@astram/guard 0.13.0 → 0.15.0

package/dist/config/app-config.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
+exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
+exports.frameworkSchemasOf = frameworkSchemasOf;
 exports.isDevOrTestNodeEnv = isDevOrTestNodeEnv;
 exports.loadPoolBudget = loadPoolBudget;
 exports.loadDbConfig = loadDbConfig;
@@ -13,8 +14,18 @@ exports.loadRefreshHmacKey = loadRefreshHmacKey;
 exports.assertRefreshHmacKey = assertRefreshHmacKey;
 exports.loadAppConfig = loadAppConfig;
 exports.loadAppConfigAsync = loadAppConfigAsync;
+exports.loadObjectStorageConfig = loadObjectStorageConfig;
 exports.evaluatePoolBudget = evaluatePoolBudget;
 const core_1 = require("@astram/core");
+const loopback_host_js_1 = require("./loopback-host.js");
+/**
+ * The resolved framework database names for a config: `config.schemas`, else resolved from
+ * `process.env` (a hand-built config without `schemas`). Call at boot only (Shield #12).
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` (fail closed).
+ */
+function frameworkSchemasOf(config) {
+    return config.schemas ?? (0, core_1.resolveFrameworkSchemas)(process.env);
+}
 /** Plan D3 default: 50 failed logins per client IP per 15 minutes. */
 exports.DEFAULT_LOGIN_IP_LIMIT = {
     maxAttempts: 50,
@@ -100,12 +111,18 @@ function loadPoolBudget(env = process.env) {
 // lifetimes. All pure env-readers with documented defaults; the ONLY hard-
 // required value is the refresh HMAC key (fail-closed).
 // ---------------------------------------------------------------------------
-/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+/** The default-namespace framework names (`SHIELD_DB_NAMESPACE` unset). */
+const DEFAULT_FRAMEWORK_SCHEMAS = (0, core_1.resolveFrameworkSchemas)({});
+/**
+ * Documented defaults for the runtime MariaDB descriptor (local docker substrate), for the
+ * default namespace. Under `SHIELD_DB_NAMESPACE` the user and database follow the namespace
+ * (`<ns>_core`, `<ns>_identity`; see {@link loadDbConfig}).
+ */
 exports.DEFAULT_DB_CONFIG = {
     host: 'localhost',
     port: 3306,
-    user: 'shield_core',
-    database: 'shield_identity',
+    user: (0, core_1.frameworkAccountName)(DEFAULT_FRAMEWORK_SCHEMAS.namespace, 'core'),
+    database: DEFAULT_FRAMEWORK_SCHEMAS.identity,
 };
 /** Documented default Redis url (local docker substrate). */
 exports.DEFAULT_REDIS_URL = 'redis://localhost:6379';
@@ -137,14 +154,29 @@ function parseOptionalPositiveInt(raw) {
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
  * which is a fail-closed security invariant even for unit tests).
+ *
+ * Namespace (configurable-framework-db, spec 5.C): `APP_DB_USER` unset ⇒ `<ns>_core`;
+ * `APP_DB_NAME` unset ⇒ `<ns>_identity`. A set `APP_DB_NAME` must be one of the four resolved
+ * framework names, else this throws naming the variable (fail closed: an unqualified query must
+ * not reach another environment's database). An invalid `SHIELD_DB_NAMESPACE` throws too.
+ *
+ * `schemas` (optional): names the caller already resolved (e.g. `IdentityFeatureModule.forRoot
+ * ({ schemas })`). When given they replace the env namespace for the defaults and the
+ * `APP_DB_NAME` check, so the runtime database cannot drift from them (G-007 QA P2-5).
  */
-function loadDbConfig(env = process.env) {
+function loadDbConfig(env = process.env, schemas = (0, core_1.resolveFrameworkSchemas)(env)) {
+    const database = parseString(env.APP_DB_NAME, schemas.identity);
+    const allowed = [schemas.app, schemas.identity, schemas.authz, schemas.audit];
+    if (!allowed.includes(database)) {
+        throw new core_1.FrameworkSchemaConfigError(`APP_DB_NAME must be one of the framework databases for namespace ` +
+            `"${schemas.namespace}" (${allowed.join(', ')}); unset it for ${schemas.identity}.`);
+    }
     return {
         host: parseString(env.APP_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
         port: parsePort(env.APP_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
-        user: parseString(env.APP_DB_USER, exports.DEFAULT_DB_CONFIG.user),
+        user: parseString(env.APP_DB_USER, (0, core_1.frameworkAccountName)(schemas.namespace, 'core')),
         password: parseString(env.APP_DB_PASSWORD, ''),
-        database: parseString(env.APP_DB_NAME, exports.DEFAULT_DB_CONFIG.database),
+        database,
         tls: loadDbTlsConfig(env),
     };
 }
@@ -279,6 +311,7 @@ function assertRefreshHmacKey(key) {
 function loadAppConfig(env = process.env) {
     const refreshReplayWindowMs = loadRefreshReplayWindowMs(env);
     return {
+        schemas: (0, core_1.resolveFrameworkSchemas)(env),
         port: parsePort(env.PORT, 3000),
         environment: parseEnvironment(env.NODE_ENV),
         pool: loadPoolBudget(env),
@@ -310,6 +343,95 @@ async function loadAppConfigAsync(provider, env = process.env) {
     const resolved = await (0, core_1.resolveSecretRefs)(env, provider);
     return loadAppConfig(resolved);
 }
+/** Default per-file cap when `OBJECT_STORAGE_MAX_BYTES` is unset (10 MiB, SPEC §10). */
+exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = 10 * 1024 * 1024;
+/**
+ * Read the object-storage config (FILE_STORAGE SPEC §5 F). Returns `undefined` when
+ * `OBJECT_STORAGE_BUCKET` is unset or blank (storage off). Otherwise every bad value is a boot
+ * error that names the variable and never its value (Shield #1, #10):
+ * - endpoint or either credential missing/blank;
+ * - endpoint not a URL, carrying userinfo, or not `https:` outside development/test unless the
+ *   host is loopback (the raw `NODE_ENV`; unset is not dev);
+ * - a credential still holding an unresolved `secret-ref:` value;
+ * - outside development/test, a credential not resolved from a `secret-ref:` per
+ *   `options.resolvedFromSecretRef` (`ShieldModule.forRoot({ storage: 'env' })` passes
+ *   `wasResolvedFromSecretRef`); without the option every credential there is refused;
+ * - `OBJECT_STORAGE_SSE` other than `AES256`;
+ * - `OBJECT_STORAGE_MAX_BYTES` not a plain positive decimal without leading zeros, or above the
+ *   50 MiB ceiling.
+ */
+function loadObjectStorageConfig(env = process.env, options = {}) {
+    const bucket = env.OBJECT_STORAGE_BUCKET?.trim();
+    if (!bucket)
+        return undefined;
+    const devOrTest = isDevOrTestNodeEnv(env.NODE_ENV);
+    const endpoint = requireStorageVar(env, 'OBJECT_STORAGE_ENDPOINT');
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error('OBJECT_STORAGE_ENDPOINT is not a valid URL');
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        throw new Error('OBJECT_STORAGE_ENDPOINT must be an https: (or local http:) URL');
+    }
+    if (url.username !== '' || url.password !== '') {
+        throw new Error('OBJECT_STORAGE_ENDPOINT must not carry credentials (use OBJECT_STORAGE_ACCESS_KEY_ID / ' +
+            'OBJECT_STORAGE_SECRET_ACCESS_KEY)');
+    }
+    if (url.protocol === 'http:' && !devOrTest && !(0, loopback_host_js_1.isLoopbackHost)(url.hostname)) {
+        throw new Error('OBJECT_STORAGE_ENDPOINT must use https: outside NODE_ENV development/test ' +
+            '(plain http: is allowed only to a loopback host)');
+    }
+    const credential = (name) => {
+        const value = requireStorageVar(env, name);
+        // `startsWith` via the core predicate on a widened copy: the predicate is a type guard.
+        if ((0, core_1.isSecretRef)(value)) {
+            throw new Error(`${name} still holds an unresolved secret-ref: value; call resolveBootSecrets() in main.ts ` +
+                'before loading AppModule');
+        }
+        // Fail closed: without a provenance check every credential counts as a literal here.
+        if (!devOrTest && !(options.resolvedFromSecretRef?.(name, env) === true)) {
+            throw new Error(`${name} must be a secret-ref: value outside NODE_ENV development/test ` +
+                '(literal credentials are refused; see ADR-0032)');
+        }
+        return value;
+    };
+    const accessKeyId = credential('OBJECT_STORAGE_ACCESS_KEY_ID');
+    const secretAccessKey = credential('OBJECT_STORAGE_SECRET_ACCESS_KEY');
+    const sse = env.OBJECT_STORAGE_SSE?.trim() || 'AES256';
+    if (sse !== 'AES256') {
+        throw new Error("OBJECT_STORAGE_SSE must be 'AES256' (SSE-S3); other modes are not supported");
+    }
+    return {
+        endpoint,
+        bucket,
+        region: env.OBJECT_STORAGE_REGION?.trim() || 'us-east-1',
+        accessKeyId,
+        secretAccessKey,
+        sse,
+        maxBytes: parseStorageMaxBytes(env.OBJECT_STORAGE_MAX_BYTES),
+    };
+}
+function requireStorageVar(env, name) {
+    const value = env[name]?.trim();
+    if (!value)
+        throw new Error(`${name} must be set when OBJECT_STORAGE_BUCKET is set`);
+    return value;
+}
+function parseStorageMaxBytes(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES;
+    // Plain decimal digits, no sign, exponent, separators or leading zeros.
+    const n = /^[1-9]\d*$/.test(value) ? Number(value) : NaN;
+    if (!Number.isSafeInteger(n) || n <= 0 || n > core_1.FILE_MAX_BYTES_CEILING) {
+        throw new Error(`OBJECT_STORAGE_MAX_BYTES must be a positive decimal integer (no leading zeros) of at most ` +
+            `${core_1.FILE_MAX_BYTES_CEILING} bytes`);
+    }
+    return n;
+}
 /**
  * Evaluate a pool budget. Pure: no throwing, no I/O — the caller decides how to
  * react (the boot assertion throws; tests inspect the fields).

package/dist/config/config.module.d.ts

@@ -1,5 +1,12 @@
 /** DI token for the resolved {@link AppConfig}. */
 export declare const APP_CONFIG: unique symbol;
+/**
+ * DI token for the resolved framework database names (core `FrameworkSchemas`:
+ * `{ namespace, app, identity, authz, audit, isDefault }`, frozen; configurable-framework-db,
+ * ADR-0037). Provided and exported app-wide by `ShieldModule` from `APP_CONFIG`, resolved once at
+ * boot; identity and app modules inject it instead of hard-coding `shield_*` names.
+ */
+export declare const FRAMEWORK_SCHEMAS: unique symbol;
 /**
  * Minimal config module (Scaffold).
  *

package/dist/config/config.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.module.d.ts","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":"AAGA,mDAAmD;AACnD,eAAO,MAAM,UAAU,eAAuB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAUa,YAAY;CAAG"}
+{"version":3,"file":"config.module.d.ts","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,eAAO,MAAM,UAAU,eAAuB,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,qBAaa,YAAY;CAAG"}

package/dist/config/config.module.js

@@ -6,11 +6,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigModule = exports.APP_CONFIG = void 0;
+exports.ConfigModule = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = void 0;
 const common_1 = require("@nestjs/common");
 const app_config_js_1 = require("./app-config.js");
+const boot_secrets_js_1 = require("../secrets/boot-secrets.js");
 /** DI token for the resolved {@link AppConfig}. */
 exports.APP_CONFIG = Symbol('APP_CONFIG');
+/**
+ * DI token for the resolved framework database names (core `FrameworkSchemas`:
+ * `{ namespace, app, identity, authz, audit, isDefault }`, frozen; configurable-framework-db,
+ * ADR-0037). Provided and exported app-wide by `ShieldModule` from `APP_CONFIG`, resolved once at
+ * boot; identity and app modules inject it instead of hard-coding `shield_*` names.
+ */
+exports.FRAMEWORK_SCHEMAS = Symbol('FRAMEWORK_SCHEMAS');
 /**
  * Minimal config module (Scaffold).
  *
@@ -27,7 +35,10 @@ exports.ConfigModule = ConfigModule = __decorate([
         providers: [
             {
                 provide: exports.APP_CONFIG,
-                useFactory: () => (0, app_config_js_1.loadAppConfig)(),
+                useFactory: () => {
+                    (0, boot_secrets_js_1.assertNoUnresolvedSecretRefs)(process.env);
+                    return (0, app_config_js_1.loadAppConfig)();
+                },
             },
         ],
         exports: [exports.APP_CONFIG],

package/dist/config/framework-schema-names.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The framework database names a guard store or adapter targets (configurable-framework-db,
+ * spec §5.C, ADR-0037). Every store takes them from its constructor; the module wiring passes
+ * `AppConfig.schemas` / `FRAMEWORK_SCHEMAS`, so no SQL in guard carries a database literal.
+ *
+ * SECURITY (Shield #12): names are resolved at CONSTRUCTION (boot), never per request; a store
+ * built outside the wiring resolves `SHIELD_DB_NAMESPACE` once here, so it can never split names
+ * across two namespaces. An invalid namespace throws (fail closed, Shield #1). Names reach SQL
+ * only after core's pattern check, which admits no backtick, quote, dot or whitespace.
+ */
+import { type FrameworkSchemas } from '@astram/core';
+/** The four framework database names (core `FrameworkSchemas` without its metadata). */
+export type FrameworkSchemaNames = Pick<FrameworkSchemas, 'app' | 'identity' | 'authz' | 'audit'>;
+/**
+ * `given` (each name checked with core `assertSchemaName`), else the names resolved from
+ * `SHIELD_DB_NAMESPACE` NOW. Call from a constructor or a boot-time factory only, never on a
+ * request path.
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` or an unsafe given name.
+ */
+export declare function schemaNamesAtConstruction(given?: FrameworkSchemaNames): FrameworkSchemaNames;
+/**
+ * An authz adapter's `opts.schema`: the given name, checked with core `assertSchemaName`, else
+ * the authz name resolved from `SHIELD_DB_NAMESPACE` NOW. Constructors / boot factories only.
+ * @throws FrameworkSchemaConfigError on an unsafe given name or an invalid namespace.
+ */
+export declare function authzSchemaAtConstruction(given?: string): string;
+/** The backtick-quoted `` `schema`.`table` `` reference for a validated database name. */
+export declare function qualifiedTableName(schema: string, table: string): string;
+//# sourceMappingURL=framework-schema-names.d.ts.map

package/dist/config/framework-schema-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-schema-names.d.ts","sourceRoot":"","sources":["../../src/config/framework-schema-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAElG;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAI5F;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/config/framework-schema-names.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schemaNamesAtConstruction = schemaNamesAtConstruction;
+exports.authzSchemaAtConstruction = authzSchemaAtConstruction;
+exports.qualifiedTableName = qualifiedTableName;
+/**
+ * The framework database names a guard store or adapter targets (configurable-framework-db,
+ * spec §5.C, ADR-0037). Every store takes them from its constructor; the module wiring passes
+ * `AppConfig.schemas` / `FRAMEWORK_SCHEMAS`, so no SQL in guard carries a database literal.
+ *
+ * SECURITY (Shield #12): names are resolved at CONSTRUCTION (boot), never per request; a store
+ * built outside the wiring resolves `SHIELD_DB_NAMESPACE` once here, so it can never split names
+ * across two namespaces. An invalid namespace throws (fail closed, Shield #1). Names reach SQL
+ * only after core's pattern check, which admits no backtick, quote, dot or whitespace.
+ */
+const core_1 = require("@astram/core");
+/**
+ * `given` (each name checked with core `assertSchemaName`), else the names resolved from
+ * `SHIELD_DB_NAMESPACE` NOW. Call from a constructor or a boot-time factory only, never on a
+ * request path.
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` or an unsafe given name.
+ */
+function schemaNamesAtConstruction(given) {
+    return given !== undefined
+        ? (0, core_1.assertFrameworkSchemaNames)(given, 'schemas')
+        : (0, core_1.resolveFrameworkSchemas)(process.env);
+}
+/**
+ * An authz adapter's `opts.schema`: the given name, checked with core `assertSchemaName`, else
+ * the authz name resolved from `SHIELD_DB_NAMESPACE` NOW. Constructors / boot factories only.
+ * @throws FrameworkSchemaConfigError on an unsafe given name or an invalid namespace.
+ */
+function authzSchemaAtConstruction(given) {
+    return given !== undefined
+        ? (0, core_1.assertSchemaName)(given, 'opts.schema')
+        : (0, core_1.resolveFrameworkSchemas)(process.env).authz;
+}
+/** The backtick-quoted `` `schema`.`table` `` reference for a validated database name. */
+function qualifiedTableName(schema, table) {
+    return `\`${schema}\`.\`${table}\``;
+}

package/dist/config/loopback-host.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Loopback host predicate, shared by the DB TLS boot warning (`auth/connections.ts`) and the
+ * object-storage endpoint check (`loadObjectStorageConfig`). Kept dependency-free here so
+ * `app-config.ts` can use it without importing the driver-loading connections module (which
+ * itself imports `app-config.ts`).
+ */
+/** `localhost`, `127.0.0.0/8` or `::1` (any case, with or without IPv6 brackets). */
+export declare function isLoopbackHost(host: string): boolean;
+//# sourceMappingURL=loopback-host.d.ts.map

package/dist/config/loopback-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-host.d.ts","sourceRoot":"","sources":["../../src/config/loopback-host.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOpD"}

package/dist/config/loopback-host.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Loopback host predicate, shared by the DB TLS boot warning (`auth/connections.ts`) and the
+ * object-storage endpoint check (`loadObjectStorageConfig`). Kept dependency-free here so
+ * `app-config.ts` can use it without importing the driver-loading connections module (which
+ * itself imports `app-config.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLoopbackHost = isLoopbackHost;
+/** `localhost`, `127.0.0.0/8` or `::1` (any case, with or without IPv6 brackets). */
+function isLoopbackHost(host) {
+    const h = host
+        .trim()
+        .toLowerCase()
+        .replace(/^\[(.*)\]$/, '$1');
+    if (h === 'localhost' || h === '::1' || h === '0:0:0:0:0:0:0:1')
+        return true;
+    return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}

package/dist/encryption/local-kek-crypto.d.ts

@@ -9,6 +9,12 @@ export declare class LocalKekCrypto implements CryptoPort {
     generateDek(): Promise<Dek>;
     wrapDek(dek: Dek, tenantId: string): Promise<WrappedDek>;
     unwrapDek(wrapped: WrappedDek, tenantId: string): Promise<Dek>;
+    /**
+     * Synchronous {@link unwrapDek} (same AEAD, same AAD binding) for boot paths that must fail
+     * closed before any async work runs (`createSecretsProviderFromEnv`). Throws on a wrong KEK,
+     * a wrong AAD or a malformed blob; never includes key material in the error.
+     */
+    unwrapDekSync(wrapped: WrappedDek, tenantId: string): Dek;
     encrypt(plaintext: Uint8Array, dek: Dek, tenantId: string): Promise<Ciphertext>;
     decrypt(ciphertext: Ciphertext, dek: Dek, tenantId: string): Promise<Uint8Array>;
 }

package/dist/encryption/local-kek-crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-kek-crypto.d.ts","sourceRoot":"","sources":["../../src/encryption/local-kek-crypto.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO5E,qBAAa,cAAe,YAAW,UAAU;;IAG/C;;;OAGG;gBACS,GAAG,EAAE,UAAU;IAOrB,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAI3B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxD,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAI9D,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA2BvF"}
+{"version":3,"file":"local-kek-crypto.d.ts","sourceRoot":"","sources":["../../src/encryption/local-kek-crypto.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO5E,qBAAa,cAAe,YAAW,UAAU;;IAG/C;;;OAGG;gBACS,GAAG,EAAE,UAAU;IAOrB,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAI3B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAIxD,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAIpE;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG;IAInD,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/E,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CA2BvF"}

package/dist/encryption/local-kek-crypto.js

@@ -44,6 +44,14 @@ class LocalKekCrypto {
         return this.#seal(this.#kek, Buffer.from(dek), tenantId);
     }
     async unwrapDek(wrapped, tenantId) {
+        return this.unwrapDekSync(wrapped, tenantId);
+    }
+    /**
+     * Synchronous {@link unwrapDek} (same AEAD, same AAD binding) for boot paths that must fail
+     * closed before any async work runs (`createSecretsProviderFromEnv`). Throws on a wrong KEK,
+     * a wrong AAD or a malformed blob; never includes key material in the error.
+     */
+    unwrapDekSync(wrapped, tenantId) {
         return new Uint8Array(this.#open(this.#kek, Buffer.from(wrapped), tenantId));
     }
     async encrypt(plaintext, dek, tenantId) {

package/dist/identity/identity-actions.d.ts

@@ -1,10 +1,10 @@
 /**
- * The fixed action vocabulary + module key for the framework's @astram/identity objects.
- * Engine ObjectTypes carry no action list, so actions are synthesized here — the ONE source
- * the module-registry bridge derives from. Permission keys are `identity:<typeKey>:<action>`.
- * (Ported from astram3. `cross_tenant_grant` gets its own override — see below — every other
- * type uses the CRUD verbs.)
+ * Module key + action-vocabulary constants for the framework's identity registry. Permission
+ * keys are `identity:<typeKey>:<action>`. A type's vocabulary is declared on its engine
+ * ObjectType (`actions` / `crudActions`, ADR-0038) and read through {@link actionsOf}; the
+ * constants below stay exported as the single literal each identity object declares.
  */
+import type { ObjectType } from '@astram/engine';
 export declare const MODULE_KEY = "identity";
 export declare const IDENTITY_ACTIONS: readonly ["read", "create", "update", "delete"];
 export type IdentityAction = (typeof IDENTITY_ACTIONS)[number];
@@ -33,6 +33,17 @@ export type RecordShareAction = (typeof RECORD_SHARE_ACTIONS)[number];
  */
 export declare const SERVICE_ACCOUNT_ACTIONS: readonly ["read", "create", "update", "delete", "manage_keys"];
 export type ServiceAccountAction = (typeof SERVICE_ACCOUNT_ACTIONS)[number];
-/** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
-export declare function actionsFor(typeKey: string): readonly string[];
+/**
+ * The action vocabulary declared on a registration (ADR-0038): the CRUD verbs then the declared
+ * extras, or exactly the declared list when `crudActions === false`. Delegates to engine
+ * `effectiveActions`, so an invalid declaration throws the same `RegistrationError`.
+ */
+export declare function actionsOf(reg: Pick<ObjectType, 'actions' | 'crudActions'>): readonly string[];
+/**
+ * @deprecated Use {@link actionsOf} with the type's registration. The vocabulary now lives on
+ * the object type (ADR-0038), so a typeKey alone cannot name it: this returns the CRUD verbs
+ * ({@link IDENTITY_ACTIONS}) for every type, including `cross_tenant_grant`, `record_share` and
+ * `service_account`. The framework no longer calls it.
+ */
+export declare function actionsFor(_typeKey: string): readonly string[];
 //# sourceMappingURL=identity-actions.d.ts.map

package/dist/identity/identity-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,gEAM1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAY5E,mGAAmG;AACnG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7D"}
+{"version":3,"file":"identity-actions.d.ts","sourceRoot":"","sources":["../../src/identity/identity-actions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,wCAAyC,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,4BAA6B,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,gEAM1B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,aAAa,CAAC,GAAG,SAAS,MAAM,EAAE,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE9D"}

package/dist/identity/identity-actions.js

@@ -1,14 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SERVICE_ACCOUNT_ACTIONS = exports.RECORD_SHARE_ACTIONS = exports.CROSS_TENANT_GRANT_ACTIONS = exports.IDENTITY_ACTIONS = exports.MODULE_KEY = void 0;
+exports.actionsOf = actionsOf;
 exports.actionsFor = actionsFor;
-/**
- * The fixed action vocabulary + module key for the framework's @astram/identity objects.
- * Engine ObjectTypes carry no action list, so actions are synthesized here — the ONE source
- * the module-registry bridge derives from. Permission keys are `identity:<typeKey>:<action>`.
- * (Ported from astram3. `cross_tenant_grant` gets its own override — see below — every other
- * type uses the CRUD verbs.)
- */
+const engine_1 = require("@astram/engine");
 exports.MODULE_KEY = 'identity';
 exports.IDENTITY_ACTIONS = ['read', 'create', 'update', 'delete'];
 /**
@@ -40,15 +35,19 @@ exports.SERVICE_ACCOUNT_ACTIONS = [
     'manage_keys',
 ];
 /**
- * Per-type action-vocabulary override. Every type not listed here defaults to
- * {@link IDENTITY_ACTIONS} (the CRUD verbs).
+ * The action vocabulary declared on a registration (ADR-0038): the CRUD verbs then the declared
+ * extras, or exactly the declared list when `crudActions === false`. Delegates to engine
+ * `effectiveActions`, so an invalid declaration throws the same `RegistrationError`.
+ */
+function actionsOf(reg) {
+    return (0, engine_1.effectiveActions)(reg);
+}
+/**
+ * @deprecated Use {@link actionsOf} with the type's registration. The vocabulary now lives on
+ * the object type (ADR-0038), so a typeKey alone cannot name it: this returns the CRUD verbs
+ * ({@link IDENTITY_ACTIONS}) for every type, including `cross_tenant_grant`, `record_share` and
+ * `service_account`. The framework no longer calls it.
  */
-const ACTIONS_BY_TYPE = {
-    cross_tenant_grant: exports.CROSS_TENANT_GRANT_ACTIONS,
-    record_share: exports.RECORD_SHARE_ACTIONS,
-    service_account: exports.SERVICE_ACCOUNT_ACTIONS,
-};
-/** The action vocabulary for `typeKey` — the per-type override if one exists, else the default. */
-function actionsFor(typeKey) {
-    return ACTIONS_BY_TYPE[typeKey] ?? exports.IDENTITY_ACTIONS;
+function actionsFor(_typeKey) {
+    return exports.IDENTITY_ACTIONS;
 }

package/dist/identity/module-registry.bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CA4B9F"}
+{"version":3,"file":"module-registry.bridge.d.ts","sourceRoot":"","sources":["../../src/identity/module-registry.bridge.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQlE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,cAAc,CA4B9F"}

package/dist/identity/module-registry.bridge.js

@@ -4,8 +4,10 @@ exports.buildIdentityModuleRegistry = buildIdentityModuleRegistry;
 /**
  * Bridge: engine ObjectTypes → a populated core ModuleRegistry. Ported from astram3 (framework
  * now owns identity). Engine ObjectTypes describe physical tables; core's gates + the
- * permission-facts projection need object types + ACTIONS + tiers + planes. ObjectTypes carry no
- * action list, so we synthesize per-type actions (actionsFor). Every action is `gated` — nothing
+ * permission-facts projection need object types + ACTIONS + tiers + planes. Each type's actions
+ * are its declared vocabulary (`actionsOf` = engine `effectiveActions`, ADR-0038): CRUD plus
+ * extras, or exactly the declared list for `crudActions: false`; an invalid declaration throws
+ * `RegistrationError` here. Every action is `gated` with the type's `access.plane` — nothing
  * open unless reclassified. `register()` throws on duplicate typeKey/permissionKey.
  */
 const core_1 = require("@astram/core");
@@ -30,7 +32,7 @@ function buildIdentityModuleRegistry(inputs) {
             ...(Object.keys(access).length > 0 ? { access } : {}),
         };
     });
-    const actions = regs.flatMap((r) => (0, identity_actions_js_1.actionsFor)(r.typeKey).map((actionKey) => ({
+    const actions = regs.flatMap((r) => (0, identity_actions_js_1.actionsOf)(r).map((actionKey) => ({
         actionKey,
         typeKey: r.typeKey,
         tier: 'gated',

package/dist/identity/permission-facts.adapter.d.ts

@@ -8,6 +8,7 @@
  * never a fabricated empty projection (that would silently read as "you have no grants").
  */
 import type { Pool } from 'mariadb';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export interface AuthFactDto {
     readonly action: string;
     readonly allowed: boolean;
@@ -29,7 +30,12 @@ export declare class MariaDbPermissionFactsAdapter {
     private readonly listActions;
     private readonly controlPlaneKeys;
     private readonly now;
-    constructor(pool: Pool, listActions: () => readonly string[], controlPlaneKeys: readonly string[], now?: () => number);
+    /** The org (`<app>`) and authorization (`<authz>`) databases, resolved at construction. */
+    private readonly app;
+    private readonly authz;
+    constructor(pool: Pool, listActions: () => readonly string[], controlPlaneKeys: readonly string[], now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     projectFor(principalId: string, tenantId: string, isRoot: boolean): Promise<AuthFactProjection>;
     currentVersionFor(_principalId: string, tenantId: string): Promise<number>;
     private readRoleIdsForTenant;

package/dist/identity/permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAYD,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAGzC,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC;IAmBxB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAepB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}
+{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAYD,qBAAa,6BAA6B;IAMtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC;IAmBxB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAepB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}

package/dist/identity/permission-facts.adapter.js

@@ -10,6 +10,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbPermissionFactsAdapter = exports.AuthorizationUnavailableError = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** A store/dependency outage while computing facts — the controller maps this to 503. */
 class AuthorizationUnavailableError extends Error {
     constructor(message = 'authorization_unavailable') {
@@ -23,11 +24,19 @@ class MariaDbPermissionFactsAdapter {
     listActions;
     controlPlaneKeys;
     now;
-    constructor(pool, listActions, controlPlaneKeys, now = Date.now) {
+    /** The org (`<app>`) and authorization (`<authz>`) databases, resolved at construction. */
+    app;
+    authz;
+    constructor(pool, listActions, controlPlaneKeys, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.listActions = listActions;
         this.controlPlaneKeys = controlPlaneKeys;
         this.now = now;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.app = s.app;
+        this.authz = s.authz;
     }
     async projectFor(principalId, tenantId, isRoot) {
         try {
@@ -62,9 +71,9 @@ class MariaDbPermissionFactsAdapter {
     async readRoleIdsForTenant(userUuid, companyUuid) {
         const nowMs = this.now();
         const rows = (await this.pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
-         FROM \`shield_app\`.\`company_membership\` cm
-         JOIN \`shield_app\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
-         JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+         FROM \`${this.app}\`.\`company_membership\` cm
+         JOIN \`${this.app}\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
+         JOIN \`${this.app}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
         WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1
           AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
           AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [userUuid, companyUuid, nowMs, nowMs]));
@@ -72,11 +81,11 @@ class MariaDbPermissionFactsAdapter {
     }
     async readGrantKeys(roleIds) {
         const placeholders = roleIds.map(() => '?').join(', ');
-        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`shield_authz\`.\`role_permission\` WHERE rp_role_uuid IN (${placeholders})`, [...roleIds]));
+        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.authz}\`.\`role_permission\` WHERE rp_role_uuid IN (${placeholders})`, [...roleIds]));
         return rows.map((r) => r.rp_perm_key);
     }
     async readVersion(tenantId) {
-        const rows = (await this.pool.query('SELECT apv_version FROM `shield_authz`.`authz_permission_version` WHERE apv_tenant_uuid = ? LIMIT 1', [tenantId]));
+        const rows = (await this.pool.query(`SELECT apv_version FROM \`${this.authz}\`.\`authz_permission_version\` WHERE apv_tenant_uuid = ? LIMIT 1`, [tenantId]));
         return rows[0] !== undefined ? Number(rows[0].apv_version) : 0;
     }
     /**