@astram/identity 0.18.0 → 0.18.1

package/dist/features/authz/authz-pool-lifecycle.d.ts

@@ -0,0 +1,20 @@
+import { type OnApplicationShutdown } from '@nestjs/common';
+import type { Pool } from 'mariadb';
+/**
+ * Ends the ONE shared identity authz pool on shutdown (G-026 spec 5.J). `forRoot()` provides the
+ * pool as a value (`IDENTITY_AUTHZ_POOL`), and value providers get no lifecycle callback, so this
+ * class holds it, like guard's `ConnectionLifecycle`.
+ *
+ * The close runs in `onApplicationShutdown` (Nest `close()` step 4): after every `onModuleDestroy`
+ * (the catalog reconcile has been stopped and drained by `CatalogBootstrapProvider`) and after the
+ * HTTP server closed and its in-flight requests finished. Nothing happens in `onModuleDestroy`.
+ * Best-effort and idempotent: an `end()` error is swallowed, a second call does nothing, and it
+ * never throws.
+ */
+export declare class IdentityAuthzPoolLifecycle implements OnApplicationShutdown {
+    private readonly pool;
+    private ended;
+    constructor(pool: Pool);
+    onApplicationShutdown(): Promise<void>;
+}
+//# sourceMappingURL=authz-pool-lifecycle.d.ts.map

package/dist/features/authz/authz-pool-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-pool-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/features/authz/authz-pool-lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAGpC;;;;;;;;;;GAUG;AACH,qBACa,0BAA2B,YAAW,qBAAqB;IAG7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAF9D,OAAO,CAAC,KAAK,CAAS;gBAEoC,IAAI,EAAE,IAAI;IAE9D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;CAS7C"}

package/dist/features/authz/authz-pool-lifecycle.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityAuthzPoolLifecycle = void 0;
+const common_1 = require("@nestjs/common");
+const org_bootstrap_tokens_js_1 = require("../org-bootstrap/org-bootstrap.tokens.js");
+/**
+ * Ends the ONE shared identity authz pool on shutdown (G-026 spec 5.J). `forRoot()` provides the
+ * pool as a value (`IDENTITY_AUTHZ_POOL`), and value providers get no lifecycle callback, so this
+ * class holds it, like guard's `ConnectionLifecycle`.
+ *
+ * The close runs in `onApplicationShutdown` (Nest `close()` step 4): after every `onModuleDestroy`
+ * (the catalog reconcile has been stopped and drained by `CatalogBootstrapProvider`) and after the
+ * HTTP server closed and its in-flight requests finished. Nothing happens in `onModuleDestroy`.
+ * Best-effort and idempotent: an `end()` error is swallowed, a second call does nothing, and it
+ * never throws.
+ */
+let IdentityAuthzPoolLifecycle = class IdentityAuthzPoolLifecycle {
+    pool;
+    ended = false;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async onApplicationShutdown() {
+        if (this.ended)
+            return;
+        this.ended = true;
+        try {
+            await this.pool.end();
+        }
+        catch {
+            // best-effort: a pool already ending or a mid-query close is non-fatal at shutdown.
+        }
+    }
+};
+exports.IdentityAuthzPoolLifecycle = IdentityAuthzPoolLifecycle;
+exports.IdentityAuthzPoolLifecycle = IdentityAuthzPoolLifecycle = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(org_bootstrap_tokens_js_1.IDENTITY_AUTHZ_POOL)),
+    __metadata("design:paramtypes", [Object])
+], IdentityAuthzPoolLifecycle);

package/dist/features/authz/catalog-bootstrap.provider.d.ts

@@ -1,4 +1,4 @@
-import { type OnApplicationBootstrap } from '@nestjs/common';
+import { type OnApplicationBootstrap, type OnModuleDestroy } from '@nestjs/common';
 import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
 import { type RecordAuthorizationInputs } from '@astram/guard';
 import type { ObjectType } from '@astram/engine';
@@ -16,7 +16,7 @@ import { ScopeClosureService } from '../scope/scope-closure.service.js';
  * health controller injects — so verify, the post-boot pass, and the endpoint all share
  * one job. This provider owns only the boot verify + the schedule.
  */
-export declare class CatalogBootstrapProvider implements OnApplicationBootstrap {
+export declare class CatalogBootstrapProvider implements OnApplicationBootstrap, OnModuleDestroy {
     private readonly discovery;
     private readonly scanner;
     private readonly reflector;
@@ -27,8 +27,20 @@ export declare class CatalogBootstrapProvider implements OnApplicationBootstrap
     private readonly recordAuthorization;
     private readonly logger;
     private timer;
+    /** The last scheduled reconcile pass (settled or not); drained by `onModuleDestroy`. */
+    private inFlightReconcile;
+    private destroyed;
     constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, job: CatalogReconcileJob, accessBundleJob: AccessBundleReconcileJob, scopeClosure: ScopeClosureService, registrations: readonly ObjectType[], recordAuthorization: RecordAuthorizationInputs);
     onApplicationBootstrap(): Promise<void>;
+    /**
+     * G-026 (spec 5.K): stop the hourly reconcile before the authz pool ends. Clears the interval,
+     * then waits for a reconcile already running (its outcome is not this hook's concern), so
+     * `IdentityAuthzPoolLifecycle` (in `onApplicationShutdown`) never ends the pool under it. A tick
+     * that fires after this is a no-op. Never throws.
+     */
+    onModuleDestroy(): Promise<void>;
+    /** One scheduled reconcile pass (catalog, then bundles, then the scope closure). */
+    private tick;
     /** Rebuild the scope closure; a failure is logged loudly (never silently swallowed) but does
      *  not abort boot or a cron tick — the reconcile is idempotent and retried next interval. */
     private reconcileScopeClosure;

package/dist/features/authz/catalog-bootstrap.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB;IAKnE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAbtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,KAAK,CAA+B;gBAGzB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EACzC,YAAY,EAAE,mBAAmB,EAEjC,aAAa,EAAE,SAAS,UAAU,EAAE,EAEpC,mBAAmB,EAAE,yBAAyB;IAG3D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAyE7C;iGAC6F;YAC/E,qBAAqB;CAOpC"}
+{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB,EAAE,eAAe;IAQpF,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAhBtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,KAAK,CAA+B;IAC5C,wFAAwF;IACxF,OAAO,CAAC,iBAAiB,CAA8B;IACvD,OAAO,CAAC,SAAS,CAAS;gBAGP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EACzC,YAAY,EAAE,mBAAmB,EAEjC,aAAa,EAAE,SAAS,UAAU,EAAE,EAEpC,mBAAmB,EAAE,yBAAyB;IAG3D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmE7C;;;;;OAKG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAUtC,oFAAoF;IACpF,OAAO,CAAC,IAAI;IAaZ;iGAC6F;YAC/E,qBAAqB;CAOpC"}

package/dist/features/authz/catalog-bootstrap.provider.js

@@ -49,6 +49,9 @@ let CatalogBootstrapProvider = CatalogBootstrapProvider_1 = class CatalogBootstr
     recordAuthorization;
     logger = new common_1.Logger(CatalogBootstrapProvider_1.name);
     timer = null;
+    /** The last scheduled reconcile pass (settled or not); drained by `onModuleDestroy`. */
+    inFlightReconcile = null;
+    destroyed = false;
     constructor(discovery, scanner, reflector, job, accessBundleJob, scopeClosure, registrations, recordAuthorization) {
         this.discovery = discovery;
         this.scanner = scanner;
@@ -104,17 +107,41 @@ let CatalogBootstrapProvider = CatalogBootstrapProvider_1 = class CatalogBootstr
         // logged error rather than aborting boot — the reconcile is idempotent and retried on the
         // interval below once the data is fixed.
         await this.reconcileScopeClosure();
-        if (process.env.DISABLE_ALL_CRONS !== 'true') {
-            this.timer = setInterval(() => {
-                const tickIso = new Date().toISOString();
-                void this.job
-                    .runOnce(tickIso)
-                    .then(() => this.accessBundleJob.runOnce(tickIso))
-                    .then(() => this.reconcileScopeClosure());
-            }, RECONCILE_INTERVAL_MS);
+        if (process.env.DISABLE_ALL_CRONS !== 'true' && !this.destroyed) {
+            this.timer = setInterval(() => this.tick(), RECONCILE_INTERVAL_MS);
             this.timer.unref?.();
         }
     }
+    /**
+     * G-026 (spec 5.K): stop the hourly reconcile before the authz pool ends. Clears the interval,
+     * then waits for a reconcile already running (its outcome is not this hook's concern), so
+     * `IdentityAuthzPoolLifecycle` (in `onApplicationShutdown`) never ends the pool under it. A tick
+     * that fires after this is a no-op. Never throws.
+     */
+    async onModuleDestroy() {
+        this.destroyed = true;
+        if (this.timer !== null) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        const running = this.inFlightReconcile;
+        if (running !== null)
+            await running.catch(() => undefined);
+    }
+    /** One scheduled reconcile pass (catalog, then bundles, then the scope closure). */
+    tick() {
+        if (this.destroyed)
+            return;
+        const tickIso = new Date().toISOString();
+        const run = this.job
+            .runOnce(tickIso)
+            .then(() => this.accessBundleJob.runOnce(tickIso))
+            .then(() => this.reconcileScopeClosure());
+        // Kept so onModuleDestroy can drain it. Storing the reference attaches no handler, so a
+        // failing tick surfaces exactly as before this change.
+        this.inFlightReconcile = run;
+        void run;
+    }
     /** Rebuild the scope closure; a failure is logged loudly (never silently swallowed) but does
      *  not abort boot or a cron tick — the reconcile is idempotent and retried next interval. */
     async reconcileScopeClosure() {

package/dist/features/authz/record-authorization.d.ts

@@ -30,6 +30,8 @@ export declare function authzPoolLimit(env?: NodeJS.ProcessEnv): number;
  * Opens the pool at CALL time (never at import) — the caller owns closing it.
  * `schemas` (the names `forRoot` resolved or was given) set the default database and user; absent
  * ⇒ from the env namespace. An explicit `APP_DB_USER` / `APP_DB_NAME` wins (QA P2-5).
+ * G-026 (spec 5.I): idle and timeout settings from guard's `loadPoolTuning` (`minimumIdle`
+ * capped at the cap); `IdentityAuthzPoolLifecycle` ends the pool in `onApplicationShutdown`.
  */
 export declare function createIdentityAuthzPool(schemas?: FrameworkSchemas): Pool;
 /**

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAML,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAexE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}

package/dist/features/authz/record-authorization.js

@@ -50,19 +50,23 @@ function authzPoolLimit(env = process.env) {
  * Opens the pool at CALL time (never at import) — the caller owns closing it.
  * `schemas` (the names `forRoot` resolved or was given) set the default database and user; absent
  * ⇒ from the env namespace. An explicit `APP_DB_USER` / `APP_DB_NAME` wins (QA P2-5).
+ * G-026 (spec 5.I): idle and timeout settings from guard's `loadPoolTuning` (`minimumIdle`
+ * capped at the cap); `IdentityAuthzPoolLifecycle` ends the pool in `onApplicationShutdown`.
  */
 function createIdentityAuthzPool(schemas) {
     const db = schemas === undefined ? (0, guard_1.loadDbConfig)() : (0, guard_1.loadDbConfig)(process.env, schemas);
     const ssl = (0, guard_1.mariadbSslOption)(db.tls);
+    const connectionLimit = authzPoolLimit(process.env);
     return mariadb_1.default.createPool({
         host: db.host,
         port: db.port,
         user: db.user,
         password: db.password,
         database: db.database,
-        connectionLimit: authzPoolLimit(process.env),
+        connectionLimit,
         // Phase 16: APP_DB_TLS / APP_DB_TLS_CA (production accounts are REQUIRE SSL).
         ...(ssl ? { ssl } : {}),
+        ...(0, guard_1.mariadbPoolTuningOptions)((0, guard_1.loadPoolTuning)(process.env), { connectionLimit }),
     });
 }
 /**

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAaL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAwDxB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA0G/E;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AA2BD,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,GACP,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,MAAM,CAAC,EAAE,aAAa,CAAC;KACnB,GAAG,aAAa;CAgqBvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAaL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAyDxB,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AA2G/E;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAyBhB;AA2BD,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,GACP,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;QAC3B,MAAM,CAAC,EAAE,aAAa,CAAC;KACnB,GAAG,aAAa;CAmqBvB"}

package/dist/features/identity-feature.module.js

@@ -66,6 +66,7 @@ const service_account_controller_js_1 = require("./service-account/service-accou
 const catalog_reconcile_job_js_1 = require("./authz/catalog-reconcile.job.js");
 const access_bundle_reconcile_job_js_1 = require("./authz/access-bundle-reconcile.job.js");
 const catalog_bootstrap_provider_js_1 = require("./authz/catalog-bootstrap.provider.js");
+const authz_pool_lifecycle_js_1 = require("./authz/authz-pool-lifecycle.js");
 const scope_closure_service_js_1 = require("./scope/scope-closure.service.js");
 const mariadb_audit_reader_js_1 = require("./audit/mariadb-audit-reader.js");
 const directory_label_resolver_js_1 = require("./audit/directory-label-resolver.js");
@@ -203,6 +204,10 @@ function engineDbFromEnv(schemas, env = process.env) {
         connectionLimit,
         // Phase 16: APP_DB_TLS / APP_DB_TLS_CA (production accounts are REQUIRE SSL).
         ...(ssl ? { ssl } : {}),
+        // G-026 (spec 5.H): POOL_MIN_IDLE, POOL_IDLE_TIMEOUT_S and the optional
+        // APP_DB_QUERY_TIMEOUT_MS / POOL_LEAK_DETECTION_MS, from guard's one loader (a set but invalid
+        // value throws naming the variable). The engine caps minimumIdle at connectionLimit.
+        ...(0, guard_1.loadPoolTuning)(env),
     };
 }
 /**
@@ -780,6 +785,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // above), the jobs, the ScopeClosureService, ENGINE_ALL_REGISTRATIONS and the record
                 // authorization (whose registry is the verify key universe, KI #70).
                 catalog_bootstrap_provider_js_1.CatalogBootstrapProvider,
+                // G-026 (spec 5.J): ends the shared authz pool in onApplicationShutdown, after the
+                // reconcile above has drained (its onModuleDestroy) and the HTTP server has closed.
+                authz_pool_lifecycle_js_1.IdentityAuthzPoolLifecycle,
                 // Stored files (file-storage Phase 5): the request-principal RecordsService + the guard's
                 // object store (`null`/absent ⇒ every method answers 501) + the file_access audit bridge.
                 // G-010 T9 (P-5): the invite, its settings, its audit writer and its two Redis limiters

package/dist/features/org-bootstrap/run-org-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-org-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/run-org-bootstrap.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAQ,MAAM,gBAAgB,CAAC;AA8BpE,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAIL,KAAK,OAAO,EAIb,MAAM,yBAAyB,CAAC;AAkBjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwCD,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,+FAC6D,CAAC;AA8D/F,wBAAsB,eAAe,CACnC,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAmqB7B"}
+{"version":3,"file":"run-org-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/run-org-bootstrap.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAQ,MAAM,gBAAgB,CAAC;AA+BpE,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAIL,KAAK,OAAO,EAIb,MAAM,yBAAyB,CAAC;AAkBjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwCD,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,+FAC6D,CAAC;AA8D/F,wBAAsB,eAAe,CACnC,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAoqB7B"}

package/dist/features/org-bootstrap/run-org-bootstrap.js

@@ -191,10 +191,8 @@ async function runOrgBootstrap(app, opts) {
     const lockName = `astram_org_bootstrap:${schemas.app}`;
     const lockConn = await pool.getConnection();
     try {
-        const got = (await lockConn.query('SELECT GET_LOCK(?, ?) AS acquired', [
-            lockName,
-            opts.lockTimeoutSeconds ?? 30,
-        ]));
+        // G-026 (spec 5.L): APP_DB_QUERY_TIMEOUT_MS never cuts the lock wait; its own timeout applies.
+        const got = (await lockConn.query((0, guard_1.withoutStatementTimeout)('SELECT GET_LOCK(?, ?) AS acquired'), [lockName, opts.lockTimeoutSeconds ?? 30]));
         if (Number(got[0]?.acquired) !== 1) {
             throw new org_bootstrap_error_js_1.OrgBootstrapError('lock_not_acquired', 'Another org bootstrap run holds the lock; nothing was written. Retry when it finishes.');
         }

package/dist/features/scope/scope-closure.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B;;;;OAIG;gBAEgB,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,mBAA+C;IAG3E;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC;IA+ChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}
+{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B;;;;OAIG;gBAEgB,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,mBAA+C;IAG3E;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAyCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC;IA+ChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}

package/dist/features/scope/scope-closure.service.js

@@ -116,7 +116,8 @@ class ScopeClosureService {
         const conn = await this.pool.getConnection();
         let locked = false;
         try {
-            const got = (await conn.query('SELECT GET_LOCK(?, ?) AS got', [
+            // G-026 (spec 5.L): APP_DB_QUERY_TIMEOUT_MS never cuts the lock wait; its own timeout applies.
+            const got = (await conn.query((0, guard_1.withoutStatementTimeout)('SELECT GET_LOCK(?, ?) AS got'), [
                 TREE_LOCK,
                 TREE_LOCK_TIMEOUT_S,
             ]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -37,8 +37,8 @@
   "dependencies": {
     "mariadb": "^3.5.4",
     "@astram/core": "1.12.0",
-    "@astram/guard": "0.21.0",
-    "@astram/engine": "0.14.0"
+    "@astram/guard": "0.22.0",
+    "@astram/engine": "0.15.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",