@astram/guard 0.7.0 → 0.9.0

package/dist/index.d.ts

@@ -25,7 +25,7 @@ export { CatalogReconciler, CatalogGatabilityError } from './completeness/catalo
 export type { CatalogStore, CatalogPermissionRow, ReconcileReport, } from './completeness/ports/catalog-store.js';
 export { SHIELD_SESSION_TOKEN_BINDER, SHIELD_SERVICE_AUTHENTICATOR, } from './request-auth/tokens.js';
 export { SessionTokenBinder } from './request-auth/session-token-binder.js';
-export type { BoundPrincipalClaims } from './request-auth/session-token-binder.js';
+export type { BoundPrincipalClaims, SessionTokenBinderOptions, } from './request-auth/session-token-binder.js';
 export { resolveRequestPrincipal, resolveRequestAuth, principalFromClaims, extractBearerToken, isApiKey, } from './request-auth/request-principal.js';
 export { MariaDbApiKeyStore } from './authentication/mariadb-api-key-store.js';
 export { SHIELD_SESSION_FACTS_ALS, NO_SESSION_FACTS, type SessionFactsStore, } from './request-auth/session-facts-als.js';
@@ -34,7 +34,7 @@ export { stubDecisionAuthority, type Effect, type CoreDecisionAuthority, type Co
 export { Argon2idPasswordHasher, argon2idHasherProvider, SHIELD_PASSWORD_HASHER, type Argon2idParams, } from './authentication/argon2id-password-hasher.js';
 export { LocalKekCrypto } from './encryption/local-kek-crypto.js';
 export { EncryptedFileSecretsProvider } from './secrets/encrypted-file-secrets.js';
-export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, } from './session/index.js';
+export { MariaDbSessionRecordStore, SHIELD_SESSION_RECORD_STORE, RedisHotSessionStore, SHIELD_HOT_SESSION_STORE, CryptoTokenGenerator, Sha256RefreshTokenHasher, SystemClock, cryptoTokenGeneratorProvider, refreshHasherProvider, systemClockProvider, SHIELD_TOKEN_GENERATOR, SHIELD_REFRESH_HASHER, SHIELD_CLOCK, HotRevokingSessionRecordStore, type SessionHotRevoker, type LineageSessionLookup, SHIELD_SESSION_LIFETIMES, ROTATE_GRACE_MS, accessBindingTtlMs, } from './session/index.js';
 export { MariaDbRecordPermissionRuleAdapter, SHIELD_RECORD_RULE_PORT, type RuleQueryable, } from './authz/mariadb-record-rule-adapter.js';
 export { MariaDbPolicyStore, SHIELD_POLICY_STORE, type RuleQueryable as PolicyStoreQueryable, } from './authz/mariadb-policy-store.js';
 export { MariaDbListScopeAdapter, SHIELD_LIST_SCOPE_PORT, type ListScopeQueryable, } from './authz/mariadb-list-scope-adapter.js';
@@ -46,17 +46,21 @@ export { MariaDbCrossTenantGrantAdapter, SHIELD_CROSS_TENANT_GRANT_PORT, type Gr
 export { CrossTenantGrantWriter, SHIELD_CROSS_TENANT_GRANT_WRITER, GrantNotPermittedError, InvalidGrantError, GrantStoreUnavailableError, type GrantAuthorizeFn, type GrantAuditEvent, type GrantAuditSink, type GrantGranteeKind, type GrantScope, type OfferGrantInput, type AcceptGrantInput, type RevokeGrantInput, } from './authz/cross-tenant-grant-writer.js';
 export { ManifestOperationAuthorityAdapter, SHIELD_OPERATION_AUTHORITY_PORT, type OperationManifestEntry, } from './authz/manifest-operation-authority-adapter.js';
 export { buildRecordAuthorization } from './authz/wire-record-authorization.js';
+export { withRedisPermissionVersion, type BuildRecordAuthorizationOptions, } from './authz/wire-record-authorization.js';
+export { RedisPermissionVersionCache, PERMISSION_VERSION_KEY_PREFIX, DEFAULT_PERMISSION_VERSION_TTL_MS, type PermissionVersionReader, type PermissionVersionPublisher, type RedisPermissionVersionCacheOptions, } from './authz/permission-version-cache.js';
+export { SHIELD_PERMISSION_VERSION_CACHE } from './auth/tokens.js';
+export { SHIELD_SESSION_RESTRICTIONS } from './auth/tokens.js';
+export { MariaDbSessionRestrictionStore, type SessionRestrictionStore, type SessionRebuildFacts, } from './session/session-restriction-store.js';
 export { buildListScopeFn, type ListScopeFn } from './authz/wire-record-authorization.js';
 export { BootSequence, assertPoolBudget } from './boot/boot-sequence.js';
 export { APP_CONFIG } from './config/config.module.js';
-export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, } from './config/app-config.js';
-export { SHIELD_DB_POOL, SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
+export { loadAppConfig, loadPoolBudget, evaluatePoolBudget, DEFAULT_POOL_BUDGET, SCHEMA_SVC_POOL_HARD_CAP, type AppConfig, type PoolBudgetConfig, type PoolBudgetEvaluation, type RuntimeAccountPools, loadDbConfig, loadRedisConfig, loadSessionLifetimes, loadRefreshHmacKey, assertRefreshHmacKey, DEFAULT_DB_CONFIG, DEFAULT_REDIS_URL, type DbConfig, type RedisConfig, type SessionLifetimeOverrides, loadLoginIpLimit, DEFAULT_LOGIN_IP_LIMIT, isDevOrTestNodeEnv, type LoginIpLimitConfig, } from './config/app-config.js';
+export { SHIELD_REDIS, SHIELD_CREDENTIAL_RESOLVER, SHIELD_PROFILE_RESOLVER, SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY, SHIELD_CREDENTIAL_WRITER, SHIELD_RESET_TOKEN_STORE, SHIELD_EMAIL_SENDER, SHIELD_RECOVERY_CODE_STORE, SHIELD_PROFILE_WRITER, SHIELD_SESSION_SWEEPER, SHIELD_AUDIT_SINK, SHIELD_MFA_DEVICE_STORE, SHIELD_TOTP_VERIFIER_OVERRIDE, } from './auth/tokens.js';
 export { MariaDbCredentialResolver } from './authentication/mariadb-credential-resolver.js';
 export type { SessionView, SessionTokensView, SessionSuccess, LoginRequest, MfaChallengeResponse, LoginResponse, MfaRequest, MfaResponse, RefreshRequest, RefreshResponse, LogoutRequest, LogoutAck, } from './auth/dto.js';
-export { PersistenceModule } from './auth/persistence.module.js';
 export { AuthModule, type AuthModuleOptions } from './auth/auth.module.js';
 export { makeDefaultTotpVerifier, resolveTotpVerifier, hmacSha1 } from './auth/auth.module.js';
-export type { CredentialResolver, ResolvedCredential, RequiredFactor, } from '@astram/core';
+export type { CredentialResolver, ResolvedCredential, RequiredFactor } from '@astram/core';
 export type { FactorVerifier, FactorVerdict, Credential } from '@astram/core';
 export type { ProfileResolver, CurrentUserProfile, ProfileRole, ProfileTenant, } from './auth/profile-resolver.js';
 export type { CredentialWriter } from './auth/ports/credential-writer.js';
@@ -72,7 +76,9 @@ export { SHIELD_SESSION_FACTS_PROJECTOR } from './auth/tokens.js';
 export type { ScopeSubtreeResolver } from './auth/ports/scope-subtree-resolver.js';
 export { SHIELD_SCOPE_SUBTREE_RESOLVER } from './auth/tokens.js';
 export { AuthController } from './auth/auth.controller.js';
-export { PendingMfaStore } from './auth/pending-mfa-store.js';
+export { PendingMfaStore, RedisPendingMfaStore, type PendingMfaChallenge, } from './auth/pending-mfa-store.js';
+export { CredentialMfaStepUp, credentialFingerprint, challengeMatches, type MfaStepUp, type MfaStepUpResult, } from './auth/mfa-step-up.js';
+export { SHIELD_MFA_LIMITER, SHIELD_MFA_STEP_UP, SHIELD_LOGIN_TOTP_VERIFIER, } from './auth/tokens.js';
 export { generateTotpSecret, buildOtpauthUri, generateRecoveryCodes, } from './auth/totp-enrollment.js';
 export { AccountController } from './auth/account.controller.js';
 export { buildClosureRows, ScopeCycleError, ScopeDepthError, ScopeUnknownParentError, type ScopeEdge, type ClosureRow, } from './scope/closure-builder.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAKtD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,GAC9B,MAAM,wBAAwB,CAAC;AAchC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAKvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AAQtB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAK9D,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAQjE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAG1F,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAI7B,KAAK,yBAAyB,GAC/B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAKhF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjG,YAAY,EACV,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAChB,MAAM,uCAAuC,CAAC;AAM/C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,QAAQ,GACT,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAS/E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,qCAAqC,CAAC;AAU7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AAKnF,OAAO,EACL,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,cAAc,GACpB,MAAM,8CAA8C,CAAC;AAKtD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAKlE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAOnF,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,WAAW,EACX,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EAEZ,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAEzB,wBAAwB,EACxB,eAAe,EACf,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,KAAK,aAAa,GACnB,MAAM,wCAAwC,CAAC;AAShD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,IAAI,oBAAoB,GAC3C,MAAM,iCAAiC,CAAC;AAUzC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,cAAc,GACpB,MAAM,yCAAyC,CAAC;AASjD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,cAAc,GACpB,MAAM,+CAA+C,CAAC;AAWvD,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,sCAAsC,CAAC;AAQ9C,OAAO,EACL,iCAAiC,EACjC,+BAA+B,EAC/B,KAAK,sBAAsB,GAC5B,MAAM,iDAAiD,CAAC;AAYzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAChF,OAAO,EACL,0BAA0B,EAC1B,KAAK,+BAA+B,GACrC,MAAM,sCAAsC,CAAC;AAM9C,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,kCAAkC,GACxC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EACL,8BAA8B,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,wCAAwC,CAAC;AAOhD,OAAO,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAI1F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAOzE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EACL,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,wBAAwB,EAG7B,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAehC,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,uBAAuB,EACvB,oBAAoB,EACpB,wBAAwB,EAIxB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EAEtB,iBAAiB,EAEjB,uBAAuB,EAEvB,6BAA6B,GAC9B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAI5F,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAS/F,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQ3F,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM9E,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,aAAa,GACd,MAAM,4BAA4B,CAAC;AAMpC,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClF,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAMlE,YAAY,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAQjE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,4BAA4B,CAAC"}

package/dist/index.js

@@ -16,9 +16,9 @@
  * `@nestjs/core`, `reflect-metadata`, `rxjs` so the host owns one copy of each.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsFor = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
-exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.SHIELD_DB_POOL = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = void 0;
-exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.PersistenceModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = void 0;
+exports.accessBindingTtlMs = exports.ROTATE_GRACE_MS = exports.SHIELD_SESSION_LIFETIMES = exports.HotRevokingSessionRecordStore = exports.SHIELD_CLOCK = exports.SHIELD_REFRESH_HASHER = exports.SHIELD_TOKEN_GENERATOR = exports.systemClockProvider = exports.refreshHasherProvider = exports.cryptoTokenGeneratorProvider = exports.SystemClock = exports.Sha256RefreshTokenHasher = exports.CryptoTokenGenerator = exports.SHIELD_HOT_SESSION_STORE = exports.RedisHotSessionStore = exports.SHIELD_SESSION_RECORD_STORE = exports.MariaDbSessionRecordStore = exports.EncryptedFileSecretsProvider = exports.LocalKekCrypto = exports.SHIELD_PASSWORD_HASHER = exports.argon2idHasherProvider = exports.Argon2idPasswordHasher = exports.stubDecisionAuthority = exports.GlobalEnforcementGuard = exports.NO_SESSION_FACTS = exports.SHIELD_SESSION_FACTS_ALS = exports.MariaDbApiKeyStore = exports.isApiKey = exports.extractBearerToken = exports.principalFromClaims = exports.resolveRequestAuth = exports.resolveRequestPrincipal = exports.SessionTokenBinder = exports.SHIELD_SERVICE_AUTHENTICATOR = exports.SHIELD_SESSION_TOKEN_BINDER = exports.CatalogGatabilityError = exports.CatalogReconciler = exports.OperationInventoryScanner = exports.normalizeClassification = exports.DEFAULT_CLASSIFIED_ACTION = exports.CLASSIFICATION_METADATA = exports.Classified = exports.Public = exports.SHIELD_DECISION_AUTHORITY = exports.ShieldModule = exports.actionsFor = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = exports.buildIdentityModuleRegistry = exports.guardMigrationsDir = void 0;
+exports.DEFAULT_LOGIN_IP_LIMIT = exports.loadLoginIpLimit = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.assertRefreshHmacKey = exports.loadRefreshHmacKey = exports.loadSessionLifetimes = exports.loadRedisConfig = exports.loadDbConfig = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.evaluatePoolBudget = exports.loadPoolBudget = exports.loadAppConfig = exports.APP_CONFIG = exports.assertPoolBudget = exports.BootSequence = exports.buildListScopeFn = exports.MariaDbSessionRestrictionStore = exports.SHIELD_SESSION_RESTRICTIONS = exports.SHIELD_PERMISSION_VERSION_CACHE = exports.DEFAULT_PERMISSION_VERSION_TTL_MS = exports.PERMISSION_VERSION_KEY_PREFIX = exports.RedisPermissionVersionCache = exports.withRedisPermissionVersion = exports.buildRecordAuthorization = exports.SHIELD_OPERATION_AUTHORITY_PORT = exports.ManifestOperationAuthorityAdapter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = exports.CrossTenantGrantWriter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = exports.MariaDbCrossTenantGrantAdapter = exports.makeShareDeleteCascade = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = exports.RecordShareWriter = exports.SHIELD_RECORD_SHARE_PORT = exports.MariaDbRecordShareAdapter = exports.UnknownScopeFieldError = exports.translateListScope = exports.SHIELD_LIST_SCOPE_PORT = exports.MariaDbListScopeAdapter = exports.SHIELD_POLICY_STORE = exports.MariaDbPolicyStore = exports.SHIELD_RECORD_RULE_PORT = exports.MariaDbRecordPermissionRuleAdapter = void 0;
+exports.ScopeUnknownParentError = exports.ScopeDepthError = exports.ScopeCycleError = exports.buildClosureRows = exports.AccountController = exports.generateRecoveryCodes = exports.buildOtpauthUri = exports.generateTotpSecret = exports.SHIELD_LOGIN_TOTP_VERIFIER = exports.SHIELD_MFA_STEP_UP = exports.SHIELD_MFA_LIMITER = exports.challengeMatches = exports.credentialFingerprint = exports.CredentialMfaStepUp = exports.RedisPendingMfaStore = exports.PendingMfaStore = exports.AuthController = exports.SHIELD_SCOPE_SUBTREE_RESOLVER = exports.SHIELD_SESSION_FACTS_PROJECTOR = exports.hmacSha1 = exports.resolveTotpVerifier = exports.makeDefaultTotpVerifier = exports.AuthModule = exports.MariaDbCredentialResolver = exports.SHIELD_TOTP_VERIFIER_OVERRIDE = exports.SHIELD_MFA_DEVICE_STORE = exports.SHIELD_AUDIT_SINK = exports.SHIELD_SESSION_SWEEPER = exports.SHIELD_PROFILE_WRITER = exports.SHIELD_RECOVERY_CODE_STORE = exports.SHIELD_EMAIL_SENDER = exports.SHIELD_RESET_TOKEN_STORE = exports.SHIELD_CREDENTIAL_WRITER = exports.SHIELD_SESSION_AUTHORITY = exports.SHIELD_AUTHENTICATOR = exports.SHIELD_PROFILE_RESOLVER = exports.SHIELD_CREDENTIAL_RESOLVER = exports.SHIELD_REDIS = exports.isDevOrTestNodeEnv = void 0;
 // Framework authz migrations (shield_authz DDL — permission / role_permission /
 // authz_permission_version). Absolute path a consumer's `@astram/migrate` setup merges in.
 var migrations_dir_js_1 = require("./migrations-dir.js");
@@ -136,6 +136,12 @@ Object.defineProperty(exports, "systemClockProvider", { enumerable: true, get: f
 Object.defineProperty(exports, "SHIELD_TOKEN_GENERATOR", { enumerable: true, get: function () { return index_js_1.SHIELD_TOKEN_GENERATOR; } });
 Object.defineProperty(exports, "SHIELD_REFRESH_HASHER", { enumerable: true, get: function () { return index_js_1.SHIELD_REFRESH_HASHER; } });
 Object.defineProperty(exports, "SHIELD_CLOCK", { enumerable: true, get: function () { return index_js_1.SHIELD_CLOCK; } });
+// Security hardening M-A: durable revoke → Redis unbind decorator.
+Object.defineProperty(exports, "HotRevokingSessionRecordStore", { enumerable: true, get: function () { return index_js_1.HotRevokingSessionRecordStore; } });
+// Security hardening #8: the resolved lifetimes token + the access-binding TTL rule.
+Object.defineProperty(exports, "SHIELD_SESSION_LIFETIMES", { enumerable: true, get: function () { return index_js_1.SHIELD_SESSION_LIFETIMES; } });
+Object.defineProperty(exports, "ROTATE_GRACE_MS", { enumerable: true, get: function () { return index_js_1.ROTATE_GRACE_MS; } });
+Object.defineProperty(exports, "accessBindingTtlMs", { enumerable: true, get: function () { return index_js_1.accessBindingTtlMs; } });
 // The record-permit ADMIN-rule adapter (ADR-0003 / design §5.1): the concrete
 // `RecordPermissionRulePort` over the `record_permission_rule` table. Reads ADMIN
 // rules only; the framework-owned OWNER baseline is core's job (not a row here). An
@@ -237,13 +243,31 @@ Object.defineProperty(exports, "SHIELD_OPERATION_AUTHORITY_PORT", { enumerable:
 // enforcement-only path core-free.
 var wire_record_authorization_js_1 = require("./authz/wire-record-authorization.js");
 Object.defineProperty(exports, "buildRecordAuthorization", { enumerable: true, get: function () { return wire_record_authorization_js_1.buildRecordAuthorization; } });
+var wire_record_authorization_js_2 = require("./authz/wire-record-authorization.js");
+Object.defineProperty(exports, "withRedisPermissionVersion", { enumerable: true, get: function () { return wire_record_authorization_js_2.withRedisPermissionVersion; } });
+// The Redis-held permission version (ADR-0035, GAPS #6): gate 5 reads `shield:permver:<tenant>`
+// instead of MariaDB; `@astram/identity`'s bumper publishes to it after commit (injecting
+// `SHIELD_PERMISSION_VERSION_CACHE`, provided by the auth surface under `auth: true`). Monotonic
+// writes, TTL-bounded; a Redis error on the read fails closed.
+var permission_version_cache_js_1 = require("./authz/permission-version-cache.js");
+Object.defineProperty(exports, "RedisPermissionVersionCache", { enumerable: true, get: function () { return permission_version_cache_js_1.RedisPermissionVersionCache; } });
+Object.defineProperty(exports, "PERMISSION_VERSION_KEY_PREFIX", { enumerable: true, get: function () { return permission_version_cache_js_1.PERMISSION_VERSION_KEY_PREFIX; } });
+Object.defineProperty(exports, "DEFAULT_PERMISSION_VERSION_TTL_MS", { enumerable: true, get: function () { return permission_version_cache_js_1.DEFAULT_PERMISSION_VERSION_TTL_MS; } });
+var tokens_js_2 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_PERMISSION_VERSION_CACHE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PERMISSION_VERSION_CACHE; } });
+// Durable session restrictions (Phase 3B review P1): the recovery-login re-enroll marker on the
+// durable session + the account status the refresh-time rebuild checks.
+var tokens_js_3 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_RESTRICTIONS", { enumerable: true, get: function () { return tokens_js_3.SHIELD_SESSION_RESTRICTIONS; } });
+var session_restriction_store_js_1 = require("./session/session-restriction-store.js");
+Object.defineProperty(exports, "MariaDbSessionRestrictionStore", { enumerable: true, get: function () { return session_restriction_store_js_1.MariaDbSessionRestrictionStore; } });
 // The LIST-FORM sibling (Task 2.2): the engine-facing `ListScopeFn` the module wiring hands
 // to the engine's `list()` (Task 3.1). `buildListScopeFn` is a SEPARATE factory (Option A)
 // that takes the SAME `RecordAuthorizationInputs` and constructs its `MariaDbListScopeAdapter`
 // over the SAME un-overridable `inputs.pool` — the adapter is NOT a field of the inputs, so a
 // consumer cannot inject a fail-open scope port. Fail-closed: a transient throw PROPAGATES.
-var wire_record_authorization_js_2 = require("./authz/wire-record-authorization.js");
-Object.defineProperty(exports, "buildListScopeFn", { enumerable: true, get: function () { return wire_record_authorization_js_2.buildListScopeFn; } });
+var wire_record_authorization_js_3 = require("./authz/wire-record-authorization.js");
+Object.defineProperty(exports, "buildListScopeFn", { enumerable: true, get: function () { return wire_record_authorization_js_3.buildListScopeFn; } });
 // Boot infrastructure (ADR-0018 connection-pool budget assertion). `BootModule`
 // itself is NOT exported — it is composed internally by `ShieldModule.forRoot()`.
 var boot_sequence_js_1 = require("./boot/boot-sequence.js");
@@ -271,6 +295,11 @@ Object.defineProperty(exports, "loadRefreshHmacKey", { enumerable: true, get: fu
 Object.defineProperty(exports, "assertRefreshHmacKey", { enumerable: true, get: function () { return app_config_js_1.assertRefreshHmacKey; } });
 Object.defineProperty(exports, "DEFAULT_DB_CONFIG", { enumerable: true, get: function () { return app_config_js_1.DEFAULT_DB_CONFIG; } });
 Object.defineProperty(exports, "DEFAULT_REDIS_URL", { enumerable: true, get: function () { return app_config_js_1.DEFAULT_REDIS_URL; } });
+// Security hardening #5/#6 (additive): the per-IP login failure limit (D3) and the
+// raw-NODE_ENV dev/test predicate that gates the dev email logger.
+Object.defineProperty(exports, "loadLoginIpLimit", { enumerable: true, get: function () { return app_config_js_1.loadLoginIpLimit; } });
+Object.defineProperty(exports, "DEFAULT_LOGIN_IP_LIMIT", { enumerable: true, get: function () { return app_config_js_1.DEFAULT_LOGIN_IP_LIMIT; } });
+Object.defineProperty(exports, "isDevOrTestNodeEnv", { enumerable: true, get: function () { return app_config_js_1.isDevOrTestNodeEnv; } });
 // ---------------------------------------------------------------------------
 // Phase 0b Auth surface (framework-owned login → session, spec §2/§3/§4).
 //
@@ -281,37 +310,37 @@ Object.defineProperty(exports, "DEFAULT_REDIS_URL", { enumerable: true, get: fun
 // path is untouched; ShieldModule wiring is deferred to the integration owner.
 // ---------------------------------------------------------------------------
 // Shared DI provider tokens (the seams the teams bind/consume — see tokens.ts for
-// who provides/consumes each).
-var tokens_js_2 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_2.SHIELD_DB_POOL; } });
-Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_2.SHIELD_REDIS; } });
-Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_RESOLVER; } });
-Object.defineProperty(exports, "SHIELD_PROFILE_RESOLVER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_RESOLVER; } });
-Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUTHENTICATOR; } });
-Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_AUTHORITY; } });
+// who provides/consumes each). The raw pool token `SHIELD_DB_POOL` is NOT here (Phase 8 #5):
+// it is on `@astram/guard/internal`, with the `PersistenceModule` that provides it.
+var tokens_js_4 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_REDIS", { enumerable: true, get: function () { return tokens_js_4.SHIELD_REDIS; } });
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_CREDENTIAL_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_RESOLVER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_PROFILE_RESOLVER; } });
+Object.defineProperty(exports, "SHIELD_AUTHENTICATOR", { enumerable: true, get: function () { return tokens_js_4.SHIELD_AUTHENTICATOR; } });
+Object.defineProperty(exports, "SHIELD_SESSION_AUTHORITY", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SESSION_AUTHORITY; } });
 // Account & credential-surface seams (forgot/reset, change-password, MFA
 // enrollment, profile edit) — all OPTIONAL, consumer-plugged through
 // ShieldModule.forRoot. See tokens.ts for who provides/consumes each.
-Object.defineProperty(exports, "SHIELD_CREDENTIAL_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_CREDENTIAL_WRITER; } });
-Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RESET_TOKEN_STORE; } });
-Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_EMAIL_SENDER; } });
-Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_RECOVERY_CODE_STORE; } });
-Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_PROFILE_WRITER; } });
-Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_2.SHIELD_SESSION_SWEEPER; } });
+Object.defineProperty(exports, "SHIELD_CREDENTIAL_WRITER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_CREDENTIAL_WRITER; } });
+Object.defineProperty(exports, "SHIELD_RESET_TOKEN_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_RESET_TOKEN_STORE; } });
+Object.defineProperty(exports, "SHIELD_EMAIL_SENDER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_EMAIL_SENDER; } });
+Object.defineProperty(exports, "SHIELD_RECOVERY_CODE_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_RECOVERY_CODE_STORE; } });
+Object.defineProperty(exports, "SHIELD_PROFILE_WRITER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_PROFILE_WRITER; } });
+Object.defineProperty(exports, "SHIELD_SESSION_SWEEPER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SESSION_SWEEPER; } });
 // The auth-surface audit sink seam (the first auth audit event — recovery login).
-Object.defineProperty(exports, "SHIELD_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_2.SHIELD_AUDIT_SINK; } });
+Object.defineProperty(exports, "SHIELD_AUDIT_SINK", { enumerable: true, get: function () { return tokens_js_4.SHIELD_AUDIT_SINK; } });
 // The multi-device MFA store seam (multiple independent authenticator devices).
-Object.defineProperty(exports, "SHIELD_MFA_DEVICE_STORE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_MFA_DEVICE_STORE; } });
+Object.defineProperty(exports, "SHIELD_MFA_DEVICE_STORE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_MFA_DEVICE_STORE; } });
 // The login totp-verifier OVERRIDE seam (Phase 2 — plug an OR-matching verifier).
-Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: true, get: function () { return tokens_js_2.SHIELD_TOTP_VERIFIER_OVERRIDE; } });
+Object.defineProperty(exports, "SHIELD_TOTP_VERIFIER_OVERRIDE", { enumerable: true, get: function () { return tokens_js_4.SHIELD_TOTP_VERIFIER_OVERRIDE; } });
 // The credential-store contract (skeleton — Team A implements the SELECT).
 var mariadb_credential_resolver_js_1 = require("./authentication/mariadb-credential-resolver.js");
 Object.defineProperty(exports, "MariaDbCredentialResolver", { enumerable: true, get: function () { return mariadb_credential_resolver_js_1.MariaDbCredentialResolver; } });
 // The composition module skeletons (Team B fills the factory bodies; the
 // integration owner imports AuthModule into ShieldModule — see auth.module.ts /
 // DONE.md).
-var persistence_module_js_1 = require("./auth/persistence.module.js");
-Object.defineProperty(exports, "PersistenceModule", { enumerable: true, get: function () { return persistence_module_js_1.PersistenceModule; } });
+// `PersistenceModule` (it provides the raw `SHIELD_DB_POOL` pool) is NOT exported here (Phase 8
+// #5): a feature module importing it could inject the pool. It is on `@astram/guard/internal`.
 var auth_module_js_1 = require("./auth/auth.module.js");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_js_1.AuthModule; } });
 // Phase-2 verifier-seam helpers. `makeDefaultTotpVerifier()` builds the framework's
@@ -325,10 +354,10 @@ var auth_module_js_2 = require("./auth/auth.module.js");
 Object.defineProperty(exports, "makeDefaultTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.makeDefaultTotpVerifier; } });
 Object.defineProperty(exports, "resolveTotpVerifier", { enumerable: true, get: function () { return auth_module_js_2.resolveTotpVerifier; } });
 Object.defineProperty(exports, "hmacSha1", { enumerable: true, get: function () { return auth_module_js_2.hmacSha1; } });
-var tokens_js_3 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_3.SHIELD_SESSION_FACTS_PROJECTOR; } });
-var tokens_js_4 = require("./auth/tokens.js");
-Object.defineProperty(exports, "SHIELD_SCOPE_SUBTREE_RESOLVER", { enumerable: true, get: function () { return tokens_js_4.SHIELD_SCOPE_SUBTREE_RESOLVER; } });
+var tokens_js_5 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SESSION_FACTS_PROJECTOR", { enumerable: true, get: function () { return tokens_js_5.SHIELD_SESSION_FACTS_PROJECTOR; } });
+var tokens_js_6 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_SCOPE_SUBTREE_RESOLVER", { enumerable: true, get: function () { return tokens_js_6.SHIELD_SCOPE_SUBTREE_RESOLVER; } });
 // The framework-owned `/auth/*` HTTP controller (Team C) + its pending-MFA store.
 // The controller CONSUMES SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY and the
 // PendingMfaStore. It is EXPORTED so AuthModule (Team B) / the integration owner
@@ -338,6 +367,17 @@ var auth_controller_js_1 = require("./auth/auth.controller.js");
 Object.defineProperty(exports, "AuthController", { enumerable: true, get: function () { return auth_controller_js_1.AuthController; } });
 var pending_mfa_store_js_1 = require("./auth/pending-mfa-store.js");
 Object.defineProperty(exports, "PendingMfaStore", { enumerable: true, get: function () { return pending_mfa_store_js_1.PendingMfaStore; } });
+Object.defineProperty(exports, "RedisPendingMfaStore", { enumerable: true, get: function () { return pending_mfa_store_js_1.RedisPendingMfaStore; } });
+// The MFA step-up (security hardening M6): `/auth/mfa` verifies only the second factor for
+// the principal the password step recorded (no password held between the two requests).
+var mfa_step_up_js_1 = require("./auth/mfa-step-up.js");
+Object.defineProperty(exports, "CredentialMfaStepUp", { enumerable: true, get: function () { return mfa_step_up_js_1.CredentialMfaStepUp; } });
+Object.defineProperty(exports, "credentialFingerprint", { enumerable: true, get: function () { return mfa_step_up_js_1.credentialFingerprint; } });
+Object.defineProperty(exports, "challengeMatches", { enumerable: true, get: function () { return mfa_step_up_js_1.challengeMatches; } });
+var tokens_js_7 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_MFA_LIMITER", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_LIMITER; } });
+Object.defineProperty(exports, "SHIELD_MFA_STEP_UP", { enumerable: true, get: function () { return tokens_js_7.SHIELD_MFA_STEP_UP; } });
+Object.defineProperty(exports, "SHIELD_LOGIN_TOTP_VERIFIER", { enumerable: true, get: function () { return tokens_js_7.SHIELD_LOGIN_TOTP_VERIFIER; } });
 // The pure TOTP-enrollment helpers (Phase 4 MFA). Re-exported for consumers/tests
 // that need them; the multi-device MFA routes (Phase 3) reuse them to mint a device
 // secret + provisioning URI + recovery codes. (The old in-memory

package/dist/internal.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @astram/guard/internal — framework-composition and test surface (Phase 8 #5).
+ *
+ * `PersistenceModule` provides the raw `shield_core` pool under `SHIELD_DB_POOL`; a module that
+ * imported it could inject that pool. Neither is on the package entry point (`@astram/guard`):
+ * `ShieldModule.forRoot({ auth: true })` composes them internally, and the pool provider is not
+ * exported app-wide. The scaffolded app's lint wall rejects this subpath outside the composition
+ * root.
+ */
+export { PersistenceModule } from './auth/persistence.module.js';
+export { SHIELD_DB_POOL } from './auth/tokens.js';
+//# sourceMappingURL=internal.d.ts.map

package/dist/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../src/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/internal.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHIELD_DB_POOL = exports.PersistenceModule = void 0;
+/**
+ * @astram/guard/internal — framework-composition and test surface (Phase 8 #5).
+ *
+ * `PersistenceModule` provides the raw `shield_core` pool under `SHIELD_DB_POOL`; a module that
+ * imported it could inject that pool. Neither is on the package entry point (`@astram/guard`):
+ * `ShieldModule.forRoot({ auth: true })` composes them internally, and the pool provider is not
+ * exported app-wide. The scaffolded app's lint wall rejects this subpath outside the composition
+ * root.
+ */
+var persistence_module_js_1 = require("./auth/persistence.module.js");
+Object.defineProperty(exports, "PersistenceModule", { enumerable: true, get: function () { return persistence_module_js_1.PersistenceModule; } });
+var tokens_js_1 = require("./auth/tokens.js");
+Object.defineProperty(exports, "SHIELD_DB_POOL", { enumerable: true, get: function () { return tokens_js_1.SHIELD_DB_POOL; } });

package/dist/module/shield.module.d.ts

@@ -105,7 +105,13 @@ export interface ShieldModuleOptions {
      */
     readonly credentialWriter?: CredentialWriter;
     readonly resetTokenStore?: ResetTokenStore;
-    readonly emailSender?: EmailSender;
+    /**
+     * Password-reset email delivery — see {@link AuthModuleOptions.emailSender}. A real
+     * sender, or `'disabled'` (no-op, forgot-password still 204). REQUIRED under
+     * `auth: true` unless the raw `NODE_ENV` is `development`/`test` (where the dev
+     * `LogEmailSender` is the default); otherwise boot fails (security hardening #6).
+     */
+    readonly emailSender?: EmailSender | 'disabled';
     readonly recoveryCodeStore?: RecoveryCodeStore;
     readonly profileWriter?: ProfileWriter;
     readonly sessionSweeper?: SessionSweeper;
@@ -221,7 +227,8 @@ export interface ShieldModuleAsyncOptions {
      */
     readonly credentialWriter?: CredentialWriter;
     readonly resetTokenStore?: ResetTokenStore;
-    readonly emailSender?: EmailSender;
+    /** See {@link ShieldModuleOptions.emailSender} (a sender, or `'disabled'`). */
+    readonly emailSender?: EmailSender | 'disabled';
     readonly recoveryCodeStore?: RecoveryCodeStore;
     readonly profileWriter?: ProfileWriter;
     readonly sessionSweeper?: SessionSweeper;

package/dist/module/shield.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAIrC,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AAyFvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IA6FhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAiGtE"}
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAOnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAQvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAgBxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAIrC,YAAY,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AA0HvF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,yBAAyB,CAAC;IACzD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0FAA0F;IAC1F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2FAA2F;IAC3F,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IA8FhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAkGtE"}

package/dist/module/shield.module.js

@@ -55,6 +55,9 @@ const app_config_js_1 = require("../config/app-config.js");
 // the enforcement-only path never INSTANTIATES it (no live pool/Redis, no HMAC
 // gate, no core load).
 const auth_module_js_1 = require("../auth/auth.module.js");
+// Core-free (type-only core imports): the deferred default projector + the version-cache token.
+const default_session_facts_projector_js_1 = require("../auth/default-session-facts-projector.js");
+const tokens_js_1 = require("../auth/tokens.js");
 // The `SHIELD_DECISION_AUTHORITY` token now lives in `./shield-tokens.js` so the
 // enforcement guard can import it without a cycle (guard → token → ShieldModule →
 // EnforcementModule → guard). Re-exported here to keep the public import path stable.
@@ -87,7 +90,8 @@ let cachedRecordAuthApi;
 async function loadBuildRecordAuthorization() {
     if (cachedRecordAuthApi === undefined) {
         try {
-            cachedRecordAuthApi = (await Promise.resolve().then(() => __importStar(require('../authz/wire-record-authorization.js'))));
+            cachedRecordAuthApi =
+                (await Promise.resolve().then(() => __importStar(require('../authz/wire-record-authorization.js'))));
         }
         catch {
             // Built-dist fallback (the CJS dist path — see evalImport). `__dirname` is defined
@@ -97,7 +101,7 @@ async function loadBuildRecordAuthorization() {
             cachedRecordAuthApi = (await evalImport(base));
         }
     }
-    return cachedRecordAuthApi.buildRecordAuthorization;
+    return cachedRecordAuthApi;
 }
 /**
  * Resolve the `SHIELD_DECISION_AUTHORITY` VALUE from the caller's options (the ONE seam,
@@ -113,18 +117,33 @@ async function loadBuildRecordAuthorization() {
  *
  * Async because the `recordAuthorization` path lazy-loads the (core-touching) builder.
  */
-async function resolveDecisionAuthority(options) {
+async function resolveDecisionAuthority(options, extras = {}) {
     if (options.recordAuthorization && options.decisionAuthority) {
         throw new Error('ShieldModule: `recordAuthorization` and `decisionAuthority` are mutually exclusive — ' +
             'supply the record-authorization inputs (pool + app ports + registry) so the framework ' +
             'builds the decision authority, OR a pre-built `decisionAuthority`, but not both.');
     }
     if (options.recordAuthorization) {
-        const build = await loadBuildRecordAuthorization();
-        return build(options.recordAuthorization);
+        const api = await loadBuildRecordAuthorization();
+        const versionCache = extras.versionCache ?? undefined;
+        // ADR-0035 default projector: cache the SAME facts the authority decides on (version-cache
+        // wrapped, so a login projection also warms the Redis version).
+        extras.defaultProjector?.attach(versionCache !== undefined
+            ? api.withRedisPermissionVersion(options.recordAuthorization.permissionFacts, versionCache)
+            : options.recordAuthorization.permissionFacts);
+        return api.buildRecordAuthorization(options.recordAuthorization, versionCache !== undefined ? { versionCache } : {});
     }
     return options.decisionAuthority ?? core_seam_js_1.stubDecisionAuthority;
 }
+/**
+ * The deferred default projector for a registration (ADR-0035): only when auth is on and the
+ * consumer did not supply its own projector. `undefined` otherwise.
+ */
+function defaultProjectorFor(auth, explicit) {
+    return auth && explicit === undefined ? new default_session_facts_projector_js_1.DeferredSessionFactsProjector() : undefined;
+}
+/** Inject the Redis version cache when AuthModule provides it (`auth: true`); absent otherwise. */
+const OPTIONAL_VERSION_CACHE = { token: tokens_js_1.SHIELD_PERMISSION_VERSION_CACHE, optional: true };
 /**
  * `ShieldModule` — the SINGLE registration seam (ADR-0023 §4).
  *
@@ -153,6 +172,10 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
     /** Register Shield with static options (the common path). */
     static forRoot(options = {}) {
         const config = options.config ?? (0, app_config_js_1.loadAppConfig)();
+        // ADR-0035: with auth on and no explicit projector, sessions cache the facts the framework-built
+        // authority decides on (attached when the authority is built; inactive until then).
+        const defaultProjector = defaultProjectorFor(options.auth, options.sessionFactsProjector);
+        const sessionFactsProjector = options.sessionFactsProjector ?? defaultProjector;
         // Build the opt-in AuthModule ONCE so the SAME DynamicModule instance is both
         // imported (composes) and re-exported (propagates its exported engine tokens
         // app-wide through the @Global ShieldModule). Re-exporting the two Symbols
@@ -172,9 +195,7 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.credentialResolver
                     ? { credentialResolver: options.credentialResolver }
                     : {}),
-                ...(options.profileResolver
-                    ? { profileResolver: options.profileResolver }
-                    : {}),
+                ...(options.profileResolver ? { profileResolver: options.profileResolver } : {}),
                 // The account/credential-surface seams — same spread-when-present rule
                 // (an explicit `undefined` is not assignable under
                 // exactOptionalPropertyTypes; absent → AuthModule binds `null` → 501).
@@ -194,15 +215,11 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.identityControlPlaneKeys
                     ? { identityControlPlaneKeys: options.identityControlPlaneKeys }
                     : {}),
-                ...(options.sessionFactsProjector
-                    ? { sessionFactsProjector: options.sessionFactsProjector }
-                    : {}),
+                ...(sessionFactsProjector ? { sessionFactsProjector } : {}),
                 ...(options.scopeSubtreeResolver
                     ? { scopeSubtreeResolver: options.scopeSubtreeResolver }
                     : {}),
-                ...(options.membershipChecker
-                    ? { membershipChecker: options.membershipChecker }
-                    : {}),
+                ...(options.membershipChecker ? { membershipChecker: options.membershipChecker } : {}),
             })
             : undefined;
         return {
@@ -221,24 +238,22 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                     // stub paths resolve synchronously but flow through the same one seam. Both
                     // supplied → throws (mutual exclusion).
                     provide: shield_tokens_js_1.SHIELD_DECISION_AUTHORITY,
-                    useFactory: () => resolveDecisionAuthority({
+                    useFactory: (versionCache) => resolveDecisionAuthority({
                         ...(options.recordAuthorization
                             ? { recordAuthorization: options.recordAuthorization }
                             : {}),
                         ...(options.decisionAuthority
                             ? { decisionAuthority: options.decisionAuthority }
                             : {}),
-                    }),
+                    }, { versionCache, defaultProjector }),
+                    // ADR-0035: the Redis version cache AuthModule provides under `auth: true`.
+                    inject: [OPTIONAL_VERSION_CACHE],
                 },
             ],
             // Re-export the composed AuthModule app-wide ONLY when auth is opted in — its
             // own `exports` (SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY) then become
             // visible to a consumer's controllers/services via the @Global seam.
-            exports: [
-                config_module_js_1.APP_CONFIG,
-                shield_tokens_js_1.SHIELD_DECISION_AUTHORITY,
-                ...(authModule ? [authModule] : []),
-            ],
+            exports: [config_module_js_1.APP_CONFIG, shield_tokens_js_1.SHIELD_DECISION_AUTHORITY, ...(authModule ? [authModule] : [])],
         };
     }
     /**
@@ -263,6 +278,10 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
             useFactory: (opts) => opts.config ?? (0, app_config_js_1.loadAppConfig)(),
             inject: [optionsToken],
         };
+        // ADR-0035: the deferred default projector (auth on, no explicit projector), attached when the
+        // async-resolved options yield `recordAuthorization`.
+        const defaultProjector = defaultProjectorFor(options.auth, options.sessionFactsProjector);
+        const sessionFactsProjector = options.sessionFactsProjector ?? defaultProjector;
         const authorityProvider = {
             provide: shield_tokens_js_1.SHIELD_DECISION_AUTHORITY,
             // Same one-seam resolution as forRoot, over the async-resolved options: the
@@ -270,11 +289,11 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
             // in its useFactory from the injected registrations) has the framework build the
             // real wired authority; `decisionAuthority` is the legacy passthrough; both →
             // throws; neither → stub. Async because the record path lazy-loads the builder.
-            useFactory: (opts) => resolveDecisionAuthority({
+            useFactory: (opts, versionCache) => resolveDecisionAuthority({
                 ...(opts.recordAuthorization ? { recordAuthorization: opts.recordAuthorization } : {}),
                 ...(opts.decisionAuthority ? { decisionAuthority: opts.decisionAuthority } : {}),
-            }),
-            inject: [optionsToken],
+            }, { versionCache, defaultProjector }),
+            inject: [optionsToken, OPTIONAL_VERSION_CACHE],
         };
         // Same one-instance opt-in AuthModule as forRoot (imported + re-exported).
         // `credentialResolver` is STATIC on the async options (like `auth`) — a
@@ -289,9 +308,7 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.credentialResolver
                     ? { credentialResolver: options.credentialResolver }
                     : {}),
-                ...(options.profileResolver
-                    ? { profileResolver: options.profileResolver }
-                    : {}),
+                ...(options.profileResolver ? { profileResolver: options.profileResolver } : {}),
                 // The account/credential-surface seams — same spread-when-present rule
                 // (an explicit `undefined` is not assignable under
                 // exactOptionalPropertyTypes; absent → AuthModule binds `null` → 501).
@@ -311,15 +328,11 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.identityControlPlaneKeys
                     ? { identityControlPlaneKeys: options.identityControlPlaneKeys }
                     : {}),
-                ...(options.sessionFactsProjector
-                    ? { sessionFactsProjector: options.sessionFactsProjector }
-                    : {}),
+                ...(sessionFactsProjector ? { sessionFactsProjector } : {}),
                 ...(options.scopeSubtreeResolver
                     ? { scopeSubtreeResolver: options.scopeSubtreeResolver }
                     : {}),
-                ...(options.membershipChecker
-                    ? { membershipChecker: options.membershipChecker }
-                    : {}),
+                ...(options.membershipChecker ? { membershipChecker: options.membershipChecker } : {}),
             })
             : undefined;
         return {
@@ -335,11 +348,7 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                 ...(options.imports ?? []),
             ],
             providers: [asyncOptionsProvider, configProvider, authorityProvider],
-            exports: [
-                config_module_js_1.APP_CONFIG,
-                shield_tokens_js_1.SHIELD_DECISION_AUTHORITY,
-                ...(authModule ? [authModule] : []),
-            ],
+            exports: [config_module_js_1.APP_CONFIG, shield_tokens_js_1.SHIELD_DECISION_AUTHORITY, ...(authModule ? [authModule] : [])],
         };
     }
 };

package/dist/request-auth/session-facts-als.d.ts

@@ -35,7 +35,7 @@
  * (`PermissionFactsPort.loadCoarseGrants`). A cache miss NEVER fabricates a permit.
  */
 import { AsyncLocalStorage } from 'node:async_hooks';
-import type { CoarseGrants } from '@astram/core';
+import type { CoarseGrants, PermissionFactsPort } from '@astram/core';
 /**
  * The per-request session-facts store carried through the ALS. `cachedFacts` is the
  * principal's coarse grants for THIS request (or `null` when none were projected →
@@ -47,7 +47,22 @@ export interface SessionFactsStore {
     readonly cachedFacts: CoarseGrants | null;
     /** The version `cachedFacts` was projected at (0 when absent). */
     readonly permissionsVersion: number;
+    /**
+     * OPTIONAL reload signal (security hardening Phase 1C). The framework-built decision authority
+     * calls it when gate 5 RELOADS the coarse grants for a principal inside this request's scope
+     * (cache miss or stale version), passing the authoritative reloaded grants. The enforcement guard
+     * uses it to notice a permission-version move and re-derive the session's scope subtree. A pure
+     * notification: it never changes the decision, and readers ignore it.
+     */
+    readonly onReload?: (principalId: string, tenantId: string, grants: CoarseGrants) => void;
 }
+/**
+ * Wrap an app-owned `PermissionFactsPort`-shaped object so a gate-5 reload inside an enforcement
+ * request notifies that request's {@link SessionFactsStore.onReload}. Behaviour-identical
+ * otherwise: same results, same errors (a throwing reload propagates and notifies nothing).
+ * Outside a guard request (no ALS store, e.g. the engine's in-handler decide calls) it is a no-op.
+ */
+export declare function signalGateFiveReloads(port: PermissionFactsPort): PermissionFactsPort;
 /**
  * The ONE shared session-facts `AsyncLocalStorage` (see the file header). The
  * enforcement guard imports this to `run()` the `decide()` call inside the request's

package/dist/request-auth/session-facts-als.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-facts-als.d.ts","sourceRoot":"","sources":["../../src/request-auth/session-facts-als.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,sCAA6C,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAG7B,CAAC"}
+{"version":3,"file":"session-facts-als.d.ts","sourceRoot":"","sources":["../../src/request-auth/session-facts-als.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIrD,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,YAAY,GAAG,IAAI,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,CAepF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,sCAA6C,CAAC;AAEnF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAG7B,CAAC"}