@astram/guard 0.6.0 → 0.7.0

package/dist/authz/mariadb-policy-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-policy-store.js","sourceRoot":"","sources":["../../src/authz/mariadb-policy-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;;;AAEH,6CAAyC;AAGzC,sFAAsF;AACzE,QAAA,mBAAmB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEjE,uFAAuF;AACvF,MAAM,cAAc,GAAG,cAAc,CAAC;AAOtC;;;;GAIG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,SAAS;IACT,aAAa;IACb,UAAU;IACV,cAAc;CACf,CAAC,CAAC;AAYH,uFAAuF;AACvF,SAAS,cAAc,CAAC,SAA0B;IAChD,IAAI,sBAAsB,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAa,kBAAkB;IACZ,EAAE,CAAgB;IAClB,MAAM,CAAS;IAEhC,YAAY,EAAiB,EAAE,OAA4B,EAAE;QAC3D,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,MAAoB;QACrD,iFAAiF;QACjF,MAAM,UAAU,GAAG,IAAA,wBAAU,GAAE,CAAC;QAEhC,4EAA4E;QAC5E,gDAAgD;QAChD,MAAM,IAAI,GAKR,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAC5B,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,yCAAyC;gBAC/D,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;aACzB,CAAC,CAAC,CAAC;QAEV,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,iBAAiB,IAAI,CAAC,MAAM;;;kDAGc,EAC1C;gBACE,IAAA,wBAAU,GAAE,EAAE,gCAAgC;gBAC9C,UAAU,EAAE,wCAAwC;gBACpD,QAAQ,EAAE,kBAAkB;gBAC5B,MAAM,CAAC,OAAO,EAAE,eAAe;gBAC/B,MAAM,CAAC,MAAM,EAAE,aAAa;gBAC5B,MAAM,CAAC,MAAM,EAAE,aAAa;gBAC5B,UAAU,EAAE,kDAAkD;gBAC9D,IAAI,EAAE,oBAAoB;gBAC1B,GAAG,CAAC,KAAK,EAAE,YAAY;gBACvB,GAAG,CAAC,QAAQ,EAAE,eAAe;gBAC7B,GAAG,CAAC,KAAK,EAAE,YAAY;aACxB,CACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,QAAgB;QAClD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC/B;kBACY,IAAI,CAAC,MAAM;;;2DAG8B,EACrD,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAgB,CAAC;QAElB,yDAAyD;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,mEAAmE;YACnE,4EAA4E;YAC5E,6EAA6E;YAC7E,qBAAqB;YACrB,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI;gBAAE,SAAS;YAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC/C,IAAI,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;gBACxB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS,CAAC,gDAAgD;YACnF,MAAM,UAAU,GAAsB,SAAS;gBAC7C,6DAA6D;iBAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC;iBACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,KAAK,EAAE,CAAC,CAAC,SAAmB;gBAC5B,QAAQ,EAAE,CAAC,CAAC,YAA2C;gBACvD,KAAK,EAAE,CAAC,CAAC,SAAS;aACnB,CAAC,CAAC,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ;gBACR,QAAQ;gBACR,MAAM,EAAE;oBACN,OAAO;oBACP,MAAM,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;oBAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;oBACxD,UAAU;iBACX;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,iBAAiB,IAAI,CAAC,MAAM;kCACA,EAC5B,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,QAAgB,EAAE,QAAgB;QAC5D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjC,iBAAiB,IAAI,CAAC,MAAM;0DACwB,EACpD,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAwC,CAAC;QAC1C,MAAM,QAAQ,GAAI,MAAoC,EAAE,YAAY,CAAC;QACrE,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;CACF;AAlJD,gDAkJC"}

package/dist/authz/mariadb-record-rule-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-record-rule-adapter.js","sourceRoot":"","sources":["../../src/authz/mariadb-record-rule-adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;;;AAOH,uCAA6D;AAE7D,qFAAqF;AACxE,QAAA,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAEzE,wFAAwF;AACxF,MAAM,cAAc,GAAG,cAAc,CAAC;AAkBtC,sFAAsF;AACtF,SAAS,cAAc,CAAC,GAAY,EAAE,KAAsB;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC;IAClC,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,CACL,GAAG,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAC1F,CAAC;IACJ,CAAC;IACD,uDAAuD;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,GAAW,EAAE,KAAsB;IACvD,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACnD,IAAI,GAAG,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iGAAiG;AACjG,SAAS,UAAU,CAAC,KAAa,EAAE,KAAsB;IACvD,OAAO,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAe,EAAE,QAAiB;IACxD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,WAAW,GACf,MAAM,KAAK,EAAE;QACb,QAAQ,KAAK,EAAE;QACf,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1B,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,KAAsB;IAC1D,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAClD,QAAQ,GAAG,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ;YACX,OAAO,MAAM,KAAK,QAAQ,CAAC;QAC7B,KAAK,IAAI,CAAC;QACV,KAAK,YAAY;YACf,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,QAAQ,CAAC;QAClD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,+DAA+D;YAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;iBAC5B,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,uEAAuE;YACvE,yEAAyE;YACzE,iFAAiF;YACjF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;iBAC5B,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,UAAU;YACb,0DAA0D;YAC1D,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,KAAK,cAAc;YACjB,4EAA4E;YAC5E,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,KAAK,SAAS;YACZ,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,KAAK,UAAU;YACb,0EAA0E;YAC1E,6CAA6C;YAC7C,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,KAAK,cAAc;YACjB,uEAAuE;YACvE,iDAAiD;YACjD,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E;YACE,OAAO,KAAK,CAAC,CAAC,uDAAuD;IACzE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAa,kCAAkC;IAC5B,EAAE,CAAgB;IAClB,MAAM,CAAS;IAEhC,YAAY,EAAiB,EAAE,OAA4B,EAAE;QAC3D,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAsB;QACnC,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrE,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACzB;oBACY,IAAI,CAAC,MAAM;;;qDAGsB,EAC7C,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CACrD,CAAc,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,MAAM,IAAI,oCAA6B,CACrC,+CAA+C;gBAC7C,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,iFAAiF;QACjF,gFAAgF;QAChF,iFAAiF;QACjF,+DAA+D;QAC/D,EAAE;QACF,kFAAkF;QAClF,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GACP,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,6CAA6C;gBACvE,CAAC,CAAC,KAAK,GAAG,CAAC,eAAe,EAAE;gBAC5B,CAAC,CAAC,KAAK,YAAY,EAAE,EAAE,CAAC,CAAC,4CAA4C;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;gBACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS,CAAC,gDAAgD;YAClF,oFAAoF;YACpF,iFAAiF;YACjF,6EAA6E;YAC7E,iEAAiE;YACjE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAC7B,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAClE,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,8DAA8D;gBAC9D,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;iBAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC9B,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,yEAAyE;QAC3E,CAAC;QAED,kFAAkF;QAClF,oEAAoE;QACpE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;CACF;AAhFD,gFAgFC"}

package/dist/authz/mariadb-record-share-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-record-share-adapter.js","sourceRoot":"","sources":["../../src/authz/mariadb-record-share-adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;;;AAGH,uCAA6D;AAE7D,iFAAiF;AACpE,QAAA,wBAAwB,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,cAAc,GAAG,cAAc,CAAC;AAYtC;;;GAGG;AACH,MAAa,yBAAyB;IACnB,EAAE,CAAiB;IACnB,MAAM,CAAS;IAEhC,YAAY,EAAkB,EAAE,OAA4B,EAAE;QAC5D,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,OAA0B,EAC1B,OAAe,EACf,QAAgB,EAChB,MAAc;QAEd,sFAAsF;QACtF,sFAAsF;QACtF,mFAAmF;QACnF,IAAI,UAAU,GAAG,oDAAoD,CAAC;QACtE,MAAM,aAAa,GAAc,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,UAAU,IAAI,yDAAyD,YAAY,IAAI,CAAC;YACxF,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACjC,CAAC;QAED,8FAA8F;QAC9F,MAAM,MAAM,GAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,MAAM,CAAC,CAAC;QAExE,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACzB,+BAA+B,IAAI,CAAC,MAAM,qBAAqB;gBAC7D,wBAAwB;gBACxB,2BAA2B;gBAC3B,WAAW,UAAU,GAAG;gBACxB,2CAA2C,EAC7C,MAAM,CACP,CAAe,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,MAAM,IAAI,oCAA6B,CACrC,sCAAsC,OAAO,IAAI,QAAQ,IAAI,MAAM,IAAI;gBACrE,GAAI,GAAa,CAAC,OAAO,EAAE,CAC9B,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,gFAAgF;QAChF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;CACF;AApDD,8DAoDC"}

package/dist/authz/record-share-cascade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-share-cascade.js","sourceRoot":"","sources":["../../src/authz/record-share-cascade.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;AA6BH,wDAcC;AAzCD,gDAAgD;AAChD,MAAM,cAAc,GAAG,cAAc,CAAC;AAoBtC;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,OAA4B,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,OAAO,KAAK,EACV,KAAmB,EACnB,OAAe,EACf,QAAgB,EAChB,QAAgB,EACD,EAAE;QACjB,MAAM,KAAK,CACT,iBAAiB,MAAM,qBAAqB;YAC1C,sEAAsE,EACxE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAC9B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/authz/record-share-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-share-writer.js","sourceRoot":"","sources":["../../src/authz/record-share-writer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;;;AAEH,6CAAyC;AAGzC,8EAA8E;AAC9E,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC,8CAA8C;AACjC,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAoF/E,iFAAiF;AACjF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,6EAA6E;AAC7E,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAOD,MAAa,iBAAiB;IACX,EAAE,CAAiB;IACnB,KAAK,CAAoB;IACzB,KAAK,CAA6B;IAClC,MAAM,CAAS;IACf,GAAG,CAAe;IAEnC,YAAY,IAQX;QACC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,mFAAmF;YACnF,0DAA0D;YAC1D,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,iBAAiB,IAAI,CAAC,MAAM,qBAAqB;gBAC/C,yDAAyD;gBACzD,+DAA+D;gBAC/D,kCAAkC;gBAClC,gEAAgE,EAClE;gBACE,IAAA,wBAAU,GAAE;gBACZ,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,MAAM;gBACZ,KAAK,CAAC,QAAQ;aACf,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,iCAAiC,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAiB;QAC7B,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,iBAAiB,IAAI,CAAC,MAAM,qBAAqB;gBAC/C,2BAA2B;gBAC3B,wBAAwB;gBACxB,2BAA2B;gBAC3B,4BAA4B;gBAC5B,4BAA4B;gBAC5B,sBAAsB,EACxB;gBACE,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,MAAM;aACb,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,kCAAkC,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAKzB;QAQC,oFAAoF;QACpF,MAAM,IAAI,CAAC,cAAc,CAAC;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,uFAAuF;YACvF,2DAA2D;YAC3D,WAAW,EAAE,MAAM;YACnB,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,IAAI,IAKF,CAAC;QACH,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACzB,mEAAmE;gBACjE,WAAW,IAAI,CAAC,MAAM,qBAAqB;gBAC3C,sEAAsE;gBACtE,yBAAyB,EAC3B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAChD,CAAgB,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,gCAAgC,KAAK,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,WAAW,EAAE,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3D,WAAW,EAAE,CAAC,CAAC,eAAe;YAC9B,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,SAAS,EAAE,CAAC,CAAC,aAAa;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,8EAA8E;IAE9E;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,KAAiB;QAC5C,iDAAiD;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,sBAAsB,CAC9B,SAAS,KAAK,CAAC,OAAO,qCAAqC,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAC9B,SAAS,KAAK,CAAC,OAAO,4DAA4D,CACnF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,sBAAsB,CAAC,iEAAiE,CAAC,CAAC;QACtG,CAAC;QAED,qFAAqF;QACrF,4EAA4E;QAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,sBAAsB,CAC9B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,IAAI,KAAK,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,sBAAsB,CAC9B,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,sBAAsB,CAClC,IAAmB,EACnB,QAAgB,EAChB,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,KAAK,IAAI,CAAC,QAAQ,QAAQ,CAAC;QACvC,MAAM,MAAM,GAAc,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,IAAI,UAAU,IAAI,CAAC,YAAY,QAAQ,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACzB,YAAY,IAAI,CAAC,WAAW,uBAAuB,SAAS,UAAU,KAAK,UAAU,EACrF,MAAM,CACP,CAAe,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,IAAI,CAAC,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC7E,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,IAAmB;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;IACpF,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,IAAI,CAAC,MAAiC,EAAE,KAAiB;QACrE,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,KAAK,GAAoB;YAC7B,IAAI,EAAE,cAAc;YACpB,MAAM;YACN,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,MAAM;aAC1B;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;CACF;AAtQD,8CAsQC"}

package/dist/authz/wire-record-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-record-authorization.js","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":";;AAsFA,4DAmBC;AAoCD,4CAkEC;AA7KD,uCAA8E;AAE9E,qFAG0C;AAC1C,uFAA8E;AAC9E,mGAAyF;AACzF,mFAA0E;AAC1E,2DAAyD;AACzD,uGAGmD;AAiCnD;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,MAAiC;IACxE,OAAO,IAAA,mCAA4B,EAAC;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,sFAAsF;QACtF,kFAAkF;QAClF,mFAAmF;QACnF,UAAU,EAAE,IAAI,mEAAkC,CAAC,MAAM,CAAC,IAAI,CAAC;QAC/D,mFAAmF;QACnF,6EAA6E;QAC7E,WAAW,EAAE,IAAI,2DAAyB,CAAC,MAAM,CAAC,IAAI,CAAC;QACvD,kFAAkF;QAClF,6DAA6D;QAC7D,gBAAgB,EAAE,IAAI,sEAA8B,CAAC,MAAM,CAAC,IAAI,CAAC;QACjE,+EAA+E;QAC/E,sFAAsF;QACtF,kBAAkB,EAAE,IAAI,2EAAiC,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,gBAAgB,CAAC,MAAiC;IAChE,yFAAyF;IACzF,MAAM,aAAa,GAAG,IAAI,uDAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/D,uFAAuF;IACvF,2FAA2F;IAC3F,4FAA4F;IAC5F,gCAAgC;IAChC,MAAM,kBAAkB,GAAG,IAAI,sEAA8B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE3E,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAClC,mFAAmF;QACnF,mFAAmF;QACnF,uFAAuF;QACvF,mFAAmF;QACnF,MAAM,QAAQ,GAAG;YACf,iBAAiB,CAAC,OAAe;gBAC/B,OAAO,OAAO,KAAK,GAAG,CAAC,OAAO;oBAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;oBAC9E,CAAC,CAAC,SAAS,CAAC;YAChB,CAAC;SACF,CAAC;QAEF,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAgB,EACjC,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,EACtC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAC7E,CAAC;QAEF,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,4FAA4F;QAC5F,2FAA2F;QAC3F,0FAA0F;QAC1F,0FAA0F;QAC1F,4FAA4F;QAC5F,0FAA0F;QAC1F,wFAAwF;QACxF,IAAI,gBAAgB,GAA2C,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,uBAAuB,CAAC;gBACrE,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;oBAChG,WAAW,EAAE,KAAK,CAAC,EAAE;oBACrB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACvB,CAAC,CAAC;gBACH,gBAAgB,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,iDAAiD;YACzF,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,gDAAgD;QAChD,MAAM,UAAU,GAAG,IAAA,sCAAkB,EACnC,IAAI,EACJ,GAAG,EACH,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,QAAQ,EAAE,EAC5D,EAAE,gBAAgB,EAAE,CACrB,CAAC;QAEF,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC"}

package/dist/boot/boot-sequence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-sequence.js","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAoDA,4CAuBC;AA3ED,2CAAiF;AACjF,iEAAwD;AACxD,2DAAoG;AAEpG;;;;;;;;;;;;;;GAcG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IAC0B;IAAjD,YAAiD,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAAG,CAAC;IAEtE,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACvC,8DAA8D;IAChE,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,yBAAyB;QACrC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAtBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,6BAAU,CAAC,CAAA;;GADpB,YAAY,CAsBxB;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,GAAqB;IACpD,MAAM,CAAC,GAAG,IAAA,kCAAkB,EAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,iCAAiC,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI;YACxE,uEAAuE;YACvE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,eAAe,CAAC,CAAC,mBAAmB,0BAA0B;YAC9D,GAAG,GAAG,CAAC,cAAc,sBAAsB,GAAG,CAAC,OAAO,MAAM;YAC5D,2BAA2B,CAAC,CAAC,oBAAoB,eAAe;YAChE,GAAG,GAAG,CAAC,QAAQ,OAAO,CAAC,CAAC,mBAAmB,MAAM,GAAG,CAAC,cAAc,IAAI;YACvE,4DAA4D;YAC5D,6DAA6D,CAChE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/boot/boot.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot.module.js","sourceRoot":"","sources":["../../src/boot/boot.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,yDAAkD;AAElD;;;;GAIG;AAII,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IAHtB,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,+BAAY,CAAC;KAC1B,CAAC;GACW,UAAU,CAAG"}

package/dist/completeness/catalog-reconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-reconciler.js","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":";;;AAAA,yEAAyE;AACzE,uCAAiD;AAIjD;iFACiF;AACjF,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,MAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAA6B,EAAE,QAAwB;QACnE,MAAM,MAAM,GAAG,IAAA,wBAAiB,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACrE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,GAAG,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3F,CAAC;YACF,MAAM,IAAI,sBAAsB,CAC9B,WAAW,QAAQ,CAAC,MAAM,eAAe,YAAY,CAAC,MAAM,wCAAwC;gBAClG,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;gBAC/D,sCAAsC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI;gBAC3E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,QAAwB,EAAE,KAAmB,EAAE,MAAc;QAC3E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAuB,CAAC,CAAC,CAAC;QAEjF,wEAAwE;QACxE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,aAAuB,CAAC;YACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;oBAC5C,aAAa,EAAE,GAAG;oBAClB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO;oBACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;oBAC1B,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE;oBAClD,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;gBACH,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE5D,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;aAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACtD,CAAC;CACF;AA9DD,8CA8DC"}

package/dist/completeness/operation-inventory-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-inventory-scanner.js","sourceRoot":"","sources":["../../src/completeness/operation-inventory-scanner.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,wDAAyD;AACzD,uCAA4E;AAC5E,uCAAmD;AAEnD,4FAIoD;AAEpD;;;;;;GAMG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAEjB;IACA;IACA;IAHnB,YACmB,SAA2B,EAC3B,OAAwB,EACxB,SAAoB;QAFpB,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAiB;QACxB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,IAAI,CAAC,SAAiB;QACpB,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;YACtD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;gBAClC,+EAA+E;gBAC/E,kFAAkF;gBAClF,+EAA+E;gBAC/E,iFAAiF;gBACjF,8DAA8D;gBAC9D,IAAI,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,OAAO,CAAC,KAAK,SAAS;oBAAE,SAAS;gBACxE,wEAAwE;gBACxE,MAAM,QAAQ,GACZ,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAuB,CAAC,MAAM,EAAE;oBACxE,OAAO;oBACP,QAAQ;iBACT,CAAC,KAAK,IAAI,CAAC;gBACd,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,qDAAuB,CAAC,UAAU,EAClC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;gBACF,MAAM,cAAc,GAAG,IAAA,qDAAuB,EAAC,GAAG,CAAC,CAAC;gBACpD,2EAA2E;gBAC3E,mEAAmE;gBACnE,MAAM,aAAa,GACjB,CAAC,QAAQ,IAAI,cAAc;oBACzB,CAAC,CAAC,IAAA,0BAAmB,EAAC,SAAS,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC;oBAC/E,CAAC,CAAC,SAAS,CAAC;gBAChB,UAAU,CAAC,IAAI,CAAC;oBACd,WAAW,EAAE,GAAG,cAAc,IAAI,MAAM,EAAE;oBAC1C,QAAQ;oBACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;CACF,CAAA;AAhDY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAGmB,uBAAgB;QAClB,sBAAe;QACb,gBAAS;GAJ5B,yBAAyB,CAgDrC"}

package/dist/completeness/ports/catalog-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-store.js","sourceRoot":"","sources":["../../../src/completeness/ports/catalog-store.ts"],"names":[],"mappings":""}

package/dist/config/app-config.d.ts

@@ -23,6 +23,7 @@
  *   8 × (12 + 8 + 1) + 40 = 208 ≤ 250  ✓
  * ─────────────────────────────────────────────────────────────────────────────
  */
+import type { SecretsProvider } from '@astram/core';
 export interface AppConfig {
     /** HTTP port the Nest app listens on. */
     readonly port: number;
@@ -222,6 +223,21 @@ export declare function assertRefreshHmacKey(key: string): string;
  * auth-composition time (see its doc).
  */
 export declare function loadAppConfig(env?: NodeJS.ProcessEnv): AppConfig;
+/**
+ * ADR-0032 secrets integration — build the {@link AppConfig} AFTER resolving any `secret-ref:<path>`
+ * env references via the injected `SecretsProvider`, so an app can hold only REFERENCES in its env
+ * (safe to commit/log) and the real credentials are fetched at boot.
+ *
+ * - With a `provider`: every `secret-ref:` value in `env` is resolved (fail-closed — a missing
+ *   reference aborts boot; a value is never logged), producing a resolved env the pure
+ *   {@link loadAppConfig} consumes unchanged.
+ * - Without a `provider`: identical to `loadAppConfig(env)` — literal env, unchanged behaviour
+ *   (backward compatible; references would pass through as literals, which fail loudly at connect
+ *   time rather than silently — the operator is expected to wire a provider when using references).
+ *
+ * The core resolver (`resolveSecretRefs`) does the work; this is the guard-side boot seam.
+ */
+export declare function loadAppConfigAsync(provider?: SecretsProvider, env?: NodeJS.ProcessEnv): Promise<AppConfig>;
 /** Result of evaluating a {@link PoolBudgetConfig} against the ADR-0018 budget. */
 export interface PoolBudgetEvaluation {
     /** Σ(per-account runtime pool max) for a single worker. */

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}

package/dist/config/app-config.js

@@ -8,7 +8,9 @@ exports.loadSessionLifetimes = loadSessionLifetimes;
 exports.loadRefreshHmacKey = loadRefreshHmacKey;
 exports.assertRefreshHmacKey = assertRefreshHmacKey;
 exports.loadAppConfig = loadAppConfig;
+exports.loadAppConfigAsync = loadAppConfigAsync;
 exports.evaluatePoolBudget = evaluatePoolBudget;
+const core_1 = require("@astram/core");
 /** Documented MVP single-node defaults (see the class doc + my.cnf). */
 exports.DEFAULT_POOL_BUDGET = {
     workers: 8,
@@ -214,6 +216,26 @@ function loadAppConfig(env = process.env) {
         lifetimes: loadSessionLifetimes(env),
     };
 }
+/**
+ * ADR-0032 secrets integration — build the {@link AppConfig} AFTER resolving any `secret-ref:<path>`
+ * env references via the injected `SecretsProvider`, so an app can hold only REFERENCES in its env
+ * (safe to commit/log) and the real credentials are fetched at boot.
+ *
+ * - With a `provider`: every `secret-ref:` value in `env` is resolved (fail-closed — a missing
+ *   reference aborts boot; a value is never logged), producing a resolved env the pure
+ *   {@link loadAppConfig} consumes unchanged.
+ * - Without a `provider`: identical to `loadAppConfig(env)` — literal env, unchanged behaviour
+ *   (backward compatible; references would pass through as literals, which fail loudly at connect
+ *   time rather than silently — the operator is expected to wire a provider when using references).
+ *
+ * The core resolver (`resolveSecretRefs`) does the work; this is the guard-side boot seam.
+ */
+async function loadAppConfigAsync(provider, env = process.env) {
+    if (provider === undefined)
+        return loadAppConfig(env);
+    const resolved = await (0, core_1.resolveSecretRefs)(env, provider);
+    return loadAppConfig(resolved);
+}
 /**
  * Evaluate a pool budget. Pure: no throwing, no I/O — the caller decides how to
  * react (the boot assertion throws; tests inspect the fields).

package/dist/config/app-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":";;;AAoMA,wCAuBC;AAgDD,oCAQC;AAOD,0CAaC;AAYD,oDAeC;AAQD,gDAEC;AAiBD,oDASC;AAaD,sCAUC;AA0BD,gDAgBC;AAlRD,wEAAwE;AAC3D,QAAA,mBAAmB,GAAqB;IACnD,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,GAAG;IACnB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE;QACb,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,CAAC;QAClB,iBAAiB,EAAE,CAAC;KACrB;CACF,CAAC;AAEF,gFAAgF;AACnE,QAAA,wBAAwB,GAAG,CAAC,CAAC;AAE1C,SAAS,SAAS,CAAC,GAAuB,EAAE,QAAgB;IAC1D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACvD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAgB;IACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO;QACL,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,2BAAmB,CAAC,OAAO,CAAC;QACxE,cAAc,EAAE,gBAAgB,CAC9B,GAAG,CAAC,sBAAsB,EAC1B,2BAAmB,CAAC,cAAc,CACnC;QACD,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,2BAAmB,CAAC,QAAQ,CAAC;QAC3E,aAAa,EAAE;YACb,WAAW,EAAE,gBAAgB,CAC3B,GAAG,CAAC,aAAa,EACjB,2BAAmB,CAAC,aAAa,CAAC,WAAW,CAC9C;YACD,eAAe,EAAE,gBAAgB,CAC/B,GAAG,CAAC,iBAAiB,EACrB,2BAAmB,CAAC,aAAa,CAAC,eAAe,CAClD;YACD,iBAAiB,EAAE,gBAAgB,CACjC,GAAG,CAAC,mBAAmB,EACvB,2BAAmB,CAAC,aAAa,CAAC,iBAAiB,CACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,wDAAwD;AACxD,8EAA8E;AAE9E,uFAAuF;AAC1E,QAAA,iBAAiB,GAA+B;IAC3D,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,iBAAiB;CAC5B,CAAC;AAEF,6DAA6D;AAChD,QAAA,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,wEAAwE;AACxE,SAAS,WAAW,CAAC,GAAuB,EAAE,QAAgB;IAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,GAAuB;IACvD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC1D,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,IAAI,CAAC;QACxD,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,IAAI,CAAC;QAC1D,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC;QAC9C,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAiB,CAAC,QAAQ,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,yBAAiB,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAIX,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC;IACvD,IAAI,GAAG,KAAK,SAAS;QAAE,SAAS,CAAC,oBAAoB,GAAG,GAAG,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,+EAA+E;YAC/E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC;QAC/B,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC;QACzB,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC;QACrB,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;QAC3B,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC;QACvC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC;KACrC,CAAC;AACJ,CAAC;AAsBD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAqB;IACtD,MAAM,oBAAoB,GACxB,GAAG,CAAC,aAAa,CAAC,WAAW;QAC7B,GAAG,CAAC,aAAa,CAAC,eAAe;QACjC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC;IACtC,MAAM,kBAAkB,GAAG,GAAG,CAAC,OAAO,GAAG,oBAAoB,CAAC;IAC9D,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,GAAG,mBAAmB,CAAC;IACvD,OAAO;QACL,oBAAoB;QACpB,kBAAkB;QAClB,mBAAmB;QACnB,KAAK;QACL,YAAY,EAAE,mBAAmB,IAAI,GAAG,CAAC,cAAc;QACvD,sBAAsB,EAAE,GAAG,CAAC,aAAa,CAAC,iBAAiB,IAAI,gCAAwB;KACxF,CAAC;AACJ,CAAC"}

package/dist/config/config.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.module.js","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,mDAAgE;AAEhE,mDAAmD;AACtC,QAAA,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAE/C;;;;;;GAMG;AAWI,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAVxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,kBAAU;gBACnB,UAAU,EAAE,GAAc,EAAE,CAAC,IAAA,6BAAa,GAAE;aAC7C;SACF;QACD,OAAO,EAAE,CAAC,kBAAU,CAAC;KACtB,CAAC;GACW,YAAY,CAAG"}

package/dist/encryption/local-kek-crypto.d.ts

@@ -0,0 +1,15 @@
+import type { CryptoPort, Dek, WrappedDek, Ciphertext } from '@astram/core';
+export declare class LocalKekCrypto implements CryptoPort {
+    #private;
+    /**
+     * @param kek the 32-byte Key Encryption Key (from a KMS/secrets-manager reference). MUST be
+     *   exactly 32 bytes. NEVER hard-code it; NEVER log it.
+     */
+    constructor(kek: Uint8Array);
+    generateDek(): Promise<Dek>;
+    wrapDek(dek: Dek, tenantId: string): Promise<WrappedDek>;
+    unwrapDek(wrapped: WrappedDek, tenantId: string): Promise<Dek>;
+    encrypt(plaintext: Uint8Array, dek: Dek, tenantId: string): Promise<Ciphertext>;
+    decrypt(ciphertext: Ciphertext, dek: Dek, tenantId: string): Promise<Uint8Array>;
+}
+//# sourceMappingURL=local-kek-crypto.d.ts.map

package/dist/encryption/local-kek-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-kek-crypto.d.ts","sourceRoot":"","sources":["../../src/encryption/local-kek-crypto.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO5E,qBAAa,cAAe,YAAW,UAAU;;IAG/C;;;OAGG;gBACS,GAAG,EAAE,UAAU;IAOrB,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAI3B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxD,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI9D,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA0BvF"}

package/dist/encryption/local-kek-crypto.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalKekCrypto = void 0;
+/**
+ * `LocalKekCrypto` — a reference {@link CryptoPort} adapter (ADR-0031). Real AES-256-GCM AEAD for
+ * data + DEK-wrapping, with the KEK held as a local secret (from a secrets-manager reference /
+ * env). This is the dev + air-gapped / single-box adapter (what astram-infra's box can use); the
+ * AWS-KMS / GCP-KMS / Vault-Transit adapters implement the SAME port and swap in on demand
+ * (Rule of Three).
+ *
+ * SECURITY:
+ *  - AES-256-GCM (authenticated): a 96-bit random nonce per operation; the 128-bit tag is verified
+ *    on decrypt; the `tenantId` is bound as ADDITIONAL AUTHENTICATED DATA (AAD) so a ciphertext for
+ *    tenant A cannot be decrypted as tenant B (the core's cross-tenant guard, enforced in crypto).
+ *  - DEK wrapping uses the SAME AEAD under the KEK, with the tenantId as AAD — a wrapped DEK is
+ *    bound to its tenant.
+ *  - The KEK is 32 bytes, provided at construction (never hard-coded, never logged). Losing it makes
+ *    all wrapped DEKs (hence all data) unrecoverable — it belongs in a KMS/secrets-manager.
+ *  - NEVER logs a plaintext, a DEK, or the KEK.
+ *
+ * Self-describing output layout (both encrypt + wrap): [1B version][12B nonce][16B tag][ciphertext].
+ */
+const node_crypto_1 = require("node:crypto");
+const VERSION = 1;
+const NONCE_LEN = 12;
+const TAG_LEN = 16;
+const DEK_LEN = 32; // AES-256
+class LocalKekCrypto {
+    #kek;
+    /**
+     * @param kek the 32-byte Key Encryption Key (from a KMS/secrets-manager reference). MUST be
+     *   exactly 32 bytes. NEVER hard-code it; NEVER log it.
+     */
+    constructor(kek) {
+        if (kek.length !== DEK_LEN) {
+            throw new Error(`KEK must be ${DEK_LEN} bytes (got ${kek.length}).`);
+        }
+        this.#kek = Buffer.from(kek);
+    }
+    async generateDek() {
+        return new Uint8Array((0, node_crypto_1.randomBytes)(DEK_LEN));
+    }
+    async wrapDek(dek, tenantId) {
+        return this.#seal(this.#kek, Buffer.from(dek), tenantId);
+    }
+    async unwrapDek(wrapped, tenantId) {
+        return new Uint8Array(this.#open(this.#kek, Buffer.from(wrapped), tenantId));
+    }
+    async encrypt(plaintext, dek, tenantId) {
+        return this.#seal(Buffer.from(dek), Buffer.from(plaintext), tenantId);
+    }
+    async decrypt(ciphertext, dek, tenantId) {
+        return new Uint8Array(this.#open(Buffer.from(dek), Buffer.from(ciphertext), tenantId));
+    }
+    // ── AES-256-GCM seal/open, tenantId bound as AAD ──────────────────────────
+    #seal(key, plaintext, tenantId) {
+        const nonce = (0, node_crypto_1.randomBytes)(NONCE_LEN);
+        const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', key, nonce);
+        cipher.setAAD(Buffer.from(tenantId, 'utf8'));
+        const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return new Uint8Array(Buffer.concat([Buffer.from([VERSION]), nonce, tag, body]));
+    }
+    #open(key, sealed, tenantId) {
+        if (sealed.length < 1 + NONCE_LEN + TAG_LEN)
+            throw new Error('ciphertext too short / malformed');
+        if (sealed[0] !== VERSION)
+            throw new Error(`unsupported ciphertext version ${sealed[0]}`);
+        const nonce = sealed.subarray(1, 1 + NONCE_LEN);
+        const tag = sealed.subarray(1 + NONCE_LEN, 1 + NONCE_LEN + TAG_LEN);
+        const body = sealed.subarray(1 + NONCE_LEN + TAG_LEN);
+        const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, nonce);
+        decipher.setAAD(Buffer.from(tenantId, 'utf8'));
+        decipher.setAuthTag(tag);
+        // .final() THROWS on a tag/AAD mismatch — the fail-closed guarantee the core relies on.
+        return Buffer.concat([decipher.update(body), decipher.final()]);
+    }
+}
+exports.LocalKekCrypto = LocalKekCrypto;

package/dist/enforcement/classification.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.decorator.js","sourceRoot":"","sources":["../../src/enforcement/classification.decorator.ts"],"names":[],"mappings":";;;AA4CA,0DAgBC;AA5DD,2CAA6C;AAE7C;;;;;;;;;;;;GAYG;AACU,QAAA,uBAAuB,GAAG;IACrC,kEAAkE;IAClE,MAAM,EAAE,8BAA8B;IACtC;;;;OAIG;IACH,UAAU,EAAE,kCAAkC;CACtC,CAAC;AAgBX,wFAAwF;AAC3E,QAAA,yBAAyB,GAAG,QAAQ,CAAC;AAElD,gFAAgF;AAChF,SAAgB,uBAAuB,CACrC,KAA0C;IAE1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IACD,IACE,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACI,MAAM,MAAM,GAAG,GAAqC,EAAE,CAC3D,IAAA,oBAAW,EAAC,+BAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AADvC,QAAA,MAAM,UACiC;AAEpD;;;;;;;;GAQG;AACI,MAAM,UAAU,GAAG,CACxB,cAAuC,EACL,EAAE,CACpC,IAAA,oBAAW,EAAC,+BAAuB,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;AAHrD,QAAA,UAAU,cAG2C"}

package/dist/enforcement/core-seam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-seam.js","sourceRoot":"","sources":["../../src/enforcement/core-seam.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAqBH;;;;;;;;;;;GAWG;AACU,QAAA,qBAAqB,GAA0B;IAC1D,MAAM;QACJ,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;CACF,CAAC"}

package/dist/enforcement/enforcement.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.module.js","sourceRoot":"","sources":["../../src/enforcement/enforcement.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,uCAAyC;AACzC,+EAAuE;AAEvE;;;;;;;;;;;;;;GAcG;AASI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IAR7B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,oDAAsB;aACjC;SACF;KACF,CAAC;GACW,iBAAiB,CAAG"}

package/dist/enforcement/global-enforcement.guard.d.ts

@@ -2,6 +2,7 @@ import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import type { CoreDecisionAuthority } from './core-seam.js';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import type { ServiceAuthenticator } from '@astram/core';
 /**
  * Global, fail-closed enforcement guard (ADR-0002) — now with REAL request
  * authorization for classified routes.
@@ -33,7 +34,8 @@ export declare class GlobalEnforcementGuard implements CanActivate {
     private readonly reflector;
     private readonly decisionAuthority?;
     private readonly tokenBinder?;
-    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined);
+    private readonly serviceAuth?;
+    constructor(reflector: Reflector, decisionAuthority?: CoreDecisionAuthority | undefined, tokenBinder?: SessionTokenBinder | undefined, serviceAuth?: ServiceAuthenticator | undefined);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /** The real authorization path for a classified route (fail-closed throughout). */
     private authorizeClassified;

package/dist/enforcement/global-enforcement.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAQlF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBANZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAG7C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}
+{"version":3,"file":"global-enforcement.guard.d.ts","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAQzD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,sBAAuB,YAAW,WAAW;IAEtD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAGnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAM7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAZZ,SAAS,EAAE,SAAS,EAGpB,iBAAiB,CAAC,EAAE,qBAAqB,YAAA,EAGzC,WAAW,CAAC,EAAE,kBAAkB,YAAA,EAMhC,WAAW,CAAC,EAAE,oBAAoB,YAAA;IAG/C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAuC9D,mFAAmF;YACrE,mBAAmB;CA0FlC"}

package/dist/enforcement/global-enforcement.guard.js

@@ -52,10 +52,12 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
     reflector;
     decisionAuthority;
     tokenBinder;
-    constructor(reflector, decisionAuthority, tokenBinder) {
+    serviceAuth;
+    constructor(reflector, decisionAuthority, tokenBinder, serviceAuth) {
         this.reflector = reflector;
         this.decisionAuthority = decisionAuthority;
         this.tokenBinder = tokenBinder;
+        this.serviceAuth = serviceAuth;
     }
     async canActivate(context) {
         // Only HTTP requests are classified here. Non-HTTP contexts (if ever added)
@@ -94,7 +96,7 @@ let GlobalEnforcementGuard = class GlobalEnforcementGuard {
         }
         const req = context.switchToHttp().getRequest();
         const authHeader = req?.headers?.['authorization'];
-        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authHeader, this.tokenBinder);
+        const resolved = await (0, request_principal_js_1.resolveRequestAuth)(authHeader, this.tokenBinder, this.serviceAuth);
         if (resolved === null) {
             // No/invalid/expired token → not authenticated. 401 (distinct from a deny).
             throw new common_1.UnauthorizedException('Shield enforcement: missing or invalid access token for a classified route.');
@@ -155,5 +157,7 @@ exports.GlobalEnforcementGuard = GlobalEnforcementGuard = __decorate([
     __param(1, (0, common_1.Inject)(shield_tokens_js_1.SHIELD_DECISION_AUTHORITY)),
     __param(2, (0, common_1.Optional)()),
     __param(2, (0, common_1.Inject)(tokens_js_1.SHIELD_SESSION_TOKEN_BINDER)),
-    __metadata("design:paramtypes", [core_1.Reflector, Object, Function])
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(tokens_js_1.SHIELD_SERVICE_AUTHENTICATOR)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object, Function, Object])
 ], GlobalEnforcementGuard);

package/dist/enforcement/global-enforcement.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-enforcement.guard.js","sourceRoot":"","sources":["../../src/enforcement/global-enforcement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AACzC,+EAIuC;AACvC,iEAAuE;AAEvE,yDAAwE;AAExE,+EAA0E;AAC1E,+EAG8C;AAC9C,mEAA4D;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAEd;IAGA;IAGA;IAPnB,YACmB,SAAoB,EAGpB,iBAAyC,EAGzC,WAAgC;QANhC,cAAS,GAAT,SAAS,CAAW;QAGpB,sBAAiB,GAAjB,iBAAiB,CAAwB;QAGzC,gBAAW,GAAX,WAAW,CAAqB;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,4EAA4E;QAC5E,2DAA2D;QAC3D,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,2BAAkB,CAC1B,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAuB,CAAC,MAAM,EAAE;YACzF,OAAO;YACP,UAAU;SACX,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8DAA8D;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,qDAAuB,CAAC,UAAU,EAClC,CAAC,OAAO,EAAE,UAAU,CAAC,CACtB,CAAC;QACF,MAAM,cAAc,GAAG,IAAA,qDAAuB,EAAC,GAAG,CAAC,CAAC;QACpD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,2BAAkB,CAC1B,mEAAmE;YACjE,uEAAuE;YACvE,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,mFAAmF;IAC3E,KAAK,CAAC,mBAAmB,CAC/B,OAAyB,EACzB,cAA8B;QAE9B,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC3E,MAAM,IAAI,2BAAkB,CAC1B,kFAAkF;gBAChF,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAMzC,CAAC;QACL,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAkB,EAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,4EAA4E;YAC5E,MAAM,IAAI,8BAAqB,CAC7B,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAEvC,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,8EAA8E;QAC9E,8EAA8E;QAC9E,oFAAoF;QACpF,kFAAkF;QAClF,oFAAoF;QACpF,iFAAiF;QACjF,8EAA8E;QAC9E,gCAAgC;QAChC,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,GAAG,CAAC;YACzC,IAAI,CAAC,IAAA,yCAAiB,EAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,2BAAkB,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAE1B,gFAAgF;QAChF,kFAAkF;QAClF,kFAAkF;QAClF,qFAAqF;QACrF,iFAAiF;QACjF,oFAAoF;QACpF,yDAAyD;QACzD,EAAE;QACF,8EAA8E;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,EAAE;QACF,sFAAsF;QACtF,oFAAoF;QACpF,6EAA6E;QAC7E,MAAM,UAAU,GAAsB;YACpC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,kBAAkB,IAAI,CAAC;SAChE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,+CAAwB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CACnE,IAAI,CAAC,iBAAkB,CAAC,MAAM,CAC5B,SAAS,EACT,EAAE,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,EAC9B,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,EACvF,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CACF,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,8EAA8E;QAC9E,MAAM,IAAI,2BAAkB,CAC1B,yCAAyC,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,OAAO,GAAG,CAC/F,CAAC;IACJ,CAAC;CACF,CAAA;AA7IY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,4CAAyB,CAAC,CAAA;IAEjC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;qCALR,gBAAS;GAF5B,sBAAsB,CA6IlC"}

package/dist/enforcement/reenroll-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reenroll-allowlist.js","sourceRoot":"","sources":["../../src/enforcement/reenroll-allowlist.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AA2BH,oDAOC;AAYD,8CAUC;AA/CD;;;;GAIG;AACU,QAAA,gBAAgB,GAAoC,MAAM,CAAC,MAAM,CAAC;IAC7E,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE;IAClE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC/C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE;IACnC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;CACzC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,MAAe;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,0CAA0C;IAC1C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACtD,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,MAAe,EAAE,MAAe;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,wBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/identity/auth-facts.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-facts.controller.js","sourceRoot":"","sources":["../../src/identity/auth-facts.controller.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;AAEH,2CAAuG;AACvG,4FAAoE;AACpE,yDAAwE;AAExE,+EAA+E;AAC/E,iDAA4D;AAC5D,+EAA2I;AAGpI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEsC;IACJ;IAFhE,YACoE,WAA2C,EAC/C,KAAgD;QAD5C,gBAAW,GAAX,WAAW,CAAgC;QAC/C,UAAK,GAAL,KAAK,CAA2C;IAC7G,CAAC;IAIE,AAAN,KAAK,CAAC,YAAY,CAA2B,aAAsB;QACjE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2DAA6B,EAAE,CAAC;gBACjD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAIK,AAAN,KAAK,CAAC,qBAAqB,CAA2B,aAAsB;QAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YACrF,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2DAA6B,EAAE,CAAC;gBACjD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;YAClG,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,YAAY,CAAC,aAAsB;QAC/C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAChE,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAA,8CAAuB,EAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AApDY,kDAAmB;AAQxB;IAFL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,YAAY,CAAC;IACE,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;uDAa3C;AAIK;IAFL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,qBAAqB,CAAC;IACE,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;gEAcpD;8BAvCU,mBAAmB;IAD/B,IAAA,mBAAU,EAAC,UAAU,CAAC;IAGlB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;IAC/C,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;;GAHnC,mBAAmB,CAoD/B"}

package/dist/identity/identity-actions.d.ts

@@ -24,6 +24,15 @@ export type CrossTenantGrantAction = (typeof CROSS_TENANT_GRANT_ACTIONS)[number]
  */
 export declare const RECORD_SHARE_ACTIONS: readonly ["share", "read"];
 export type RecordShareAction = (typeof RECORD_SHARE_ACTIONS)[number];
+/**
+ * `service_account`'s action vocabulary (ADR-0033). The CRUD verbs administer the ACCOUNT
+ * (`read`/list, `create`, `update` its label/scope/status, `delete`), plus `manage_keys` — the
+ * one credential-lifecycle action gating issue/rotate/revoke of the account's `ask_…` API keys
+ * (a distinct, more-sensitive capability than editing the account row, so it can be granted
+ * separately: an admin may edit an agent's label without holding the power to mint its keys).
+ */
+export declare const SERVICE_ACCOUNT_ACTIONS: readonly ["read", "create", "update", "delete", "manage_keys"];
+export type ServiceAccountAction = (typeof SERVICE_ACCOUNT_ACTIONS)[number];
 /** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
 export declare function actionsFor(typeKey: string): readonly string[];
 //# sourceMappingURL=identity-actions.d.ts.map

package/dist/identity/identity-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAWtE,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,gEAM1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAY5E,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}

package/dist/identity/identity-actions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
+exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
 exports.actionsFor = actionsFor;
 /**
  * The fixed action vocabulary + module key for the framework's @astram/identity objects.
@@ -25,6 +25,20 @@ exports.CROSS_TENANT_GRANT_ACTIONS = ['share', 'accept', 'revoke'];
  * the real wall), `read` gates the list-a-record's-shares route.
  */
 exports.RECORD_SHARE_ACTIONS = ['share', 'read'];
+/**
+ * `service_account`'s action vocabulary (ADR-0033). The CRUD verbs administer the ACCOUNT
+ * (`read`/list, `create`, `update` its label/scope/status, `delete`), plus `manage_keys` — the
+ * one credential-lifecycle action gating issue/rotate/revoke of the account's `ask_…` API keys
+ * (a distinct, more-sensitive capability than editing the account row, so it can be granted
+ * separately: an admin may edit an agent's label without holding the power to mint its keys).
+ */
+exports.SERVICE_ACCOUNT_ACTIONS = [
+    'read',
+    'create',
+    'update',
+    'delete',
+    'manage_keys',
+];
 /**
  * Per-type action-vocabulary override. Every type not listed here defaults to
  * {@link IDENTITY_ACTIONS} (the CRUD verbs).
@@ -32,6 +46,7 @@ exports.RECORD_SHARE_ACTIONS = ['share', 'read'];
 const ACTIONS_BY_TYPE = {
     cross_tenant_grant: exports.CROSS_TENANT_GRANT_ACTIONS,
     record_share: exports.RECORD_SHARE_ACTIONS,
+    service_account: exports.SERVICE_ACCOUNT_ACTIONS,
 };
 /** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
 function actionsFor(typeKey) {

package/dist/identity/identity-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-actions.js","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":";;;AAuCA,gCAEC;AAzCD;;;;;;GAMG;AACU,QAAA,UAAU,GAAG,UAAU,CAAC;AACxB,QAAA,gBAAgB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGhF;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGjF;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAG/D;;;GAGG;AACH,MAAM,eAAe,GAAgD;IACnE,kBAAkB,EAAE,kCAA0B;IAC9C,YAAY,EAAE,4BAAoB;CACnC,CAAC;AAEF,mGAAmG;AACnG,SAAgB,UAAU,CAAC,OAAe;IACxC,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,wBAAgB,CAAC;AACtD,CAAC"}

package/dist/identity/module-registry.bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-registry.bridge.js","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":";;AAsBA,kEA4BC;AAlDD;;;;;;GAMG;AACH,uCAAoD;AAQpD,2CAAmD;AACnD,+DAA+D;AAE/D,SAAS,YAAY,CAAC,KAAsB;IAC1C,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,SAAgB,2BAA2B,CAAC,MAAkC;IAC5E,MAAM,IAAI,GAA0B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,WAAW,GAA2B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG;YACb,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QACF,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,OAAO;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAuB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACrD,IAAA,gCAAU,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,SAAS;QACT,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,OAAgB;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,MAAM;KACjC,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,QAAQ,GAAmB,EAAE,SAAS,EAAE,gCAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAA,2BAAoB,GAAE,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/identity/permission-facts.adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-facts.adapter.js","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAiBH,yFAAyF;AACzF,MAAa,6BAA8B,SAAQ,KAAK;IACtD,YAAY,OAAO,GAAG,2BAA2B;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AALD,sEAKC;AAMD,MAAa,6BAA6B;IAErB;IACA;IACA;IACA;IAJnB,YACmB,IAAU,EACV,WAAoC,EACpC,gBAAmC,EACnC,MAAoB,IAAI,CAAC,GAAG;QAH5B,SAAI,GAAJ,IAAI,CAAM;QACV,gBAAW,GAAX,WAAW,CAAyB;QACpC,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,QAAgB,EAAE,MAAe;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACvD,CAAC,CAAC,QAAQ,CAAC;YACb,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC5D,OAAO;gBACL,WAAW;gBACX,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC,CAAC;gBACjE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;gBACvB,kBAAkB;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B;gBAAE,MAAM,GAAG,CAAC;YAC5D,MAAM,IAAI,6BAA6B,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB,EAAE,QAAgB;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B;gBAAE,MAAM,GAAG,CAAC;YAC5D,MAAM,IAAI,6BAA6B,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,WAAmB;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC;;;;;iFAK2E,EAC3E,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CACtC,CAAgB,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAA0B;QACpD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,uFAAuF,YAAY,GAAG,EACtG,CAAC,GAAG,OAAO,CAAC,CACb,CAAkB,CAAC;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAgB;QACxC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,qGAAqG,EACrG,CAAC,QAAQ,CAAC,CACX,CAAiB,CAAC;QACnB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,SAA4B;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,oDAAoD;gBACtH,KAAK,MAAM,CAAC,IAAI,GAAG;oBAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;CACF;AAzFD,sEAyFC"}

package/dist/index.d.ts

@@ -23,14 +23,17 @@ export type { Classification } from './enforcement/classification.decorator.js';
 export { OperationInventoryScanner } from './completeness/operation-inventory-scanner.js';
 export { CatalogReconciler, CatalogGatabilityError } from './completeness/catalog-reconciler.js';
 export type { CatalogStore, CatalogPermissionRow, ReconcileReport, } from './completeness/ports/catalog-store.js';
-export { SHIELD_SESSION_TOKEN_BINDER } from './request-auth/tokens.js';
+export { SHIELD_SESSION_TOKEN_BINDER, SHIELD_SERVICE_AUTHENTICATOR, } from './request-auth/tokens.js';
 export { SessionTokenBinder } from './request-auth/session-token-binder.js';
 export type { BoundPrincipalClaims } from './request-auth/session-token-binder.js';
-export { resolveRequestPrincipal, principalFromClaims, extractBearerToken, } from './request-auth/request-principal.js';
+export { resolveRequestPrincipal, resolveRequestAuth, principalFromClaims, extractBearerToken, isApiKey, } from './request-auth/request-principal.js';
+export { MariaDbApiKeyStore } from './authentication/mariadb-api-key-store.js';
 export { SHIELD_SESSION_FACTS_ALS, NO_SESSION_FACTS, type SessionFactsStore, } from './request-auth/session-facts-als.js';
 export { GlobalEnforcementGuard } from './enforcement/global-enforcement.guard.js';
 export { stubDecisionAuthority, type Effect, type CoreDecisionAuthority, type CoreDecision, type Principal, } from './enforcement/core-seam.js';
 export { Argon2idPasswordHasher, argon2idHasherProvider, SHIELD_PASSWORD_HASHER, type Argon2idParams, } from './authentication/argon2id-password-hasher.js';
+export { LocalKekCrypto } from './encryption/local-kek-crypto.js';
+export { EncryptedFileSecretsProvider } from './secrets/encrypted-file-secrets.js';
 export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, } from './session/index.js';
 export { MariaDbRecordPermissionRuleAdapter, SHIELD_RECORD_RULE_PORT, type RuleQueryable, } from './authz/mariadb-record-rule-adapter.js';
 export { MariaDbPolicyStore, SHIELD_POLICY_STORE, type RuleQueryable as PolicyStoreQueryable, } from './authz/mariadb-policy-store.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAS7C,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAOtD,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAQjE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAKtD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAQjE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -16,9 +16,9 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsFor = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
-exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = void 0;
-exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = void 0;
+exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsFor = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
+exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -61,12 +61,19 @@ Object.defineProperty(exports, "CatalogGatabilityError", { enumerable: true, get
 // internally — a consumer does NOT hand-wire request auth.
 var tokens_js_1 = require("./request-auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_SESSION_TOKEN_BINDER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SESSION_TOKEN_BINDER; } });
+Object.defineProperty(exports, "SHIELD_SERVICE_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_1.SHIELD_SERVICE_AUTHENTICATOR; } });
 var session_token_binder_js_1 = require("./request-auth/session-token-binder.js");
 Object.defineProperty(exports, "SessionTokenBinder", { enumerable: true, get: function () { return session_token_binder_js_1.SessionTokenBinder; } });
 var request_principal_js_1 = require("./request-auth/request-principal.js");
 Object.defineProperty(exports, "resolveRequestPrincipal", { enumerable: true, get: function () { return request_principal_js_1.resolveRequestPrincipal; } });
+Object.defineProperty(exports, "resolveRequestAuth", { enumerable: true, get: function () { return request_principal_js_1.resolveRequestAuth; } });
 Object.defineProperty(exports, "principalFromClaims", { enumerable: true, get: function () { return request_principal_js_1.principalFromClaims; } });
 Object.defineProperty(exports, "extractBearerToken", { enumerable: true, get: function () { return request_principal_js_1.extractBearerToken; } });
+Object.defineProperty(exports, "isApiKey", { enumerable: true, get: function () { return request_principal_js_1.isApiKey; } });
+// Machine/agent auth (ADR-0033): the MariaDB ApiKeyStore adapter (hash-only) — a consumer wires it
+// + a ServiceAuthenticator to enable `Authorization: Bearer ask_…` service-account access.
+var mariadb_api_key_store_js_1 = require("./authentication/mariadb-api-key-store.js");
+Object.defineProperty(exports, "MariaDbApiKeyStore", { enumerable: true, get: function () { return mariadb_api_key_store_js_1.MariaDbApiKeyStore; } });
 // The per-request session-facts hot path (ADR-0011): the SINGLE shared
 // `AsyncLocalStorage` the enforcement guard ENTERS around decide() and the consumer's
 // app-owned `SessionFactsReader` READS. The consumer imports THIS exact singleton to
@@ -100,6 +107,16 @@ var argon2id_password_hasher_js_1 = require("./authentication/argon2id-password-
 Object.defineProperty(exports, "Argon2idPasswordHasher", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.Argon2idPasswordHasher; } });
 Object.defineProperty(exports, "argon2idHasherProvider", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.argon2idHasherProvider; } });
 Object.defineProperty(exports, "SHIELD_PASSWORD_HASHER", { enumerable: true, get: function () { return argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER; } });
+// The reference `CryptoPort` adapter (ADR-0031 envelope encryption): real AES-256-GCM AEAD +
+// local-KEK DEK-wrapping, injected into `@astram/core`'s `createEncryptionService({ crypto })`.
+// Core stays zero-dep; the KMS-backed adapters (AWS/GCP/Vault) implement the same port.
+var local_kek_crypto_js_1 = require("./encryption/local-kek-crypto.js");
+Object.defineProperty(exports, "LocalKekCrypto", { enumerable: true, get: function () { return local_kek_crypto_js_1.LocalKekCrypto; } });
+// The reference `SecretsProvider` adapter (ADR-0032 secrets management): an ENCRYPTED on-box store
+// (secrets AES-GCM-encrypted at rest under the box KEK) so env holds `secret-ref:` pointers and the
+// real values are resolved at boot. Vault / AWS SM / GCP SM implement the same port.
+var encrypted_file_secrets_js_1 = require("./secrets/encrypted-file-secrets.js");
+Object.defineProperty(exports, "EncryptedFileSecretsProvider", { enumerable: true, get: function () { return encrypted_file_secrets_js_1.EncryptedFileSecretsProvider; } });
 // The Session storage/crypto adapters (ADR-0003 / ADR-0013): the concrete durable
 // (MariaDB) + hot (Redis) stores, the node:crypto token generator, the keyed HMAC
 // refresh hasher, and the system clock — all implementing `@astram/core`'s Session