@astram/guide 0.2.0 → 0.2.2

package/CAPABILITIES.md

@@ -20,11 +20,9 @@ below is wired by the two `forRoot` calls in your `app.module.ts`; you write no
 import { ShieldModule } from '@astram/guard';
 import {
   IdentityFeatureModule, identityAuthActionKeys, identityControlPlaneKeys,
-  createIdentityAuthzPool, buildIdentityRecordAuthorization,
 } from '@astram/identity';
 
 const rootIds = ['<platform-admin user uuid>'];   // from config, never from a request
-const authzPool = createIdentityAuthzPool();
 
 imports: [
   ShieldModule.forRoot({
@@ -33,14 +31,15 @@ imports: [
     rootIds,
     identityActionKeys: identityAuthActionKeys,
     identityControlPlaneKeys,
-    recordAuthorization: buildIdentityRecordAuthorization(authzPool, [/* YourType */]),
+    // no recordAuthorization: IdentityFeatureModule provides it
   }),
   IdentityFeatureModule.forRoot({ rootIds, extraObjects: [/* YourType */] }),
 ],
 ```
 
 - **`ShieldModule.forRoot(options?)`** (`@astram/guard`; `forRootAsync` for DI-computed options).
-  Options: `auth?`, `recordAuthorization?` (or a pre-built `decisionAuthority?`, never both),
+  Options: `auth?`, `recordAuthorization?` (or a pre-built `decisionAuthority?`; only for an app
+  WITHOUT `IdentityFeatureModule`, never both),
   `emailSender?: EmailSender | 'disabled'`, `rootIds?`, `identityActionKeys?`,
   `identityControlPlaneKeys?`, `config?`, and optional overrides `credentialResolver?`,
   `profileResolver?`, `credentialWriter?`, `resetTokenStore?`, `recoveryCodeStore?`,
@@ -48,11 +47,12 @@ imports: [
   `sessionFactsProjector?`, `scopeSubtreeResolver?`, `membershipChecker?`. With `auth: true` every
   override has a MariaDB/Redis default; leave them out unless you have a reason.
 - **`IdentityFeatureModule.forRoot({ rootIds?, extraObjects? })`** (`@astram/identity`). Pass the
-  SAME `rootIds` as `ShieldModule`, and the SAME `extraObjects` as
-  `buildIdentityRecordAuthorization`. Without `rootIds` it logs a boot warning.
-- `ShieldModule.forRoot()` with no options = enforcement only (no DB, no Redis, boots without
-  `.env`). Omitting `recordAuthorization` (and `decisionAuthority`) binds a stub that denies every
-  `@Classified` route.
+  SAME `rootIds` as `ShieldModule`. `extraObjects` (your own registered object types) are given
+  HERE ONLY: the module builds the record authorization from them and `ShieldModule` decides with
+  it. Passing `recordAuthorization`/`decisionAuthority` to `ShieldModule` as well fails the boot.
+  Without `rootIds` it logs a boot warning.
+- `ShieldModule.forRoot()` with no options and no identity module = enforcement only (no DB, no
+  Redis, boots without `.env`); it binds a stub that denies every `@Classified` route.
 
 ## Enforcement (`@astram/guard`)
 - **Global deny-by-default guard** — every route is denied unless `@Public()` or

package/FRAMEWORK_RULES.md

@@ -50,10 +50,13 @@ the permission gate, validation, audit, and cross-tenant isolation on every writ
 by construction.
 
 This is enforced two ways: the raw DB pool is **sealed inside the engine module** (you
-cannot inject what you are not given), and the app's `server/eslint.config.mjs` **fails
-lint** on off-road DB access anywhere in `src/**` (only `app.module.ts` and `main.ts` may
-wire infrastructure). The lint wall is a backstop, not a sandbox: code that slips past it
-is still a Rule 2 violation. If you find yourself wanting a raw query, see Rule 4.
+cannot inject what you are not given) and no package entry point exports a raw pool or
+unit of work (they live on `@astram/*/internal` subpaths for `app.module.ts` wiring only);
+and the app's `server/eslint.config.mjs` **fails lint** on off-road DB access anywhere in
+`src/**` (only `app.module.ts` and `main.ts` may import `@astram/*/internal` and wire
+infrastructure, and they may not re-export it). The lint wall is a backstop, not a
+sandbox: code that slips past it is still a Rule 2 violation. If you find yourself
+wanting a raw query, see Rule 4.
 
 ## 3. Classify every route (deny-by-default)
 

package/index.js

@@ -18,7 +18,6 @@ const FRAMEWORK_RULES_PATH = join(__dirname, 'FRAMEWORK_RULES.md');
 const CAPABILITIES_PATH = join(__dirname, 'CAPABILITIES.md');
 
 /** The guide version (== the framework release it ships with). */
-// eslint-disable-next-line @typescript-eslint/no-var-requires
 const { version } = require('./package.json');
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guide",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "license": "MIT",
   "description": "Astram framework — the AI/dev GUIDE layer (ADR-0025). Ships the framework's hard rules + capabilities manifest as installed, upgrade-refreshed docs. A consumer app's CLAUDE.md references FRAMEWORK_RULES.md from this package; `npm update` replaces it wholesale so new rules arrive cleanly, while the app's own .astram/guide/ layer is never touched. This is the framework-owned FLOOR: an app rule may tighten it, never weaken it.",
   "type": "commonjs",