@astram/guard 0.6.0 → 0.7.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;AAEH,gFAAgF;AAChF,2FAA2F;AAC3F,yDAAyD;AAAhD,uHAAA,kBAAkB,OAAA;AAE3B,6EAA6E;AAC7E,mFAAmF;AACnF,oFAAoF;AACpF,qFAAqF;AACrF,6FAA6F;AAC7F,wFAAwF;AACxF,iDAAiD;AACjD,kFAAmF;AAA1E,wIAAA,2BAA2B,OAAA;AACpC,sEAA0F;AAAjF,iHAAA,UAAU,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,iHAAA,UAAU,OAAA;AAEjD,gCAAgC;AAChC,8DASmC;AARjC,gHAAA,YAAY,OAAA;AACZ,6HAAA,yBAAyB,OAAA;AAS3B,wEAAwE;AACxE,yFAMmD;AALjD,qHAAA,MAAM,OAAA;AACN,yHAAA,UAAU,OAAA;AACV,sIAAA,uBAAuB,OAAA;AACvB,wIAAA,yBAAyB,OAAA;AACzB,sIAAA,uBAAuB,OAAA;AAIzB,uFAAuF;AACvF,sFAAsF;AACtF,mEAAmE;AACnE,gGAA0F;AAAjF,2IAAA,yBAAyB,OAAA;AAClC,8EAAiG;AAAxF,0HAAA,iBAAiB,OAAA;AAAE,+HAAA,sBAAsB,OAAA;AAOlD,oFAAoF;AACpF,iFAAiF;AACjF,oFAAoF;AACpF,2DAA2D;AAC3D,sDAAuE;AAA9D,wHAAA,2BAA2B,OAAA;AACpC,kFAA4E;AAAnE,6HAAA,kBAAkB,OAAA;AAE3B,4EAI6C;AAH3C,+HAAA,uBAAuB,OAAA;AACvB,2HAAA,mBAAmB,OAAA;AACnB,0HAAA,kBAAkB,OAAA;AAGpB,uEAAuE;AACvE,sFAAsF;AACtF,qFAAqF;AACrF,oFAAoF;AACpF,qFAAqF;AACrF,uFAAuF;AACvF,8EAA8E;AAC9E,4EAI6C;AAH3C,gIAAA,wBAAwB,OAAA;AACxB,wHAAA,gBAAgB,OAAA;AAIlB,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,+EAA+E;AAC/E,yFAAmF;AAA1E,qIAAA,sBAAsB,OAAA;AAE/B,6EAA6E;AAC7E,gFAAgF;AAChF,2CAA2C;AAC3C,2DAMoC;AALlC,qHAAA,qBAAqB,OAAA;AAOvB,sEAAsE;AACtE,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,4FAKsD;AAJpD,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AACtB,qIAAA,sBAAsB,OAAA;AAIxB,kFAAkF;AAClF,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,wDAAwD;AACxD,+CAc4B;AAb1B,qHAAA,yBAAyB,OAAA;AACzB,uHAAA,2BAA2B,OAAA;AAC3B,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,gHAAA,oBAAoB,OAAA;AACpB,oHAAA,wBAAwB,OAAA;AACxB,uGAAA,WAAW,OAAA;AACX,wHAAA,4BAA4B,OAAA;AAC5B,iHAAA,qBAAqB,OAAA;AACrB,+GAAA,mBAAmB,OAAA;AACnB,kHAAA,sBAAsB,OAAA;AACtB,iHAAA,qBAAqB,OAAA;AACrB,wGAAA,YAAY,OAAA;AAGd,8EAA8E;AAC9E,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,2DAA2D;AAC3D,yFAIgD;AAH9C,oJAAA,kCAAkC,OAAA;AAClC,yIAAA,uBAAuB,OAAA;AAIzB,4EAA4E;AAC5E,mFAAmF;AACnF,8EAA8E;AAC9E,qFAAqF;AACrF,iFAAiF;AACjF,yFAAyF;AACzF,4DAA4D;AAC5D,2EAIyC;AAHvC,6HAAA,kBAAkB,OAAA;AAClB,8HAAA,mBAAmB,OAAA;AAIrB,uFAAuF;AACvF,4FAA4F;AAC5F,4FAA4F;AAC5F,4FAA4F;AAC5F,4FAA4F;AAC5F,2FAA2F;AAC3F,6FAA6F;AAC7F,8FAA8F;AAC9F,uFAI+C;AAH7C,wIAAA,uBAAuB,OAAA;AACvB,uIAAA,sBAAsB,OAAA;AAGxB,+DAKmC;AAJjC,uHAAA,kBAAkB,OAAA;AAClB,2HAAA,sBAAsB,OAAA;AAKxB,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AACzF,kEAAkE;AAClE,2FAIiD;AAH/C,4IAAA,yBAAyB,OAAA;AACzB,2IAAA,wBAAwB,OAAA;AAI1B,uFAAuF;AACvF,yFAAyF;AACzF,iFAAiF;AACjF,sFAAsF;AACtF,+EAA+E;AAC/E,0FAA0F;AAC1F,yCAAyC;AACzC,yEAWwC;AAVtC,2HAAA,iBAAiB,OAAA;AACjB,oIAAA,0BAA0B,OAAA;AAC1B,gIAAA,sBAAsB,OAAA;AACtB,oIAAA,0BAA0B,OAAA;AAS5B,gFAAgF;AAChF,wFAAwF;AACxF,yFAAyF;AACzF,uDAAuD;AACvD,2EAIyC;AAHvC,iIAAA,sBAAsB,OAAA;AAKxB,gGAAgG;AAChG,mGAAmG;AACnG,iGAAiG;AACjG,gGAAgG;AAChG,qDAAqD;AACrD,uGAIuD;AAHrD,uJAAA,8BAA8B,OAAA;AAC9B,uJAAA,8BAA8B,OAAA;AAIhC,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,8FAA8F;AAC9F,8FAA8F;AAC9F,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,WAAW;AACX,qFAc8C;AAb5C,sIAAA,sBAAsB,OAAA;AACtB,gJAAA,gCAAgC,OAAA;AAChC,sIAAA,sBAAsB,OAAA;AACtB,iIAAA,iBAAiB,OAAA;AACjB,0IAAA,0BAA0B,OAAA;AAW5B,0FAA0F;AAC1F,mGAAmG;AACnG,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,uEAAuE;AACvE,2GAIyD;AAHvD,4JAAA,iCAAiC,OAAA;AACjC,0JAAA,+BAA+B,OAAA;AAIjC,mFAAmF;AACnF,wFAAwF;AACxF,0FAA0F;AAC1F,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,wFAAwF;AACxF,oFAAoF;AACpF,qFAAqF;AACrF,mCAAmC;AACnC,qFAAgF;AAAvE,wIAAA,wBAAwB,OAAA;AAEjC,4FAA4F;AAC5F,2FAA2F;AAC3F,+FAA+F;AAC/F,8FAA8F;AAC9F,4FAA4F;AAC5F,qFAA0F;AAAjF,gIAAA,gBAAgB,OAAA;AAEzB,gFAAgF;AAChF,kFAAkF;AAClF,4DAAyE;AAAhE,gHAAA,YAAY,OAAA;AAAE,oHAAA,gBAAgB,OAAA;AAEvC,8EAA8E;AAC9E,kFAAkF;AAClF,mFAAmF;AACnF,kFAAkF;AAClF,iDAAiD;AACjD,8DAAuD;AAA9C,8GAAA,UAAU,OAAA;AACnB,wDAsBgC;AArB9B,8GAAA,aAAa,OAAA;AACb,+GAAA,cAAc,OAAA;AACd,mHAAA,kBAAkB,OAAA;AAClB,oHAAA,mBAAmB,OAAA;AACnB,yHAAA,wBAAwB,OAAA;AAKxB,+EAA+E;AAC/E,yDAAyD;AACzD,6GAAA,YAAY,OAAA;AACZ,gHAAA,eAAe,OAAA;AACf,qHAAA,oBAAoB,OAAA;AACpB,mHAAA,kBAAkB,OAAA;AAClB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AACjB,kHAAA,iBAAiB,OAAA;AAMnB,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,iFAAiF;AACjF,0EAA0E;AAC1E,mEAAmE;AACnE,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAE9E,kFAAkF;AAClF,+BAA+B;AAC/B,8CAsB0B;AArBxB,2GAAA,cAAc,OAAA;AACd,yGAAA,YAAY,OAAA;AACZ,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,qHAAA,wBAAwB,OAAA;AACxB,yEAAyE;AACzE,qEAAqE;AACrE,sEAAsE;AACtE,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,gHAAA,mBAAmB,OAAA;AACnB,uHAAA,0BAA0B,OAAA;AAC1B,kHAAA,qBAAqB,OAAA;AACrB,mHAAA,sBAAsB,OAAA;AACtB,kFAAkF;AAClF,8GAAA,iBAAiB,OAAA;AACjB,gFAAgF;AAChF,oHAAA,uBAAuB,OAAA;AACvB,kFAAkF;AAClF,0HAAA,6BAA6B,OAAA;AAG/B,2EAA2E;AAC3E,kGAA4F;AAAnF,2IAAA,yBAAyB,OAAA;AAmBlC,yEAAyE;AACzE,gFAAgF;AAChF,YAAY;AACZ,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA;AAC1B,wDAA2E;AAAlE,4GAAA,UAAU,OAAA;AACnB,oFAAoF;AACpF,uFAAuF;AACvF,qFAAqF;AACrF,+EAA+E;AAC/E,uFAAuF;AACvF,oFAAoF;AACpF,kFAAkF;AAClF,wDAA+F;AAAtF,yHAAA,uBAAuB,OAAA;AAAE,qHAAA,mBAAmB,OAAA;AAAE,0GAAA,QAAQ,OAAA;AAmD/D,8CAAkE;AAAzD,2HAAA,8BAA8B,OAAA;AAOvC,8CAAiE;AAAxD,0HAAA,6BAA6B,OAAA;AAEtC,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,mFAAmF;AACnF,6EAA6E;AAC7E,gEAA2D;AAAlD,oHAAA,cAAc,OAAA;AACvB,oEAA8D;AAArD,uHAAA,eAAe,OAAA;AACxB,kFAAkF;AAClF,oFAAoF;AACpF,iEAAiE;AACjE,yFAAyF;AACzF,gEAImC;AAHjC,wHAAA,kBAAkB,OAAA;AAClB,qHAAA,eAAe,OAAA;AACf,2HAAA,qBAAqB,OAAA;AAGvB,mFAAmF;AACnF,kFAAkF;AAClF,gFAAgF;AAChF,sEAAiE;AAAxD,0HAAA,iBAAiB,OAAA;AAE1B,sFAAsF;AACtF,0FAA0F;AAC1F,kFAAkF;AAClF,qFAAqF;AACrF,sFAAsF;AACtF,8FAA8F;AAC9F,iEAOoC;AANlC,sHAAA,gBAAgB,OAAA;AAChB,qHAAA,eAAe,OAAA;AACf,qHAAA,eAAe,OAAA;AACf,6HAAA,uBAAuB,OAAA"}

package/dist/migrations-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations-dir.js","sourceRoot":"","sources":["../src/migrations-dir.ts"],"names":[],"mappings":";;;AAAA;;;;;;;GAOG;AACH,yCAAiC;AAEpB,QAAA,kBAAkB,GAAW,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC"}

package/dist/module/shield-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield-tokens.js","sourceRoot":"","sources":["../../src/module/shield-tokens.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH;;;;;;;;;;GAUG;AACH,qCAAyD;AAAhD,iHAAA,yBAAyB,OAAA"}

package/dist/module/shield.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shield.module.js","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAmF;AACnF,uCAAyC;AA4BzC,8DAAoE;AACpE,gFAAyE;AACzE,2DAAoD;AACpD,iEAAwD;AACxD,2DAAwE;AACxE,gFAAgF;AAChF,4EAA4E;AAC5E,kFAAkF;AAClF,mFAAmF;AACnF,+EAA+E;AAC/E,uBAAuB;AACvB,2DAAoD;AAEpD,iFAAiF;AACjF,kFAAkF;AAClF,sFAAsF;AACtF,yDAA+D;AACtD,0GADA,4CAAyB,OACA;AAelC;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAEnD,CAAC;AAEtB,IAAI,mBAAuD,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,4BAA4B;IAGzC,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,mBAAmB,GAAG,CAAC,wDACrB,uCAAuC,GACxC,CAAsC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,oFAAoF;YACpF,sFAAsF;YACtF,MAAM,IAAI,GAAG,IAAA,wBAAa,EAAC,GAAG,SAAS,wCAAwC,CAAC,CAAC,IAAI,CAAC;YACtF,mBAAmB,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAA2B,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,wBAAwB,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,wBAAwB,CACrC,OAA+E;IAE/E,IAAI,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,uFAAuF;YACrF,wFAAwF;YACxF,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,4BAA4B,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,OAAO,CAAC,iBAAiB,IAAI,oCAAqB,CAAC;AAC5D,CAAC;AA8QD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,YAAY,oBAAlB,MAAM,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,UAA+B,EAAE;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,6BAAa,GAAE,CAAC;QACjD,8EAA8E;QAC9E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,+EAA+E;QAC/E,gFAAgF;QAChF,+EAA+E;QAC/E,gFAAgF;QAChF,4DAA4D;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI;YAC7B,CAAC,CAAC,2BAAU,CAAC,OAAO;YAChB,8DAA8D;YAC9D,0EAA0E;YAC1E,2EAA2E;YAC3E,iEAAiE;YACjE;gBACE,GAAG,CAAC,OAAO,CAAC,kBAAkB;oBAC5B,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,eAAe;oBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,uEAAuE;gBACvE,mDAAmD;gBACnD,uEAAuE;gBACvE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,OAAO,CAAC,kBAAkB;oBAC5B,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,wBAAwB;oBAClC,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,EAAE;oBAChE,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,qBAAqB;oBAC/B,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,oBAAoB;oBAC9B,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;oBAC3B,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACR,CACF;YACH,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,MAAM,EAAE,cAAY;YACpB,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,sDAAsD;YACtD,OAAO,EAAE,CAAC,yCAAiB,EAAE,2BAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7E,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,6BAAU,EAAE,QAAQ,EAAE,MAAM,EAAE;gBACzC;oBACE,+EAA+E;oBAC/E,2EAA2E;oBAC3E,4EAA4E;oBAC5E,wCAAwC;oBACxC,OAAO,EAAE,4CAAyB;oBAClC,UAAU,EAAE,GAAmC,EAAE,CAC/C,wBAAwB,CAAC;wBACvB,GAAG,CAAC,OAAO,CAAC,mBAAmB;4BAC7B,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE;4BACtD,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;4BAC3B,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE;4BAClD,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;iBACL;aACF;YACD,8EAA8E;YAC9E,8EAA8E;YAC9E,qEAAqE;YACrE,OAAO,EAAE;gBACP,6BAAU;gBACV,4CAAyB;gBACzB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAiC;QACnD,MAAM,YAAY,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAErD,MAAM,oBAAoB,GAAa;YACrC,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAY;SAC1C,CAAC;QAEF,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,6BAAU;YACnB,UAAU,EAAE,CAAC,IAAyB,EAAa,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,IAAA,6BAAa,GAAE;YACpF,MAAM,EAAE,CAAC,YAAY,CAAC;SACvB,CAAC;QAEF,MAAM,iBAAiB,GAAa;YAClC,OAAO,EAAE,4CAAyB;YAClC,4EAA4E;YAC5E,mFAAmF;YACnF,iFAAiF;YACjF,8EAA8E;YAC9E,gFAAgF;YAChF,UAAU,EAAE,CAAC,IAAyB,EAAkC,EAAE,CACxE,wBAAwB,CAAC;gBACvB,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;YACJ,MAAM,EAAE,CAAC,YAAY,CAAC;SACvB,CAAC;QAEF,2EAA2E;QAC3E,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI;YAC7B,CAAC,CAAC,2BAAU,CAAC,OAAO;YAChB,8DAA8D;YAC9D,0EAA0E;YAC1E,2EAA2E;YAC3E,iEAAiE;YACjE;gBACE,GAAG,CAAC,OAAO,CAAC,kBAAkB;oBAC5B,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,eAAe;oBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,uEAAuE;gBACvE,mDAAmD;gBACnD,uEAAuE;gBACvE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,OAAO,CAAC,kBAAkB;oBAC5B,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,wBAAwB;oBAClC,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,EAAE;oBAChE,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,qBAAqB;oBAC/B,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,oBAAoB;oBAC9B,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;oBAC3B,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACR,CACF;YACH,CAAC,CAAC,SAAS,CAAC;QACd,OAAO;YACL,MAAM,EAAE,cAAY;YACpB,2EAA2E;YAC3E,6EAA6E;YAC7E,4EAA4E;YAC5E,+BAA+B;YAC/B,OAAO,EAAE;gBACP,yCAAiB;gBACjB,2BAAU;gBACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,GAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAa;aACxC;YACD,SAAS,EAAE,CAAC,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,CAAC;YACpE,OAAO,EAAE;gBACP,6BAAU;gBACV,4CAAyB;gBACzB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA1MY,oCAAY;uBAAZ,YAAY;IAFxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,YAAY,CA0MxB"}

package/dist/request-auth/request-principal.d.ts

@@ -12,7 +12,7 @@
  * captured from the login-time Principal, so a genuinely-root login stays
  * root; a normal login can never become one on a later request).
  */
-import type { Principal } from '@astram/core';
+import type { Principal, ServiceAuthenticator } from '@astram/core';
 import type { SessionTokenBinder, BoundPrincipalClaims } from './session-token-binder.js';
 /** Extract a bearer token from an `Authorization: Bearer <token>` header. */
 export declare function extractBearerToken(authorizationHeader: unknown): string | null;
@@ -22,11 +22,19 @@ export declare function extractBearerToken(authorizationHeader: unknown): string
  * a root on the request path.
  */
 export declare function principalFromClaims(claims: BoundPrincipalClaims): Principal | null;
+/**
+ * Is this bearer token a service-account API key (`ask_…`, ADR-0033) rather than a session
+ * access token? A cheap prefix check; the authenticator does the real (constant-time) verify.
+ */
+export declare function isApiKey(token: string): boolean;
 /**
  * Resolve an HTTP request's bearer token to a `Principal`, or `null` (fail-closed)
  * when there is no token, no binding, or the binding is malformed.
+ *
+ * When `serviceAuth` is provided and the bearer token is an API key (`ask_…`, ADR-0033), the token
+ * is authenticated as a service account instead of resolved against the session binder.
  */
-export declare function resolveRequestPrincipal(authorizationHeader: unknown, binder: SessionTokenBinder): Promise<Principal | null>;
+export declare function resolveRequestPrincipal(authorizationHeader: unknown, binder: SessionTokenBinder, serviceAuth?: ServiceAuthenticator): Promise<Principal | null>;
 /**
  * Resolve an HTTP request's bearer token to BOTH a `Principal` AND the raw
  * {@link BoundPrincipalClaims}, or `null` (fail-closed) — the same read path as
@@ -35,7 +43,7 @@ export declare function resolveRequestPrincipal(authorizationHeader: unknown, bi
  * uses this so it can read `claims.mustReenroll` to apply the enforced-re-enroll gate
  * while still attaching the resolved `Principal` for `decide()`.
  */
-export declare function resolveRequestAuth(authorizationHeader: unknown, binder: SessionTokenBinder): Promise<{
+export declare function resolveRequestAuth(authorizationHeader: unknown, binder: SessionTokenBinder, serviceAuth?: ServiceAuthenticator): Promise<{
     principal: Principal;
     claims: BoundPrincipalClaims;
 } | null>;

package/dist/request-auth/request-principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-principal.d.ts","sourceRoot":"","sources":["../../src/request-auth/request-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAK1F,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAiClF;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM3B;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,CAAC,CAQxE"}
+{"version":3,"file":"request-principal.d.ts","sourceRoot":"","sources":["../../src/request-auth/request-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAa1F,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAiClF;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/C;AA4BD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAU3B;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,mBAAmB,EAAE,OAAO,EAC5B,MAAM,EAAE,kBAAkB,EAC1B,WAAW,CAAC,EAAE,oBAAoB,GACjC,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,CAAC,CAgBxE"}

package/dist/request-auth/request-principal.js

@@ -16,10 +16,18 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractBearerToken = extractBearerToken;
 exports.principalFromClaims = principalFromClaims;
+exports.isApiKey = isApiKey;
 exports.resolveRequestPrincipal = resolveRequestPrincipal;
 exports.resolveRequestAuth = resolveRequestAuth;
 /** Valid `Principal.kind` values (mirror of the Core union; validated at rebuild). */
 const PRINCIPAL_KINDS = new Set(['user', 'role_group', 'service_account']);
+/**
+ * The service-account API-key prefix (mirror of Core's `API_KEY_PREFIX = 'ask_'`, ADR-0033) —
+ * inlined as a literal so this file keeps its ZERO-runtime-`require('@astram/core')` discipline
+ * (importing the value would add a runtime dep; the type-only imports above are erased). Kept in
+ * sync with Core by the ADR + a guard test that asserts equality with the Core export.
+ */
+const API_KEY_PREFIX = 'ask_';
 /** Extract a bearer token from an `Authorization: Bearer <token>` header. */
 function extractBearerToken(authorizationHeader) {
     if (typeof authorizationHeader !== 'string')
@@ -64,14 +72,53 @@ function principalFromClaims(claims) {
         isRoot: claims.isRoot === true,
     });
 }
+/**
+ * Is this bearer token a service-account API key (`ask_…`, ADR-0033) rather than a session
+ * access token? A cheap prefix check; the authenticator does the real (constant-time) verify.
+ */
+function isApiKey(token) {
+    return token.startsWith(API_KEY_PREFIX);
+}
+/**
+ * Synthesize {@link BoundPrincipalClaims} for a machine (service-account) request from its resolved
+ * {@link Principal} (ADR-0033). A service account has NO interactive-session state — so the
+ * session-only gates are set to their benign defaults:
+ *  - `mustReenroll: false` — re-enroll is a human recovery-code concern; a machine never re-enrolls.
+ *  - `sessionId: ''` — there is no durable session row (the key IS the credential); the field is
+ *    present only to satisfy the claims shape (no logout/liveness correlation applies to a key —
+ *    revocation is via the key's `revokedAtMs`, enforced at authenticate time).
+ *  - no `cachedFacts` (absent) — gate 5 DB-reloads the account's grants (fail-closed default; a
+ *    machine has no login-time projection).
+ * The Principal's `scopeSubtreeNodeIds` is carried through so the tenant/scope gate reads the
+ * account's own subtree (least privilege).
+ */
+function claimsFromServicePrincipal(principal) {
+    return {
+        id: principal.id,
+        tenantId: principal.tenantId,
+        roleIds: [...principal.roleIds],
+        kind: principal.kind,
+        isRoot: false, // a service account is NEVER root (ADR-0033) — defense-in-depth on the claims too.
+        sessionId: '',
+        mustReenroll: false,
+        scopeSubtreeNodeIds: [...principal.scopeSubtreeNodeIds],
+    };
+}
 /**
  * Resolve an HTTP request's bearer token to a `Principal`, or `null` (fail-closed)
  * when there is no token, no binding, or the binding is malformed.
+ *
+ * When `serviceAuth` is provided and the bearer token is an API key (`ask_…`, ADR-0033), the token
+ * is authenticated as a service account instead of resolved against the session binder.
  */
-async function resolveRequestPrincipal(authorizationHeader, binder) {
+async function resolveRequestPrincipal(authorizationHeader, binder, serviceAuth) {
     const token = extractBearerToken(authorizationHeader);
     if (token === null)
         return null;
+    if (serviceAuth !== undefined && isApiKey(token)) {
+        const res = await serviceAuth.authenticateApiKey(token);
+        return res.ok ? res.principal : null; // fail-closed uniform on any bad key.
+    }
     const claims = await binder.resolve(token);
     if (claims === null)
         return null;
@@ -85,10 +132,19 @@ async function resolveRequestPrincipal(authorizationHeader, binder) {
  * uses this so it can read `claims.mustReenroll` to apply the enforced-re-enroll gate
  * while still attaching the resolved `Principal` for `decide()`.
  */
-async function resolveRequestAuth(authorizationHeader, binder) {
+async function resolveRequestAuth(authorizationHeader, binder, serviceAuth) {
     const token = extractBearerToken(authorizationHeader);
     if (token === null)
         return null;
+    // Machine path (ADR-0033): an `ask_…` bearer is a service-account API key. Authenticate it and
+    // synthesize the claims (benign session defaults) so ALL downstream enforcement — the re-enroll
+    // gate, the facts hot-path, decide() — is IDENTICAL to a human's (invariant #3, one authority).
+    if (serviceAuth !== undefined && isApiKey(token)) {
+        const res = await serviceAuth.authenticateApiKey(token);
+        if (!res.ok)
+            return null; // uniform fail-closed (malformed/unknown/expired/revoked/outage).
+        return { principal: res.principal, claims: claimsFromServicePrincipal(res.principal) };
+    }
     const claims = await binder.resolve(token);
     if (claims === null)
         return null;

package/dist/request-auth/request-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-principal.js","sourceRoot":"","sources":["../../src/request-auth/request-principal.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AASH,gDAKC;AAOD,kDAiCC;AAMD,0DASC;AAUD,gDAWC;AArFD,sFAAsF;AACtF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE3E,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,mBAA4B;IAC7D,IAAI,OAAO,mBAAmB,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7B,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,MAA4B;IAC9D,IACE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;QAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAA0B,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;IACP,yFAAyF;IACzF,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,2FAA2F;IAC3F,6EAA6E;IAC7E,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC;QAChF,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACjC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,iBAAiB,EAAE,MAAM,CAAC,QAAQ;QAClC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,mBAA4B,EAC5B,MAA0B;IAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACtC,mBAA4B,EAC5B,MAA0B;IAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/dist/request-auth/session-facts-als.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-facts-als.js","sourceRoot":"","sources":["../../src/request-auth/session-facts-als.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAEH,uDAAqD;AAmBrD;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG,IAAI,oCAAiB,EAAqB,CAAC;AAEnF;;;;GAIG;AACU,QAAA,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/D,WAAW,EAAE,IAAI;IACjB,kBAAkB,EAAE,CAAC;CACtB,CAAC,CAAC"}

package/dist/request-auth/session-token-binder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-token-binder.js","sourceRoot":"","sources":["../../src/request-auth/session-token-binder.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;;AAqEH;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,CAAC,GAAG,IAAyE,CAAC;IACpF,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;IACrF,OAAO;QACL,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,qBAAqB,EAAE,CAAC,GAAI,CAAC,CAAC,qBAAkC,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,MAA4B;IACrD,IAAI,CAAC,CAAC,qBAAqB,IAAI,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAE/C,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,MAA4B;IACpD,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAEvC,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,sFAAsF;AACtF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD,SAAS,KAAK,CAAC,WAAmB;IAChC,OAAO,GAAG,aAAa,GAAG,WAAW,EAAE,CAAC;AAC1C,CAAC;AACD,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,GAAG,kBAAkB,GAAG,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED,MAAa,kBAAkB;IACA;IAA7B,YAA6B,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,MAA4B,EAAE,KAAa;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/D,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAsB,EACtB,SAAiB,EACjB,KAAa,EACb,UAAgC,EAChC,YAAgC;QAEhC,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAE/B,yFAAyF;QACzF,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,IAAI,UAAU,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3D,qFAAqF;YACrF,wFAAwF;YACxF,mFAAmF;YACnF,mEAAmE;YACnE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;gBACvD,IAAI,IAAI,GAAyB,MAAM,CAAC;gBACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,IAAI;wBACF,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;gBACxF,CAAC;gBACD,qFAAqF;gBACrF,0FAA0F;gBAC1F,oFAAoF;gBACpF,uFAAuF;gBACvF,mCAAmC;gBACnC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1D,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,mBAAmB,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;gBAC7D,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,GAAG,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAClE,wFAAwF;QACxF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,iBAAiB,CACrB,WAAmB,EACnB,SAAiB,EACjB,YAAoB,EACpB,OAA0B;QAE1B,qFAAqF;QACrF,sFAAsF;QACtF,IAAI,KAAoB,CAAC;QACzB,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACjD,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,+CAA+C;QAC/D,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,oCAAoC;QAE1F,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,8DAA8D;QAC9E,CAAC;QAED,wFAAwF;QACxF,0FAA0F;QAC1F,uFAAuF;QACvF,MAAM,IAAI,GAAyB,gBAAgB,CAAC;YAClD,GAAG,iBAAiB,CAAC,OAAO,CAAC;YAC7B,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAErC,oFAAoF;QACpF,IAAI,KAAa,CAAC;QAClB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClD,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,uCAAuC;QAErF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAClD,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ;YAC9B,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ;YACpC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;YAC/B,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ;YAChC,OAAO,MAAM,EAAE,MAAM,KAAK,SAAS;YACnC,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ;YACrC,OAAO,MAAM,EAAE,YAAY,KAAK,SAAS,EACzC,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,2BAA2B;QAC1C,CAAC;QACD,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,gFAAgF;QAChF,MAAM,WAAW,GAAG,gBAAgB,CAAE,MAAoC,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,GAAG,WAAW,KAAK,SAAS;YAChC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/B,wFAAwF;QACxF,6FAA6F;QAC7F,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,mBAAmB,GAAG,iBAAiB,CAC1C,MAA4C,CAAC,mBAAmB,CAClE,CAAC;QACF,MAAM,GAAG,mBAAmB,KAAK,SAAS;YACxC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC3B,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACvC,8EAA8E;QAC9E,iFAAiF;QACjF,kFAAkF;QAClF,mFAAmF;QACnF,kFAAkF;QAClF,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAClD,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;QAEvE,mFAAmF;QACnF,mFAAmF;QACnF,mFAAmF;QACnF,mFAAmF;QACnF,iFAAiF;QACjF,iFAAiF;QACjF,IAAI,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;YAChE,YAAY,GAAG,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,KAAK,CAAC,CAAC,sDAAsD;QAC9E,CAAC;QACD,OAAO,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACrF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,0EAA0E;QACpF,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,CAAC,8CAA8C;QACxE,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,+DAA+D;QACzE,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;YAAE,OAAO,CAAC,oCAAoC;QAC/E,kFAAkF;QAClF,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,CAAC,qDAAqD;QAC7E,MAAM,OAAO,GAAyB,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;CACF;AAhTD,gDAgTC"}

package/dist/request-auth/tokens.d.ts

@@ -11,4 +11,14 @@
  * missing (fail-closed).
  */
 export declare const SHIELD_SESSION_TOKEN_BINDER: unique symbol;
+/**
+ * The {@link import('@astram/core').ServiceAuthenticator} — authenticates a service-account API
+ * key (`Authorization: Bearer ask_…`, ADR-0033) into a tenant-bound `service_account` Principal.
+ * Provided only when the app wires an {@link import('@astram/core').ApiKeyStore} (i.e. it enables
+ * machine/agent access). ABSENT by default — the guard injects it `@Optional()`; when missing, an
+ * `ask_…` bearer simply has no authenticator and is treated as an unresolvable token (401,
+ * fail-closed), exactly as if the key were unknown. Enabling it opens the machine auth path WITHOUT
+ * touching the human session path.
+ */
+export declare const SHIELD_SERVICE_AUTHENTICATOR: unique symbol;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/request-auth/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/request-auth/tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/request-auth/tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AAEjF;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,eAAyC,CAAC"}

package/dist/request-auth/tokens.js

@@ -4,7 +4,7 @@
  * the enforcement guard and the auth wiring can both depend on them without cycles.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_SESSION_TOKEN_BINDER = void 0;
+exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = void 0;
 /**
  * The {@link import('./session-token-binder.js').SessionTokenBinder} — binds an
  * opaque access token to its principal claims (server-side), so the enforcement
@@ -14,3 +14,13 @@ exports.SHIELD_SESSION_TOKEN_BINDER = void 0;
  * missing (fail-closed).
  */
 exports.SHIELD_SESSION_TOKEN_BINDER = Symbol('SHIELD_SESSION_TOKEN_BINDER');
+/**
+ * The {@link import('@astram/core').ServiceAuthenticator} — authenticates a service-account API
+ * key (`Authorization: Bearer ask_…`, ADR-0033) into a tenant-bound `service_account` Principal.
+ * Provided only when the app wires an {@link import('@astram/core').ApiKeyStore} (i.e. it enables
+ * machine/agent access). ABSENT by default — the guard injects it `@Optional()`; when missing, an
+ * `ask_…` bearer simply has no authenticator and is treated as an unresolvable token (401,
+ * fail-closed), exactly as if the key were unknown. Enabling it opens the machine auth path WITHOUT
+ * touching the human session path.
+ */
+exports.SHIELD_SERVICE_AUTHENTICATOR = Symbol('SHIELD_SERVICE_AUTHENTICATOR');

package/dist/request-auth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/request-auth/tokens.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH;;;;;;;GAOG;AACU,QAAA,2BAA2B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC"}

package/dist/scope/closure-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"closure-builder.js","sourceRoot":"","sources":["../../src/scope/closure-builder.ts"],"names":[],"mappings":";AAAA,+DAA+D;AAC/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;;;AA4DH,4CA8DC;AA3GD,4FAA4F;AAC5F,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,IAAY;QACtB,KAAK,CACH,kEAAkE,IAAI,eAAe;YACnF,oFAAoF;YACpF,iFAAiF,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AATD,0CASC;AAED,+EAA+E;AAC/E,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,IAAY,EAAE,QAAgB;QACxC,KAAK,CACH,wBAAwB,IAAI,0DAA0D;YACpF,UAAU,QAAQ,6DAA6D;YAC/E,qFAAqF;YACrF,SAAS,CACZ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAVD,0CAUC;AAED,qFAAqF;AACrF,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CACH,wBAAwB,IAAI,sBAAsB,MAAM,6BAA6B;YACnF,+EAA+E;YAC/E,iFAAiF;YACjF,gBAAgB,CACnB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAVD,0DAUC;AAED,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,KAA2B,EAC3B,IAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IAErD,iFAAiF;IACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,IAAI,GAAiB,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,wDAAwD;QACxD,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAE1D,kFAAkF;QAClF,gFAAgF;QAChF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,gFAAgF;gBAChF,+EAA+E;gBAC/E,4DAA4D;gBAC5D,MAAM,IAAI,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,CAAC,uDAAuD;YAChE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YAED,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEzD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;QACxC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CACpB,CAAC;AACJ,CAAC"}

package/dist/secrets/encrypted-file-secrets.d.ts

@@ -0,0 +1,16 @@
+import type { CryptoPort, Dek, SecretsProvider, SecretPath } from '@astram/core';
+export declare class EncryptedFileSecretsProvider implements SecretsProvider {
+    #private;
+    /**
+     * @param file  path to the encrypted store file (created 0600 on first write).
+     * @param crypto  the ADR-0031 CryptoPort (AES-GCM); the SAME box KEK protects secrets + DEKs.
+     * @param dek  the data key used to encrypt secret values. Provisioned/managed by the caller (a
+     *   dedicated secrets DEK, wrapped by the KEK) — it is NEVER written to the store in plaintext.
+     */
+    constructor(file: string, crypto: CryptoPort, dek: Dek);
+    resolve(path: SecretPath): Promise<string>;
+    store(path: SecretPath, value: string): Promise<number>;
+    rotate(path: SecretPath, newValue: string): Promise<number>;
+    currentVersion(path: SecretPath): Promise<number>;
+}
+//# sourceMappingURL=encrypted-file-secrets.d.ts.map

package/dist/secrets/encrypted-file-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-file-secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/encrypted-file-secrets.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AASjF,qBAAa,4BAA6B,YAAW,eAAe;;IAKlE;;;;;OAKG;gBACS,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG;IAMhD,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAS1C,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIvD,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3D,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CA+BxD"}

package/dist/secrets/encrypted-file-secrets.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptedFileSecretsProvider = void 0;
+/**
+ * `EncryptedFileSecretsProvider` — the reference {@link SecretsProvider} adapter (ADR-0032). An
+ * on-box secrets store where every secret is ENCRYPTED AT REST (AES-256-GCM under the box KEK, via
+ * the ADR-0031 `CryptoPort`), so the file on disk is ciphertext — not a plaintext `.env` password.
+ *
+ * This is the dev + air-gapped / single-box backend (what astram-infra's box uses). Vault / AWS
+ * Secrets Manager / GCP Secret Manager implement the SAME `SecretsProvider` and drop in later
+ * (Rule of Three) — no consumer change.
+ *
+ * SECURITY: never logs a secret value. `resolve` fails closed (throws SecretNotFoundError on an
+ * absent path — never returns ''). The store file is written 0600. The value is bound to its path
+ * as AEAD AAD, so a ciphertext for one path can't be replayed under another.
+ *
+ * Store format (JSON): { "<path>": { "version": n, "ciphertext": "<base64>" }, ... }
+ * The ciphertext is the CryptoPort AES-GCM sealing of the secret value, AAD = the secret path.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const core_1 = require("@astram/core");
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+class EncryptedFileSecretsProvider {
+    #file;
+    #crypto;
+    #dek;
+    /**
+     * @param file  path to the encrypted store file (created 0600 on first write).
+     * @param crypto  the ADR-0031 CryptoPort (AES-GCM); the SAME box KEK protects secrets + DEKs.
+     * @param dek  the data key used to encrypt secret values. Provisioned/managed by the caller (a
+     *   dedicated secrets DEK, wrapped by the KEK) — it is NEVER written to the store in plaintext.
+     */
+    constructor(file, crypto, dek) {
+        this.#file = file;
+        this.#crypto = crypto;
+        this.#dek = dek;
+    }
+    async resolve(path) {
+        const store = this.#read();
+        const entry = store[path];
+        if (!entry)
+            throw new core_1.SecretNotFoundError(path);
+        // AAD = path (bound), so a ciphertext moved to another path fails to decrypt.
+        const plain = await this.#crypto.decrypt(fromB64(entry.ciphertext), this.#dek, path);
+        return dec.decode(plain);
+    }
+    async store(path, value) {
+        return this.#write(path, value, /*rotate*/ false);
+    }
+    async rotate(path, newValue) {
+        return this.#write(path, newValue, /*rotate*/ true);
+    }
+    async currentVersion(path) {
+        return this.#read()[path]?.version ?? 0;
+    }
+    // ── internals ─────────────────────────────────────────────────────────────
+    async #write(path, value, _rotate) {
+        const store = this.#read();
+        const ct = await this.#crypto.encrypt(enc.encode(value), this.#dek, path);
+        const version = (store[path]?.version ?? 0) + 1;
+        store[path] = { version, ciphertext: toB64(ct) };
+        this.#persist(store);
+        return version;
+    }
+    #read() {
+        if (!(0, node_fs_1.existsSync)(this.#file))
+            return {};
+        try {
+            const raw = (0, node_fs_1.readFileSync)(this.#file, 'utf8');
+            return raw.trim() === '' ? {} : JSON.parse(raw);
+        }
+        catch {
+            // A corrupt store must NOT silently become empty (that would erase secrets); fail loud.
+            throw new Error(`secrets store is unreadable/corrupt: ${this.#file}`);
+        }
+    }
+    #persist(store) {
+        const dir = (0, node_path_1.dirname)(this.#file);
+        if (!(0, node_fs_1.existsSync)(dir))
+            (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+        (0, node_fs_1.writeFileSync)(this.#file, JSON.stringify(store, null, 2), { mode: 0o600 });
+        try {
+            (0, node_fs_1.chmodSync)(this.#file, 0o600);
+        }
+        catch { /* best-effort on platforms without chmod */ }
+    }
+}
+exports.EncryptedFileSecretsProvider = EncryptedFileSecretsProvider;
+function toB64(b) { return Buffer.from(b).toString('base64'); }
+function fromB64(s) { return new Uint8Array(Buffer.from(s, 'base64')); }

package/dist/session/crypto-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-adapters.js","sourceRoot":"","sources":["../../src/session/crypto-adapters.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA2DH,oEAKC;AAED,sDAKC;AAED,kDAEC;AAzED,6CAAsD;AAGtD,yEAAyE;AAC5D,QAAA,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAC1D,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AACxD,QAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAa,oBAAoB;IACF;IAA7B,YAA6B,aAAa,EAAE;QAAf,eAAU,GAAV,UAAU,CAAK;IAAG,CAAC;IAEhD,IAAI;QACF,uEAAuE;QACvE,OAAO,IAAA,yBAAW,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;CACF;AAPD,oDAOC;AAED;;;;;;;;GAQG;AACH,MAAa,wBAAwB;IAClB,GAAG,CAAS;IAE7B,YAAY,GAAW;QACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,QAAgB;QACnB,mEAAmE;QACnE,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;CACF;AAhBD,4DAgBC;AAED,oDAAoD;AACpD,MAAa,WAAW;IACtB,KAAK;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;CACF;AAJD,kCAIC;AAED,qFAAqF;AACrF,SAAgB,4BAA4B,CAAC,UAAmB;IAI9D,OAAO,EAAE,OAAO,EAAE,8BAAsB,EAAE,QAAQ,EAAE,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,SAAgB,qBAAqB,CAAC,GAAW;IAI/C,OAAO,EAAE,OAAO,EAAE,6BAAqB,EAAE,QAAQ,EAAE,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAgB,mBAAmB;IACjC,OAAO,EAAE,OAAO,EAAE,oBAAY,EAAE,QAAQ,EAAE,IAAI,WAAW,EAAE,EAAE,CAAC;AAChE,CAAC"}

package/dist/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,qFAG2C;AAFzC,4IAAA,yBAAyB,OAAA;AACzB,8IAAA,2BAA2B,OAAA;AAG7B,2EAGsC;AAFpC,kIAAA,oBAAoB,OAAA;AACpB,sIAAA,wBAAwB,OAAA;AAG1B,2DAU8B;AAT5B,0HAAA,oBAAoB,OAAA;AACpB,8HAAA,wBAAwB,OAAA;AACxB,iHAAA,WAAW,OAAA;AACX,kIAAA,4BAA4B,OAAA;AAC5B,2HAAA,qBAAqB,OAAA;AACrB,yHAAA,mBAAmB,OAAA;AACnB,4HAAA,sBAAsB,OAAA;AACtB,2HAAA,qBAAqB,OAAA;AACrB,kHAAA,YAAY,OAAA"}

package/dist/session/mariadb-session-record-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mariadb-session-record-store.js","sourceRoot":"","sources":["../../src/session/mariadb-session-record-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAYH,6CAA6C;AAChC,QAAA,2BAA2B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAsBjF,uEAAuE;AACvE,SAAS,KAAK,CAAC,CAAkB;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,YAAY;QACzB,WAAW,EAAE,CAAC,CAAC,cAAc;QAC7B,QAAQ,EAAE,CAAC,CAAC,WAAW;QACvB,MAAM,EAAE,CAAC,CAAC,QAAQ;QAClB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC;QACnC,mBAAmB,EAAE,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,aAAa;QAC1B,SAAS,EAAE,CAAC,CAAC,aAAa;QAC1B,SAAS,EAAE,CAAC,CAAC,aAAa;QAC1B,aAAa,EAAE,CAAC,CAAC,kBAAkB;QACnC,SAAS,EAAE,CAAC,CAAC,aAAa;QAC1B,MAAM,EAAE,CAAC,CAAC,SAAS;QACnB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC;QACpC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,MAAa,yBAAyB;IACP;IAA7B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;wCAEkC,EAClC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAClG,CAAC;QACF,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAyB;QACjD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;;8CAGwC,EACxC;YACE,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,SAAS,EAAE,mCAAmC;YACpD,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,eAAe;SACtB,CACF,CAAC;QACF,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,6EAA6E,EAC7E,CAAC,SAAS,CAAC,CACZ,CAAiB,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACjC,sEAAsE,EACtE,CAAC,SAAS,CAAC,CACZ,CAAiB,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACzC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAChC;wDACkD,EAClD,CAAC,SAAS,CAAC,CACZ,CAA8B,CAAC;QAChC,OAAO,GAAG,EAAE,YAAY,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB;QACjC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;+BACyB,EACzB,CAAC,SAAS,CAAC,CACZ,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,CAAC,KAAK,CACd;iCACyB,EACzB,CAAC,SAAS,CAAC,CACZ,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CACd;;;WAGG,EACH,CAAC,SAAS,CAAC,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC/B,MAAM,IAAI,CAAC,KAAK,CACd,gFAAgF,EAChF,CAAC,SAAS,CAAC,CACZ,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CACd,wFAAwF,EACxF,CAAC,SAAS,CAAC,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,MAAM,CAAC,EAA2C;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YACf,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AA/ID,8DA+IC"}

package/dist/session/redis-hot-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-hot-session-store.js","sourceRoot":"","sources":["../../src/session/redis-hot-session-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAKH,6CAA6C;AAChC,QAAA,wBAAwB,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE3E;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,CAAC,GAAG,GAA4C,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;QACzB,cAAc;QACd,YAAY;QACZ,WAAW;QACX,OAAO;QACP,WAAW;QACX,WAAW;QACX,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CACL,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;QACrC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QACpC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAa,oBAAoB;IACF;IAA7B,YAA6B,KAAY;QAAZ,UAAK,GAAL,KAAK,CAAO;IAAG,CAAC;IAE7C,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,KAAsB,EAAE,KAAa;QACpE,iFAAiF;QACjF,8EAA8E;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6DAA6D;YAC7D,IAAI,mBAAmB,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAC7D,wEAAwE;YACxE,yEAAyE;YACzE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,6BAA6B;QAC1E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;YACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACvF,2EAA2E;gBAC3E,gEAAgE;gBAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,4EAA4E;QAC9E,CAAC;IACH,CAAC;CACF;AA3CD,oDA2CC"}

package/migrations/1710000000017-CreateServiceAccountKey.cjs

@@ -0,0 +1,41 @@
+/**
+ * Framework authz migration — `shield_authz.service_account_key`: the HASH-ONLY store of
+ * service-account API keys (ADR-0033). One row = one KEY VERSION of one service account; the
+ * account presents `ask_<sak_account_id>_<secret>` and the engine verifies `<secret>` against
+ * `sak_secret_hash` (Argon2id) — the raw secret is NEVER stored, logged, or re-fetchable.
+ *
+ * This table is the physical backing of `packages/guard/src/authentication/mariadb-api-key-store.ts`
+ * (`MariaDbApiKeyStore`): its columns MUST match that adapter's SELECT/INSERT/UPDATE EXACTLY
+ * (rule 30 — the store is the source of truth). Rotation INSERTs a new `(account, version)` row;
+ * `getByAccountId` returns the highest version; `revoke` stamps `sak_revoked_at_ms` on all of an
+ * account's rows. A revoked/expired key fails closed at authenticate time.
+ *
+ * Schema `shield_authz` is created by `1710000000006-CreateAuthzSchema.cjs` — NOT recreated here.
+ * Idempotent (CREATE TABLE IF NOT EXISTS). No hard-coded UUIDs, no seed (keys are admin-issued).
+ * `down` drops the table. Run by the DDL account.
+ */
+
+const SCHEMA = 'shield_authz';
+
+async function up({ query }) {
+  await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`service_account_key\` (
+    sak_account_id     VARCHAR(36)  NOT NULL,          -- the <accountId> inside the ask_ key (= service_account.sa_id)
+    sak_version        INT          NOT NULL,          -- monotonic per account; rotation bumps it
+    sak_tenant_id      VARCHAR(36)  NOT NULL,          -- server-stamped; tenant the key is bound to
+    sak_scope_subtree  JSON         NOT NULL,          -- reachable node ids for the key's Principal (least privilege)
+    sak_role_ids       JSON         NOT NULL,          -- roles the key's Principal holds
+    sak_secret_hash    VARCHAR(255) NOT NULL,          -- Argon2id hash of the secret — NEVER the plaintext
+    sak_expires_at_ms  BIGINT       NULL,              -- absolute expiry (epoch-ms); NULL = non-expiring (discouraged)
+    sak_revoked_at_ms  BIGINT       NULL,              -- set on revoke (epoch-ms); a revoked key fails closed
+    sak_created_at_ms  BIGINT       NOT NULL,          -- issue time (epoch-ms)
+    PRIMARY KEY (sak_account_id, sak_version),
+    INDEX idx_sak_account (sak_account_id),
+    INDEX idx_sak_tenant (sak_tenant_id)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`);
+}
+
+async function down({ query }) {
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`service_account_key\``);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -24,8 +24,8 @@
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
     "mariadb": "^3.4.0",
-    "@astram/engine": "0.2.0",
-    "@astram/core": "1.2.0"
+    "@astram/core": "1.3.0",
+    "@astram/engine": "0.3.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",