. Pure: no throwing, no I/O — the caller decides how to
  * react (the boot assertion throws; tests inspect the fields).

package/dist/config/app-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":";;;AAoMA,wCAuBC;AAgDD,oCAQC;AAOD,0CAaC;AAYD,oDAeC;AAQD,gDAEC;AAiBD,oDASC;AAaD,sCAUC;AA0BD,gDAgBC;AAlRD,wEAAwE;AAC3D,QAAA,mBAAmB,GAAqB;IACnD,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,GAAG;IACnB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE;QACb,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,CAAC;QAClB,iBAAiB,EAAE,CAAC;KACrB;CACF,CAAC;AAEF,gFAAgF;AACnE,QAAA,wBAAwB,GAAG,CAAC,CAAC;AAE1C,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAgB;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACvD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO;QACL,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,2BAAmB,CAAC,OAAO,CAAC;QACxE,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,sBAAsB,EAC1B,2BAAmB,CAAC,cAAc,CACnC;QACD,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,2BAAmB,CAAC,QAAQ,CAAC;QAC3E,aAAa,EAAE;YACb,WAAW,EAAE,gBAAgB,CAC3B,GAAG,CAAC,aAAa,EACjB,2BAAmB,CAAC,aAAa,CAAC,WAAW,CAC9C;YACD,eAAe,EAAE,gBAAgB,CAC/B,GAAG,CAAC,iBAAiB,EACrB,2BAAmB,CAAC,aAAa,CAAC,eAAe,CAClD;YACD,iBAAiB,EAAE,gBAAgB,CACjC,GAAG,CAAC,mBAAmB,EACvB,2BAAmB,CAAC,aAAa,CAAC,iBAAiB,CACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,8EAA8E;AAE9E,uFAAuF;AAC1E,QAAA,iBAAiB,GAA+B;IAC3D,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,iBAAiB;CAC5B,CAAC;AAEF,6DAA6D;AAChD,QAAA,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,wEAAwE;AACxE,SAAS,WAAW,CAAC,GAAuB,EAAE,QAAgB;IAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,GAAuB;IACvD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC1D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,IAAI,CAAC;QACxD,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC1D,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC;QAC9C,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,QAAQ,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,yBAAiB,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAIX,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,SAAS,CAAC,oBAAoB,GAAG,GAAG,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,+EAA+E;YAC/E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC/B,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC;QACzB,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC;QACrB,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;QAC3B,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACvC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;KACrC,CAAC;AACJ,CAAC;AAsBD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAqB;IACtD,MAAM,oBAAoB,GACxB,GAAG,CAAC,aAAa,CAAC,WAAW;QAC7B,GAAG,CAAC,aAAa,CAAC,eAAe;QACjC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC;IACtC,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,GAAG,oBAAoB,CAAC;IAC9D,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,GAAG,mBAAmB,CAAC;IACvD,OAAO;QACL,oBAAoB;QACpB,kBAAkB;QAClB,mBAAmB;QACnB,KAAK;QACL,YAAY,EAAE,mBAAmB,IAAI,GAAG,CAAC,cAAc;QACvD,sBAAsB,EAAE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,gCAAwB;KACxF,CAAC;AACJ,CAAC"}

package/dist/config/config.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.module.js","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,mDAAgE;AAEhE,mDAAmD;AACtC,QAAA,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAE/C;;;;;;GAMG;AAWI,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAVxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,kBAAU;gBACnB,UAAU,EAAE,GAAc,EAAE,CAAC,IAAA,6BAAa,GAAE;aAC7C;SACF;QACD,OAAO,EAAE,CAAC,kBAAU,CAAC;KACtB,CAAC;GACW,YAAY,CAAG"}

package/dist/encryption/local-kek-crypto.d.ts

@@ -0,0 +1,15 @@
+import type { CryptoPort, Dek, WrappedDek, Ciphertext } from '@astram/core';
+export declare class LocalKekCrypto implements CryptoPort {
+    #private;
+    /**
+     * @param kek the 32-byte Key Encryption Key (from a KMS/secrets-manager reference). MUST be
+     *   exactly 32 bytes. NEVER hard-code it; NEVER log it.
+     */
+    constructor(kek: Uint8Array);
+    generateDek(): Promise<Dek>;
+    wrapDek(dek: Dek, tenantId: string): Promise<WrappedDek>;
+    unwrapDek(wrapped: WrappedDek, tenantId: string): Promise<Dek>;
+    encrypt(plaintext: Uint8Array, dek: Dek, tenantId: string): Promise<Ciphertext>;
+    decrypt(ciphertext: Ciphertext, dek: Dek, tenantId: string): Promise<Uint8Array>;
+}
+//# sourceMappingURL=local-kek-crypto.d.ts.map

package/dist/encryption/local-kek-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-kek-crypto.d.ts","sourceRoot":"","sources":["../../src/encryption/local-kek-crypto.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO5E,qBAAa,cAAe,YAAW,UAAU;;IAG/C;;;OAGG;gBACS,GAAG,EAAE,UAAU;IAOrB,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAI3B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxD,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI9D,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA0BvF"}

package/dist/encryption/local-kek-crypto.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalKekCrypto = void 0;
+/**
+ * `LocalKekCrypto` — a reference {@link CryptoPort} adapter (ADR-0031). Real AES-256-GCM AEAD for
+ * data + DEK-wrapping, with the KEK held as a local secret (from a secrets-manager reference /
+ * env). This is the dev + air-gapped / single-box adapter (what astram-infra's box can use); the
+ * AWS-KMS / GCP-KMS / Vault-Transit adapters implement the SAME port and swap in on demand
+ * (Rule of Three).
+ *
+ * SECURITY:
+ *  - AES-256-GCM (authenticated): a 96-bit random nonce per operation; the 128-bit tag is verified
+ *    on decrypt; the `tenantId` is bound as ADDITIONAL AUTHENTICATED DATA (AAD) so a ciphertext for
+ *    tenant A cannot be decrypted as tenant B (the core's cross-tenant guard, enforced in crypto).
+ *  - DEK wrapping uses the SAME AEAD under the KEK, with the tenantId as AAD — a wrapped DEK is
+ *    bound to its tenant.
+ *  - The KEK is 32 bytes, provided at construction (never hard-coded, never logged). Losing it makes
+ *    all wrapped DEKs (hence all data) unrecoverable — it belongs in a KMS/secrets-manager.
+ *  - NEVER logs a plaintext, a DEK, or the KEK.
+ *
+ * Self-describing output layout (both encrypt + wrap): [1B version][12B nonce][16B tag][ciphertext].
+ */
+const node_crypto_1 = require("node:crypto");
+const VERSION = 1;
+const NONCE_LEN = 12;
+const TAG_LEN = 16;
+const DEK_LEN = 32; // AES-256
+class LocalKekCrypto {
+    #kek;
+    /**
+     * @param kek the 32-byte Key Encryption Key (from a KMS/secrets-manager reference). MUST be
+     *   exactly 32 bytes. NEVER hard-code it; NEVER log it.
+     */
+    constructor(kek) {
+        if (kek.length !== DEK_LEN) {
+            throw new Error(`KEK must be ${DEK_LEN} bytes (got ${kek.length}).`);
+        }
+        this.#kek = Buffer.from(kek);
+    }
+    async generateDek() {
+        return new Uint8Array((0, node_crypto_1.randomBytes)(DEK_LEN));
+    }
+    async wrapDek(dek, tenantId) {
+        return this.#seal(this.#kek, Buffer.from(dek), tenantId);
+    }
+    async unwrapDek(wrapped, tenantId) {
+        return new Uint8Array(this.#open(this.#kek, Buffer.from(wrapped), tenantId));
+    }
+    async encrypt(plaintext, dek, tenantId) {
+        return this.#seal(Buffer.from(dek), Buffer.from(plaintext), tenantId);
+    }
+    async decrypt(ciphertext, dek, tenantId) {
+        return new Uint8Array(this.#open(Buffer.from(dek), Buffer.from(ciphertext), tenantId));
+    }
+    // ── AES-256-GCM seal/open, tenantId bound as AAD ──────────────────────────
+    #seal(key, plaintext, tenantId) {
+        const nonce = (0, node_crypto_1.randomBytes)(NONCE_LEN);
+        const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', key, nonce);
+        cipher.setAAD(Buffer.from(tenantId, 'utf8'));
+        const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return new Uint8Array(Buffer.concat([Buffer.from([VERSION]), nonce, tag, body]));
+    }
+    #open(key, sealed, tenantId) {
+        if (sealed.length < 1 + NONCE_LEN + TAG_LEN)
+            throw new Error('ciphertext too short / malformed');
+        if (sealed[0] !== VERSION)
+            throw new Error(`unsupported ciphertext version ${sealed[0]}`);
+        const nonce = sealed.subarray(1, 1 + NONCE_LEN);
+        const tag = sealed.subarray(1 + NONCE_LEN, 1 + NONCE_LEN + TAG_LEN);
+        const body = sealed.subarray(1 + NONCE_LEN + TAG_LEN);
+        const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, nonce);
+        decipher.setAAD(Buffer.from(tenantId, 'utf8'));
+        decipher.setAuthTag(tag);
+        // .final() THROWS on a tag/AAD mismatch — the fail-closed guarantee the core relies on.
+        return Buffer.concat([decipher.update(body), decipher.final()]);
+    }
+}
+exports.LocalKekCrypto = LocalKekCrypto;

package/dist/enforcement/classification.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.decorator.js","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":";;;AA4CA,0DAgBC;AA5DD,2CAA6C;AAE7C;;;;;;;;;;;;GAYG;AACU,QAAA,uBAAuB,GAAG;IACrC,kEAAkE;IAClE,MAAM,EAAE,8BAA8B;IACtC;;;;OAIG;IACH,UAAU,EAAE,kCAAkC;CACtC,CAAC;AAgBX,wFAAwF;AAC3E,QAAA,yBAAyB,GAAG,QAAQ,CAAC;AAElD,gFAAgF;AAChF,SAAgB,uBAAuB,CACrC,KAA0C;IAE1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IACD,IACE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,MAAM,MAAM,GAAG,GAAqC,EAAE,CAC3D,IAAA,oBAAW,EAAC,+BAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AADvC,QAAA,MAAM,UACiC;AAEpD;;;;;;;;GAQG;AACI,MAAM,UAAU,GAAG,CACxB,cAAuC,EACL,EAAE,CACpC,IAAA,oBAAW,EAAC,+BAAuB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;AAHrD,QAAA,UAAU,cAG2C"}

package/dist/enforcement/core-seam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-seam.js","sourceRoot":"","sources":["../../src/enforcement/core-seam.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAqBH;;;;;;;;;;;GAWG;AACU,QAAA,qBAAqB,GAA0B;IAC1D,MAAM;QACJ,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;CACF,CAAC"}

package/dist/enforcement/enforcement.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.module.js","sourceRoot":"","sources":["../../src/enforcement/enforcement.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,uCAAyC;AACzC,+EAAuE;AAEvE;;;;;;;;;;;;;;GAcG;AASI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IAR7B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,oDAAsB;aACjC;SACF;KACF,CAAC;GACW,iBAAiB,CAAG"}

package/dist/enforcement/global-enforcement.guard.d.ts

@@ -2,6 +2,7 @@ import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import type { CoreDecisionAuthority } from './core-seam.js';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { ServiceAuthenticator } from '@astram/core';
 /**
  * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
  * authorization for classified routes.
@@ -33,7 +34,8 @@ export declare class GlobalEnforcementGuard implements CanActivate {
     private readonly reflector;
     private readonly decisionAuthority?;
     private readonly tokenBinder?;
-    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined);
+    private readonly serviceAuth?;
+    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined, serviceAuth?: ServiceAuthenticator | undefined);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /** The real authorization path for a classified route (fail-closed throughout). */
     private authorizeClassified;

package/dist/enforcement/global-enforcement.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAQlF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBANZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAG7C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}
+{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAQzD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAM7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAZZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAMhC,WAAW,CAAC,EAAE,oBAAoB,YAAA;IAG/C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}

package/dist/enforcement/global-enforcement.guard.js

@@ -52,10 +52,12 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
     reflector;
     decisionAuthority;
     tokenBinder;
-    constructor(reflector, decisionAuthority, tokenBinder) {
+    serviceAuth;
+    constructor(reflector, decisionAuthority, tokenBinder, serviceAuth) {
         this.reflector = reflector;
         this.decisionAuthority = decisionAuthority;
         this.tokenBinder = tokenBinder;
+        this.serviceAuth = serviceAuth;
     }
     async canActivate(context) {
         // Only HTTP requests are classified here. Non-HTTP contexts (if ever added)
@@ -94,7 +96,7 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         }
         const req = context.switchToHttp().getRequest();
         const authHeader = req?.headers?.['authorization'];
-        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authHeader, this.tokenBinder);
+        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authHeader, this.tokenBinder, this.serviceAuth);
         if (resolved === null) {
             // No/invalid/expired token → not authenticated. 401 (distinct from a deny).
             throw new common_1.UnauthorizedException('Shield enforcement: missing or invalid access token for a classified route.');
@@ -155,5 +157,7 @@ exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
     __param(1, (0, common_1.Inject)(shield_tokens_js_1.SHIELD_DECISION_AUTHORITY)),
     __param(2, (0, common_1.Optional)()),
     __param(2, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
-    __metadata("design:paramtypes", [core_1.Reflector, Object, Function])
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(tokens_js_1.SHIELD_SERVICE_AUTHENTICATOR)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object, Function, Object])
 ], GlobalEnforcementGuard);

package/dist/enforcement/global-enforcement.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-enforcement.guard.js","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AACzC,+EAIuC;AACvC,iEAAuE;AAEvE,yDAAwE;AAExE,+EAA0E;AAC1E,+EAG8C;AAC9C,mEAA4D;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAEd;IAGA;IAGA;IAPnB,YACmB,SAAoB,EAGpB,iBAAyC,EAGzC,WAAgC;QANhC,cAAS,GAAT,SAAS,CAAW;QAGpB,sBAAiB,GAAjB,iBAAiB,CAAwB;QAGzC,gBAAW,GAAX,WAAW,CAAqB;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,4EAA4E;QAC5E,2DAA2D;QAC3D,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,2BAAkB,CAC1B,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAuB,CAAC,MAAM,EAAE;YACzF,OAAO;YACP,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8DAA8D;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,qDAAuB,CAAC,UAAU,EAClC,CAAC,OAAO,EAAE,UAAU,CAAC,CACtB,CAAC;QACF,MAAM,cAAc,GAAG,IAAA,qDAAuB,EAAC,GAAG,CAAC,CAAC;QACpD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,2BAAkB,CAC1B,mEAAmE;YACjE,uEAAuE;YACvE,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,mBAAmB,CAC/B,OAAyB,EACzB,cAA8B;QAE9B,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC3E,MAAM,IAAI,2BAAkB,CAC1B,kFAAkF;gBAChF,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAMzC,CAAC;QACL,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAkB,EAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,4EAA4E;YAC5E,MAAM,IAAI,8BAAqB,CAC7B,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAEvC,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,8EAA8E;QAC9E,8EAA8E;QAC9E,oFAAoF;QACpF,kFAAkF;QAClF,oFAAoF;QACpF,iFAAiF;QACjF,8EAA8E;QAC9E,gCAAgC;QAChC,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,GAAG,CAAC;YACzC,IAAI,CAAC,IAAA,yCAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,2BAAkB,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAE1B,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,qFAAqF;QACrF,iFAAiF;QACjF,oFAAoF;QACpF,yDAAyD;QACzD,EAAE;QACF,8EAA8E;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,EAAE;QACF,sFAAsF;QACtF,oFAAoF;QACpF,6EAA6E;QAC7E,MAAM,UAAU,GAAsB;YACpC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,kBAAkB,IAAI,CAAC;SAChE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,+CAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CACnE,IAAI,CAAC,iBAAkB,CAAC,MAAM,CAC5B,SAAS,EACT,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,EAC9B,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,EACvF,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8EAA8E;QAC9E,MAAM,IAAI,2BAAkB,CAC1B,yCAAyC,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,OAAO,GAAG,CAC/F,CAAC;IACJ,CAAC;CACF,CAAA;AA7IY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,4CAAyB,CAAC,CAAA;IAEjC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;qCALR,gBAAS;GAF5B,sBAAsB,CA6IlC"}

package/dist/enforcement/reenroll-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reenroll-allowlist.js","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AA2BH,oDAOC;AAYD,8CAUC;AA/CD;;;;GAIG;AACU,QAAA,gBAAgB,GAAoC,MAAM,CAAC,MAAM,CAAC;IAC7E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE;IAClE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC/C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;IACnC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;CACzC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,MAAe;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,0CAA0C;IAC1C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACtD,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,MAAe,EAAE,MAAe;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,wBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/identity/auth-facts.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-facts.controller.js","sourceRoot":"","sources":["../../src/identity/auth-facts.controller.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;AAEH,2CAAuG;AACvG,4FAAoE;AACpE,yDAAwE;AAExE,+EAA+E;AAC/E,iDAA4D;AAC5D,+EAA2I;AAGpI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEsC;IACJ;IAFhE,YACoE,WAA2C,EAC/C,KAAgD;QAD5C,gBAAW,GAAX,WAAW,CAAgC;QAC/C,UAAK,GAAL,KAAK,CAA2C;IAC7G,CAAC;IAIE,AAAN,KAAK,CAAC,YAAY,CAA2B,aAAsB;QACjE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2DAA6B,EAAE,CAAC;gBACjD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAIK,AAAN,KAAK,CAAC,qBAAqB,CAA2B,aAAsB;QAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrF,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2DAA6B,EAAE,CAAC;gBACjD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,YAAY,CAAC,aAAsB;QAC/C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAChE,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAA,8CAAuB,EAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AApDY,kDAAmB;AAQxB;IAFL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,YAAY,CAAC;IACE,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;uDAa3C;AAIK;IAFL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,qBAAqB,CAAC;IACE,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;gEAcpD;8BAvCU,mBAAmB;IAD/B,IAAA,mBAAU,EAAC,UAAU,CAAC;IAGlB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;IAC/C,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;;GAHnC,mBAAmB,CAoD/B"}

package/dist/identity/identity-actions.d.ts

@@ -17,6 +17,22 @@ export type IdentityAction = (typeof IDENTITY_ACTIONS)[number];
  */
 export declare const CROSS_TENANT_GRANT_ACTIONS: readonly ["share", "accept", "revoke"];
 export type CrossTenantGrantAction = (typeof CROSS_TENANT_GRANT_ACTIONS)[number];
+/**
+ * `record_share`'s action vocabulary (list-scoping engine Phase 6, §9.2) — NOT the CRUD verbs.
+ * `share` gates the create/revoke routes (a per-record owner action; the writer's owner-bound is
+ * the real wall), `read` gates the list-a-record's-shares route.
+ */
+export declare const RECORD_SHARE_ACTIONS: readonly ["share", "read"];
+export type RecordShareAction = (typeof RECORD_SHARE_ACTIONS)[number];
+/**
+ * `service_account`'s action vocabulary (ADR-0033). The CRUD verbs administer the ACCOUNT
+ * (`read`/list, `create`, `update` its label/scope/status, `delete`), plus `manage_keys` — the
+ * one credential-lifecycle action gating issue/rotate/revoke of the account's `ask_…` API keys
+ * (a distinct, more-sensitive capability than editing the account row, so it can be granted
+ * separately: an admin may edit an agent's label without holding the power to mint its keys).
+ */
+export declare const SERVICE_ACCOUNT_ACTIONS: readonly ["read", "create", "update", "delete", "manage_keys"];
+export type ServiceAccountAction = (typeof SERVICE_ACCOUNT_ACTIONS)[number];
 /** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
 export declare function actionsFor(typeKey: string): readonly string[];
 //# sourceMappingURL=identity-actions.d.ts.map

package/dist/identity/identity-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAUjF,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,gEAM1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAY5E,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}

package/dist/identity/identity-actions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
+exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
 exports.actionsFor = actionsFor;
 /**
  * The fixed action vocabulary + module key for the framework's @astram/identity objects.
@@ -19,12 +19,34 @@ exports.IDENTITY_ACTIONS = ['read', 'create', 'update', 'delete'];
  * revoke -> 'revoke'). Mirrors astram3's `authz/actions.ts`'s `CROSS_TENANT_GRANT_ACTIONS`.
  */
 exports.CROSS_TENANT_GRANT_ACTIONS = ['share', 'accept', 'revoke'];
+/**
+ * `record_share`'s action vocabulary (list-scoping engine Phase 6, §9.2) — NOT the CRUD verbs.
+ * `share` gates the create/revoke routes (a per-record owner action; the writer's owner-bound is
+ * the real wall), `read` gates the list-a-record's-shares route.
+ */
+exports.RECORD_SHARE_ACTIONS = ['share', 'read'];
+/**
+ * `service_account`'s action vocabulary (ADR-0033). The CRUD verbs administer the ACCOUNT
+ * (`read`/list, `create`, `update` its label/scope/status, `delete`), plus `manage_keys` — the
+ * one credential-lifecycle action gating issue/rotate/revoke of the account's `ask_…` API keys
+ * (a distinct, more-sensitive capability than editing the account row, so it can be granted
+ * separately: an admin may edit an agent's label without holding the power to mint its keys).
+ */
+exports.SERVICE_ACCOUNT_ACTIONS = [
+    'read',
+    'create',
+    'update',
+    'delete',
+    'manage_keys',
+];
 /**
  * Per-type action-vocabulary override. Every type not listed here defaults to
  * {@link IDENTITY_ACTIONS} (the CRUD verbs).
  */
 const ACTIONS_BY_TYPE = {
     cross_tenant_grant: exports.CROSS_TENANT_GRANT_ACTIONS,
+    record_share: exports.RECORD_SHARE_ACTIONS,
+    service_account: exports.SERVICE_ACCOUNT_ACTIONS,
 };
 /** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
 function actionsFor(typeKey) {

package/dist/identity/identity-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-actions.js","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":";;;AAuCA,gCAEC;AAzCD;;;;;;GAMG;AACU,QAAA,UAAU,GAAG,UAAU,CAAC;AACxB,QAAA,gBAAgB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGhF;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGjF;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAG/D;;;GAGG;AACH,MAAM,eAAe,GAAgD;IACnE,kBAAkB,EAAE,kCAA0B;IAC9C,YAAY,EAAE,4BAAoB;CACnC,CAAC;AAEF,mGAAmG;AACnG,SAAgB,UAAU,CAAC,OAAe;IACxC,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,wBAAgB,CAAC;AACtD,CAAC"}

package/dist/identity/module-registry.bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-registry.bridge.js","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":";;AAsBA,kEA4BC;AAlDD;;;;;;GAMG;AACH,uCAAoD;AAQpD,2CAAmD;AACnD,+DAA+D;AAE/D,SAAS,YAAY,CAAC,KAAsB;IAC1C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,SAAgB,2BAA2B,CAAC,MAAkC;IAC5E,MAAM,IAAI,GAA0B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,WAAW,GAA2B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QACF,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,OAAO;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAuB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACrD,IAAA,gCAAU,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,SAAS;QACT,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,OAAgB;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,MAAM;KACjC,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,QAAQ,GAAmB,EAAE,SAAS,EAAE,gCAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAA,2BAAoB,GAAE,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/identity/permission-facts.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-facts.adapter.js","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAiBH,yFAAyF;AACzF,MAAa,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAO,GAAG,2BAA2B;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AALD,sEAKC;AAMD,MAAa,6BAA6B;IAErB;IACA;IACA;IACA;IAJnB,YACmB,IAAU,EACV,WAAoC,EACpC,gBAAmC,EACnC,MAAoB,IAAI,CAAC,GAAG;QAH5B,SAAI,GAAJ,IAAI,CAAM;QACV,gBAAW,GAAX,WAAW,CAAyB;QACpC,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,QAAgB,EAAE,MAAe;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACvD,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC5D,OAAO;gBACL,WAAW;gBACX,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC,CAAC;gBACjE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,kBAAkB;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B;gBAAE,MAAM,GAAG,CAAC;YAC5D,MAAM,IAAI,6BAA6B,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB,EAAE,QAAgB;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B;gBAAE,MAAM,GAAG,CAAC;YAC5D,MAAM,IAAI,6BAA6B,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,WAAmB;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;;;;;iFAK2E,EAC3E,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CACtC,CAAgB,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAA0B;QACpD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,uFAAuF,YAAY,GAAG,EACtG,CAAC,GAAG,OAAO,CAAC,CACb,CAAkB,CAAC;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAgB;QACxC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,qGAAqG,EACrG,CAAC,QAAQ,CAAC,CACX,CAAiB,CAAC;QACnB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,SAA4B;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,oDAAoD;gBACtH,KAAK,MAAM,CAAC,IAAI,GAAG;oBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;CACF;AAzFD,sEAyFC"}

package/dist/index.d.ts

@@ -23,16 +23,22 @@ export type { Classification } from './enforcement/classification.decorator.js';
 export { OperationInventoryScanner } from './completeness/operation-inventory-scanner.js';
 export { CatalogReconciler, CatalogGatabilityError } from './completeness/catalog-reconciler.js';
 export type { CatalogStore, CatalogPermissionRow, ReconcileReport, } from './completeness/ports/catalog-store.js';
-export { SHIELD_SESSION_TOKEN_BINDER } from './request-auth/tokens.js';
+export { SHIELD_SESSION_TOKEN_BINDER, SHIELD_SERVICE_AUTHENTICATOR, } from './request-auth/tokens.js';
 export { SessionTokenBinder } from './request-auth/session-token-binder.js';
 export type { BoundPrincipalClaims } from './request-auth/session-token-binder.js';
-export { resolveRequestPrincipal, principalFromClaims, extractBearerToken, } from './request-auth/request-principal.js';
+export { resolveRequestPrincipal, resolveRequestAuth, principalFromClaims, extractBearerToken, isApiKey, } from './request-auth/request-principal.js';
+export { MariaDbApiKeyStore } from './authentication/mariadb-api-key-store.js';
 export { SHIELD_SESSION_FACTS_ALS, NO_SESSION_FACTS, type SessionFactsStore, } from './request-auth/session-facts-als.js';
 export { GlobalEnforcementGuard } from './enforcement/global-enforcement.guard.js';
 export { stubDecisionAuthority, type Effect, type CoreDecisionAuthority, type CoreDecision, type Principal, } from './enforcement/core-seam.js';
 export { Argon2idPasswordHasher, argon2idHasherProvider, SHIELD_PASSWORD_HASHER, type Argon2idParams, } from './authentication/argon2id-password-hasher.js';
+export { LocalKekCrypto } from './encryption/local-kek-crypto.js';
+export { EncryptedFileSecretsProvider } from './secrets/encrypted-file-secrets.js';
 export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, } from './session/index.js';
 export { MariaDbRecordPermissionRuleAdapter, SHIELD_RECORD_RULE_PORT, type RuleQueryable, } from './authz/mariadb-record-rule-adapter.js';
+export { MariaDbPolicyStore, SHIELD_POLICY_STORE, type RuleQueryable as PolicyStoreQueryable, } from './authz/mariadb-policy-store.js';
+export { MariaDbListScopeAdapter, SHIELD_LIST_SCOPE_PORT, type ListScopeQueryable, } from './authz/mariadb-list-scope-adapter.js';
+export { translateListScope, UnknownScopeFieldError, type TranslatedListScope, type ListScopePrincipal, } from './authz/list-scope-sql.js';
 export { MariaDbRecordShareAdapter, SHIELD_RECORD_SHARE_PORT, type ShareQueryable, } from './authz/mariadb-record-share-adapter.js';
 export { RecordShareWriter, SHIELD_RECORD_SHARE_WRITER, ShareNotPermittedError, ShareStoreUnavailableError, type ShareInput, type ShareGranteeKind, type ShareTypeInfo, type ShareTypeResolver, type ShareAuditEvent, type ShareAuditSink, } from './authz/record-share-writer.js';
 export { makeShareDeleteCascade, type RecordDeletedHook, type ShareQueryFn, } from './authz/record-share-cascade.js';
@@ -40,6 +46,7 @@ export { MariaDbCrossTenantGrantAdapter, SHIELD_CROSS_TENANT_GRANT_PORT, type Gr
 export { CrossTenantGrantWriter, SHIELD_CROSS_TENANT_GRANT_WRITER, GrantNotPermittedError, InvalidGrantError, GrantStoreUnavailableError, type GrantAuthorizeFn, type GrantAuditEvent, type GrantAuditSink, type GrantGranteeKind, type GrantScope, type OfferGrantInput, type AcceptGrantInput, type RevokeGrantInput, } from './authz/cross-tenant-grant-writer.js';
 export { ManifestOperationAuthorityAdapter, SHIELD_OPERATION_AUTHORITY_PORT, type OperationManifestEntry, } from './authz/manifest-operation-authority-adapter.js';
 export { buildRecordAuthorization } from './authz/wire-record-authorization.js';
+export { buildListScopeFn, type ListScopeFn } from './authz/wire-record-authorization.js';
 export { BootSequence, assertPoolBudget } from './boot/boot-sequence.js';
 export { APP_CONFIG } from './config/config.module.js';
 export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, } from './config/app-config.js';
@@ -62,8 +69,11 @@ export type { MfaDeviceStore, MfaDevice } from './auth/ports/mfa-device-store.js
 export type { AuditSink, AuthAuditEvent } from './auth/ports/audit-sink.js';
 export type { SessionFactsProjector } from './auth/ports/session-facts-projector.js';
 export { SHIELD_SESSION_FACTS_PROJECTOR } from './auth/tokens.js';
+export type { ScopeSubtreeResolver } from './auth/ports/scope-subtree-resolver.js';
+export { SHIELD_SCOPE_SUBTREE_RESOLVER } from './auth/tokens.js';
 export { AuthController } from './auth/auth.controller.js';
 export { PendingMfaStore } from './auth/pending-mfa-store.js';
 export { generateTotpSecret, buildOtpauthUri, generateRecoveryCodes, } from './auth/totp-enrollment.js';
 export { AccountController } from './auth/account.controller.js';
+export { buildClosureRows, ScopeCycleError, ScopeDepthError, ScopeUnknownParentError, type ScopeEdge, type ClosureRow, } from './scope/closure-builder.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAMhD,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAOlE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAKtD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAQjE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -16,9 +16,9 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsFor = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
-exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = void 0;
-exports.AccountController = exports.generateRecoveryCodes = void 0;
+exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsFor = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
+exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -61,12 +61,19 @@ Object.defineProperty(exports, "CatalogGatabilityError", { enumerable: true, get
 // internally — a consumer does NOT hand-wire request auth.
 var tokens_js_1 = require("./request-auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_SESSION_TOKEN_BINDER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SESSION_TOKEN_BINDER; } });
+Object.defineProperty(exports, "SHIELD_SERVICE_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SERVICE_AUTHENTICATOR; } });
 var session_token_binder_js_1 = require("./request-auth/session-token-binder.js");
 Object.defineProperty(exports, "SessionTokenBinder", { enumerable: true, get: function () { return session_token_binder_js_1.SessionTokenBinder; } });
 var request_principal_js_1 = require("./request-auth/request-principal.js");
 Object.defineProperty(exports, "resolveRequestPrincipal", { enumerable: true, get: function () { return request_principal_js_1.resolveRequestPrincipal; } });
+Object.defineProperty(exports, "resolveRequestAuth", { enumerable: true, get: function () { return request_principal_js_1.resolveRequestAuth; } });
 Object.defineProperty(exports, "principalFromClaims", { enumerable: true, get: function () { return request_principal_js_1.principalFromClaims; } });
 Object.defineProperty(exports, "extractBearerToken", { enumerable: true, get: function () { return request_principal_js_1.extractBearerToken; } });
+Object.defineProperty(exports, "isApiKey", { enumerable: true, get: function () { return request_principal_js_1.isApiKey; } });
+// Machine/agent auth (ADR-0033): the MariaDB ApiKeyStore adapter (hash-only) — a consumer wires it
+// + a ServiceAuthenticator to enable `Authorization: Bearer ask_…` service-account access.
+var mariadb_api_key_store_js_1 = require("./authentication/mariadb-api-key-store.js");
+Object.defineProperty(exports, "MariaDbApiKeyStore", { enumerable: true, get: function () { return mariadb_api_key_store_js_1.MariaDbApiKeyStore; } });
 // The per-request session-facts hot path (ADR-0011): the SINGLE shared
 // `AsyncLocalStorage` the enforcement guard ENTERS around decide() and the consumer's
 // app-owned `SessionFactsReader` READS. The consumer imports THIS exact singleton to
@@ -100,6 +107,16 @@ var argon2id_password_hasher_js_1 = require("./authentication/argon2id-password-
 Object.defineProperty(exports, "Argon2idPasswordHasher", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.Argon2idPasswordHasher; } });
 Object.defineProperty(exports, "argon2idHasherProvider", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.argon2idHasherProvider; } });
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
+// The reference `CryptoPort` adapter (ADR-0031 envelope encryption): real AES-256-GCM AEAD +
+// local-KEK DEK-wrapping, injected into `@astram/core`'s `createEncryptionService({ crypto })`.
+// Core stays zero-dep; the KMS-backed adapters (AWS/GCP/Vault) implement the same port.
+var local_kek_crypto_js_1 = require("./encryption/local-kek-crypto.js");
+Object.defineProperty(exports, "LocalKekCrypto", { enumerable: true, get: function () { return local_kek_crypto_js_1.LocalKekCrypto; } });
+// The reference `SecretsProvider` adapter (ADR-0032 secrets management): an ENCRYPTED on-box store
+// (secrets AES-GCM-encrypted at rest under the box KEK) so env holds `secret-ref:` pointers and the
+// real values are resolved at boot. Vault / AWS SM / GCP SM implement the same port.
+var encrypted_file_secrets_js_1 = require("./secrets/encrypted-file-secrets.js");
+Object.defineProperty(exports, "EncryptedFileSecretsProvider", { enumerable: true, get: function () { return encrypted_file_secrets_js_1.EncryptedFileSecretsProvider; } });
 // The Session storage/crypto adapters (ADR-0003 / ADR-0013): the concrete durable
 // (MariaDB) + hot (Redis) stores, the node:crypto token generator, the keyed HMAC
 // refresh hasher, and the system clock — all implementing `@astram/core`'s Session
@@ -127,6 +144,30 @@ Object.defineProperty(exports, "SHIELD_CLOCK", { enumerable: true, get: function
 var mariadb_record_rule_adapter_js_1 = require("./authz/mariadb-record-rule-adapter.js");
 Object.defineProperty(exports, "MariaDbRecordPermissionRuleAdapter", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter; } });
 Object.defineProperty(exports, "SHIELD_RECORD_RULE_PORT", { enumerable: true, get: function () { return mariadb_record_rule_adapter_js_1.SHIELD_RECORD_RULE_PORT; } });
+// The guided-policy AUTHOR store (ADR-0003 / design Task 0.3): the concrete
+// `PolicyStore` (core admin port) over the SAME `record_permission_rule` table the
+// rule adapter enforces — author-what-enforces. Persists a `GuidedPolicy`'s N
+// AND-composed conditions as N rows sharing one `rpr_policy_uuid` group id (the read
+// adapter AND-groups by it). `everyone` subject (v1 mapping); canonical operator
+// names; parameterized SQL; no hard-coded UUIDs. NOT wired into buildRecordAuthorization
+// here — the admin authoring surface (Phase 5) consumes it.
+var mariadb_policy_store_js_1 = require("./authz/mariadb-policy-store.js");
+Object.defineProperty(exports, "MariaDbPolicyStore", { enumerable: true, get: function () { return mariadb_policy_store_js_1.MariaDbPolicyStore; } });
+Object.defineProperty(exports, "SHIELD_POLICY_STORE", { enumerable: true, get: function () { return mariadb_policy_store_js_1.SHIELD_POLICY_STORE; } });
+// The LIST-SCOPE port adapter + the ScopeSpec→SQL translator (ADR-0003 / ADR-0005 list
+// form / Task 2.1). The adapter ({@link MariaDbListScopeAdapter}, `ListScopePort`) projects
+// the SAME `record_permission_rule` rows the rule adapter enforces into abstract allow/deny
+// {@link ScopeCondition} AND-groups; the PURE translator ({@link translateListScope}) turns
+// core's {@link ListScopeSpec} into a SAFE, parameterized WHERE fragment (every VALUE a `?`
+// bound param; ONLY registry-derived columns interpolated; unknown field ⇒ throw; negative
+// operators fail closed on NULL; deny-wins as `AND NOT (...)`). Phase 3 injects the fragment
+// into the engine's `list()`. Store outage ⇒ AuthorizationUnavailableError (never unbounded).
+var mariadb_list_scope_adapter_js_1 = require("./authz/mariadb-list-scope-adapter.js");
+Object.defineProperty(exports, "MariaDbListScopeAdapter", { enumerable: true, get: function () { return mariadb_list_scope_adapter_js_1.MariaDbListScopeAdapter; } });
+Object.defineProperty(exports, "SHIELD_LIST_SCOPE_PORT", { enumerable: true, get: function () { return mariadb_list_scope_adapter_js_1.SHIELD_LIST_SCOPE_PORT; } });
+var list_scope_sql_js_1 = require("./authz/list-scope-sql.js");
+Object.defineProperty(exports, "translateListScope", { enumerable: true, get: function () { return list_scope_sql_js_1.translateListScope; } });
+Object.defineProperty(exports, "UnknownScopeFieldError", { enumerable: true, get: function () { return list_scope_sql_js_1.UnknownScopeFieldError; } });
 // The per-record SHARE adapter (ADR-0003 / design §6): the concrete `RecordSharePort` over
 // the `record_share` table. Answers `hasShare` (user- OR role-granted shares, exact-or-`*`
 // action). No share ⇒ false; store outage ⇒ AuthorizationUnavailableError. Injected into
@@ -196,6 +237,13 @@ Object.defineProperty(exports, "SHIELD_OPERATION_AUTHORITY_PORT", { enumerable:
 // enforcement-only path core-free.
 var wire_record_authorization_js_1 = require("./authz/wire-record-authorization.js");
 Object.defineProperty(exports, "buildRecordAuthorization", { enumerable: true, get: function () { return wire_record_authorization_js_1.buildRecordAuthorization; } });
+// The LIST-FORM sibling (Task 2.2): the engine-facing `ListScopeFn` the module wiring hands
+// to the engine's `list()` (Task 3.1). `buildListScopeFn` is a SEPARATE factory (Option A)
+// that takes the SAME `RecordAuthorizationInputs` and constructs its `MariaDbListScopeAdapter`
+// over the SAME un-overridable `inputs.pool` — the adapter is NOT a field of the inputs, so a
+// consumer cannot inject a fail-open scope port. Fail-closed: a transient throw PROPAGATES.
+var wire_record_authorization_js_2 = require("./authz/wire-record-authorization.js");
+Object.defineProperty(exports, "buildListScopeFn", { enumerable: true, get: function () { return wire_record_authorization_js_2.buildListScopeFn; } });
 // Boot infrastructure (ADR-0018 connection-pool budget assertion). `BootModule`
 // itself is NOT exported — it is composed internally by `ShieldModule.forRoot()`.
 var boot_sequence_js_1 = require("./boot/boot-sequence.js");
@@ -279,6 +327,8 @@ Object.defineProperty(exports, "resolveTotpVerifier", { enumerable: true, get: f
 Object.defineProperty(exports, "hmacSha1", { enumerable: true, get: function () { return auth_module_js_2.hmacSha1; } });
 var tokens_js_3 = require("./auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_3.SHIELD_SESSION_FACTS_PROJECTOR; } });
+var tokens_js_4 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SCOPE_SUBTREE_RESOLVER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SCOPE_SUBTREE_RESOLVER; } });
 // The framework-owned `/auth/*` HTTP controller (Team C) + its pending-MFA store.
 // The controller CONSUMES SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY and the
 // PendingMfaStore. It is EXPORTED so AuthModule (Team B) / the integration owner
@@ -301,3 +351,14 @@ Object.defineProperty(exports, "generateRecoveryCodes", { enumerable: true, get:
 // later). Registered by AuthModule alongside AuthController under `auth: true`.
 var account_controller_js_1 = require("./auth/account.controller.js");
 Object.defineProperty(exports, "AccountController", { enumerable: true, get: function () { return account_controller_js_1.AccountController; } });
+// The PURE scope-closure builder (ADR-0027 / Phase 1 Task 1.1 of the scoped-hierarchy
+// tenancy program): turns a node forest's parent edges into the flat ancestor/descendant/
+// depth rows the `shield_authz.scope_closure` table stores. No I/O — the Task 1.2
+// reconciler is the one that calls this against real edges and writes the rows back.
+// `ScopeCycleError` / `ScopeDepthError` / `ScopeUnknownParentError` are the fail-loud
+// exceptions a caller (the reconciler) must handle as data-corruption signals, never swallow.
+var closure_builder_js_1 = require("./scope/closure-builder.js");
+Object.defineProperty(exports, "buildClosureRows", { enumerable: true, get: function () { return closure_builder_js_1.buildClosureRows; } });
+Object.defineProperty(exports, "ScopeCycleError", { enumerable: true, get: function () { return closure_builder_js_1.ScopeCycleError; } });
+Object.defineProperty(exports, "ScopeDepthError", { enumerable: true, get: function () { return closure_builder_js_1.ScopeDepthError; } });
+Object.defineProperty(exports, "ScopeUnknownParentError", { enumerable: true, get: function () { return closure_builder_js_1.ScopeUnknownParentError; } });

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;AAEH,gFAAgF;AAChF,2FAA2F;AAC3F,yDAAyD;AAAhD,uHAAA,kBAAkB,OAAA;AAE3B,6EAA6E;AAC7E,mFAAmF;AACnF,oFAAoF;AACpF,qFAAqF;AACrF,6FAA6F;AAC7F,wFAAwF;AACxF,iDAAiD;AACjD,kFAAmF;AAA1E,wIAAA,2BAA2B,OAAA;AACpC,sEAA0F;AAAjF,iHAAA,UAAU,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,iHAAA,UAAU,OAAA;AAEjD,gCAAgC;AAChC,8DASmC;AARjC,gHAAA,YAAY,OAAA;AACZ,6HAAA,yBAAyB,OAAA;AAS3B,wEAAwE;AACxE,yFAMmD;AALjD,qHAAA,MAAM,OAAA;AACN,yHAAA,UAAU,OAAA;AACV,sIAAA,uBAAuB,OAAA;AACvB,wIAAA,yBAAyB,OAAA;AACzB,sIAAA,uBAAuB,OAAA;AAIzB,uFAAuF;AACvF,sFAAsF;AACtF,mEAAmE;AACnE,gGAA0F;AAAjF,2IAAA,yBAAyB,OAAA;AAClC,8EAAiG;AAAxF,0HAAA,iBAAiB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AAOlD,oFAAoF;AACpF,iFAAiF;AACjF,oFAAoF;AACpF,2DAA2D;AAC3D,sDAAuE;AAA9D,wHAAA,2BAA2B,OAAA;AACpC,kFAA4E;AAAnE,6HAAA,kBAAkB,OAAA;AAE3B,4EAI6C;AAH3C,+HAAA,uBAAuB,OAAA;AACvB,2HAAA,mBAAmB,OAAA;AACnB,0HAAA,kBAAkB,OAAA;AAGpB,uEAAuE;AACvE,sFAAsF;AACtF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,uFAAuF;AACvF,8EAA8E;AAC9E,4EAI6C;AAH3C,gIAAA,wBAAwB,OAAA;AACxB,wHAAA,gBAAgB,OAAA;AAIlB,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,+EAA+E;AAC/E,yFAAmF;AAA1E,qIAAA,sBAAsB,OAAA;AAE/B,6EAA6E;AAC7E,gFAAgF;AAChF,2CAA2C;AAC3C,2DAMoC;AALlC,qHAAA,qBAAqB,OAAA;AAOvB,sEAAsE;AACtE,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,4FAKsD;AAJpD,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AAIxB,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,wDAAwD;AACxD,+CAc4B;AAb1B,qHAAA,yBAAyB,OAAA;AACzB,uHAAA,2BAA2B,OAAA;AAC3B,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,uGAAA,WAAW,OAAA;AACX,wHAAA,4BAA4B,OAAA;AAC5B,iHAAA,qBAAqB,OAAA;AACrB,+GAAA,mBAAmB,OAAA;AACnB,kHAAA,sBAAsB,OAAA;AACtB,iHAAA,qBAAqB,OAAA;AACrB,wGAAA,YAAY,OAAA;AAGd,8EAA8E;AAC9E,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,2DAA2D;AAC3D,yFAIgD;AAH9C,oJAAA,kCAAkC,OAAA;AAClC,yIAAA,uBAAuB,OAAA;AAIzB,4EAA4E;AAC5E,mFAAmF;AACnF,8EAA8E;AAC9E,qFAAqF;AACrF,iFAAiF;AACjF,yFAAyF;AACzF,4DAA4D;AAC5D,2EAIyC;AAHvC,6HAAA,kBAAkB,OAAA;AAClB,8HAAA,mBAAmB,OAAA;AAIrB,uFAAuF;AACvF,4FAA4F;AAC5F,4FAA4F;AAC5F,4FAA4F;AAC5F,4FAA4F;AAC5F,2FAA2F;AAC3F,6FAA6F;AAC7F,8FAA8F;AAC9F,uFAI+C;AAH7C,wIAAA,uBAAuB,OAAA;AACvB,uIAAA,sBAAsB,OAAA;AAGxB,+DAKmC;AAJjC,uHAAA,kBAAkB,OAAA;AAClB,2HAAA,sBAAsB,OAAA;AAKxB,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,kEAAkE;AAClE,2FAIiD;AAH/C,4IAAA,yBAAyB,OAAA;AACzB,2IAAA,wBAAwB,OAAA;AAI1B,uFAAuF;AACvF,yFAAyF;AACzF,iFAAiF;AACjF,sFAAsF;AACtF,+EAA+E;AAC/E,0FAA0F;AAC1F,yCAAyC;AACzC,yEAWwC;AAVtC,2HAAA,iBAAiB,OAAA;AACjB,oIAAA,0BAA0B,OAAA;AAC1B,gIAAA,sBAAsB,OAAA;AACtB,oIAAA,0BAA0B,OAAA;AAS5B,gFAAgF;AAChF,wFAAwF;AACxF,yFAAyF;AACzF,uDAAuD;AACvD,2EAIyC;AAHvC,iIAAA,sBAAsB,OAAA;AAKxB,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,gGAAgG;AAChG,qDAAqD;AACrD,uGAIuD;AAHrD,uJAAA,8BAA8B,OAAA;AAC9B,uJAAA,8BAA8B,OAAA;AAIhC,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,8FAA8F;AAC9F,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,WAAW;AACX,qFAc8C;AAb5C,sIAAA,sBAAsB,OAAA;AACtB,gJAAA,gCAAgC,OAAA;AAChC,sIAAA,sBAAsB,OAAA;AACtB,iIAAA,iBAAiB,OAAA;AACjB,0IAAA,0BAA0B,OAAA;AAW5B,0FAA0F;AAC1F,mGAAmG;AACnG,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,uEAAuE;AACvE,2GAIyD;AAHvD,4JAAA,iCAAiC,OAAA;AACjC,0JAAA,+BAA+B,OAAA;AAIjC,mFAAmF;AACnF,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,wFAAwF;AACxF,oFAAoF;AACpF,qFAAqF;AACrF,mCAAmC;AACnC,qFAAgF;AAAvE,wIAAA,wBAAwB,OAAA;AAEjC,4FAA4F;AAC5F,2FAA2F;AAC3F,+FAA+F;AAC/F,8FAA8F;AAC9F,4FAA4F;AAC5F,qFAA0F;AAAjF,gIAAA,gBAAgB,OAAA;AAEzB,gFAAgF;AAChF,kFAAkF;AAClF,4DAAyE;AAAhE,gHAAA,YAAY,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAEvC,8EAA8E;AAC9E,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,iDAAiD;AACjD,8DAAuD;AAA9C,8GAAA,UAAU,OAAA;AACnB,wDAsBgC;AArB9B,8GAAA,aAAa,OAAA;AACb,+GAAA,cAAc,OAAA;AACd,mHAAA,kBAAkB,OAAA;AAClB,oHAAA,mBAAmB,OAAA;AACnB,yHAAA,wBAAwB,OAAA;AAKxB,+EAA+E;AAC/E,yDAAyD;AACzD,6GAAA,YAAY,OAAA;AACZ,gHAAA,eAAe,OAAA;AACf,qHAAA,oBAAoB,OAAA;AACpB,mHAAA,kBAAkB,OAAA;AAClB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AACjB,kHAAA,iBAAiB,OAAA;AAMnB,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,iFAAiF;AACjF,0EAA0E;AAC1E,mEAAmE;AACnE,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAE9E,kFAAkF;AAClF,+BAA+B;AAC/B,8CAsB0B;AArBxB,2GAAA,cAAc,OAAA;AACd,yGAAA,YAAY,OAAA;AACZ,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,qHAAA,wBAAwB,OAAA;AACxB,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,gHAAA,mBAAmB,OAAA;AACnB,uHAAA,0BAA0B,OAAA;AAC1B,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,kFAAkF;AAClF,8GAAA,iBAAiB,OAAA;AACjB,gFAAgF;AAChF,oHAAA,uBAAuB,OAAA;AACvB,kFAAkF;AAClF,0HAAA,6BAA6B,OAAA;AAG/B,2EAA2E;AAC3E,kGAA4F;AAAnF,2IAAA,yBAAyB,OAAA;AAmBlC,yEAAyE;AACzE,gFAAgF;AAChF,YAAY;AACZ,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA;AAC1B,wDAA2E;AAAlE,4GAAA,UAAU,OAAA;AACnB,oFAAoF;AACpF,uFAAuF;AACvF,qFAAqF;AACrF,+EAA+E;AAC/E,uFAAuF;AACvF,oFAAoF;AACpF,kFAAkF;AAClF,wDAA+F;AAAtF,yHAAA,uBAAuB,OAAA;AAAE,qHAAA,mBAAmB,OAAA;AAAE,0GAAA,QAAQ,OAAA;AAmD/D,8CAAkE;AAAzD,2HAAA,8BAA8B,OAAA;AAOvC,8CAAiE;AAAxD,0HAAA,6BAA6B,OAAA;AAEtC,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,mFAAmF;AACnF,6EAA6E;AAC7E,gEAA2D;AAAlD,oHAAA,cAAc,OAAA;AACvB,oEAA8D;AAArD,uHAAA,eAAe,OAAA;AACxB,kFAAkF;AAClF,oFAAoF;AACpF,iEAAiE;AACjE,yFAAyF;AACzF,gEAImC;AAHjC,wHAAA,kBAAkB,OAAA;AAClB,qHAAA,eAAe,OAAA;AACf,2HAAA,qBAAqB,OAAA;AAGvB,mFAAmF;AACnF,kFAAkF;AAClF,gFAAgF;AAChF,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA;AAE1B,sFAAsF;AACtF,0FAA0F;AAC1F,kFAAkF;AAClF,qFAAqF;AACrF,sFAAsF;AACtF,8FAA8F;AAC9F,iEAOoC;AANlC,sHAAA,gBAAgB,OAAA;AAChB,qHAAA,eAAe,OAAA;AACf,qHAAA,eAAe,OAAA;AACf,6HAAA,uBAAuB,OAAA"}

package/dist/migrations-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations-dir.js","sourceRoot":"","sources":["../src/migrations-dir.ts"],"names":[],"mappings":";;;AAAA;;;;;;;GAOG;AACH,yCAAiC;AAEpB,QAAA,kBAAkB,GAAW,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC"}

package/dist/module/shield-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-tokens.js","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH;;;;;;;;;;GAUG;AACH,qCAAyD;AAAhD,iHAAA,yBAAyB,OAAA"}