@adonis-agora/authkit-server 1.0.0-rc.10 → 1.0.0-rc.12

package/build/src/agents/runtime.js

@@ -1,6 +1,7 @@
 import { getBootedApp } from '../../services/booted_app.js';
 import { supportsAccountStatus } from '../accounts/account_store.js';
 import { findMcpResource } from '../mcp/mcp_oauth.js';
+import { authkitTable } from '../schema/tables_location.js';
 import { PersonalAgentVerifier } from './agent_identity.js';
 import { PersonalAgentDelegation } from './delegation_service.js';
 import { DelegationStore } from './delegation_store.js';
@@ -156,8 +157,10 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                     conn = null;
                 }
             }
-            const store = conn ? new DelegationStore(conn) : null;
-            const registry = conn ? new AgentRegistryStore(conn) : null;
+            // Com `schema.name`, cada statement escreve `schema.tabela`.
+            const tableName = (name) => authkitTable({ schema: service.config.schema.name }, name);
+            const store = conn ? new DelegationStore(conn, tableName) : null;
+            const registry = conn ? new AgentRegistryStore(conn, { table: tableName }) : null;
             const effective = registry ? withRegistry(config, registry) : config;
             let delegation = null;
             if (config.delegation && store) {
@@ -179,6 +182,7 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                         protocol: extension.id,
                         issuer: service.config.issuer,
                         db: () => db(),
+                        table: tableName,
                         grants: scopedLedger(store, extension.grantIdPrefix),
                         registryStatus: async (identifier) => (await registry.find(extension.id, identifier))?.status ?? null,
                         deriveSecret: (label) => service.deriveSecret(label),

package/build/src/commands/expire_scan_command.js

@@ -27,7 +27,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { RuntimeSettings } from '../host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../host/runtime_settings.js';
 import { resolveEffectiveAccountExpiration } from '../host/runtime_toggles.js';
 import { ADMIN_LIST_DEFAULT_SIZE, LIST_FIRST_PAGE } from '../pagination.js';
 import { resolveAuthkitConfig } from './resolve_config.js';
@@ -54,8 +54,7 @@ export async function runExpireScan(app, opts) {
     let runtimeSettings = null;
     try {
         const db = await app.container.make('lucid.db');
-        const connection = accountStore?.connectionName;
-        runtimeSettings = new RuntimeSettings(db, connection ? { connection } : {});
+        runtimeSettings = new RuntimeSettings(db, settingsLocation(cfg));
     }
     catch {
         // Sem DB → usa defaults.

package/build/src/commands/settings_commands.js

@@ -14,7 +14,7 @@
  *
  * Todas suportam --json para output machine-readable.
  */
-import { RuntimeSettings } from '../host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../host/runtime_settings.js';
 import { SETTING_KEYS } from '../host/runtime_toggles.js';
 import { resolveAuthkitConfig } from './resolve_config.js';
 // ---------------------------------------------------------------------------
@@ -131,16 +131,16 @@ function validateKnownKey(key, value) {
 async function resolveSettingsService(app) {
     try {
         const db = await app.container.make('lucid.db');
-        // Tenta derivar a conexão do accountStore para probe searchPath-aware.
-        let connection;
+        // `auth_settings` vive na conexão das tabelas do authkit (`schema.connection`).
+        let location = {};
         try {
             const cfg = await resolveCfg(app);
-            connection = cfg?.accountStore?.connectionName;
+            location = settingsLocation(cfg);
         }
         catch {
             // Silencioso: sem config → default connection.
         }
-        return new RuntimeSettings(db, connection ? { connection } : {});
+        return new RuntimeSettings(db, location);
     }
     catch {
         return null;

package/build/src/define_config.d.ts

@@ -1190,11 +1190,21 @@ export interface AuthServerConfigInput {
      *   adiciona colunas novas (aditivo — nunca dropa nem altera tipos).
      * - `autoManage: false`: nada roda no boot; gerencie o schema você mesmo —
      *   de preferência chamando `ensureAuthkitSchema(this.db)` numa migration.
-     * - `connection`: conexão Lucid a usar (default: primária).
+     * - `connection`: a conexão Lucid de TODAS as tabelas do authkit (default:
+     *   primária) — as acima, o `authkit_keystore`, as de extensions e a do
+     *   `adapters.database()`/keystore `lucid` quando eles não declaram a própria.
+     *   A tabela da conta NÃO entra: fica na conexão do model da conta.
+     * - `name`: o schema do banco dessas tabelas (MySQL: o database), ex.: `'auth'`
+     *   → `"auth"."auth_settings"`. Vai escrito em cada statement; o boot cria o
+     *   schema quando falta (com `autoManage`). Default: o schema corrente da
+     *   conexão. SQLite não tem schemas: com `name`, o boot falha. NÃO use
+     *   `searchPath` na conexão para isso — atrás de um PgBouncer em modo
+     *   transaction, o `SET search_path` vaza para as conexões de outros clientes.
      */
     schema?: {
         autoManage?: boolean;
         connection?: string;
+        name?: string;
     };
     /**
      * Ciclo de vida da conta (LGPD/GDPR). OPT-IN para workflows DURÁVEIS:
@@ -1404,6 +1414,7 @@ export interface ResolvedServerConfig {
     schema: {
         autoManage: boolean;
         connection?: string;
+        name?: string;
     };
     /**
      * Ciclo de vida da conta resolvido. `durable` default `false` → caminho

package/build/src/define_config.js

@@ -17,6 +17,7 @@ import { loadEncryptionService } from './keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from './keys/keystore_manager.js';
 import { mcpClientRegistration, resolveMcpOAuth, } from './mcp/mcp_oauth.js';
 import { OPEN_REGISTRATION_REDIRECT_POLICY, resolveRedirectUriPolicy, } from './provider/registration_policy.js';
+import { assertSchemaSupported, authkitTablesClient, bindTablesLocation, validateSchemaName, } from './schema/tables_location.js';
 import { resolveServiceTenants, } from './service_tenants/config.js';
 export { adapters };
 const RATE_LIMIT_DEFAULTS = {
@@ -284,15 +285,31 @@ export function defineConfig(config) {
         (!Number.isInteger(requiredFactors) || requiredFactors < 2 || requiredFactors > 8)) {
         throw new Error('mfa.requiredFactors must be an integer between 2 and 8');
     }
+    // Toda tabela do AuthKit vive em `schema.connection` — inclusive as que o store da
+    // conta lê (auth_mfa, auth_password_history, organizations), que antes seguiam a
+    // conexão do model da conta.
+    const tablesSchema = validateSchemaName(config.schema?.name);
+    bindTablesLocation(config.accountStore, {
+        connection: config.schema?.connection,
+        schema: tablesSchema,
+    });
     return configProvider.create(async (app) => {
-        const AdapterClass = await config.adapter.resolver(app);
+        const tablesContext = { connection: config.schema?.connection, schema: tablesSchema };
+        if (tablesSchema) {
+            // Schema num dialeto sem schemas (SQLite) falha aqui, na resolução do config — nunca
+            // cai em silêncio para tabelas sem schema.
+            const db = await app.container.make('lucid.db').catch(() => null);
+            if (db)
+                assertSchemaSupported(authkitTablesClient(db, tablesContext), tablesSchema);
+        }
+        const AdapterClass = await config.adapter.resolver(app, tablesContext);
         // `session.adapter` ausente ⇒ mesma classe do default (back-compat: o
         // dispatcher vira identidade e tudo continua no adapter único de hoje).
         const SessionAdapterClass = config.session?.adapter
-            ? await config.session.adapter.resolver(app)
+            ? await config.session.adapter.resolver(app, tablesContext)
             : AdapterClass;
         // `jwks: 'auto'` → resolve env-aware: AUTHKIT_JWKS inline, senão managed em arquivo.
-        const jwksConfig = config.jwks === 'auto'
+        const jwksInput = config.jwks === 'auto'
             ? process.env.AUTHKIT_JWKS
                 ? {
                     source: 'jwks',
@@ -304,6 +321,19 @@ export function defineConfig(config) {
                     store: 'tmp/authkit_jwks.json',
                 }
             : config.jwks;
+        // Keystore no Lucid sem conexão/schema próprios fica onde estão as tabelas do authkit.
+        const jwksStore = jwksInput.store;
+        const jwksConfig = jwksStore?.driver === 'lucid' &&
+            ((!jwksStore.connection && config.schema?.connection) || (!jwksStore.schema && tablesSchema))
+            ? {
+                ...jwksInput,
+                store: {
+                    ...jwksStore,
+                    connection: jwksStore.connection ?? config.schema?.connection,
+                    schema: jwksStore.schema ?? tablesSchema,
+                },
+            }
+            : jwksInput;
         if (config.jwks === 'auto' && !process.env.AUTHKIT_JWKS) {
             const warning = jwksAutoFallbackWarning(jwksConfig.store ?? null);
             if (warning) {
@@ -490,6 +520,7 @@ export function defineConfig(config) {
             schema: {
                 autoManage: config.schema?.autoManage !== false,
                 connection: config.schema?.connection,
+                name: tablesSchema,
             },
             // OPT-IN: default false → caminho síncrono de sempre (byte-idêntico).
             accountLifecycle: {

package/build/src/doctor/agora_checks.js

@@ -134,6 +134,19 @@ export function authkitDoctorChecks() {
             const { managedSigningKeyAgeFinding } = await import('./doctor_input.js');
             return toResults(await managedSigningKeyAgeFinding(app, input.authkitConfig));
         },
+    }, {
+        id: 'authkit.db-schema',
+        lib: 'authkit',
+        package: AUTHKIT_DOCTOR_PACKAGE,
+        title: 'Database schema',
+        cost: 'deep',
+        async run(app) {
+            const { input, notBooted } = await prepare(app);
+            if (notBooted || !input?.authkitConfig?.schema?.name)
+                return [];
+            const { dbSchemaResults } = await import('./db_schema_check.js');
+            return dbSchemaResults(input.authkitConfig, () => app.container.make('lucid.db'), AUTHKIT_DOCTOR_DOCS);
+        },
     }, {
         id: 'authkit.console-gate',
         lib: 'authkit',

package/build/src/doctor/checks.js

@@ -553,8 +553,8 @@ export function checkSettings(input) {
         // Table absent — opt-in feature, silently ok.
         return null;
     }
-    // Informa a conexão usada quando nomeada (ajuda a diagnosticar bugs de searchPath).
-    const connectionName = cfg.accountStore?.connectionName;
+    // Informa a conexão usada quando nomeada (a das tabelas do authkit).
+    const connectionName = cfg.schema?.connection;
     const connectionHint = connectionName ? ` (connection: '${connectionName}')` : '';
     // Table present — check if botProtection.verify is configured.
     const hasBotVerify = typeof cfg.botProtection?.verify === 'function';

package/build/src/doctor/db_schema_check.d.ts

@@ -0,0 +1,6 @@
+import type { AgoraDoctorResult } from './agora_doctor.js';
+/**
+ * `agora:doctor` check for `schema.name`: the schema exists, AuthKit's tables are in it, and the
+ * connection can write there. No result at all without `schema.name`.
+ */
+export declare function dbSchemaResults(config: Record<string, any> | null, makeDb: () => Promise<any>, docs: string): Promise<AgoraDoctorResult[]>;

package/build/src/doctor/db_schema_check.js

@@ -0,0 +1,87 @@
+/** Thrown inside the probe transaction so the probe row is never kept. */
+class ProbeRollback extends Error {
+}
+function rows(result) {
+    if (Array.isArray(result))
+        return Array.isArray(result[0]) ? result[0] : result;
+    return result?.rows ?? [];
+}
+/**
+ * `agora:doctor` check for `schema.name`: the schema exists, AuthKit's tables are in it, and the
+ * connection can write there. No result at all without `schema.name`.
+ */
+export async function dbSchemaResults(config, makeDb, docs) {
+    const schema = config?.schema?.name;
+    if (!schema)
+        return [];
+    const [{ AUTHKIT_TABLE_NAMES }, { authkitTable, authkitTablesClient, dialectOf }] = await Promise.all([import('../schema/ensure.js'), import('../schema/tables_location.js')]);
+    const client = authkitTablesClient(await makeDb(), { connection: config?.schema?.connection });
+    const dialect = dialectOf(client);
+    if (dialect !== 'postgres' && dialect !== 'mysql') {
+        return [
+            {
+                status: 'error',
+                message: `schema.name "${schema}" is set, but the connection uses ${dialect ?? 'an unknown dialect'}, which has no schemas`,
+                fix: 'Remove schema.name from config/authkit.ts, or use Postgres or MySQL',
+                docs,
+            },
+        ];
+    }
+    const exists = rows(await client.rawQuery('select 1 as ok from information_schema.schemata where schema_name = ?', [
+        schema,
+    ]));
+    if (exists.length === 0) {
+        return [
+            {
+                status: 'error',
+                message: `database schema "${schema}" does not exist on this connection`,
+                fix: dialect === 'mysql'
+                    ? `Boot the app once with schema.autoManage on, or run CREATE DATABASE \`${schema}\``
+                    : `Boot the app once with schema.autoManage on, or run CREATE SCHEMA "${schema}"`,
+                docs,
+            },
+        ];
+    }
+    const found = new Set(rows(await client.rawQuery('select table_name as name from information_schema.tables where table_schema = ?', [schema])).map((r) => String(r.name ?? r.NAME ?? r.TABLE_NAME)));
+    const missing = AUTHKIT_TABLE_NAMES.filter((name) => !found.has(name));
+    if (missing.length > 0) {
+        return [
+            {
+                status: 'error',
+                message: `AuthKit tables missing from schema "${schema}": ${missing.join(', ')}`,
+                fix: 'Boot the app once with schema.autoManage on, or run ensureAuthkitSchema(db, { schema }) in a migration',
+                docs,
+            },
+        ];
+    }
+    try {
+        await client.transaction(async (trx) => {
+            await trx.table(authkitTable({ schema }, 'auth_settings')).insert({
+                key: '__authkit_doctor_probe',
+                organization_id: null,
+                value: 'null',
+            });
+            throw new ProbeRollback();
+        });
+    }
+    catch (error) {
+        if (!(error instanceof ProbeRollback)) {
+            return [
+                {
+                    status: 'error',
+                    message: `the connection cannot write to schema "${schema}": ${error?.message ?? error}`,
+                    fix: dialect === 'mysql'
+                        ? `GRANT INSERT, UPDATE, DELETE ON \`${schema}\`.* TO the app user`
+                        : `GRANT USAGE ON SCHEMA "${schema}" and INSERT, UPDATE, DELETE on its tables to the app role`,
+                    docs,
+                },
+            ];
+        }
+    }
+    return [
+        {
+            status: 'ok',
+            message: `AuthKit tables are in schema "${schema}" and the connection can write there`,
+        },
+    ];
+}

package/build/src/host/admin_sessions_service.js

@@ -1,6 +1,7 @@
 import { getBootedApp } from '../../services/booted_app.js';
 import { pickModelAdapterClass } from '../adapters/factory.js';
 import { buildPersonalAgentsRuntime } from '../agents/runtime.js';
+import { authkitTable } from '../schema/tables_location.js';
 import { normalizeActiveOrg } from './active_org_cookie.js';
 /**
  * Serviço de inspeção/revogação das SESSÕES e GRANTS ativos de uma conta.
@@ -22,8 +23,10 @@ export class AdminSessionsService {
     #AdapterClass;
     #SessionAdapterClass;
     #accountStore;
-    /** Conexão Lucid das tabelas authkit (schema `auth`) — onde vive auth_session_revocations. */
+    /** Conexão Lucid das tabelas authkit (`schema.connection`) — onde vive auth_session_revocations. */
     #schemaConnection;
+    /** `auth_session_revocations`, qualificada com `schema.name` quando há um. */
+    #revocationsTable;
     #oidc;
     constructor(oidc) {
         this.#oidc = oidc;
@@ -34,6 +37,7 @@ export class AdminSessionsService {
         this.#SessionAdapterClass = oidc.config.SessionAdapterClass ?? oidc.config.AdapterClass;
         this.#accountStore = oidc.config.accountStore;
         this.#schemaConnection = oidc.config.schema?.connection;
+        this.#revocationsTable = authkitTable({ schema: oidc.config.schema?.name }, 'auth_session_revocations');
     }
     #adapter(model) {
         return new (pickModelAdapterClass(model, this.#AdapterClass, this.#SessionAdapterClass))(model);
@@ -70,7 +74,7 @@ export class AdminSessionsService {
             const conn = this.#schemaConnection
                 ? db.connection(this.#schemaConnection)
                 : db.connection();
-            await conn.insertQuery().table('auth_session_revocations').insert({
+            await conn.insertQuery().table(this.#revocationsTable).insert({
                 sid: null,
                 sub: accountId,
                 revoked_at: revokedAt,

package/build/src/host/runtime_settings.d.ts

@@ -92,13 +92,26 @@ export interface RuntimeSettingsOptions {
     /** TTL do cache em ms. Default: 15_000 (15s). */
     ttlMs?: number;
     /**
-     * Nome da conexão Lucid a usar (ex.: 'auth'). Quando presente, todas as
-     * queries usam `db.connection(name)` em vez da conexão default. Necessário
-     * quando o schema de auth vive numa conexão nomeada com searchPath próprio.
-     * Ausente (ou undefined) → conexão default (back-compat total).
+     * Nome da conexão Lucid a usar (ex.: 'auth') — a `schema.connection` do
+     * `defineConfig`, onde vivem as tabelas do authkit. Quando presente, todas as
+     * queries usam `db.connection(name)` em vez da conexão default.
+     * Ausente (ou undefined) → conexão default.
      */
     connection?: string;
+    /**
+     * Schema do banco de `auth_settings` (MySQL: o database) — o `schema.name` do
+     * `defineConfig`. Escrito em cada statement (`"auth"."auth_settings"`).
+     */
+    schema?: string;
 }
+/**
+ * `{ connection, schema }` das tabelas do authkit a partir do config resolvido
+ * (`schema.connection`/`schema.name`), no formato de {@link RuntimeSettingsOptions}.
+ */
+export declare function settingsLocation(config: any): {
+    connection?: string;
+    schema?: string;
+};
 /**
  * Implementação default do SettingsCapability sobre um `Database` Lucid.
  *
@@ -108,6 +121,8 @@ export declare class RuntimeSettings implements SettingsCapability {
     private readonly db;
     private readonly ttlMs;
     private readonly connectionName;
+    /** `auth_settings`, qualificada com o schema quando há um. */
+    private readonly table;
     private readonly shared;
     constructor(db: any, opts?: RuntimeSettingsOptions);
     private get cache();
@@ -171,8 +186,8 @@ export declare class RuntimeSettings implements SettingsCapability {
  *
  * Esta fábrica SUBSTITUI ~16 cópias do mesmo bloco db/connection que viviam sob
  * nomes distintos (`getRuntimeSettings`, `getSettingsService`,
- * `getRuntimeSettingsForSudo`) e elimina o cast `as any` (via `connectionName`
- * tipado em {@link AccountStore}).
+ * `getRuntimeSettingsForSudo`). A conexão é `schema.connection`, a de todas as
+ * tabelas do authkit.
  *
  * @example
  * ```ts

package/build/src/host/runtime_settings.js

@@ -50,6 +50,7 @@
  * );
  * ```
  */
+import { authkitTable } from '../schema/tables_location.js';
 import { isSettingLocked, SettingLockedError } from './config_locks.js';
 /**
  * Type guard: o objeto (store ou serviço) expõe SettingsCapability?
@@ -58,7 +59,7 @@ export function supportsSettings(obj) {
     return !!obj && typeof obj.getSetting === 'function';
 }
 const sharedStates = new WeakMap();
-function sharedStateFor(db, connection) {
+function sharedStateFor(db, connection, table) {
     const fresh = () => ({ cache: new Map(), tablePresent: null, tableAbsentUntil: 0 });
     if (!db || (typeof db !== 'object' && typeof db !== 'function'))
         return fresh();
@@ -67,7 +68,7 @@ function sharedStateFor(db, connection) {
         byConnection = new Map();
         sharedStates.set(db, byConnection);
     }
-    const name = connection ?? '';
+    const name = `${connection ?? ''}\x00${table}`;
     let state = byConnection.get(name);
     if (!state) {
         state = fresh();
@@ -75,6 +76,18 @@ function sharedStateFor(db, connection) {
     }
     return state;
 }
+/**
+ * `{ connection, schema }` das tabelas do authkit a partir do config resolvido
+ * (`schema.connection`/`schema.name`), no formato de {@link RuntimeSettingsOptions}.
+ */
+export function settingsLocation(config) {
+    const out = {};
+    if (config?.schema?.connection)
+        out.connection = config.schema.connection;
+    if (config?.schema?.name)
+        out.schema = config.schema.name;
+    return out;
+}
 /** Chave de cache: combina key + escopo de org (null = global). */
 function cacheKey(key, orgId) {
     return orgId ? `${key}\x00${orgId}` : key;
@@ -88,12 +101,15 @@ export class RuntimeSettings {
     db;
     ttlMs;
     connectionName;
+    /** `auth_settings`, qualificada com o schema quando há um. */
+    table;
     shared;
     constructor(db, opts = {}) {
         this.db = db;
         this.ttlMs = opts.ttlMs ?? 15_000;
         this.connectionName = opts.connection;
-        this.shared = sharedStateFor(db, opts.connection);
+        this.table = authkitTable({ schema: opts.schema }, 'auth_settings');
+        this.shared = sharedStateFor(db, opts.connection, this.table);
     }
     get cache() {
         return this.shared.cache;
@@ -127,7 +143,7 @@ export class RuntimeSettings {
         if (shared.tablePresent === false && shared.tableAbsentUntil > Date.now())
             return false;
         try {
-            await this.conn().from('auth_settings').select('key').limit(1);
+            await this.conn().from(this.table).select('key').limit(1);
             shared.tablePresent = true;
             return true;
         }
@@ -152,7 +168,7 @@ export class RuntimeSettings {
             return null;
         }
         try {
-            let q = this.conn().from('auth_settings').where('key', key);
+            let q = this.conn().from(this.table).where('key', key);
             if (orgId) {
                 q = q.where('organization_id', orgId);
             }
@@ -192,7 +208,7 @@ export class RuntimeSettings {
         const resolvedOrgId = orgId ?? null;
         try {
             // Delete first then insert = upsert (compatível com sqlite + pg sem UPSERT syntax).
-            let q = this.conn().from('auth_settings').where('key', key);
+            let q = this.conn().from(this.table).where('key', key);
             if (resolvedOrgId) {
                 q = q.where('organization_id', resolvedOrgId);
             }
@@ -200,7 +216,7 @@ export class RuntimeSettings {
                 q = q.whereNull('organization_id');
             }
             await q.delete();
-            await this.conn().table('auth_settings').insert({
+            await this.conn().table(this.table).insert({
                 key,
                 organization_id: resolvedOrgId,
                 value: json,
@@ -220,7 +236,7 @@ export class RuntimeSettings {
             return;
         const resolvedOrgId = orgId ?? null;
         try {
-            let q = this.conn().from('auth_settings').where('key', key);
+            let q = this.conn().from(this.table).where('key', key);
             if (resolvedOrgId) {
                 q = q.where('organization_id', resolvedOrgId);
             }
@@ -238,7 +254,7 @@ export class RuntimeSettings {
         if (!(await this.hasTable()))
             return [];
         try {
-            let q = this.conn().from('auth_settings').select('*');
+            let q = this.conn().from(this.table).select('*');
             if (orgId !== undefined) {
                 // orgId fornecido: filtra pelo escopo
                 if (orgId) {
@@ -312,8 +328,8 @@ export class RuntimeSettings {
  *
  * Esta fábrica SUBSTITUI ~16 cópias do mesmo bloco db/connection que viviam sob
  * nomes distintos (`getRuntimeSettings`, `getSettingsService`,
- * `getRuntimeSettingsForSudo`) e elimina o cast `as any` (via `connectionName`
- * tipado em {@link AccountStore}).
+ * `getRuntimeSettingsForSudo`). A conexão é `schema.connection`, a de todas as
+ * tabelas do authkit.
  *
  * @example
  * ```ts
@@ -325,8 +341,8 @@ export async function resolveRuntimeSettings(ctx) {
     try {
         const db = await ctx.containerResolver.make('lucid.db');
         const service = await ctx.containerResolver.make('authkit.server').catch(() => null);
-        const connection = service?.config?.accountStore?.connectionName;
-        return new RuntimeSettings(db, connection ? { connection } : {});
+        // `auth_settings` vive onde estão as tabelas do authkit, não na conexão do model da conta.
+        return new RuntimeSettings(db, settingsLocation(service?.config));
     }
     catch {
         return null;

package/build/src/keys/keystore_manager.js

@@ -1,3 +1,4 @@
+import { validateSchemaName } from '../schema/tables_location.js';
 import { generateSigningJwk, planRotation, } from './keystore.js';
 import { DriveKeystoreVault, FileKeystoreVault, HashicorpVaultKeystoreVault, LazyExternalVault, LucidKeystoreVault, RedisKeystoreVault, } from './keystore_vault.js';
 /**
@@ -80,7 +81,7 @@ export function resolveKeystoreVault(store, ctx) {
             return new LucidKeystoreVault(async () => {
                 const db = await ctx.container.make('lucid.db');
                 return cfg.connection ? db.connection(cfg.connection) : db.connection();
-            }, cfg.table, cfg.key);
+            }, cfg.table, cfg.key, validateSchemaName(cfg.schema, 'jwks.store.schema'));
         case 'redis':
             return new RedisKeystoreVault(async () => {
                 const rm = await ctx.container.make('redis');

package/build/src/keys/keystore_vault.d.ts

@@ -30,7 +30,15 @@ export declare class LucidKeystoreVault implements KeystoreVault {
     private getConn;
     private table;
     private key;
-    constructor(getConn: () => Promise<any>, table?: string, key?: string);
+    /** Schema do banco da tabela (MySQL: o database). Escrito em cada statement. */
+    private schema?;
+    constructor(getConn: () => Promise<any>, table?: string, key?: string, 
+    /** Schema do banco da tabela (MySQL: o database). Escrito em cada statement. */
+    schema?: string | undefined);
+    /** Schema builder no schema da tabela (`withSchema`), ou o da conexão. */
+    private ddl;
+    /** `schema.tabela` (o knex cita cada parte) ou só `tabela`. */
+    private get qualified();
     private ensureTable;
     read(): Promise<string | null>;
     write(blob: string): Promise<void>;

package/build/src/keys/keystore_vault.js

@@ -8,6 +8,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { assertSchemaSupported, createDbSchema } from '../schema/tables_location.js';
 /** Cofre em arquivo local (default; mode 0600). */
 export class FileKeystoreVault {
     path;
@@ -49,16 +50,30 @@ export class LucidKeystoreVault {
     getConn;
     table;
     key;
-    constructor(getConn, table = 'authkit_keystore', key = 'jwks') {
+    schema;
+    constructor(getConn, table = 'authkit_keystore', key = 'jwks', 
+    /** Schema do banco da tabela (MySQL: o database). Escrito em cada statement. */
+    schema) {
         this.getConn = getConn;
         this.table = table;
         this.key = key;
+        this.schema = schema;
+    }
+    /** Schema builder no schema da tabela (`withSchema`), ou o da conexão. */
+    ddl(conn) {
+        return this.schema ? conn.schema.withSchema(this.schema) : conn.schema;
+    }
+    /** `schema.tabela` (o knex cita cada parte) ou só `tabela`. */
+    get qualified() {
+        return this.schema ? `${this.schema}.${this.table}` : this.table;
     }
     async ensureTable(conn) {
-        if (await conn.schema.hasTable(this.table))
+        if (await this.ddl(conn).hasTable(this.table))
             return;
+        if (this.schema)
+            await createDbSchema(conn, this.schema);
         try {
-            await conn.schema.createTable(this.table, (t) => {
+            await this.ddl(conn).createTable(this.table, (t) => {
                 t.string('key').notNullable().primary();
                 t.text('blob').notNullable();
                 t.bigInteger('updated_at').notNullable();
@@ -67,31 +82,34 @@ export class LucidKeystoreVault {
         catch (err) {
             // Outra instância criou a tabela entre o hasTable e o createTable (race no boot
             // multi-instância). Se já existe agora, OK; senão propaga.
-            if (!(await conn.schema.hasTable(this.table)))
+            if (!(await this.ddl(conn).hasTable(this.table)))
                 throw err;
         }
     }
     async read() {
         const conn = await this.getConn();
-        if (!(await conn.schema.hasTable(this.table)))
+        assertSchemaSupported(conn, this.schema);
+        if (!(await this.ddl(conn).hasTable(this.table)))
             return null;
-        const row = await conn.from(this.table).where('key', this.key).first();
+        const row = await conn.from(this.qualified).where('key', this.key).first();
         return row ? row.blob : null;
     }
     async write(blob) {
         const conn = await this.getConn();
+        assertSchemaSupported(conn, this.schema);
         await this.ensureTable(conn);
         await conn
-            .table(this.table)
+            .table(this.qualified)
             .insert({ key: this.key, blob, updated_at: Date.now() })
             .onConflict('key')
             .merge();
     }
     async head() {
         const conn = await this.getConn();
-        if (!(await conn.schema.hasTable(this.table)))
+        assertSchemaSupported(conn, this.schema);
+        if (!(await this.ddl(conn).hasTable(this.table)))
             return null;
-        const row = await conn.from(this.table).where('key', this.key).first();
+        const row = await conn.from(this.qualified).where('key', this.key).first();
         return row ? String(row.updated_at) : null;
     }
 }