@astram/guard 0.13.0 → 0.15.0

package/dist/authentication/mariadb-email-address-changer.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbEmailAddressChanger = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** Seconds to wait for the email-change named lock before giving up (caller → 503). */
 const LOCK_TIMEOUT_S = 10;
 /** MariaDB `ER_DUP_ENTRY`: a unique index (here `uq_users_email` or the hint PK) refused a write. */
@@ -15,13 +16,25 @@ function isDuplicateKey(err) {
 class MariaDbEmailAddressChanger {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<app>`.`users`. */
+    usersTable;
+    /** `<identity>`.`identity_credential`. */
+    credentialTable;
+    /** `<identity>`.`email_change_token`. */
+    tokenTable;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.usersTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'users');
+        this.credentialTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'identity_credential');
+        this.tokenTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'email_change_token');
     }
     async readCurrent(principalId, candidate) {
         const rows = (await this.pool.query(`SELECT u_email, u_status, (u_email = ?) AS same_as_candidate
-         FROM \`shield_app\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [candidate, principalId]));
+         FROM ${this.usersTable} WHERE u_uuid = ? LIMIT 1`, [candidate, principalId]));
         const row = rows[0];
         if (row === undefined)
             return null;
@@ -66,7 +79,7 @@ class MariaDbEmailAddressChanger {
     }
     async changeLocked(conn, request) {
         const { principalId, newEmail } = request;
-        const self = (await conn.query('SELECT u_email, u_status FROM `shield_app`.`users` WHERE u_uuid = ? FOR UPDATE', [principalId]));
+        const self = (await conn.query(`SELECT u_email, u_status FROM ${this.usersTable} WHERE u_uuid = ? FOR UPDATE`, [principalId]));
         const row = self[0];
         if (row === undefined)
             return { status: 'not_found' };
@@ -76,24 +89,24 @@ class MariaDbEmailAddressChanger {
         if (request.expectedOldEmail !== undefined && oldEmail !== request.expectedOldEmail) {
             return { status: 'stale' };
         }
-        const otherUser = (await conn.query('SELECT u_uuid FROM `shield_app`.`users` WHERE u_email = ? AND u_uuid <> ? LIMIT 1 FOR UPDATE', [newEmail, principalId]));
+        const otherUser = (await conn.query(`SELECT u_uuid FROM ${this.usersTable} WHERE u_email = ? AND u_uuid <> ? LIMIT 1 FOR UPDATE`, [newEmail, principalId]));
         if (otherUser.length > 0)
             return { status: 'unavailable' };
-        const hintOwners = (await conn.query('SELECT ic_principal_id FROM `shield_identity`.`identity_credential` WHERE ic_identity_hint = ? FOR UPDATE', [newEmail]));
+        const hintOwners = (await conn.query(`SELECT ic_principal_id FROM ${this.credentialTable} WHERE ic_identity_hint = ? FOR UPDATE`, [newEmail]));
         if (hintOwners.some((h) => h.ic_principal_id !== principalId))
             return { status: 'unavailable' };
         const selfAlreadyHasNewHint = hintOwners.length > 0;
-        await conn.query('SELECT ic_identity_hint FROM `shield_identity`.`identity_credential` WHERE ic_principal_id = ? FOR UPDATE', [principalId]);
+        await conn.query(`SELECT ic_identity_hint FROM ${this.credentialTable} WHERE ic_principal_id = ? FOR UPDATE`, [principalId]);
         // Steps 3–4: a duplicate key here is a row the locked reads could not see (written by a path
         // without the named lock); the index refuses it → `unavailable`, and `change` rolls back.
         let hintMoved = false;
         try {
-            await conn.query('UPDATE `shield_app`.`users` SET u_email = ? WHERE u_uuid = ?', [
+            await conn.query(`UPDATE ${this.usersTable} SET u_email = ? WHERE u_uuid = ?`, [
                 newEmail,
                 principalId,
             ]);
             if (oldEmail !== null && oldEmail !== '' && !selfAlreadyHasNewHint) {
-                const moved = (await conn.query(`UPDATE \`shield_identity\`.\`identity_credential\`
+                const moved = (await conn.query(`UPDATE ${this.credentialTable}
               SET ic_identity_hint = ?, ic_updated_at_ms = ?
             WHERE ic_principal_id = ? AND ic_identity_hint = ?`, [newEmail, this.now(), principalId, oldEmail]));
                 hintMoved = moved.affectedRows > 0;
@@ -104,7 +117,7 @@ class MariaDbEmailAddressChanger {
                 return { status: 'unavailable' }; // the driver message is dropped
             throw err;
         }
-        await conn.query(`UPDATE \`shield_identity\`.\`email_change_token\` SET ect_consumed_at_ms = ?
+        await conn.query(`UPDATE ${this.tokenTable} SET ect_consumed_at_ms = ?
         WHERE ect_principal_id = ? AND ect_consumed_at_ms IS NULL`, [this.now(), principalId]);
         if (request.withinTransaction !== undefined) {
             await request.withinTransaction((sql, params) => conn.query(sql, params ?? []), { oldEmail, hintMoved });

package/dist/authentication/mariadb-email-change-token-store.d.ts

@@ -14,10 +14,17 @@
  */
 import type { Pool } from 'mariadb';
 import type { EmailChangeTokenBinding, EmailChangeTokenIssue, EmailChangeTokenStore } from '../auth/ports/email-change-token-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbEmailChangeTokenStore implements EmailChangeTokenStore {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** `<identity>`.`email_change_token`. */
+    private readonly table;
+    /** `<app>`.`users`. */
+    private readonly usersTable;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     issue(token: EmailChangeTokenIssue): Promise<void>;
     consume(tokenHash: string): Promise<EmailChangeTokenBinding | null>;
     invalidateAllForPrincipal(principalId: string): Promise<void>;

package/dist/authentication/mariadb-email-change-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-email-change-token-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-change-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,2CAA2C,CAAC;AAYnD,qBAAa,4BAA6B,YAAW,qBAAqB;IAEtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2ClD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAwBnE,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOpE"}
+{"version":3,"file":"mariadb-email-change-token-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-change-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAU7C,qBAAa,4BAA6B,YAAW,qBAAqB;IAOtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,uBAAuB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2ClD,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAwBnE,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOpE"}

package/dist/authentication/mariadb-email-change-token-store.js

@@ -1,13 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbEmailChangeTokenStore = void 0;
-const TABLE = '`shield_identity`.`email_change_token`';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbEmailChangeTokenStore {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<identity>`.`email_change_token`. */
+    table;
+    /** `<app>`.`users`. */
+    usersTable;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'email_change_token');
+        this.usersTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'users');
     }
     async issue(token) {
         const now = this.now();
@@ -15,13 +24,13 @@ class MariaDbEmailChangeTokenStore {
         try {
             await conn.beginTransaction();
             try {
-                const user = (await conn.query('SELECT u_uuid FROM `shield_app`.`users` WHERE u_uuid = ? FOR UPDATE', [token.principalId]));
+                const user = (await conn.query(`SELECT u_uuid FROM ${this.usersTable} WHERE u_uuid = ? FOR UPDATE`, [token.principalId]));
                 if (user.length === 0)
                     throw new Error('email change: unknown user');
-                await conn.query(`DELETE FROM ${TABLE} WHERE ect_expires_at_ms <= ?`, [now]);
-                await conn.query(`UPDATE ${TABLE} SET ect_consumed_at_ms = ?
+                await conn.query(`DELETE FROM ${this.table} WHERE ect_expires_at_ms <= ?`, [now]);
+                await conn.query(`UPDATE ${this.table} SET ect_consumed_at_ms = ?
             WHERE ect_principal_id = ? AND ect_consumed_at_ms IS NULL`, [now, token.principalId]);
-                await conn.query(`INSERT INTO ${TABLE}
+                await conn.query(`INSERT INTO ${this.table}
              (ect_token_hash, ect_principal_id, ect_new_email, ect_old_email, ect_session_id,
               ect_tenant_id, ect_expires_at_ms, ect_consumed_at_ms, ect_created_at_ms)
            VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`, [
@@ -47,12 +56,12 @@ class MariaDbEmailChangeTokenStore {
     }
     async consume(tokenHash) {
         const now = this.now();
-        const res = (await this.pool.query(`UPDATE ${TABLE} SET ect_consumed_at_ms = ?
+        const res = (await this.pool.query(`UPDATE ${this.table} SET ect_consumed_at_ms = ?
         WHERE ect_token_hash = ? AND ect_consumed_at_ms IS NULL AND ect_expires_at_ms > ?`, [now, tokenHash, now]));
         if (res.affectedRows !== 1)
             return null;
         const rows = (await this.pool.query(`SELECT ect_principal_id, ect_new_email, ect_old_email, ect_session_id, ect_tenant_id
-         FROM ${TABLE} WHERE ect_token_hash = ? LIMIT 1`, [tokenHash]));
+         FROM ${this.table} WHERE ect_token_hash = ? LIMIT 1`, [tokenHash]));
         const row = rows[0];
         if (row === undefined)
             return null; // the user was deleted in between (FK cascade)
@@ -65,7 +74,7 @@ class MariaDbEmailChangeTokenStore {
         };
     }
     async invalidateAllForPrincipal(principalId) {
-        await this.pool.query(`UPDATE ${TABLE} SET ect_consumed_at_ms = ?
+        await this.pool.query(`UPDATE ${this.table} SET ect_consumed_at_ms = ?
         WHERE ect_principal_id = ? AND ect_consumed_at_ms IS NULL`, [this.now(), principalId]);
     }
 }

package/dist/authentication/mariadb-mfa-device-store.d.ts

@@ -1,8 +1,13 @@
 import type { Pool } from 'mariadb';
 import type { MfaDevice, MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbMfaDeviceStore implements MfaDeviceStore {
     private readonly pool;
-    constructor(pool: Pool);
+    /** `<identity>`.`mfa_device`, resolved at construction. */
+    private readonly table;
+    constructor(pool: Pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     listAll(principalId: string): Promise<MfaDevice[]>;
     listConfirmedSecrets(principalId: string): Promise<string[]>;
     getSecret(principalId: string, deviceId: string): Promise<string | null>;

package/dist/authentication/mariadb-mfa-device-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-mfa-device-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-device-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAuBnF,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASlD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS5D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASxE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBhE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAetF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}
+{"version":3,"file":"mariadb-mfa-device-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-device-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAuB7C,qBAAa,qBAAsB,YAAW,cAAc;IAKxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAK1B,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASlD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS5D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASxE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBhE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAetF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}

package/dist/authentication/mariadb-mfa-device-store.js

@@ -24,6 +24,7 @@ exports.MariaDbMfaDeviceStore = void 0;
  * other method's genuine store outage propagates (fails loud), never swallowed.
  */
 const node_crypto_1 = require("node:crypto");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** Pending-device TTL — a `begin` never confirmed within this window is self-pruned. */
 const PENDING_TTL_MS = 15 * 60 * 1000;
 /** Map a DB row → the display shape (NO secret). BIGINT columns arrive as bigint → Number. */
@@ -36,67 +37,75 @@ const toDevice = (r) => ({
 });
 class MariaDbMfaDeviceStore {
     pool;
-    constructor(pool) {
+    /** `<identity>`.`mfa_device`, resolved at construction. */
+    table;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'mfa_device');
     }
     async listAll(principalId) {
         const rows = (await this.pool.query(`SELECT md_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms
-         FROM \`shield_identity\`.\`mfa_device\` WHERE md_principal_id = ? ORDER BY md_created_at_ms ASC`, [principalId]));
+         FROM ${this.table} WHERE md_principal_id = ? ORDER BY md_created_at_ms ASC`, [principalId]));
         return rows.map(toDevice);
     }
     async listConfirmedSecrets(principalId) {
-        const rows = (await this.pool.query(`SELECT md_secret FROM \`shield_identity\`.\`mfa_device\`
+        const rows = (await this.pool.query(`SELECT md_secret FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL`, [principalId]));
         return rows.map((r) => r.md_secret);
     }
     async getSecret(principalId, deviceId) {
-        const rows = (await this.pool.query(`SELECT md_secret FROM \`shield_identity\`.\`mfa_device\`
+        const rows = (await this.pool.query(`SELECT md_secret FROM ${this.table}
         WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
         return rows[0]?.md_secret ?? null;
     }
     async begin(principalId, name, secret) {
         // Prune the caller's stale pending rows first (self-pruning; no cron).
-        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\`
+        await this.pool.query(`DELETE FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NULL AND md_created_at_ms < ?`, [principalId, Date.now() - PENDING_TTL_MS]);
         const id = (0, node_crypto_1.randomUUID)();
-        await this.pool.query(`INSERT INTO \`shield_identity\`.\`mfa_device\`
+        await this.pool.query(`INSERT INTO ${this.table}
          (md_id, md_principal_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms)
        VALUES (?, ?, ?, ?, ?, NULL, NULL)`, [id, principalId, name, secret, Date.now()]);
         return id;
     }
     async confirm(principalId, deviceId) {
-        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_confirmed_at_ms = ?
+        const res = (await this.pool.query(`UPDATE ${this.table} SET md_confirmed_at_ms = ?
         WHERE md_id = ? AND md_principal_id = ? AND md_confirmed_at_ms IS NULL`, [Date.now(), deviceId, principalId]));
         if (res.affectedRows !== 1)
             return false;
         // KI #14 re-review: once a device is confirmed MFA is on, so every later begin needs a code.
         // Drop the principal's OTHER pending devices: one begun by a stolen session while MFA was
         // still off (between the user's own begin and confirm) must not stay confirmable.
-        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\`
+        await this.pool.query(`DELETE FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NULL AND md_id <> ?`, [principalId, deviceId]);
         return true;
     }
     async rename(principalId, deviceId, name) {
-        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_name = ?
+        const res = (await this.pool.query(`UPDATE ${this.table} SET md_name = ?
         WHERE md_id = ? AND md_principal_id = ?`, [name, deviceId, principalId]));
         if (res.affectedRows !== 1)
             return null;
         const rows = (await this.pool.query(`SELECT md_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms
-         FROM \`shield_identity\`.\`mfa_device\` WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
+         FROM ${this.table} WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
         return rows[0] ? toDevice(rows[0]) : null;
     }
     async remove(principalId, deviceId) {
-        const res = (await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\` WHERE md_id = ? AND md_principal_id = ?`, [deviceId, principalId]));
+        const res = (await this.pool.query(`DELETE FROM ${this.table} WHERE md_id = ? AND md_principal_id = ?`, [deviceId, principalId]));
         return res.affectedRows === 1;
     }
     async countConfirmed(principalId) {
-        const rows = (await this.pool.query(`SELECT COUNT(*) AS c FROM \`shield_identity\`.\`mfa_device\`
+        const rows = (await this.pool.query(`SELECT COUNT(*) AS c FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL`, [principalId]));
         return Number(rows[0]?.c ?? 0);
     }
     async stampUsed(secret) {
         try {
-            await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_last_used_at_ms = ? WHERE md_secret = ?`, [Date.now(), secret]);
+            await this.pool.query(`UPDATE ${this.table} SET md_last_used_at_ms = ? WHERE md_secret = ?`, [
+                Date.now(),
+                secret,
+            ]);
         }
         catch {
             // best-effort; a stamp failure must never fail a login.

package/dist/authentication/mariadb-profile-resolver.d.ts

@@ -14,10 +14,15 @@
 import type { Pool } from 'mariadb';
 import type { Principal } from '@astram/core';
 import type { CurrentUserProfile, ProfileResolver } from '../auth/profile-resolver.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbProfileResolver implements ProfileResolver {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** The org database (`<app>`), resolved at construction. */
+    private readonly app;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     resolve(principal: Principal): Promise<CurrentUserProfile | null>;
     private resolveRoleNames;
 }

package/dist/authentication/mariadb-profile-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-profile-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAe,MAAM,6BAA6B,CAAC;AAcpG,qBAAa,sBAAuB,YAAW,eAAe;IAE1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;YA4BzD,gBAAgB;CAc/B"}
+{"version":3,"file":"mariadb-profile-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAe,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAc7C,qBAAa,sBAAuB,YAAW,eAAe;IAK1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAGV,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAK1B,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;YA4BzD,gBAAgB;CAc/B"}

package/dist/authentication/mariadb-profile-resolver.js

@@ -14,21 +14,27 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbProfileResolver = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbProfileResolver {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** The org database (`<app>`), resolved at construction. */
+    app;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        this.app = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).app;
     }
     async resolve(principal) {
         const userUuid = principal.id;
         const companyUuid = principal.tenantId;
-        const users = (await this.pool.query('SELECT u_username, u_email FROM `shield_app`.`users` WHERE u_uuid = ? LIMIT 1', [userUuid]));
+        const users = (await this.pool.query(`SELECT u_username, u_email FROM \`${this.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [userUuid]));
         const user = users[0];
         if (!user)
             return null; // deleted user → no profile (never id-leak; endpoint 404s)
-        const companies = (await this.pool.query('SELECT c_name FROM `shield_app`.`companies` WHERE c_uuid = ? LIMIT 1', [companyUuid]));
+        const companies = (await this.pool.query(`SELECT c_name FROM \`${this.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [companyUuid]));
         const companyName = companies[0]?.c_name ?? '(unknown company)';
         const roles = await this.resolveRoleNames(userUuid, companyUuid);
         return {
@@ -42,9 +48,9 @@ class MariaDbProfileResolver {
     async resolveRoleNames(userUuid, companyUuid) {
         const nowMs = this.now();
         const rows = (await this.pool.query(`SELECT DISTINCT r.r_uuid, r.r_name
-         FROM \`shield_app\`.\`membership_posting\` mp
-         JOIN \`shield_app\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
-         JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = mp.mp_role_uuid
+         FROM \`${this.app}\`.\`membership_posting\` mp
+         JOIN \`${this.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+         JOIN \`${this.app}\`.\`roles\` r ON r.r_uuid = mp.mp_role_uuid
         WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ?
           AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
           AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [userUuid, companyUuid, nowMs, nowMs]));

package/dist/authentication/mariadb-profile-writer.d.ts

@@ -7,10 +7,15 @@
 import type { Pool } from 'mariadb';
 import { type ProfileWriter } from '../auth/ports/profile-writer.js';
 import type { CurrentUserProfile } from '../auth/profile-resolver.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbProfileWriter implements ProfileWriter {
     private readonly pool;
     private readonly resolver;
-    constructor(pool: Pool);
+    /** The org database (`<app>`), resolved at construction; the re-read resolver uses the same. */
+    private readonly app;
+    constructor(pool: Pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     update(principalId: string, changes: {
         name?: string;
         email?: string;

package/dist/authentication/mariadb-profile-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgBtE,qBAAa,oBAAqB,YAAW,aAAa;IAE5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;gBACrB,IAAI,EAAE,IAAI;IAIjC,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,CAAC;CAgD/B"}
+{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAe7C,qBAAa,oBAAqB,YAAW,aAAa;IAKtD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,gGAAgG;IAChG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEV,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,CAAC;CAgD/B"}

package/dist/authentication/mariadb-profile-writer.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbProfileWriter = void 0;
 const profile_writer_js_1 = require("../auth/ports/profile-writer.js");
 const mariadb_profile_resolver_js_1 = require("./mariadb-profile-resolver.js");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** MariaDB `ER_DUP_ENTRY`: here `IDX_users_username` refused the name (KI #97). */
 const ER_DUP_ENTRY = 1062;
 function isDuplicateKey(err) {
@@ -14,9 +15,15 @@ function isDuplicateKey(err) {
 class MariaDbProfileWriter {
     pool;
     resolver;
-    constructor(pool) {
+    /** The org database (`<app>`), resolved at construction; the re-read resolver uses the same. */
+    app;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
-        this.resolver = new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool);
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.app = s.app;
+        this.resolver = new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool, undefined, s);
     }
     async update(principalId, changes) {
         // Phase 12 / KI #87: the email is written ONLY by the verified email-change flow
@@ -34,7 +41,7 @@ class MariaDbProfileWriter {
         if (sets.length > 0) {
             params.push(principalId);
             try {
-                await this.pool.query(`UPDATE \`shield_app\`.\`users\` SET ${sets.join(', ')} WHERE u_uuid = ?`, params);
+                await this.pool.query(`UPDATE \`${this.app}\`.\`users\` SET ${sets.join(', ')} WHERE u_uuid = ?`, params);
             }
             catch (err) {
                 // KI #97: the driver message quotes the value; drop it and answer a typed conflict.
@@ -44,7 +51,7 @@ class MariaDbProfileWriter {
             }
         }
         // Resolve the caller's active company so the re-read profile is tenant-correct.
-        const active = (await this.pool.query("SELECT cm_company_uuid FROM `shield_app`.`company_membership` WHERE cm_user_uuid = ? AND cm_is_active = 1 AND cm_status = 'active' LIMIT 1", [principalId]));
+        const active = (await this.pool.query(`SELECT cm_company_uuid FROM \`${this.app}\`.\`company_membership\` WHERE cm_user_uuid = ? AND cm_is_active = 1 AND cm_status = 'active' LIMIT 1`, [principalId]));
         const tenantId = active[0]?.cm_company_uuid ?? '';
         const profile = await this.resolver.resolve({
             kind: 'user',

package/dist/authentication/mariadb-recovery-code-store.d.ts

@@ -21,14 +21,19 @@
 import type { Pool } from 'mariadb';
 import type { PasswordHasher } from '@astram/core';
 import type { RecoveryCodeStore } from '../auth/ports/recovery-code-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbRecoveryCodeStore implements RecoveryCodeStore {
     private readonly pool;
     /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
     private readonly hasher;
     private readonly now;
+    /** `<identity>`.`mfa_recovery_code`, resolved at construction. */
+    private readonly table;
     constructor(pool: Pool, 
     /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
-    hasher: PasswordHasher, now?: () => number);
+    hasher: PasswordHasher, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     /**
      * Replace the principal's entire recovery-code set with `codeHashes` (already
      * Argon2-hashed). Wipes any prior codes first, then inserts the new batch. Passing

package/dist/authentication/mariadb-recovery-code-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-recovery-code-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-recovery-code-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAM9E,qBAAa,wBAAyB,YAAW,iBAAiB;IAE9D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI;IAC3B,+EAA+E;IAC9D,MAAM,EAAE,cAAc,EACtB,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnF;;;;;;OAMG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAqBtE"}
+{"version":3,"file":"mariadb-recovery-code-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-recovery-code-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAM7C,qBAAa,wBAAyB,YAAW,iBAAiB;IAK9D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,kEAAkE;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI;IAC3B,+EAA+E;IAC9D,MAAM,EAAE,cAAc,EACtB,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQhC;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAanF;;;;;;OAMG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAqBtE"}

package/dist/authentication/mariadb-recovery-code-store.js

@@ -1,16 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbRecoveryCodeStore = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbRecoveryCodeStore {
     pool;
     hasher;
     now;
+    /** `<identity>`.`mfa_recovery_code`, resolved at construction. */
+    table;
     constructor(pool, 
     /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
-    hasher, now = Date.now) {
+    hasher, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.hasher = hasher;
         this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'mfa_recovery_code');
     }
     /**
      * Replace the principal's entire recovery-code set with `codeHashes` (already
@@ -18,10 +24,10 @@ class MariaDbRecoveryCodeStore {
      * an empty array simply wipes (used when MFA is disabled).
      */
     async replaceAll(principalId, codeHashes) {
-        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_recovery_code\` WHERE mrc_principal_id = ?`, [principalId]);
+        await this.pool.query(`DELETE FROM ${this.table} WHERE mrc_principal_id = ?`, [principalId]);
         const createdAt = this.now();
         for (const hash of codeHashes) {
-            await this.pool.query(`INSERT INTO \`shield_identity\`.\`mfa_recovery_code\`
+            await this.pool.query(`INSERT INTO ${this.table}
            (mrc_principal_id, mrc_code_hash, mrc_consumed_at_ms, mrc_created_at_ms)
          VALUES (?, ?, NULL, ?)`, [principalId, hash, createdAt]);
         }
@@ -36,11 +42,11 @@ class MariaDbRecoveryCodeStore {
     async consume(principalId, rawCode) {
         if (typeof rawCode !== 'string' || rawCode.length === 0)
             return false;
-        const rows = (await this.pool.query(`SELECT mrc_code_hash FROM \`shield_identity\`.\`mfa_recovery_code\`
+        const rows = (await this.pool.query(`SELECT mrc_code_hash FROM ${this.table}
         WHERE mrc_principal_id = ? AND mrc_consumed_at_ms IS NULL`, [principalId]));
         for (const row of rows) {
             if (await this.hasher.verify(row.mrc_code_hash, rawCode)) {
-                const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_recovery_code\`
+                const res = (await this.pool.query(`UPDATE ${this.table}
               SET mrc_consumed_at_ms = ?
             WHERE mrc_principal_id = ? AND mrc_code_hash = ? AND mrc_consumed_at_ms IS NULL`, [this.now(), principalId, row.mrc_code_hash]));
                 // Single-use guard: only the UPDATE that flips NULL→consumed wins.

package/dist/authentication/mariadb-reset-token-store.d.ts

@@ -15,10 +15,15 @@
  */
 import type { Pool } from 'mariadb';
 import type { ResetTokenStore } from '../auth/ports/reset-token-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbResetTokenStore implements ResetTokenStore {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** `<identity>`.`password_reset_token`, resolved at construction. */
+    private readonly table;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     issue(principalId: string, tokenHash: string, expiresAtMs: number): Promise<void>;
     consume(tokenHash: string): Promise<string | null>;
     invalidateAllForPrincipal(principalId: string): Promise<void>;

package/dist/authentication/mariadb-reset-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-reset-token-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-reset-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAM1E,qBAAa,sBAAuB,YAAW,eAAe;IAE1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0BlD,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpE"}
+{"version":3,"file":"mariadb-reset-token-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-reset-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAM7C,qBAAa,sBAAuB,YAAW,eAAe;IAK1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0BlD,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpE"}

package/dist/authentication/mariadb-reset-token-store.js

@@ -1,15 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbResetTokenStore = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbResetTokenStore {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<identity>`.`password_reset_token`, resolved at construction. */
+    table;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'password_reset_token');
     }
     async issue(principalId, tokenHash, expiresAtMs) {
-        await this.pool.query(`INSERT INTO \`shield_identity\`.\`password_reset_token\`
+        await this.pool.query(`INSERT INTO ${this.table}
          (prt_token_hash, prt_principal_id, prt_expires_at_ms, prt_consumed_at_ms, prt_created_at_ms)
        VALUES (?, ?, ?, NULL, ?)`, [tokenHash, principalId, expiresAtMs, this.now()]);
     }
@@ -17,7 +23,7 @@ class MariaDbResetTokenStore {
         const now = this.now();
         // 1) Find an unexpired, unconsumed token for this hash.
         const rows = (await this.pool.query(`SELECT prt_principal_id
-         FROM \`shield_identity\`.\`password_reset_token\`
+         FROM ${this.table}
         WHERE prt_token_hash = ? AND prt_consumed_at_ms IS NULL AND prt_expires_at_ms > ?
         LIMIT 1`, [tokenHash, now]));
         const principalId = rows[0]?.prt_principal_id;
@@ -25,7 +31,7 @@ class MariaDbResetTokenStore {
             return null;
         // 2) Atomically claim it (single-use). The `IS NULL` guard + affectedRows check means a
         //    concurrent consume can never both succeed — the loser sees 0 rows and returns null.
-        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`password_reset_token\`
+        const res = (await this.pool.query(`UPDATE ${this.table}
           SET prt_consumed_at_ms = ?
         WHERE prt_token_hash = ? AND prt_consumed_at_ms IS NULL`, [now, tokenHash]));
         if (res.affectedRows !== 1)
@@ -35,7 +41,7 @@ class MariaDbResetTokenStore {
     async invalidateAllForPrincipal(principalId) {
         // Burn every outstanding (unconsumed) token for the principal after a successful reset, so a
         // second still-valid link cannot re-reset.
-        await this.pool.query(`UPDATE \`shield_identity\`.\`password_reset_token\`
+        await this.pool.query(`UPDATE ${this.table}
           SET prt_consumed_at_ms = ?
         WHERE prt_principal_id = ? AND prt_consumed_at_ms IS NULL`, [this.now(), principalId]);
     }

package/dist/authentication/mariadb-session-sweeper.d.ts

@@ -23,6 +23,7 @@
 import type { Pool } from 'mariadb';
 import type { SessionSweeper } from '../auth/ports/session-sweeper.js';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 /** The binder surface the sweeper needs; `unbindSessionStrict` (throws on a Redis error) is preferred. */
 type SweepBinder = Pick<SessionTokenBinder, 'unbindSession'> & Partial<Pick<SessionTokenBinder, 'unbindSessionStrict'>>;
 export declare class MariaDbSessionSweeper implements SessionSweeper {
@@ -30,9 +31,13 @@ export declare class MariaDbSessionSweeper implements SessionSweeper {
     private readonly binder;
     /** Clock for the "not yet expired" unbind window (epoch-ms). */
     private readonly now;
+    /** `<identity>`.`session`, resolved at construction (configurable-framework-db). */
+    private readonly sessionTable;
     constructor(pool: Pool, binder: SweepBinder, 
     /** Clock for the "not yet expired" unbind window (epoch-ms). */
-    now?: () => number);
+    now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     /**
      * Unbind the given sessions in Redis. Every session is attempted; if any unbind failed, the
      * FIRST error is thrown afterwards (Phase 3 review P1), so an administrative revoke reports it