@astram/guard 0.14.0 → 0.15.0

package/dist/authentication/mariadb-email-change-token-store.js

@@ -1,13 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbEmailChangeTokenStore = void 0;
-const TABLE = '`shield_identity`.`email_change_token`';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbEmailChangeTokenStore {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<identity>`.`email_change_token`. */
+    table;
+    /** `<app>`.`users`. */
+    usersTable;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'email_change_token');
+        this.usersTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'users');
     }
     async issue(token) {
         const now = this.now();
@@ -15,13 +24,13 @@ class MariaDbEmailChangeTokenStore {
         try {
             await conn.beginTransaction();
             try {
-                const user = (await conn.query('SELECT u_uuid FROM `shield_app`.`users` WHERE u_uuid = ? FOR UPDATE', [token.principalId]));
+                const user = (await conn.query(`SELECT u_uuid FROM ${this.usersTable} WHERE u_uuid = ? FOR UPDATE`, [token.principalId]));
                 if (user.length === 0)
                     throw new Error('email change: unknown user');
-                await conn.query(`DELETE FROM ${TABLE} WHERE ect_expires_at_ms <= ?`, [now]);
-                await conn.query(`UPDATE ${TABLE} SET ect_consumed_at_ms = ?
+                await conn.query(`DELETE FROM ${this.table} WHERE ect_expires_at_ms <= ?`, [now]);
+                await conn.query(`UPDATE ${this.table} SET ect_consumed_at_ms = ?
             WHERE ect_principal_id = ? AND ect_consumed_at_ms IS NULL`, [now, token.principalId]);
-                await conn.query(`INSERT INTO ${TABLE}
+                await conn.query(`INSERT INTO ${this.table}
              (ect_token_hash, ect_principal_id, ect_new_email, ect_old_email, ect_session_id,
               ect_tenant_id, ect_expires_at_ms, ect_consumed_at_ms, ect_created_at_ms)
            VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`, [
@@ -47,12 +56,12 @@ class MariaDbEmailChangeTokenStore {
     }
     async consume(tokenHash) {
         const now = this.now();
-        const res = (await this.pool.query(`UPDATE ${TABLE} SET ect_consumed_at_ms = ?
+        const res = (await this.pool.query(`UPDATE ${this.table} SET ect_consumed_at_ms = ?
         WHERE ect_token_hash = ? AND ect_consumed_at_ms IS NULL AND ect_expires_at_ms > ?`, [now, tokenHash, now]));
         if (res.affectedRows !== 1)
             return null;
         const rows = (await this.pool.query(`SELECT ect_principal_id, ect_new_email, ect_old_email, ect_session_id, ect_tenant_id
-         FROM ${TABLE} WHERE ect_token_hash = ? LIMIT 1`, [tokenHash]));
+         FROM ${this.table} WHERE ect_token_hash = ? LIMIT 1`, [tokenHash]));
         const row = rows[0];
         if (row === undefined)
             return null; // the user was deleted in between (FK cascade)
@@ -65,7 +74,7 @@ class MariaDbEmailChangeTokenStore {
         };
     }
     async invalidateAllForPrincipal(principalId) {
-        await this.pool.query(`UPDATE ${TABLE} SET ect_consumed_at_ms = ?
+        await this.pool.query(`UPDATE ${this.table} SET ect_consumed_at_ms = ?
         WHERE ect_principal_id = ? AND ect_consumed_at_ms IS NULL`, [this.now(), principalId]);
     }
 }

package/dist/authentication/mariadb-mfa-device-store.d.ts

@@ -1,8 +1,13 @@
 import type { Pool } from 'mariadb';
 import type { MfaDevice, MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbMfaDeviceStore implements MfaDeviceStore {
     private readonly pool;
-    constructor(pool: Pool);
+    /** `<identity>`.`mfa_device`, resolved at construction. */
+    private readonly table;
+    constructor(pool: Pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     listAll(principalId: string): Promise<MfaDevice[]>;
     listConfirmedSecrets(principalId: string): Promise<string[]>;
     getSecret(principalId: string, deviceId: string): Promise<string | null>;

package/dist/authentication/mariadb-mfa-device-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-mfa-device-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-device-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAuBnF,qBAAa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASlD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS5D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASxE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBhE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAetF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}
+{"version":3,"file":"mariadb-mfa-device-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-mfa-device-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAuB7C,qBAAa,qBAAsB,YAAW,cAAc;IAKxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAK1B,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASlD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAS5D,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASxE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBzE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBhE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAetF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}

package/dist/authentication/mariadb-mfa-device-store.js

@@ -24,6 +24,7 @@ exports.MariaDbMfaDeviceStore = void 0;
  * other method's genuine store outage propagates (fails loud), never swallowed.
  */
 const node_crypto_1 = require("node:crypto");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** Pending-device TTL — a `begin` never confirmed within this window is self-pruned. */
 const PENDING_TTL_MS = 15 * 60 * 1000;
 /** Map a DB row → the display shape (NO secret). BIGINT columns arrive as bigint → Number. */
@@ -36,67 +37,75 @@ const toDevice = (r) => ({
 });
 class MariaDbMfaDeviceStore {
     pool;
-    constructor(pool) {
+    /** `<identity>`.`mfa_device`, resolved at construction. */
+    table;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'mfa_device');
     }
     async listAll(principalId) {
         const rows = (await this.pool.query(`SELECT md_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms
-         FROM \`shield_identity\`.\`mfa_device\` WHERE md_principal_id = ? ORDER BY md_created_at_ms ASC`, [principalId]));
+         FROM ${this.table} WHERE md_principal_id = ? ORDER BY md_created_at_ms ASC`, [principalId]));
         return rows.map(toDevice);
     }
     async listConfirmedSecrets(principalId) {
-        const rows = (await this.pool.query(`SELECT md_secret FROM \`shield_identity\`.\`mfa_device\`
+        const rows = (await this.pool.query(`SELECT md_secret FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL`, [principalId]));
         return rows.map((r) => r.md_secret);
     }
     async getSecret(principalId, deviceId) {
-        const rows = (await this.pool.query(`SELECT md_secret FROM \`shield_identity\`.\`mfa_device\`
+        const rows = (await this.pool.query(`SELECT md_secret FROM ${this.table}
         WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
         return rows[0]?.md_secret ?? null;
     }
     async begin(principalId, name, secret) {
         // Prune the caller's stale pending rows first (self-pruning; no cron).
-        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\`
+        await this.pool.query(`DELETE FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NULL AND md_created_at_ms < ?`, [principalId, Date.now() - PENDING_TTL_MS]);
         const id = (0, node_crypto_1.randomUUID)();
-        await this.pool.query(`INSERT INTO \`shield_identity\`.\`mfa_device\`
+        await this.pool.query(`INSERT INTO ${this.table}
          (md_id, md_principal_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms)
        VALUES (?, ?, ?, ?, ?, NULL, NULL)`, [id, principalId, name, secret, Date.now()]);
         return id;
     }
     async confirm(principalId, deviceId) {
-        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_confirmed_at_ms = ?
+        const res = (await this.pool.query(`UPDATE ${this.table} SET md_confirmed_at_ms = ?
         WHERE md_id = ? AND md_principal_id = ? AND md_confirmed_at_ms IS NULL`, [Date.now(), deviceId, principalId]));
         if (res.affectedRows !== 1)
             return false;
         // KI #14 re-review: once a device is confirmed MFA is on, so every later begin needs a code.
         // Drop the principal's OTHER pending devices: one begun by a stolen session while MFA was
         // still off (between the user's own begin and confirm) must not stay confirmable.
-        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\`
+        await this.pool.query(`DELETE FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NULL AND md_id <> ?`, [principalId, deviceId]);
         return true;
     }
     async rename(principalId, deviceId, name) {
-        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_name = ?
+        const res = (await this.pool.query(`UPDATE ${this.table} SET md_name = ?
         WHERE md_id = ? AND md_principal_id = ?`, [name, deviceId, principalId]));
         if (res.affectedRows !== 1)
             return null;
         const rows = (await this.pool.query(`SELECT md_id, md_name, md_secret, md_created_at_ms, md_last_used_at_ms, md_confirmed_at_ms
-         FROM \`shield_identity\`.\`mfa_device\` WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
+         FROM ${this.table} WHERE md_id = ? AND md_principal_id = ? LIMIT 1`, [deviceId, principalId]));
         return rows[0] ? toDevice(rows[0]) : null;
     }
     async remove(principalId, deviceId) {
-        const res = (await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_device\` WHERE md_id = ? AND md_principal_id = ?`, [deviceId, principalId]));
+        const res = (await this.pool.query(`DELETE FROM ${this.table} WHERE md_id = ? AND md_principal_id = ?`, [deviceId, principalId]));
         return res.affectedRows === 1;
     }
     async countConfirmed(principalId) {
-        const rows = (await this.pool.query(`SELECT COUNT(*) AS c FROM \`shield_identity\`.\`mfa_device\`
+        const rows = (await this.pool.query(`SELECT COUNT(*) AS c FROM ${this.table}
         WHERE md_principal_id = ? AND md_confirmed_at_ms IS NOT NULL`, [principalId]));
         return Number(rows[0]?.c ?? 0);
     }
     async stampUsed(secret) {
         try {
-            await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_device\` SET md_last_used_at_ms = ? WHERE md_secret = ?`, [Date.now(), secret]);
+            await this.pool.query(`UPDATE ${this.table} SET md_last_used_at_ms = ? WHERE md_secret = ?`, [
+                Date.now(),
+                secret,
+            ]);
         }
         catch {
             // best-effort; a stamp failure must never fail a login.

package/dist/authentication/mariadb-profile-resolver.d.ts

@@ -14,10 +14,15 @@
 import type { Pool } from 'mariadb';
 import type { Principal } from '@astram/core';
 import type { CurrentUserProfile, ProfileResolver } from '../auth/profile-resolver.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbProfileResolver implements ProfileResolver {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** The org database (`<app>`), resolved at construction. */
+    private readonly app;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     resolve(principal: Principal): Promise<CurrentUserProfile | null>;
     private resolveRoleNames;
 }

package/dist/authentication/mariadb-profile-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-profile-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAe,MAAM,6BAA6B,CAAC;AAcpG,qBAAa,sBAAuB,YAAW,eAAe;IAE1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;YA4BzD,gBAAgB;CAc/B"}
+{"version":3,"file":"mariadb-profile-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAe,MAAM,6BAA6B,CAAC;AACpG,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAc7C,qBAAa,sBAAuB,YAAW,eAAe;IAK1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAGV,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAK1B,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;YA4BzD,gBAAgB;CAc/B"}

package/dist/authentication/mariadb-profile-resolver.js

@@ -14,21 +14,27 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbProfileResolver = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbProfileResolver {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** The org database (`<app>`), resolved at construction. */
+    app;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        this.app = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).app;
     }
     async resolve(principal) {
         const userUuid = principal.id;
         const companyUuid = principal.tenantId;
-        const users = (await this.pool.query('SELECT u_username, u_email FROM `shield_app`.`users` WHERE u_uuid = ? LIMIT 1', [userUuid]));
+        const users = (await this.pool.query(`SELECT u_username, u_email FROM \`${this.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [userUuid]));
         const user = users[0];
         if (!user)
             return null; // deleted user → no profile (never id-leak; endpoint 404s)
-        const companies = (await this.pool.query('SELECT c_name FROM `shield_app`.`companies` WHERE c_uuid = ? LIMIT 1', [companyUuid]));
+        const companies = (await this.pool.query(`SELECT c_name FROM \`${this.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [companyUuid]));
         const companyName = companies[0]?.c_name ?? '(unknown company)';
         const roles = await this.resolveRoleNames(userUuid, companyUuid);
         return {
@@ -42,9 +48,9 @@ class MariaDbProfileResolver {
     async resolveRoleNames(userUuid, companyUuid) {
         const nowMs = this.now();
         const rows = (await this.pool.query(`SELECT DISTINCT r.r_uuid, r.r_name
-         FROM \`shield_app\`.\`membership_posting\` mp
-         JOIN \`shield_app\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
-         JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = mp.mp_role_uuid
+         FROM \`${this.app}\`.\`membership_posting\` mp
+         JOIN \`${this.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+         JOIN \`${this.app}\`.\`roles\` r ON r.r_uuid = mp.mp_role_uuid
         WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ?
           AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
           AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [userUuid, companyUuid, nowMs, nowMs]));

package/dist/authentication/mariadb-profile-writer.d.ts

@@ -7,10 +7,15 @@
 import type { Pool } from 'mariadb';
 import { type ProfileWriter } from '../auth/ports/profile-writer.js';
 import type { CurrentUserProfile } from '../auth/profile-resolver.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbProfileWriter implements ProfileWriter {
     private readonly pool;
     private readonly resolver;
-    constructor(pool: Pool);
+    /** The org database (`<app>`), resolved at construction; the re-read resolver uses the same. */
+    private readonly app;
+    constructor(pool: Pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     update(principalId: string, changes: {
         name?: string;
         email?: string;

package/dist/authentication/mariadb-profile-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAgBtE,qBAAa,oBAAqB,YAAW,aAAa;IAE5C,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;gBACrB,IAAI,EAAE,IAAI;IAIjC,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,CAAC;CAgD/B"}
+{"version":3,"file":"mariadb-profile-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-profile-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAe7C,qBAAa,oBAAqB,YAAW,aAAa;IAKtD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,gGAAgG;IAChG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEV,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACzC,OAAO,CAAC,kBAAkB,CAAC;CAgD/B"}

package/dist/authentication/mariadb-profile-writer.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbProfileWriter = void 0;
 const profile_writer_js_1 = require("../auth/ports/profile-writer.js");
 const mariadb_profile_resolver_js_1 = require("./mariadb-profile-resolver.js");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** MariaDB `ER_DUP_ENTRY`: here `IDX_users_username` refused the name (KI #97). */
 const ER_DUP_ENTRY = 1062;
 function isDuplicateKey(err) {
@@ -14,9 +15,15 @@ function isDuplicateKey(err) {
 class MariaDbProfileWriter {
     pool;
     resolver;
-    constructor(pool) {
+    /** The org database (`<app>`), resolved at construction; the re-read resolver uses the same. */
+    app;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
-        this.resolver = new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool);
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.app = s.app;
+        this.resolver = new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool, undefined, s);
     }
     async update(principalId, changes) {
         // Phase 12 / KI #87: the email is written ONLY by the verified email-change flow
@@ -34,7 +41,7 @@ class MariaDbProfileWriter {
         if (sets.length > 0) {
             params.push(principalId);
             try {
-                await this.pool.query(`UPDATE \`shield_app\`.\`users\` SET ${sets.join(', ')} WHERE u_uuid = ?`, params);
+                await this.pool.query(`UPDATE \`${this.app}\`.\`users\` SET ${sets.join(', ')} WHERE u_uuid = ?`, params);
             }
             catch (err) {
                 // KI #97: the driver message quotes the value; drop it and answer a typed conflict.
@@ -44,7 +51,7 @@ class MariaDbProfileWriter {
             }
         }
         // Resolve the caller's active company so the re-read profile is tenant-correct.
-        const active = (await this.pool.query("SELECT cm_company_uuid FROM `shield_app`.`company_membership` WHERE cm_user_uuid = ? AND cm_is_active = 1 AND cm_status = 'active' LIMIT 1", [principalId]));
+        const active = (await this.pool.query(`SELECT cm_company_uuid FROM \`${this.app}\`.\`company_membership\` WHERE cm_user_uuid = ? AND cm_is_active = 1 AND cm_status = 'active' LIMIT 1`, [principalId]));
         const tenantId = active[0]?.cm_company_uuid ?? '';
         const profile = await this.resolver.resolve({
             kind: 'user',

package/dist/authentication/mariadb-recovery-code-store.d.ts

@@ -21,14 +21,19 @@
 import type { Pool } from 'mariadb';
 import type { PasswordHasher } from '@astram/core';
 import type { RecoveryCodeStore } from '../auth/ports/recovery-code-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbRecoveryCodeStore implements RecoveryCodeStore {
     private readonly pool;
     /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
     private readonly hasher;
     private readonly now;
+    /** `<identity>`.`mfa_recovery_code`, resolved at construction. */
+    private readonly table;
     constructor(pool: Pool, 
     /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
-    hasher: PasswordHasher, now?: () => number);
+    hasher: PasswordHasher, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     /**
      * Replace the principal's entire recovery-code set with `codeHashes` (already
      * Argon2-hashed). Wipes any prior codes first, then inserts the new batch. Passing

package/dist/authentication/mariadb-recovery-code-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-recovery-code-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-recovery-code-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAM9E,qBAAa,wBAAyB,YAAW,iBAAiB;IAE9D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI;IAC3B,+EAA+E;IAC9D,MAAM,EAAE,cAAc,EACtB,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnF;;;;;;OAMG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAqBtE"}
+{"version":3,"file":"mariadb-recovery-code-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-recovery-code-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAM7C,qBAAa,wBAAyB,YAAW,iBAAiB;IAK9D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,kEAAkE;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI;IAC3B,+EAA+E;IAC9D,MAAM,EAAE,cAAc,EACtB,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQhC;;;;OAIG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAanF;;;;;;OAMG;IACG,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAqBtE"}

package/dist/authentication/mariadb-recovery-code-store.js

@@ -1,16 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbRecoveryCodeStore = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbRecoveryCodeStore {
     pool;
     hasher;
     now;
+    /** `<identity>`.`mfa_recovery_code`, resolved at construction. */
+    table;
     constructor(pool, 
     /** The SAME Argon2id hasher the framework uses to hash the codes on enroll. */
-    hasher, now = Date.now) {
+    hasher, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.hasher = hasher;
         this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'mfa_recovery_code');
     }
     /**
      * Replace the principal's entire recovery-code set with `codeHashes` (already
@@ -18,10 +24,10 @@ class MariaDbRecoveryCodeStore {
      * an empty array simply wipes (used when MFA is disabled).
      */
     async replaceAll(principalId, codeHashes) {
-        await this.pool.query(`DELETE FROM \`shield_identity\`.\`mfa_recovery_code\` WHERE mrc_principal_id = ?`, [principalId]);
+        await this.pool.query(`DELETE FROM ${this.table} WHERE mrc_principal_id = ?`, [principalId]);
         const createdAt = this.now();
         for (const hash of codeHashes) {
-            await this.pool.query(`INSERT INTO \`shield_identity\`.\`mfa_recovery_code\`
+            await this.pool.query(`INSERT INTO ${this.table}
            (mrc_principal_id, mrc_code_hash, mrc_consumed_at_ms, mrc_created_at_ms)
          VALUES (?, ?, NULL, ?)`, [principalId, hash, createdAt]);
         }
@@ -36,11 +42,11 @@ class MariaDbRecoveryCodeStore {
     async consume(principalId, rawCode) {
         if (typeof rawCode !== 'string' || rawCode.length === 0)
             return false;
-        const rows = (await this.pool.query(`SELECT mrc_code_hash FROM \`shield_identity\`.\`mfa_recovery_code\`
+        const rows = (await this.pool.query(`SELECT mrc_code_hash FROM ${this.table}
         WHERE mrc_principal_id = ? AND mrc_consumed_at_ms IS NULL`, [principalId]));
         for (const row of rows) {
             if (await this.hasher.verify(row.mrc_code_hash, rawCode)) {
-                const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`mfa_recovery_code\`
+                const res = (await this.pool.query(`UPDATE ${this.table}
               SET mrc_consumed_at_ms = ?
             WHERE mrc_principal_id = ? AND mrc_code_hash = ? AND mrc_consumed_at_ms IS NULL`, [this.now(), principalId, row.mrc_code_hash]));
                 // Single-use guard: only the UPDATE that flips NULL→consumed wins.

package/dist/authentication/mariadb-reset-token-store.d.ts

@@ -15,10 +15,15 @@
  */
 import type { Pool } from 'mariadb';
 import type { ResetTokenStore } from '../auth/ports/reset-token-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbResetTokenStore implements ResetTokenStore {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** `<identity>`.`password_reset_token`, resolved at construction. */
+    private readonly table;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     issue(principalId: string, tokenHash: string, expiresAtMs: number): Promise<void>;
     consume(tokenHash: string): Promise<string | null>;
     invalidateAllForPrincipal(principalId: string): Promise<void>;

package/dist/authentication/mariadb-reset-token-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-reset-token-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-reset-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAM1E,qBAAa,sBAAuB,YAAW,eAAe;IAE1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0BlD,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpE"}
+{"version":3,"file":"mariadb-reset-token-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-reset-token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAM7C,qBAAa,sBAAuB,YAAW,eAAe;IAK1D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA0BlD,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUpE"}

package/dist/authentication/mariadb-reset-token-store.js

@@ -1,15 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbResetTokenStore = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbResetTokenStore {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<identity>`.`password_reset_token`, resolved at construction. */
+    table;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'password_reset_token');
     }
     async issue(principalId, tokenHash, expiresAtMs) {
-        await this.pool.query(`INSERT INTO \`shield_identity\`.\`password_reset_token\`
+        await this.pool.query(`INSERT INTO ${this.table}
          (prt_token_hash, prt_principal_id, prt_expires_at_ms, prt_consumed_at_ms, prt_created_at_ms)
        VALUES (?, ?, ?, NULL, ?)`, [tokenHash, principalId, expiresAtMs, this.now()]);
     }
@@ -17,7 +23,7 @@ class MariaDbResetTokenStore {
         const now = this.now();
         // 1) Find an unexpired, unconsumed token for this hash.
         const rows = (await this.pool.query(`SELECT prt_principal_id
-         FROM \`shield_identity\`.\`password_reset_token\`
+         FROM ${this.table}
         WHERE prt_token_hash = ? AND prt_consumed_at_ms IS NULL AND prt_expires_at_ms > ?
         LIMIT 1`, [tokenHash, now]));
         const principalId = rows[0]?.prt_principal_id;
@@ -25,7 +31,7 @@ class MariaDbResetTokenStore {
             return null;
         // 2) Atomically claim it (single-use). The `IS NULL` guard + affectedRows check means a
         //    concurrent consume can never both succeed — the loser sees 0 rows and returns null.
-        const res = (await this.pool.query(`UPDATE \`shield_identity\`.\`password_reset_token\`
+        const res = (await this.pool.query(`UPDATE ${this.table}
           SET prt_consumed_at_ms = ?
         WHERE prt_token_hash = ? AND prt_consumed_at_ms IS NULL`, [now, tokenHash]));
         if (res.affectedRows !== 1)
@@ -35,7 +41,7 @@ class MariaDbResetTokenStore {
     async invalidateAllForPrincipal(principalId) {
         // Burn every outstanding (unconsumed) token for the principal after a successful reset, so a
         // second still-valid link cannot re-reset.
-        await this.pool.query(`UPDATE \`shield_identity\`.\`password_reset_token\`
+        await this.pool.query(`UPDATE ${this.table}
           SET prt_consumed_at_ms = ?
         WHERE prt_principal_id = ? AND prt_consumed_at_ms IS NULL`, [this.now(), principalId]);
     }

package/dist/authentication/mariadb-session-sweeper.d.ts

@@ -23,6 +23,7 @@
 import type { Pool } from 'mariadb';
 import type { SessionSweeper } from '../auth/ports/session-sweeper.js';
 import type { SessionTokenBinder } from '../request-auth/session-token-binder.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 /** The binder surface the sweeper needs; `unbindSessionStrict` (throws on a Redis error) is preferred. */
 type SweepBinder = Pick<SessionTokenBinder, 'unbindSession'> & Partial<Pick<SessionTokenBinder, 'unbindSessionStrict'>>;
 export declare class MariaDbSessionSweeper implements SessionSweeper {
@@ -30,9 +31,13 @@ export declare class MariaDbSessionSweeper implements SessionSweeper {
     private readonly binder;
     /** Clock for the "not yet expired" unbind window (epoch-ms). */
     private readonly now;
+    /** `<identity>`.`session`, resolved at construction (configurable-framework-db). */
+    private readonly sessionTable;
     constructor(pool: Pool, binder: SweepBinder, 
     /** Clock for the "not yet expired" unbind window (epoch-ms). */
-    now?: () => number);
+    now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     /**
      * Unbind the given sessions in Redis. Every session is attempted; if any unbind failed, the
      * FIRST error is thrown afterwards (Phase 3 review P1), so an administrative revoke reports it

package/dist/authentication/mariadb-session-sweeper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-session-sweeper.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-session-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAMlF,0GAA0G;AAC1G,KAAK,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAC1D,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE3D,qBAAa,qBAAsB,YAAW,cAAc;IAExD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,WAAW;IACpC,gEAAgE;IAC/C,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;OAIG;YACW,SAAS;IAUjB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBzD,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAkB1F"}
+{"version":3,"file":"mariadb-session-sweeper.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-session-sweeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAM7C,0GAA0G;AAC1G,KAAK,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,GAC1D,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE3D,qBAAa,qBAAsB,YAAW,cAAc;IAKxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAGnB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,WAAW;IACpC,gEAAgE;IAC/C,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAKhC;;;;OAIG;YACW,SAAS;IAUjB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBzD,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAkB1F"}

package/dist/authentication/mariadb-session-sweeper.js

@@ -23,16 +23,22 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbSessionSweeper = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbSessionSweeper {
     pool;
     binder;
     now;
+    /** `<identity>`.`session`, resolved at construction (configurable-framework-db). */
+    sessionTable;
     constructor(pool, binder, 
     /** Clock for the "not yet expired" unbind window (epoch-ms). */
-    now = Date.now) {
+    now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.binder = binder;
         this.now = now;
+        this.sessionTable = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'session');
     }
     /**
      * Unbind the given sessions in Redis. Every session is attempted; if any unbind failed, the
@@ -53,9 +59,9 @@ class MariaDbSessionSweeper {
         // absolute expiry, WHATEVER its status — so a retry after a failed unbind (the durable row is
         // already `revoked`) still drops the Redis keys. Read BEFORE the durable revoke.
         const rows = (await this.pool.query(`SELECT s_session_id
-         FROM \`shield_identity\`.\`session\`
+         FROM ${this.sessionTable}
         WHERE s_principal_id = ? AND s_absolute_expires_at_ms > ?`, [principalId, this.now()]));
-        await this.pool.query(`UPDATE \`shield_identity\`.\`session\`
+        await this.pool.query(`UPDATE ${this.sessionTable}
           SET s_status = 'revoked'
         WHERE s_principal_id = ? AND s_status = 'active'`, [principalId]);
         // Drop each session's Redis liveness key so outstanding access tokens die immediately, not
@@ -65,9 +71,9 @@ class MariaDbSessionSweeper {
     async revokeOthersForPrincipal(principalId, keepSessionId) {
         // Same unbind set as revokeAll (not-yet-expired, any status) minus the kept session.
         const rows = (await this.pool.query(`SELECT s_session_id
-         FROM \`shield_identity\`.\`session\`
+         FROM ${this.sessionTable}
         WHERE s_principal_id = ? AND s_absolute_expires_at_ms > ? AND s_session_id <> ?`, [principalId, this.now(), keepSessionId]));
-        await this.pool.query(`UPDATE \`shield_identity\`.\`session\`
+        await this.pool.query(`UPDATE ${this.sessionTable}
           SET s_status = 'revoked'
         WHERE s_principal_id = ? AND s_status = 'active' AND s_session_id <> ?`, [principalId, keepSessionId]);
         // Only the OTHER sessions are unbound — the kept (current) session's liveness key

package/dist/authz/cross-tenant-grant-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant-writer.d.ts","sourceRoot":"","sources":["../../src/authz/cross-tenant-grant-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAK9E,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,eAA6C,CAAC;AAE3F,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,QAAQ,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,KAClC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,eAAe,CAAC;IACtE,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,+EAA+E;AAC/E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAqCD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB;;;;WAIG;QACH,SAAS,EAAE,gBAAgB,CAAC;QAC5B,oFAAoF;QACpF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAQD;;;;;;;;;OASG;IACG,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAuEpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDpD;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkDxB;;;;OAIG;YACW,gBAAgB;IAU9B,uGAAuG;YACzF,UAAU;IAqBxB,mEAAmE;YACrD,IAAI;IAalB,wFAAwF;YAC1E,WAAW;CA0B1B"}
+{"version":3,"file":"cross-tenant-grant-writer.d.ts","sourceRoot":"","sources":["../../src/authz/cross-tenant-grant-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAG9E,8CAA8C;AAC9C,eAAO,MAAM,gCAAgC,eAA6C,CAAC;AAE3F,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,QAAQ,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,KAClC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,eAAe,CAAC;IACtE,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,+EAA+E;AAC/E,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAqCD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB;;;;WAIG;QACH,SAAS,EAAE,gBAAgB,CAAC;QAC5B,oFAAoF;QACpF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAUD;;;;;;;;;OASG;IACG,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAuEpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDpD;;;;;;;;;OASG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDpD;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkDxB;;;;OAIG;YACW,gBAAgB;IAU9B,uGAAuG;YACzF,UAAU;IAqBxB,mEAAmE;YACrD,IAAI;IAalB,wFAAwF;YAC1E,WAAW;CA0B1B"}

package/dist/authz/cross-tenant-grant-writer.js

@@ -63,8 +63,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CrossTenantGrantWriter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = void 0;
 const node_crypto_1 = require("node:crypto");
-/** Schema the `cross_tenant_grant` table lives in (astram3 ships the migration). */
-const DEFAULT_SCHEMA = 'shield_authz';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the writer is bound under. */
 exports.SHIELD_CROSS_TENANT_GRANT_WRITER = Symbol('SHIELD_CROSS_TENANT_GRANT_WRITER');
 /** Thrown when the who-may-grant bound rejects an offer/accept/revoke (fail-closed). */
@@ -122,7 +121,9 @@ class CrossTenantGrantWriter {
         this.db = deps.db;
         this.authorize = deps.authorize;
         this.audit = deps.audit;
-        this.schema = deps.schema ?? DEFAULT_SCHEMA;
+        // The `cross_tenant_grant` database: `deps.schema` (checked), else the resolved authz name
+        // (configurable-framework-db), fixed at construction.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(deps.schema);
         this.now = deps.nowMs ?? (() => Date.now());
     }
     /**