@astram/guard 0.6.0 → 0.8.0

package/dist/authentication/mariadb-profile-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAOtE,qBAAa,oBAAqB,YAAW,aAAa;IAE5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;gBACrB,IAAI,EAAE,IAAI;IAIjC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAmC3G"}
+{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAOtE,qBAAa,oBAAqB,YAAW,aAAa;IAE5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;gBACrB,IAAI,EAAE,IAAI;IAIjC,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,CAAC;CAsC/B"}

package/dist/authentication/mariadb-session-sweeper.d.ts

@@ -23,11 +23,24 @@
 import type { Pool } from 'mariadb';
 import type { SessionSweeper } from '../auth/ports/session-sweeper.js';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+/** The binder surface the sweeper needs; `unbindSessionStrict` (throws on a Redis error) is preferred. */
+type SweepBinder = Pick<SessionTokenBinder, 'unbindSession'> & Partial<Pick<SessionTokenBinder, 'unbindSessionStrict'>>;
 export declare class MariaDbSessionSweeper implements SessionSweeper {
     private readonly pool;
     private readonly binder;
-    constructor(pool: Pool, binder: SessionTokenBinder);
+    /** Clock for the "not yet expired" unbind window (epoch-ms). */
+    private readonly now;
+    constructor(pool: Pool, binder: SweepBinder, 
+    /** Clock for the "not yet expired" unbind window (epoch-ms). */
+    now?: () => number);
+    /**
+     * Unbind the given sessions in Redis. Every session is attempted; if any unbind failed, the
+     * FIRST error is thrown afterwards (Phase 3 review P1), so an administrative revoke reports it
+     * and can be retried rather than leaving live access tokens valid until their TTL.
+     */
+    private unbindAll;
     revokeAllForPrincipal(principalId: string): Promise<void>;
     revokeOthersForPrincipal(principalId: string, keepSessionId: string): Promise<void>;
 }
+export {};
 //# sourceMappingURL=mariadb-session-sweeper.d.ts.map

package/dist/authentication/mariadb-session-sweeper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-session-sweeper.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-session-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAMlF,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,kBAAkB;IAGvC,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBzD,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB1F"}
+{"version":3,"file":"mariadb-session-sweeper.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-session-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAMlF,0GAA0G;AAC1G,KAAK,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAC1D,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE3D,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,WAAW;IACpC,gEAAgE;IAC/C,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;YACW,SAAS;IAUjB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBzD,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAkB1F"}

package/dist/authentication/mariadb-session-sweeper.js

@@ -26,35 +26,53 @@ exports.MariaDbSessionSweeper = void 0;
 class MariaDbSessionSweeper {
     pool;
     binder;
-    constructor(pool, binder) {
+    now;
+    constructor(pool, binder, 
+    /** Clock for the "not yet expired" unbind window (epoch-ms). */
+    now = Date.now) {
         this.pool = pool;
         this.binder = binder;
+        this.now = now;
+    }
+    /**
+     * Unbind the given sessions in Redis. Every session is attempted; if any unbind failed, the
+     * FIRST error is thrown afterwards (Phase 3 review P1), so an administrative revoke reports it
+     * and can be retried rather than leaving live access tokens valid until their TTL.
+     */
+    async unbindAll(sessionIds) {
+        const unbind = (id) => this.binder.unbindSessionStrict !== undefined
+            ? this.binder.unbindSessionStrict(id)
+            : this.binder.unbindSession(id);
+        const results = await Promise.allSettled(sessionIds.map((id) => unbind(id)));
+        const failed = results.find((r) => r.status === 'rejected');
+        if (failed !== undefined)
+            throw failed.reason;
     }
     async revokeAllForPrincipal(principalId) {
+        // The UNBIND set (Phase 3 review P1): every session of the principal that has not reached its
+        // absolute expiry, WHATEVER its status — so a retry after a failed unbind (the durable row is
+        // already `revoked`) still drops the Redis keys. Read BEFORE the durable revoke.
         const rows = (await this.pool.query(`SELECT s_session_id
          FROM \`shield_identity\`.\`session\`
-        WHERE s_principal_id = ? AND s_status = 'active'`, [principalId]));
+        WHERE s_principal_id = ? AND s_absolute_expires_at_ms > ?`, [principalId, this.now()]));
         await this.pool.query(`UPDATE \`shield_identity\`.\`session\`
           SET s_status = 'revoked'
         WHERE s_principal_id = ? AND s_status = 'active'`, [principalId]);
-        // Drop each revoked session's Redis liveness key so outstanding access tokens die
-        // immediately, not at their TTL.
-        for (const { s_session_id } of rows) {
-            await this.binder.unbindSession(s_session_id);
-        }
+        // Drop each session's Redis liveness key so outstanding access tokens die immediately, not
+        // at their TTL. A failure is surfaced after every session was attempted.
+        await this.unbindAll(rows.map((r) => r.s_session_id));
     }
     async revokeOthersForPrincipal(principalId, keepSessionId) {
+        // Same unbind set as revokeAll (not-yet-expired, any status) minus the kept session.
         const rows = (await this.pool.query(`SELECT s_session_id
          FROM \`shield_identity\`.\`session\`
-        WHERE s_principal_id = ? AND s_status = 'active' AND s_session_id <> ?`, [principalId, keepSessionId]));
+        WHERE s_principal_id = ? AND s_absolute_expires_at_ms > ? AND s_session_id <> ?`, [principalId, this.now(), keepSessionId]));
         await this.pool.query(`UPDATE \`shield_identity\`.\`session\`
           SET s_status = 'revoked'
         WHERE s_principal_id = ? AND s_status = 'active' AND s_session_id <> ?`, [principalId, keepSessionId]);
         // Only the OTHER sessions are unbound — the kept (current) session's liveness key
         // is never touched, so the actor stays signed in after a change-password.
-        for (const { s_session_id } of rows) {
-            await this.binder.unbindSession(s_session_id);
-        }
+        await this.unbindAll(rows.map((r) => r.s_session_id));
     }
 }
 exports.MariaDbSessionSweeper = MariaDbSessionSweeper;

package/dist/authentication/noop-email-sender.d.ts

@@ -0,0 +1,12 @@
+/**
+ * NoopEmailSender — bound when the app passes `emailSender: 'disabled'` (security
+ * hardening #6). Delivers nothing and writes nothing (no stdout, no log line), so a
+ * deployment without a mail provider can run `auth: true` without leaking reset links.
+ * `POST /auth/forgot-password` keeps its always-204 contract; users simply receive no
+ * email. AuthModule logs ONE startup warning that email delivery is disabled.
+ */
+import type { EmailSender, EmailMessage } from '../auth/ports/email-sender.js';
+export declare class NoopEmailSender implements EmailSender {
+    send(_message: EmailMessage): Promise<void>;
+}
+//# sourceMappingURL=noop-email-sender.d.ts.map

package/dist/authentication/noop-email-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noop-email-sender.d.ts","sourceRoot":"","sources":["../../src/authentication/noop-email-sender.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE/E,qBAAa,eAAgB,YAAW,WAAW;IAC3C,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlD"}

package/dist/authentication/noop-email-sender.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoopEmailSender = void 0;
+class NoopEmailSender {
+    async send(_message) {
+        // Intentionally empty: delivery is disabled by explicit configuration.
+    }
+}
+exports.NoopEmailSender = NoopEmailSender;

package/dist/authz/cross-tenant-grant-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant-writer.d.ts","sourceRoot":"","sources":["../../src/authz/cross-tenant-grant-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAK9E,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,eAA6C,CAAC;AAE3F,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,QAAQ,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,KAClC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,eAAe,CAAC;IACtE,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,+EAA+E;AAC/E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAqCD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB;;;;WAIG;QACH,SAAS,EAAE,gBAAgB,CAAC;QAC5B,oFAAoF;QACpF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAQD;;;;;;;;;OASG;IACG,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAuEpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDpD;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA8CxB;;;;OAIG;YACW,gBAAgB;IAU9B,uGAAuG;YACzF,UAAU;IAqBxB,mEAAmE;YACrD,IAAI;IAalB,wFAAwF;YAC1E,WAAW;CA0B1B"}
+{"version":3,"file":"cross-tenant-grant-writer.d.ts","sourceRoot":"","sources":["../../src/authz/cross-tenant-grant-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAK9E,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,eAA6C,CAAC;AAE3F,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,QAAQ,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,KAClC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,eAAe,CAAC;IACtE,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,+EAA+E;AAC/E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAqCD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB;;;;WAIG;QACH,SAAS,EAAE,gBAAgB,CAAC;QAC5B,oFAAoF;QACpF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAQD;;;;;;;;;OASG;IACG,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAuEpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDpD;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkDxB;;;;OAIG;YACW,gBAAgB;IAU9B,uGAAuG;YACzF,UAAU;IAqBxB,mEAAmE;YACrD,IAAI;IAalB,wFAAwF;YAC1E,WAAW;CA0B1B"}

package/dist/authz/manifest-operation-authority-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-operation-authority-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/manifest-operation-authority-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE/E,yFAAyF;AACzF,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;CACxC;AA6BD,qBAAa,iCAAkC,YAAW,sBAAsB;IAC9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D;;;;;OAKG;gBACS,OAAO,GAAE,SAAS,sBAAsB,EAAO;IAuB3D,yBAAyB,CACvB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,kBAAkB,GAAG,SAAS;CAalC"}
+{"version":3,"file":"manifest-operation-authority-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/manifest-operation-authority-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE/E,yFAAyF;AACzF,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;CACxC;AA6BD,qBAAa,iCAAkC,YAAW,sBAAsB;IAC9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAE3D;;;;;OAKG;gBACS,OAAO,GAAE,SAAS,sBAAsB,EAAO;IAuB3D,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;CAajG"}

package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-cross-tenant-grant-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-cross-tenant-grant-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,cAAc,CAAC;AAGtB,wFAAwF;AACxF,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAKvF,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAsDD;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,oBAAoB;IACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAQ9E,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAwFrF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAgCtB"}
+{"version":3,"file":"mariadb-cross-tenant-grant-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-cross-tenant-grant-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,cAAc,CAAC;AAGtB,wFAAwF;AACxF,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAKvF,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAsDD;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,oBAAoB;IACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAQ9E,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAwFrF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAkCtB"}

package/dist/authz/mariadb-cross-tenant-grant-adapter.js

@@ -254,7 +254,9 @@ class MariaDbCrossTenantGrantAdapter {
             throw new core_1.AuthorizationUnavailableError(`cross_tenant_grant store unavailable resolving owning tenants for ` +
                 `${query.typeKey}:${query.action}: ${err.message}`);
         }
-        return rows.map((r) => r.ctg_owning_tenant_uuid).filter((t) => typeof t === 'string');
+        return rows
+            .map((r) => r.ctg_owning_tenant_uuid)
+            .filter((t) => typeof t === 'string');
     }
 }
 exports.MariaDbCrossTenantGrantAdapter = MariaDbCrossTenantGrantAdapter;

package/dist/authz/mariadb-policy-store.js

@@ -188,7 +188,7 @@ class MariaDbPolicyStore {
                 policy: {
                     typeKey,
                     action: first.rpr_action ?? '',
-                    effect: (first.rpr_effect === 'deny' ? 'deny' : 'allow'),
+                    effect: first.rpr_effect === 'deny' ? 'deny' : 'allow',
                     conditions,
                 },
             });

package/dist/authz/mariadb-record-rule-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-record-rule-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-record-rule-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,UAAU,EACV,eAAe,EAChB,MAAM,cAAc,CAAC;AAGtB,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAKzE,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAsLD;;;GAGG;AACH,qBAAa,kCAAmC,YAAW,wBAAwB;IACjF,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKvD,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;CAuE5D"}
+{"version":3,"file":"mariadb-record-rule-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-record-rule-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG1F,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAKzE,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAmLD;;;GAGG;AACH,qBAAa,kCAAmC,YAAW,wBAAwB;IACjF,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKvD,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;CAuE5D"}

package/dist/authz/mariadb-record-rule-adapter.js

@@ -90,10 +90,7 @@ function orderedCompare(actual, expected) {
         return null;
     const actualNum = Number(actual);
     const expectedNum = Number(expected);
-    const bothNumeric = actual !== '' &&
-        expected !== '' &&
-        Number.isFinite(actualNum) &&
-        Number.isFinite(expectedNum);
+    const bothNumeric = actual !== '' && expected !== '' && Number.isFinite(actualNum) && Number.isFinite(expectedNum);
     if (bothNumeric) {
         return actualNum < expectedNum ? -1 : actualNum > expectedNum ? 1 : 0;
     }

package/dist/authz/permission-version-cache.d.ts

@@ -0,0 +1,38 @@
+import type Redis from 'ioredis';
+/** Redis key prefix for a tenant's permission version. */
+export declare const PERMISSION_VERSION_KEY_PREFIX = "shield:permver:";
+/** Default TTL of a cached version (the bound on a lost publish). */
+export declare const DEFAULT_PERMISSION_VERSION_TTL_MS = 60000;
+/** The read side the gate-5 decorator needs. */
+export interface PermissionVersionReader {
+    /**
+     * The cached version, or `null` on a MISS (no key / unreadable value). A Redis ERROR throws —
+     * the caller fails closed, it never falls back to the DB on an outage.
+     */
+    get(tenantId: string): Promise<number | null>;
+    /** Raise the cached version to at least `version` (monotonic). A Redis error throws. */
+    raise(tenantId: string, version: number): Promise<void>;
+}
+/** The write side the permission-version bumper needs (after its commit). Never throws. */
+export interface PermissionVersionPublisher {
+    publish(tenantId: string, version: number): Promise<void>;
+}
+export interface RedisPermissionVersionCacheOptions {
+    /** TTL of a cached version in ms (default {@link DEFAULT_PERMISSION_VERSION_TTL_MS}). */
+    readonly ttlMs?: number;
+}
+export declare class RedisPermissionVersionCache implements PermissionVersionReader, PermissionVersionPublisher {
+    private readonly redis;
+    private readonly logger;
+    private readonly ttlMs;
+    constructor(redis: Redis, options?: RedisPermissionVersionCacheOptions);
+    get(tenantId: string): Promise<number | null>;
+    raise(tenantId: string, version: number): Promise<void>;
+    /**
+     * Best-effort publish after a committed bump. A failure is logged (no tenant id, no value) and
+     * swallowed: the bump itself is durable, and the TTL bounds how long the old cached version can
+     * be served.
+     */
+    publish(tenantId: string, version: number): Promise<void>;
+}
+//# sourceMappingURL=permission-version-cache.d.ts.map

package/dist/authz/permission-version-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-version-cache.d.ts","sourceRoot":"","sources":["../../src/authz/permission-version-cache.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAEjC,0DAA0D;AAC1D,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D,qEAAqE;AACrE,eAAO,MAAM,iCAAiC,QAAS,CAAC;AAcxD,gDAAgD;AAChD,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9C,wFAAwF;IACxF,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,2FAA2F;AAC3F,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAOD,MAAM,WAAW,kCAAkC;IACjD,yFAAyF;IACzF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,2BACX,YAAW,uBAAuB,EAAE,0BAA0B;IAM5D,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,KAAK,EAAE,KAAK,EAC7B,OAAO,GAAE,kCAAuC;IAS5C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAO7C,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7D;;;;OAIG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAShE"}

package/dist/authz/permission-version-cache.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisPermissionVersionCache = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = void 0;
+/**
+ * The Redis-held permission version (ADR-0035, GAPS #6). Gate 5 compares a session's cached facts
+ * against the tenant's CURRENT permission version on every classified request; reading it from
+ * MariaDB put a DB query on the request path (invariant #12). This cache holds the version under
+ * `shield:permver:<tenantId>`:
+ *
+ *  - MariaDB `shield_authz.authz_permission_version` stays the source of truth.
+ *  - WRITES ARE MONOTONIC: one Lua script sets the value only when the key is absent or holds a
+ *    LOWER version, so an out-of-order write (a reader refilling an older value, two bumps
+ *    publishing in reverse) can never move the cached version backwards and hide a bump.
+ *  - Every write sets a TTL (default 60 s). A lost publish therefore delays a bump by at most the
+ *    TTL; the next miss refills from the DB.
+ *
+ * The bumper (identity) publishes after its commit; the gate-5 decorator (`wire-record-
+ * authorization.ts`) reads, refills on a miss, and fails closed on an error. This file is
+ * deliberately free of runtime `@astram/core` imports (it is constructed in `AuthModule`).
+ *
+ * ⛔ No secret here: tenant ids and integers only. Logs carry no tenant id.
+ */
+const common_1 = require("@nestjs/common");
+/** Redis key prefix for a tenant's permission version. */
+exports.PERMISSION_VERSION_KEY_PREFIX = 'shield:permver:';
+/** Default TTL of a cached version (the bound on a lost publish). */
+exports.DEFAULT_PERMISSION_VERSION_TTL_MS = 60_000;
+/** `SET` the version only when the key is absent, unreadable, or LOWER. Returns 1 when written. */
+const RAISE_SCRIPT = `
+local cur = redis.call('GET', KEYS[1])
+local n = tonumber(ARGV[1])
+local c = cur and tonumber(cur)
+if (not c) or c < n then
+  redis.call('SET', KEYS[1], ARGV[1], 'PX', ARGV[2])
+  return 1
+end
+return 0
+`;
+/** A valid version: a non-negative safe integer. */
+function isVersion(v) {
+    return typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+}
+class RedisPermissionVersionCache {
+    redis;
+    logger = new common_1.Logger('ShieldPermissionVersion');
+    ttlMs;
+    constructor(redis, options = {}) {
+        this.redis = redis;
+        const ttl = options.ttlMs;
+        this.ttlMs =
+            ttl !== undefined && Number.isSafeInteger(ttl) && ttl > 0
+                ? ttl
+                : exports.DEFAULT_PERMISSION_VERSION_TTL_MS;
+    }
+    async get(tenantId) {
+        const raw = await this.redis.get(`${exports.PERMISSION_VERSION_KEY_PREFIX}${tenantId}`);
+        if (raw === null)
+            return null;
+        const v = Number(raw);
+        return isVersion(v) ? v : null;
+    }
+    async raise(tenantId, version) {
+        if (!isVersion(version))
+            return;
+        await this.redis.eval(RAISE_SCRIPT, 1, `${exports.PERMISSION_VERSION_KEY_PREFIX}${tenantId}`, String(version), String(this.ttlMs));
+    }
+    /**
+     * Best-effort publish after a committed bump. A failure is logged (no tenant id, no value) and
+     * swallowed: the bump itself is durable, and the TTL bounds how long the old cached version can
+     * be served.
+     */
+    async publish(tenantId, version) {
+        try {
+            await this.raise(tenantId, version);
+        }
+        catch {
+            this.logger.warn('permission version publish to Redis failed; cached sessions refresh within the version TTL');
+        }
+    }
+}
+exports.RedisPermissionVersionCache = RedisPermissionVersionCache;

package/dist/authz/wire-record-authorization.d.ts

@@ -24,6 +24,7 @@
  *    consumer opts into `recordAuthorization`. This file (and thus core) loads only then.
  */
 import type { DecisionAuthority, ModuleRegistry, PermissionFactsPort, Principal, SessionFactsReader } from '@astram/core';
+import type { PermissionVersionReader } from './permission-version-cache.js';
 import type { ObjectType } from '@astram/engine';
 import { type RuleQueryable } from './mariadb-record-rule-adapter.js';
 import { type OperationManifestEntry } from './manifest-operation-authority-adapter.js';
@@ -63,7 +64,30 @@ export interface RecordAuthorizationInputs {
  * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
  * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
  */
-export declare function buildRecordAuthorization(inputs: RecordAuthorizationInputs): DecisionAuthority;
+/**
+ * Wrap the app's {@link PermissionFactsPort} so gate 5 reads the tenant's CURRENT permission version
+ * from Redis (ADR-0035, GAPS #6 — invariant #12: the request path is Redis-only):
+ *
+ *  - HIT → that version; the app port (a DB read) is not called.
+ *  - MISS (no key: first use, TTL expiry, a Redis restart) → the app port answers from the source of
+ *    truth and the value is written back (monotonic). A miss is "Redis answered: no key", so this is
+ *    a cache fill, not an outage fallback.
+ *  - Redis ERROR → {@link AuthorizationUnavailableError} (fail closed; never served from the DB).
+ *
+ * `loadCoarseGrants` is delegated unchanged, and its version is written back too (it was read from
+ * the DB at the same moment), so a reload also warms the cache. Write-backs are best-effort.
+ */
+export declare function withRedisPermissionVersion(port: PermissionFactsPort, cache: PermissionVersionReader): PermissionFactsPort;
+/** Options for {@link buildRecordAuthorization} (all optional, additive). */
+export interface BuildRecordAuthorizationOptions {
+    /**
+     * The Redis permission-version cache (ADR-0035). Given → gate 5 reads the version from Redis
+     * (see {@link withRedisPermissionVersion}). Absent (no Redis: `auth: false`) → the app port's
+     * own version read, unchanged.
+     */
+    readonly versionCache?: PermissionVersionReader;
+}
+export declare function buildRecordAuthorization(inputs: RecordAuthorizationInputs, options?: BuildRecordAuthorizationOptions): DecisionAuthority;
 /**
  * The engine-facing list-scope fn (Task 2.2). Given the engine's registered
  * {@link ObjectType}, the requesting {@link Principal}, and the list action key, it returns

package/dist/authz/wire-record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,yBAAyB,GAAG,iBAAiB,CAmB7F;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAkE/E"}
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAM1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA2BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAuE/E"}

package/dist/authz/wire-record-authorization.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.withRedisPermissionVersion = withRedisPermissionVersion;
 exports.buildRecordAuthorization = buildRecordAuthorization;
 exports.buildListScopeFn = buildListScopeFn;
 const core_1 = require("@astram/core");
@@ -8,6 +9,7 @@ const mariadb_record_share_adapter_js_1 = require("./mariadb-record-share-adapte
 const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-grant-adapter.js");
 const mariadb_list_scope_adapter_js_1 = require("./mariadb-list-scope-adapter.js");
 const list_scope_sql_js_1 = require("./list-scope-sql.js");
+const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
 const manifest_operation_authority_adapter_js_1 = require("./manifest-operation-authority-adapter.js");
 /**
  * Construct the four framework-owned record-tier adapters over the supplied pool +
@@ -15,10 +17,61 @@ const manifest_operation_authority_adapter_js_1 = require("./manifest-operation-
  * to what the consumer's `buildDecisionAuthority` did before Phase 5 (same adapters, same
  * pool, same registry, same ports) — this is a wiring MOVE, not a logic change.
  */
-function buildRecordAuthorization(inputs) {
+/**
+ * Wrap the app's {@link PermissionFactsPort} so gate 5 reads the tenant's CURRENT permission version
+ * from Redis (ADR-0035, GAPS #6 — invariant #12: the request path is Redis-only):
+ *
+ *  - HIT → that version; the app port (a DB read) is not called.
+ *  - MISS (no key: first use, TTL expiry, a Redis restart) → the app port answers from the source of
+ *    truth and the value is written back (monotonic). A miss is "Redis answered: no key", so this is
+ *    a cache fill, not an outage fallback.
+ *  - Redis ERROR → {@link AuthorizationUnavailableError} (fail closed; never served from the DB).
+ *
+ * `loadCoarseGrants` is delegated unchanged, and its version is written back too (it was read from
+ * the DB at the same moment), so a reload also warms the cache. Write-backs are best-effort.
+ */
+function withRedisPermissionVersion(port, cache) {
+    const warm = async (tenantId, version) => {
+        try {
+            await cache.raise(tenantId, version);
+        }
+        catch {
+            // Best-effort: the answer already came from the source of truth.
+        }
+    };
+    return {
+        currentPermissionsVersion: async (principalId, tenantId) => {
+            let cached;
+            try {
+                cached = await cache.get(tenantId);
+            }
+            catch (cause) {
+                throw new core_1.AuthorizationUnavailableError('permission version cache unavailable', cause);
+            }
+            if (cached !== null)
+                return cached;
+            const version = await port.currentPermissionsVersion(principalId, tenantId);
+            await warm(tenantId, version);
+            return version;
+        },
+        loadCoarseGrants: async (principalId, tenantId) => {
+            const grants = await port.loadCoarseGrants(principalId, tenantId);
+            await warm(tenantId, grants.permissionsVersion);
+            return grants;
+        },
+    };
+}
+function buildRecordAuthorization(inputs, options = {}) {
+    const facts = options.versionCache !== undefined
+        ? withRedisPermissionVersion(inputs.permissionFacts, options.versionCache)
+        : inputs.permissionFacts;
     return (0, core_1.createWiredDecisionAuthority)({
         registry: inputs.registry,
-        permissionFacts: inputs.permissionFacts,
+        // The app-owned port, wrapped so a gate-5 reload inside an enforcement request notifies the
+        // guard (security hardening Phase 1C: a permission-version move re-derives the session's
+        // scope subtree; ADR-0035: the reloaded grants and live roles are rebound). Results, errors
+        // and decisions are unchanged.
+        permissionFacts: (0, session_facts_als_js_1.signalGateFiveReloads)(facts),
         sessionFacts: inputs.sessionFacts,
         // ── The FOUR framework-owned record-tier adapters — constructed HERE, and ONLY here.
         // Record-permit ADMIN rules over `shield_authz.record_permission_rule` (widen the

package/dist/completeness/catalog-reconciler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-reconciler.d.ts","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E;iFACiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAgB5E;;;;OAIG;IACG,SAAS,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAoCzG"}
+{"version":3,"file":"catalog-reconciler.d.ts","sourceRoot":"","sources":["../../src/completeness/catalog-reconciler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E;iFACiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAgB5E;;;;OAIG;IACG,SAAS,CACb,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC;CAoC5B"}

package/dist/config/app-config.d.ts

@@ -23,6 +23,7 @@
  *   8 × (12 + 8 + 1) + 40 = 208 ≤ 250  ✓
  * ─────────────────────────────────────────────────────────────────────────────
  */
+import type { SecretsProvider } from '@astram/core';
 export interface AppConfig {
     /** HTTP port the Nest app listens on. */
     readonly port: number;
@@ -60,7 +61,20 @@ export interface AppConfig {
      * `createSessionAuthority({ lifetimes })`.
      */
     readonly lifetimes: SessionLifetimeOverrides;
+    /**
+     * Per-client-IP password-login FAILURE limit (security hardening #5, plan D3). Optional
+     * so hand-built configs keep compiling; absent ⇒ {@link DEFAULT_LOGIN_IP_LIMIT}
+     * (50 failures / 15 min). Read from `LOGIN_IP_MAX_FAILURES` / `LOGIN_IP_WINDOW_MS`.
+     */
+    readonly loginIpLimit?: LoginIpLimitConfig;
 }
+/** The per-client-IP login failure limit (failures within `windowMs` that lock the IP). */
+export interface LoginIpLimitConfig {
+    readonly maxAttempts: number;
+    readonly windowMs: number;
+}
+/** Plan D3 default: 50 failed logins per client IP per 15 minutes. */
+export declare const DEFAULT_LOGIN_IP_LIMIT: LoginIpLimitConfig;
 /**
  * The runtime MariaDB connection descriptor. Non-secret host/port/user/database
  * plus the account password (a secret — supplied via env/secrets-manager, NEVER
@@ -85,7 +99,15 @@ export interface DbConfig {
 export interface RedisConfig {
     /** Full connection url (`redis://[:password@]host:port[/db]`). Preferred. */
     readonly url: string;
+    /**
+     * Per-command timeout in ms (GAPS #7, `REDIS_COMMAND_TIMEOUT_MS`, default
+     * {@link DEFAULT_REDIS_COMMAND_TIMEOUT_MS}). Bounds how long the request path waits on an
+     * unreachable Redis before it fails closed. Optional (absent → the default).
+     */
+    readonly commandTimeoutMs?: number;
 }
+/** Default Redis per-command timeout (GAPS #7): the request path fails closed within ~2 s. */
+export declare const DEFAULT_REDIS_COMMAND_TIMEOUT_MS = 2000;
 /**
  * Optional per-deployment overrides for the three ADR-0015 session lifetimes.
  * Shape mirrors `@astram/core`'s `Partial<SessionLifetimeConfig>` so it is passed
@@ -143,6 +165,13 @@ export interface RuntimeAccountPools {
 export declare const DEFAULT_POOL_BUDGET: PoolBudgetConfig;
 /** Upper bound the schema-service pool must never exceed (ADR-0018 §2: 1–2). */
 export declare const SCHEMA_SVC_POOL_HARD_CAP = 2;
+/**
+ * `true` ONLY when the RAW `NODE_ENV` is explicitly `'development'` or `'test'`.
+ * Unset, blank, `'production'`, `'staging'` or anything else ⇒ `false`. Used to gate
+ * dev-only defaults that would leak secrets in a real deployment (fail closed: an
+ * unset NODE_ENV is treated as "not dev").
+ */
+export declare function isDevOrTestNodeEnv(raw: string | undefined): boolean;
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
@@ -187,6 +216,14 @@ export declare function loadRedisConfig(env?: NodeJS.ProcessEnv): RedisConfig;
  *   refreshAbsoluteCapMs ← REFRESH_ABSOLUTE_CAP_MS
  */
 export declare function loadSessionLifetimes(env?: NodeJS.ProcessEnv): SessionLifetimeOverrides;
+/**
+ * Build the per-client-IP login failure limit from env (plan D3). Each field falls back
+ * to {@link DEFAULT_LOGIN_IP_LIMIT} when absent/blank/invalid.
+ * Field ↔ env name:
+ *   maxAttempts ← LOGIN_IP_MAX_FAILURES   (default 50)
+ *   windowMs    ← LOGIN_IP_WINDOW_MS      (default 900000 = 15 min)
+ */
+export declare function loadLoginIpLimit(env?: NodeJS.ProcessEnv): LoginIpLimitConfig;
 /**
  * Read the refresh-token HMAC key from env (raw; `''` when absent/blank). Total —
  * does NOT throw, so {@link loadAppConfig} stays boot-safe for a non-auth scaffold.
@@ -222,6 +259,21 @@ export declare function assertRefreshHmacKey(key: string): string;
  * auth-composition time (see its doc).
  */
 export declare function loadAppConfig(env?: NodeJS.ProcessEnv): AppConfig;
+/**
+ * ADR-0032 secrets integration — build the {@link AppConfig} AFTER resolving any `secret-ref:<path>`
+ * env references via the injected `SecretsProvider`, so an app can hold only REFERENCES in its env
+ * (safe to commit/log) and the real credentials are fetched at boot.
+ *
+ * - With a `provider`: every `secret-ref:` value in `env` is resolved (fail-closed — a missing
+ *   reference aborts boot; a value is never logged), producing a resolved env the pure
+ *   {@link loadAppConfig} consumes unchanged.
+ * - Without a `provider`: identical to `loadAppConfig(env)` — literal env, unchanged behaviour
+ *   (backward compatible; references would pass through as literals, which fail loudly at connect
+ *   time rather than silently — the operator is expected to wire a provider when using references).
+ *
+ * The core resolver (`resolveSecretRefs`) does the work; this is the guard-side boot seam.
+ */
+export declare function loadAppConfigAsync(provider?: SecretsProvider, env?: NodeJS.ProcessEnv): Promise<AppConfig>;
 /** Result of evaluating a {@link PoolBudgetConfig} against the ADR-0018 budget. */
 export interface PoolBudgetEvaluation {
     /** Σ(per-account runtime pool max) for a single worker. */

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAwB1C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAajF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAU7E;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAaD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAQ3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAW7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}