@astram/guard 0.13.0 → 0.15.0

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAanF,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AAoGtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAyhBD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAwID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAiGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA2K/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAanF,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AA6GtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AA6jBD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA6ID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAmGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA+K/D"}

package/dist/auth/auth.module.js

@@ -112,6 +112,8 @@ const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
 const app_config_js_1 = require("../config/app-config.js");
 const config_module_js_1 = require("../config/config.module.js");
+const migration_ledger_check_js_1 = require("../boot/migration-ledger-check.js");
+const migrations_dir_js_1 = require("../migrations-dir.js");
 const argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 const mariadb_credential_resolver_js_1 = require("../authentication/mariadb-credential-resolver.js");
 const mariadb_profile_resolver_js_1 = require("../authentication/mariadb-profile-resolver.js");
@@ -251,8 +253,8 @@ function makeCredentialResolverProvider(override) {
             provide: tokens_js_1.SHIELD_CREDENTIAL_RESOLVER,
             // #7: the default resolver folds the principal's CONFIRMED MFA devices into a
             // `totp` required factor, so enrolled MFA is enforced at every password login.
-            useFactory: (pool, devices) => new mariadb_credential_resolver_js_1.MariaDbCredentialResolver(pool, devices),
-            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_MFA_DEVICE_STORE],
+            useFactory: (pool, devices, config) => new mariadb_credential_resolver_js_1.MariaDbCredentialResolver(pool, devices, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_MFA_DEVICE_STORE, config_module_js_1.APP_CONFIG],
         };
 }
 /**
@@ -272,11 +274,11 @@ const sessionLifetimesProvider = {
  */
 const sessionRecordStoreProvider = {
     provide: index_js_1.SHIELD_SESSION_RECORD_STORE,
-    useFactory: (pool, binder) => {
-        const durable = new index_js_1.MariaDbSessionRecordStore(pool);
+    useFactory: (pool, binder, config) => {
+        const durable = new index_js_1.MariaDbSessionRecordStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config));
         return new index_js_1.HotRevokingSessionRecordStore(durable, binder, durable);
     },
-    inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER],
+    inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER, config_module_js_1.APP_CONFIG],
 };
 /**
  * The Redis permission-version cache (ADR-0035, GAPS #6): gate 5 reads the tenant's version from
@@ -295,8 +297,8 @@ const permissionVersionCacheProvider = {
  */
 const sessionRestrictionStoreProvider = {
     provide: tokens_js_1.SHIELD_SESSION_RESTRICTIONS,
-    useFactory: (pool) => new session_restriction_store_js_1.MariaDbSessionRestrictionStore(pool),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    useFactory: (pool, config) => new session_restriction_store_js_1.MariaDbSessionRestrictionStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
 /** Hot session store (Redis adapter, injected with the live client). */
 const hotSessionStoreProvider = {
@@ -356,11 +358,34 @@ const mfaLimiterProvider = {
  */
 const serviceAuthenticatorProvider = {
     provide: tokens_js_2.SHIELD_SERVICE_AUTHENTICATOR,
-    useFactory: (pool) => (0, core_1.createServiceAuthenticator)({
-        store: new mariadb_api_key_store_js_1.MariaDbApiKeyStore(pool),
+    useFactory: (pool, config) => (0, core_1.createServiceAuthenticator)({
+        store: new mariadb_api_key_store_js_1.MariaDbApiKeyStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
         hasher: new argon2id_password_hasher_js_1.Argon2idPasswordHasher(),
     }),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+};
+/**
+ * configurable-framework-db spec 5.D: at application bootstrap (once, never per request, Shield
+ * #12) check that every guard migration is in the `@astram/migrate` ledger, read with ONE SELECT
+ * over this module's runtime pool. Lives here, not in `BootModule`, because this is the only
+ * guard module holding a pool (the raw pool stays unexported, Phase 8 #5); an enforcement-only
+ * app opens no pool and reads no guard table, so it has nothing to check.
+ */
+const migrationLedgerCheckProvider = {
+    // Its own token (identity provides another), so a merged module can never shadow one check.
+    provide: migration_ledger_check_js_1.SHIELD_GUARD_MIGRATION_LEDGER_CHECK,
+    useFactory: (pool, config, registry) => new migration_ledger_check_js_1.FrameworkMigrationLedgerCheck({
+        query: (sql) => pool.query(sql),
+        // The ledger candidates (G-007 QA P1): `<ns>_app`, or DDL_DB_NAME / APP_DB_NAME /
+        // shield_app probed in order in default mode.
+        ...(0, migration_ledger_check_js_1.resolveMigrationLedgerCheck)(process.env, (0, app_config_js_1.frameworkSchemasOf)(config)),
+        migrationsDir: migrations_dir_js_1.guardMigrationsDir,
+        nodeEnv: process.env.NODE_ENV,
+        logger: new common_1.Logger('Shield'),
+    }, 
+    // ShieldModule's per-app registry: one ledger read shared with identity's check.
+    registry ?? null),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG, { token: migration_ledger_check_js_1.SHIELD_MIGRATION_LEDGER_REGISTRY, optional: true }],
 };
 /** Boot-time warnings from the auth composition (dev email logger, disabled email, …). */
 const authBootLogger = new common_1.Logger('ShieldAuth');
@@ -656,8 +681,8 @@ function makeProfileResolverProvider(override) {
         ? { provide: tokens_js_1.SHIELD_PROFILE_RESOLVER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_PROFILE_RESOLVER,
-            useFactory: (pool) => new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 /**
@@ -671,8 +696,8 @@ function makeCredentialWriterProvider(override) {
         ? { provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER,
-            useFactory: (pool) => new mariadb_credential_writer_js_1.MariaDbCredentialWriter(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_credential_writer_js_1.MariaDbCredentialWriter(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 function makeResetTokenStoreProvider(override) {
@@ -680,8 +705,8 @@ function makeResetTokenStoreProvider(override) {
         ? { provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE,
-            useFactory: (pool) => new mariadb_reset_token_store_js_1.MariaDbResetTokenStore(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_reset_token_store_js_1.MariaDbResetTokenStore(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 /**
@@ -690,14 +715,14 @@ function makeResetTokenStoreProvider(override) {
  */
 const emailChangeTokenStoreProvider = {
     provide: tokens_js_1.SHIELD_EMAIL_CHANGE_TOKEN_STORE,
-    useFactory: (pool) => new mariadb_email_change_token_store_js_1.MariaDbEmailChangeTokenStore(pool),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    useFactory: (pool, config) => new mariadb_email_change_token_store_js_1.MariaDbEmailChangeTokenStore(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
 /** The ONE email read/write path for an email change (Phase 12): the framework default. */
 const emailAddressChangerProvider = {
     provide: tokens_js_1.SHIELD_EMAIL_ADDRESS_CHANGER,
-    useFactory: (pool) => new mariadb_email_address_changer_js_1.MariaDbEmailAddressChanger(pool),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    useFactory: (pool, config) => new mariadb_email_address_changer_js_1.MariaDbEmailAddressChanger(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
 /**
  * The per-account email-change REQUEST limiter (Phase 12) — `email-change:pid:<id>`, 3 per 60-min
@@ -781,8 +806,8 @@ function makeRecoveryCodeStoreProvider(override) {
         ? { provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE,
-            useFactory: (pool, hasher) => new mariadb_recovery_code_store_js_1.MariaDbRecoveryCodeStore(pool, hasher),
-            inject: [tokens_js_1.SHIELD_DB_POOL, argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER],
+            useFactory: (pool, hasher, config) => new mariadb_recovery_code_store_js_1.MariaDbRecoveryCodeStore(pool, hasher, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER, config_module_js_1.APP_CONFIG],
         };
 }
 function makeProfileWriterProvider(override) {
@@ -790,8 +815,8 @@ function makeProfileWriterProvider(override) {
         ? { provide: tokens_js_1.SHIELD_PROFILE_WRITER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_PROFILE_WRITER,
-            useFactory: (pool) => new mariadb_profile_writer_js_1.MariaDbProfileWriter(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_profile_writer_js_1.MariaDbProfileWriter(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 function makeSessionSweeperProvider(override) {
@@ -799,8 +824,8 @@ function makeSessionSweeperProvider(override) {
         ? { provide: tokens_js_1.SHIELD_SESSION_SWEEPER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_SESSION_SWEEPER,
-            useFactory: (pool, binder) => new mariadb_session_sweeper_js_1.MariaDbSessionSweeper(pool, binder),
-            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER],
+            useFactory: (pool, binder, config) => new mariadb_session_sweeper_js_1.MariaDbSessionSweeper(pool, binder, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER, config_module_js_1.APP_CONFIG],
         };
 }
 function makeMfaDeviceStoreProvider(override) {
@@ -808,8 +833,8 @@ function makeMfaDeviceStoreProvider(override) {
         ? { provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE,
-            useFactory: (pool) => new mariadb_mfa_device_store_js_1.MariaDbMfaDeviceStore(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_mfa_device_store_js_1.MariaDbMfaDeviceStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 function makeAuditSinkProvider(override) {
@@ -947,8 +972,8 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // keys. The keys are CLOSED-OVER option values (never a guard→identity import).
                 {
                     provide: tokens_js_1.SHIELD_PERMISSION_FACTS,
-                    useFactory: (pool) => new permission_facts_adapter_js_1.MariaDbPermissionFactsAdapter(pool, () => identityActionKeys, identityControlPlaneKeys),
-                    inject: [tokens_js_1.SHIELD_DB_POOL],
+                    useFactory: (pool, config) => new permission_facts_adapter_js_1.MariaDbPermissionFactsAdapter(pool, () => identityActionKeys, identityControlPlaneKeys, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+                    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
                 },
                 // The reset-link base URL value the forgot-password handler composes into the
                 // emailed link (framework-owned URL composition; EmailSender stays dumb).
@@ -1002,6 +1027,8 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 forgotLimiterProvider,
                 forgotHintLimiterProvider,
                 resetLimiterProvider,
+                // spec 5.D: the guard migrations are in the ledger (once at bootstrap; production fails).
+                migrationLedgerCheckProvider,
             ],
             exports: [
                 tokens_js_1.SHIELD_AUTHENTICATOR,

package/dist/auth/connections.d.ts

@@ -25,6 +25,7 @@ import { type OnModuleDestroy } from '@nestjs/common';
 import { type Pool } from 'mariadb';
 import Redis from 'ioredis';
 import { type AppConfig, type DbTlsConfig } from '../config/app-config.js';
+import { isLoopbackHost } from '../config/loopback-host.js';
 /**
  * Create the ONE live `mariadb` {@link Pool} for the `shield_core` account from
  * {@link AppConfig}. The `connectionLimit` comes from the ADR-0018 budget
@@ -37,8 +38,7 @@ import { type AppConfig, type DbTlsConfig } from '../config/app-config.js';
  * documented defaults, so the descriptor is always well-formed.
  */
 export declare function createDbPool(config: AppConfig): Pool;
-/** `localhost`, `127.0.0.0/8` or `::1` (any case, with or without IPv6 brackets). */
-export declare function isLoopbackHost(host: string): boolean;
+export { isLoopbackHost };
 /**
  * The boot warning for a production pool to a remote MariaDB without TLS (Phase 16), or
  * `undefined` when none applies. Warns only: production accounts are provisioned `REQUIRE SSL`,

package/dist/auth/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/auth/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiBpD;AAID,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOpD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CASpB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,GAAG,SAAS,GAC3B;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,CAgB1D;AAED;;;;;;GAMG;AACH,qBACa,mBAAoB,YAAW,eAAe;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK;IAGzB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;CAavC"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../../src/auth/connections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAsB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,MAAM,SAAS,CAAC;AAC5B,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAiBpD;AAMD,OAAO,EAAE,cAAc,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CASpB;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,GAAG,SAAS,GAC3B;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,CAgB1D;AAED;;;;;;GAMG;AACH,qBACa,mBAAoB,YAAW,eAAe;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK;IAGzB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;CAavC"}

package/dist/auth/connections.js

@@ -35,9 +35,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConnectionLifecycle = void 0;
+exports.ConnectionLifecycle = exports.isLoopbackHost = void 0;
 exports.createDbPool = createDbPool;
-exports.isLoopbackHost = isLoopbackHost;
 exports.dbTlsBootWarning = dbTlsBootWarning;
 exports.mariadbSslOption = mariadbSslOption;
 exports.createRedisClient = createRedisClient;
@@ -46,6 +45,8 @@ const common_1 = require("@nestjs/common");
 const mariadb_1 = __importDefault(require("mariadb"));
 const ioredis_1 = __importDefault(require("ioredis"));
 const app_config_js_1 = require("../config/app-config.js");
+const loopback_host_js_1 = require("../config/loopback-host.js");
+Object.defineProperty(exports, "isLoopbackHost", { enumerable: true, get: function () { return loopback_host_js_1.isLoopbackHost; } });
 /**
  * Create the ONE live `mariadb` {@link Pool} for the `shield_core` account from
  * {@link AppConfig}. The `connectionLimit` comes from the ADR-0018 budget
@@ -77,16 +78,6 @@ function createDbPool(config) {
     });
 }
 const dbBootLogger = new common_1.Logger('ShieldAuth');
-/** `localhost`, `127.0.0.0/8` or `::1` (any case, with or without IPv6 brackets). */
-function isLoopbackHost(host) {
-    const h = host
-        .trim()
-        .toLowerCase()
-        .replace(/^\[(.*)\]$/, '$1');
-    if (h === 'localhost' || h === '::1' || h === '0:0:0:0:0:0:0:1')
-        return true;
-    return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
-}
 /**
  * The boot warning for a production pool to a remote MariaDB without TLS (Phase 16), or
  * `undefined` when none applies. Warns only: production accounts are provisioned `REQUIRE SSL`,
@@ -98,7 +89,7 @@ function dbTlsBootWarning(config, env = process.env) {
         return undefined;
     if ((config.db.tls?.mode ?? 'off') === 'on')
         return undefined;
-    if (isLoopbackHost(config.db.host))
+    if ((0, loopback_host_js_1.isLoopbackHost)(config.db.host))
         return undefined;
     return (`APP_DB_TLS is off but APP_DB_HOST '${config.db.host}' is not loopback (NODE_ENV=production): ` +
         'database traffic, credentials included, is sent in plaintext. Set APP_DB_TLS=on ' +

package/dist/authentication/mariadb-api-key-store.d.ts

@@ -20,9 +20,18 @@
  */
 import type { Pool } from 'mariadb';
 import type { ApiKeyStore, ApiKeyRecord } from '@astram/core';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbApiKeyStore implements ApiKeyStore {
     private readonly pool;
-    constructor(pool: Pool);
+    /** `<authz>`.`service_account_key`. */
+    private readonly keyTable;
+    /** The account rows (`<app>`.`service_account`, created by the identity migration `…018`). */
+    private readonly accountTable;
+    /** `<app>`.`companies` (the account's tenant company). */
+    private readonly companyTable;
+    constructor(pool: Pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     getByAccountId(accountId: string): Promise<ApiKeyRecord | null>;
     /**
      * Persist a NEW key version for an account (issue or rotate). Only the HASH is stored. `version`

package/dist/authentication/mariadb-api-key-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-api-key-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-api-key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA+C9D,qBAAa,kBAAmB,YAAW,WAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA0DrE;;;;OAIG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB,iGAAiG;IAC3F,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxD,+FAA+F;IACzF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ7D"}
+{"version":3,"file":"mariadb-api-key-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-api-key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AA2C7C,qBAAa,kBAAmB,YAAW,WAAW;IASlD,OAAO,CAAC,QAAQ,CAAC,IAAI;IARvB,uCAAuC;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAGnB,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA0DrE;;;;OAIG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB,iGAAiG;IAC3F,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxD,+FAA+F;IACzF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ7D"}

package/dist/authentication/mariadb-api-key-store.js

@@ -1,9 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbApiKeyStore = void 0;
-const AUTHZ = 'shield_authz';
-/** The account rows (`service_account`, created by the identity migration `…018`). */
-const APP = 'shield_app';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /**
  * Read a JSON-array column into a `string[]`. The mariadb driver returns a JSON/`longtext` column
  * EITHER already-parsed (an array/object — its default for JSON columns) OR as a raw string,
@@ -28,8 +26,20 @@ function parseJsonArray(v) {
 }
 class MariaDbApiKeyStore {
     pool;
-    constructor(pool) {
+    /** `<authz>`.`service_account_key`. */
+    keyTable;
+    /** The account rows (`<app>`.`service_account`, created by the identity migration `…018`). */
+    accountTable;
+    /** `<app>`.`companies` (the account's tenant company). */
+    companyTable;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.keyTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.authz, 'service_account_key');
+        this.accountTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'service_account');
+        this.companyTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'companies');
     }
     async getByAccountId(accountId) {
         // The CURRENT key = highest version for the account. (Rotation inserts a new version; the old
@@ -56,9 +66,9 @@ class MariaDbApiKeyStore {
               k.sak_secret_hash, k.sak_version, k.sak_expires_at_ms, k.sak_revoked_at_ms,
               sa.sa_scope_subtree, sa.sa_role_ids, sa.sa_status, sa.sa_tenant_id,
               c.c_uuid AS tenant_company_uuid
-         FROM \`${AUTHZ}\`.\`service_account_key\` k
-         JOIN \`${APP}\`.\`service_account\` sa ON sa.sa_id = k.sak_account_id
-         LEFT JOIN \`${APP}\`.\`companies\` c ON c.c_uuid = sa.sa_tenant_id
+         FROM ${this.keyTable} k
+         JOIN ${this.accountTable} sa ON sa.sa_id = k.sak_account_id
+         LEFT JOIN ${this.companyTable} c ON c.c_uuid = sa.sa_tenant_id
         WHERE k.sak_account_id = ?
         ORDER BY k.sak_version DESC
         LIMIT 1`, [accountId]));
@@ -94,7 +104,7 @@ class MariaDbApiKeyStore {
      * the natural key `(account, version)`.
      */
     async putVersion(input) {
-        await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`service_account_key\`
+        await this.pool.query(`INSERT INTO ${this.keyTable}
          (sak_account_id, sak_tenant_id, sak_scope_subtree, sak_role_ids,
           sak_secret_hash, sak_version, sak_expires_at_ms, sak_revoked_at_ms, sak_created_at_ms)
        VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`, [
@@ -110,12 +120,12 @@ class MariaDbApiKeyStore {
     }
     /** The current highest version for an account (0 if none) — for computing the next on rotate. */
     async currentVersion(accountId) {
-        const rows = (await this.pool.query(`SELECT MAX(sak_version) AS v FROM \`${AUTHZ}\`.\`service_account_key\` WHERE sak_account_id = ?`, [accountId]));
+        const rows = (await this.pool.query(`SELECT MAX(sak_version) AS v FROM ${this.keyTable} WHERE sak_account_id = ?`, [accountId]));
         return rows[0]?.v != null ? Number(rows[0].v) : 0;
     }
     /** Revoke ALL of an account's keys (immediate fail-closed on the next request). Idempotent. */
     async revoke(accountId, atMs) {
-        await this.pool.query(`UPDATE \`${AUTHZ}\`.\`service_account_key\`
+        await this.pool.query(`UPDATE ${this.keyTable}
           SET sak_revoked_at_ms = ?
         WHERE sak_account_id = ? AND sak_revoked_at_ms IS NULL`, [atMs, accountId]);
     }

package/dist/authentication/mariadb-credential-resolver.d.ts

@@ -60,6 +60,7 @@
 import type { Pool } from 'mariadb';
 import type { CredentialResolver, ResolvedCredential } from '@astram/core';
 import type { MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 /** DI token for the resolver — re-exported from the shared auth tokens module. */
 export { SHIELD_CREDENTIAL_RESOLVER } from '../auth/tokens.js';
 /**
@@ -83,6 +84,10 @@ export declare class MariaDbCredentialResolver implements CredentialResolver {
      * installed or migrated while the process runs) is enforced without a restart.
      */
     private usersTableMissingUntil;
+    /** `<identity>`.`identity_credential`. */
+    private readonly credentialTable;
+    /** `<app>`.`users` (the account status JOIN). */
+    private readonly usersTable;
     constructor(pool: Pool, 
     /**
      * The device store whose CONFIRMED keys become the login's `totp` required factor.
@@ -91,7 +96,9 @@ export declare class MariaDbCredentialResolver implements CredentialResolver {
      */
     mfaDevices?: (Pick<MfaDeviceStore, "listConfirmedSecrets"> | null) | undefined, 
     /** Clock (epoch-ms) for the users-table re-probe window. */
-    now?: () => number);
+    now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     /**
      * Resolve `identityHint` → {@link ResolvedCredential}, or `null` when no such
      * principal exists.

package/dist/authentication/mariadb-credential-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-credential-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAkB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAExE,kFAAkF;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA6D/D;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAShE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG;IAhBtB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAK;gBAGhB,IAAI,EAAE,IAAI;IAC3B;;;;OAIG;IACc,UAAU,CAAC,GAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IACjF,4DAA4D;IAC3C,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoCvE;;;;;;OAMG;YACW,MAAM;IAyBpB;;;OAGG;YACW,kBAAkB;CAQjC"}
+{"version":3,"file":"mariadb-credential-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAkB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,kFAAkF;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA6D/D;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAchE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG;IArBtB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAK;IAEnC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iDAAiD;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI;IAC3B;;;;OAIG;IACc,UAAU,CAAC,GAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IACjF,4DAA4D;IAC3C,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAOhC;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoCvE;;;;;;OAMG;YACW,MAAM;IAyBpB;;;OAGG;YACW,kBAAkB;CAQjC"}

package/dist/authentication/mariadb-credential-resolver.js

@@ -60,10 +60,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCredentialResolver = exports.SHIELD_CREDENTIAL_RESOLVER = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** DI token for the resolver — re-exported from the shared auth tokens module. */
 var tokens_js_1 = require("../auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_CREDENTIAL_RESOLVER; } });
-/** MariaDB `ER_NO_SUCH_TABLE`: the app keeps no `shield_app.users` table. */
+/** MariaDB `ER_NO_SUCH_TABLE`: the app keeps no `<app>.users` table. */
 const ER_NO_SUCH_TABLE = 1146;
 /** How long the credential-only fallback is used before the users JOIN is tried again. */
 const USERS_TABLE_REPROBE_MS = 60_000;
@@ -113,6 +114,10 @@ class MariaDbCredentialResolver {
      * installed or migrated while the process runs) is enforced without a restart.
      */
     usersTableMissingUntil = 0;
+    /** `<identity>`.`identity_credential`. */
+    credentialTable;
+    /** `<app>`.`users` (the account status JOIN). */
+    usersTable;
     constructor(pool, 
     /**
      * The device store whose CONFIRMED keys become the login's `totp` required factor.
@@ -121,10 +126,15 @@ class MariaDbCredentialResolver {
      */
     mfaDevices, 
     /** Clock (epoch-ms) for the users-table re-probe window. */
-    now = Date.now) {
+    now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.mfaDevices = mfaDevices;
         this.now = now;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.credentialTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'identity_credential');
+        this.usersTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'users');
     }
     /**
      * Resolve `identityHint` → {@link ResolvedCredential}, or `null` when no such
@@ -182,8 +192,8 @@ class MariaDbCredentialResolver {
         if (this.now() >= this.usersTableMissingUntil) {
             try {
                 return (await this.pool.query(`SELECT ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, u.u_status
-             FROM shield_identity.identity_credential
-             LEFT JOIN shield_app.users u ON u.u_uuid = ic_principal_id
+             FROM ${this.credentialTable}
+             LEFT JOIN ${this.usersTable} u ON u.u_uuid = ic_principal_id
             WHERE ic_identity_hint = ?
             LIMIT 1`, [identityHint]));
             }
@@ -194,7 +204,7 @@ class MariaDbCredentialResolver {
             }
         }
         return (await this.pool.query(`SELECT ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles
-         FROM shield_identity.identity_credential
+         FROM ${this.credentialTable}
         WHERE ic_identity_hint = ?
         LIMIT 1`, [identityHint]));
     }

package/dist/authentication/mariadb-credential-writer.d.ts

@@ -6,10 +6,15 @@
  */
 import type { Pool } from 'mariadb';
 import type { CredentialWriter } from '../auth/ports/credential-writer.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbCredentialWriter implements CredentialWriter {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    private readonly table;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     setPassword(principalId: string, passwordHash: string): Promise<void>;
     getPasswordHash(principalId: string): Promise<string | null>;
 }

package/dist/authentication/mariadb-credential-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-credential-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAM3E,qBAAa,uBAAwB,YAAW,gBAAgB;IAE5D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAOnE"}
+{"version":3,"file":"mariadb-credential-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAM7C,qBAAa,uBAAwB,YAAW,gBAAgB;IAK5D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAOnE"}

package/dist/authentication/mariadb-credential-writer.js

@@ -1,18 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCredentialWriter = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbCredentialWriter {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    table;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'identity_credential');
     }
     async setPassword(principalId, passwordHash) {
-        await this.pool.query('UPDATE `shield_identity`.`identity_credential` SET ic_password_hash = ?, ic_updated_at_ms = ? WHERE ic_principal_id = ?', [passwordHash, this.now(), principalId]);
+        await this.pool.query(`UPDATE ${this.table} SET ic_password_hash = ?, ic_updated_at_ms = ? WHERE ic_principal_id = ?`, [passwordHash, this.now(), principalId]);
     }
     async getPasswordHash(principalId) {
-        const rows = (await this.pool.query('SELECT ic_password_hash FROM `shield_identity`.`identity_credential` WHERE ic_principal_id = ? LIMIT 1', [principalId]));
+        const rows = (await this.pool.query(`SELECT ic_password_hash FROM ${this.table} WHERE ic_principal_id = ? LIMIT 1`, [principalId]));
         return rows[0]?.ic_password_hash ?? null;
     }
 }

package/dist/authentication/mariadb-email-address-changer.d.ts

@@ -29,10 +29,19 @@
  */
 import type { Pool } from 'mariadb';
 import type { CurrentEmail, EmailAddressChanger, EmailChangeOutcome, EmailChangeRequest } from '../auth/ports/email-address-changer.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbEmailAddressChanger implements EmailAddressChanger {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** `<app>`.`users`. */
+    private readonly usersTable;
+    /** `<identity>`.`identity_credential`. */
+    private readonly credentialTable;
+    /** `<identity>`.`email_change_token`. */
+    private readonly tokenTable;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     readCurrent(principalId: string, candidate: string): Promise<CurrentEmail | null>;
     change(request: EmailChangeRequest): Promise<EmailChangeOutcome>;
     private changeLocked;

package/dist/authentication/mariadb-email-address-changer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAqBhD,qBAAa,0BAA2B,YAAW,mBAAmB;IAElE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA6BxD,YAAY;CAqE3B"}
+{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAqB7C,qBAAa,0BAA2B,YAAW,mBAAmB;IASlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,uBAAuB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA6BxD,YAAY;CAqE3B"}