@astram/guard 0.14.0 → 0.15.0

package/dist/boot/migration-ledger-check.js

@@ -0,0 +1,280 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FrameworkMigrationLedgerCheck = exports.MigrationLedgerRegistry = exports.SHIELD_GUARD_MIGRATION_LEDGER_CHECK = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = void 0;
+exports.frameworkMigrationIds = frameworkMigrationIds;
+exports.resolveMigrationLedger = resolveMigrationLedger;
+exports.resolveMigrationLedgerCheck = resolveMigrationLedgerCheck;
+exports.assertFrameworkMigrationsApplied = assertFrameworkMigrationsApplied;
+/**
+ * Boot check: every framework migration a package ships is recorded in the `@astram/migrate`
+ * ledger (configurable-framework-db spec 5.D, §13).
+ *
+ * The ledger lives where `astram-migrate` writes it (spec 5.G): `<ns>_app` when
+ * `SHIELD_DB_NAMESPACE` is set, else `DDL_DB_NAME ?? APP_DB_NAME ?? <default app database>` of
+ * the migrate job's env; the table is `APP_MIGRATION_TABLE ?? 'schema_migrations'`. With the
+ * namespace set the check reads `<ns>_app` directly. In default mode it cannot know the migrate
+ * job's env, so it probes core `migrationLedgerCandidates` in order (`DDL_DB_NAME`, the runtime
+ * `APP_DB_NAME`, `shield_app`; one information_schema probe each, at bootstrap only) and reads the
+ * first ledger table that exists (G-007 QA P1). That ledger must hold every id; none found fails
+ * closed naming every location tried.
+ *
+ * Missing ids, no ledger table, or an unreadable ledger:
+ * - outside `NODE_ENV` development/test (unset included) ⇒ throws, boot fails (Shield #1);
+ * - in development/test ⇒ one warning, boot continues.
+ * An unreadable ledger is never treated as "all applied". Messages carry the database name, the
+ * table name, migration ids and a driver error code only: never a user, host, password or the
+ * driver's message text (core 70-secrets).
+ *
+ * Runs once, at application bootstrap, never per request (Shield #12). Who checks what:
+ * - `AuthModule` (`auth: true`) checks `guardMigrationsDir` over its runtime pool;
+ * - `@astram/identity` checks `guardMigrationsDir` AND `identityMigrationsDir` over its own pool
+ *   (identity reads guard's authz tables; guard never imports identity, ADR-0003);
+ * - an enforcement-only app (no `auth`, no identity) opens no DB pool and reads no framework
+ *   table, so it checks nothing.
+ * When both run in one app, the per-app {@link MigrationLedgerRegistry} (provided by
+ * `ShieldModule`) merges them: every hook registers its directories when constructed, and the
+ * first hook to bootstrap runs ONE SELECT per ledger location over the union; the others await
+ * that same result (a failure fails every one of them). Without the registry each hook runs alone.
+ */
+const node_fs_1 = require("node:fs");
+const core_1 = require("@astram/core");
+const app_config_js_1 = require("../config/app-config.js");
+/** At most this many ids are listed in the message (spec §13). */
+const MAX_LISTED_IDS = 10;
+/** Same id rule as `@astram/migrate`'s loader, restricted to the shipped `.cjs` files. */
+const MIGRATION_FILE = /^(\d+)-.+\.cjs$/;
+/** MariaDB "table doesn't exist". */
+const ER_NO_SUCH_TABLE = 1146;
+/** `1`, `01` and `001` are the same migration id (migrate orders ids numerically). */
+function idKey(id) {
+    return id.replace(/^0+(?=\d)/, '');
+}
+/** The migration ids shipped in `dir` (`.cjs` files only), ascending. */
+function frameworkMigrationIds(dir) {
+    const ids = [];
+    for (const file of (0, node_fs_1.readdirSync)(dir)) {
+        const m = MIGRATION_FILE.exec(file);
+        if (m)
+            ids.push(m[1]);
+    }
+    return sortIds(ids);
+}
+/** Ascending numeric order over decimal id strings. */
+function sortIds(ids) {
+    return ids.sort((a, b) => {
+        const ka = idKey(a);
+        const kb = idKey(b);
+        return ka.length - kb.length || (ka < kb ? -1 : ka > kb ? 1 : 0);
+    });
+}
+/**
+ * The migrate CLI's ledger location rule (core `resolveMigrationLedgerLocation`: `<ns>_app` when
+ * namespaced, else `DDL_DB_NAME ?? <default app>`). The boot check itself uses
+ * {@link resolveMigrationLedgerCheck}, which also tries the runtime `APP_DB_NAME`.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+function resolveMigrationLedger(env, schemas) {
+    return (0, core_1.resolveMigrationLedgerLocation)(schemas, env);
+}
+/**
+ * The boot check's ledger locations for this process's env (G-007 QA P1): core
+ * `migrationLedgerCandidates`, split into the first location and its `alternatives`. Namespace
+ * set ⇒ `<ns>_app` only; default ⇒ `DDL_DB_NAME`, the runtime `APP_DB_NAME`, `shield_app`.
+ * Spread it into {@link FrameworkMigrationsCheckOptions}.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+function resolveMigrationLedgerCheck(env, schemas) {
+    const [first, ...alternatives] = (0, core_1.migrationLedgerCandidates)(schemas, env);
+    return { database: first.database, table: first.table, alternatives };
+}
+/** The driver error code only (never its message: it can carry user@host). */
+function errorCode(err) {
+    if (typeof err === 'object' && err !== null) {
+        const { code, errno } = err;
+        if (typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code))
+            return code;
+        if (typeof errno === 'number')
+            return `errno ${errno}`;
+    }
+    return 'unknown error';
+}
+function isNoSuchTable(err) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    const { code, errno } = err;
+    return code === 'ER_NO_SUCH_TABLE' || errno === ER_NO_SUCH_TABLE;
+}
+/** No candidate holds a ledger table: name every location, tell the operator what to set. */
+function notFoundMessage(tried, unverified) {
+    const where = tried.map((l) => `${l.database}.${l.table}`).join(', ');
+    return (`Shield migration ledger not found (tried, in order: ${where}); ` +
+        `${unverified} framework migrations are unverified. Set DDL_DB_NAME to the ledger database, ` +
+        'the same value for `astram-migrate` and the server, and run `astram-migrate migrate` ' +
+        'with the deploy account before starting the server.');
+}
+/** One information_schema probe: does `l.database` hold the table `l.table`? Names validated. */
+function probeSql(l) {
+    return ('SELECT 1 AS present FROM information_schema.TABLES ' +
+        `WHERE TABLE_SCHEMA = '${l.database}' AND TABLE_NAME = '${l.table}' LIMIT 1`);
+}
+function missingMessage(database, missing) {
+    const listed = missing.slice(0, MAX_LISTED_IDS);
+    const more = missing.length - listed.length;
+    const ids = more > 0 ? `${listed.join(', ')}, … ${more} more` : listed.join(', ');
+    return (`Shield database ${database} is missing ${missing.length} framework migrations (${ids}). ` +
+        'Run `astram-migrate migrate` with the deploy account before starting the server.');
+}
+/**
+ * Compare the shipped migration ids in `migrationsDir` with the ledger; throw (production) or
+ * warn (development/test) when any is missing or the ledger cannot be read.
+ * @throws Error naming the database and up to 10 missing ids, outside development/test; and in
+ *   every environment for an invalid ledger database or table name (checked before any query).
+ */
+async function assertFrameworkMigrationsApplied(options) {
+    // Every location is validated before any query (operator names: any plain MariaDB identifier).
+    const locations = [
+        { database: options.database, table: options.table },
+        ...(options.alternatives ?? []),
+    ].map((l) => {
+        const database = (0, core_1.assertLedgerDatabaseName)(l.database, 'migration ledger database');
+        if (typeof l.table !== 'string' || !core_1.MIGRATION_LEDGER_TABLE_PATTERN.test(l.table)) {
+            throw new Error(`APP_MIGRATION_TABLE is not a valid table name; expected ${core_1.MIGRATION_LEDGER_TABLE_PATTERN.source}`);
+        }
+        return { database, table: l.table };
+    });
+    let { database, table } = locations[0];
+    const devOrTest = (0, app_config_js_1.isDevOrTestNodeEnv)(options.nodeEnv);
+    const fail = (message, missing) => {
+        if (!devOrTest)
+            throw new Error(message);
+        options.logger.warn(`${message} (NODE_ENV=${options.nodeEnv}: continuing)`);
+        return { ok: false, missing };
+    };
+    let shipped;
+    try {
+        const dirs = typeof options.migrationsDir === 'string' ? [options.migrationsDir] : options.migrationsDir;
+        shipped = sortIds([...new Set(dirs.flatMap((d) => frameworkMigrationIds(d)))]);
+    }
+    catch (err) {
+        return fail(`Shield database ${database}: cannot read the framework migrations directory ` +
+            `(${errorCode(err)}); the package install is incomplete.`, []);
+    }
+    if (shipped.length === 0)
+        return { ok: true, missing: [] };
+    // Several candidates (default namespace): use the first whose ledger table exists. A probe
+    // error is never "not here" or "all applied": it fails like an unreadable ledger.
+    if (locations.length > 1) {
+        let found;
+        for (const l of locations) {
+            let rows;
+            try {
+                rows = await options.query(probeSql(l));
+            }
+            catch (err) {
+                return fail(`Shield database ${l.database}: cannot look for the migration ledger ` +
+                    `${l.database}.${l.table} (${errorCode(err)}); ${shipped.length} framework ` +
+                    'migrations are unverified.', shipped);
+            }
+            if (!Array.isArray(rows)) {
+                return fail(`Shield database ${l.database}: cannot look for the migration ledger ` +
+                    `${l.database}.${l.table} (UNEXPECTED_RESULT); ${shipped.length} framework ` +
+                    'migrations are unverified.', shipped);
+            }
+            if (rows.length > 0) {
+                found = l;
+                break;
+            }
+        }
+        if (found === undefined)
+            return fail(notFoundMessage(locations, shipped.length), shipped);
+        ({ database, table } = found);
+    }
+    let applied;
+    try {
+        const rows = await options.query(`SELECT id FROM \`${database}\`.\`${table}\``);
+        if (!Array.isArray(rows))
+            throw Object.assign(new Error(), { code: 'UNEXPECTED_RESULT' });
+        applied = new Set(rows.map((r) => idKey(String(r?.id ?? ''))));
+    }
+    catch (err) {
+        // No ledger table: nothing was ever migrated here, so every shipped id is missing.
+        if (isNoSuchTable(err))
+            return fail(missingMessage(database, shipped), shipped);
+        return fail(`Shield database ${database}: cannot read the migration ledger ${database}.${table} ` +
+            `(${errorCode(err)}); ${shipped.length} framework migrations are unverified.`, shipped);
+    }
+    const missing = shipped.filter((id) => !applied.has(idKey(id)));
+    if (missing.length === 0)
+        return { ok: true, missing: [] };
+    return fail(missingMessage(database, missing), missing);
+}
+/** DI token of the per-app {@link MigrationLedgerRegistry} (provided by `ShieldModule`). */
+exports.SHIELD_MIGRATION_LEDGER_REGISTRY = Symbol('SHIELD_MIGRATION_LEDGER_REGISTRY');
+/** DI token of guard's own check (`AuthModule`); identity provides its check under its own token. */
+exports.SHIELD_GUARD_MIGRATION_LEDGER_CHECK = Symbol('SHIELD_GUARD_MIGRATION_LEDGER_CHECK');
+/**
+ * Merges the ledger checks of one application (guard's `AuthModule` and identity) so each ledger
+ * location is read once. Hooks {@link register} at construction (all providers exist before any
+ * bootstrap hook runs); the first {@link run} for a location checks the union of every registered
+ * directory and caches that promise, so later hooks share the result, rejection included.
+ */
+class MigrationLedgerRegistry {
+    entries = new Map();
+    /** The whole candidate list: hooks with the same list share one probe + read. */
+    static key(l) {
+        return [l, ...(l.alternatives ?? [])]
+            .map((x) => `${x.database}\u0000${x.table}`)
+            .join('\u0001');
+    }
+    /** Add `options.migrationsDir` to the check of `options`' ledger location. */
+    register(options) {
+        const dirs = typeof options.migrationsDir === 'string' ? [options.migrationsDir] : options.migrationsDir;
+        const key = MigrationLedgerRegistry.key(options);
+        const entry = this.entries.get(key);
+        if (entry === undefined) {
+            this.entries.set(key, { options, dirs: new Set(dirs) });
+            return;
+        }
+        if (entry.result !== undefined) {
+            throw new Error('MigrationLedgerRegistry: a check registered after the ledger was read.');
+        }
+        for (const d of dirs)
+            entry.dirs.add(d);
+    }
+    /** The (shared) check of `location`'s ledger over every registered directory. */
+    run(location) {
+        const entry = this.entries.get(MigrationLedgerRegistry.key(location));
+        // Never registered: nothing to share, nothing claims "checked" (fail closed).
+        if (entry === undefined) {
+            return Promise.reject(new Error('MigrationLedgerRegistry: ledger location not registered.'));
+        }
+        entry.result ??= assertFrameworkMigrationsApplied({
+            ...entry.options,
+            migrationsDir: [...entry.dirs],
+        });
+        return entry.result;
+    }
+}
+exports.MigrationLedgerRegistry = MigrationLedgerRegistry;
+/**
+ * The boot hook: runs {@link assertFrameworkMigrationsApplied} once, when Nest bootstraps the
+ * application (after module init, before the HTTP server listens). Never on a request. With a
+ * {@link MigrationLedgerRegistry}, it shares one read per ledger location with the app's other
+ * hooks; without one (`null`/absent), it checks alone.
+ */
+class FrameworkMigrationLedgerCheck {
+    options;
+    registry;
+    constructor(options, registry = null) {
+        this.options = options;
+        this.registry = registry;
+        registry?.register(options);
+    }
+    async onApplicationBootstrap() {
+        if (this.registry)
+            await this.registry.run(this.options);
+        else
+            await assertFrameworkMigrationsApplied(this.options);
+    }
+}
+exports.FrameworkMigrationLedgerCheck = FrameworkMigrationLedgerCheck;

package/dist/config/app-config.d.ts

@@ -23,7 +23,7 @@
  *   8 × (12 + 8 + 1) + 40 = 208 ≤ 250  ✓
  * ─────────────────────────────────────────────────────────────────────────────
  */
-import type { SecretsProvider } from '@astram/core';
+import type { FrameworkSchemas, SecretsProvider } from '@astram/core';
 export interface AppConfig {
     /** HTTP port the Nest app listens on. */
     readonly port: number;
@@ -74,7 +74,20 @@ export interface AppConfig {
      * composition (boot fails loud).
      */
     readonly refreshReplayWindowMs?: number;
+    /**
+     * The four framework database names (configurable-framework-db, ADR-0037), resolved once from
+     * `SHIELD_DB_NAMESPACE` by core `resolveFrameworkSchemas` (unset ⇒ the `shield_*` defaults).
+     * Optional so hand-built configs keep compiling; absent ⇒ {@link frameworkSchemasOf} resolves
+     * from `process.env` once at boot. Provided app-wide under `FRAMEWORK_SCHEMAS`.
+     */
+    readonly schemas?: FrameworkSchemas;
 }
+/**
+ * The resolved framework database names for a config: `config.schemas`, else resolved from
+ * `process.env` (a hand-built config without `schemas`). Call at boot only (Shield #12).
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` (fail closed).
+ */
+export declare function frameworkSchemasOf(config: Pick<AppConfig, 'schemas'>): FrameworkSchemas;
 /** The per-client-IP login failure limit (failures within `windowMs` that lock the IP). */
 export interface LoginIpLimitConfig {
     readonly maxAttempts: number;
@@ -205,7 +218,11 @@ export declare function isDevOrTestNodeEnv(raw: string | undefined): boolean;
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
  */
 export declare function loadPoolBudget(env?: NodeJS.ProcessEnv): PoolBudgetConfig;
-/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+/**
+ * Documented defaults for the runtime MariaDB descriptor (local docker substrate), for the
+ * default namespace. Under `SHIELD_DB_NAMESPACE` the user and database follow the namespace
+ * (`<ns>_core`, `<ns>_identity`; see {@link loadDbConfig}).
+ */
 export declare const DEFAULT_DB_CONFIG: Omit<DbConfig, 'password'>;
 /** Documented default Redis url (local docker substrate). */
 export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
@@ -219,8 +236,17 @@ export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
  * which is a fail-closed security invariant even for unit tests).
+ *
+ * Namespace (configurable-framework-db, spec 5.C): `APP_DB_USER` unset ⇒ `<ns>_core`;
+ * `APP_DB_NAME` unset ⇒ `<ns>_identity`. A set `APP_DB_NAME` must be one of the four resolved
+ * framework names, else this throws naming the variable (fail closed: an unqualified query must
+ * not reach another environment's database). An invalid `SHIELD_DB_NAMESPACE` throws too.
+ *
+ * `schemas` (optional): names the caller already resolved (e.g. `IdentityFeatureModule.forRoot
+ * ({ schemas })`). When given they replace the env namespace for the defaults and the
+ * `APP_DB_NAME` check, so the runtime database cannot drift from them (G-007 QA P2-5).
  */
-export declare function loadDbConfig(env?: NodeJS.ProcessEnv): DbConfig;
+export declare function loadDbConfig(env?: NodeJS.ProcessEnv, schemas?: FrameworkSchemas): DbConfig;
 /**
  * `APP_DB_TLS` = `off` (default) | `on`; `APP_DB_TLS_CA` = PEM path (only with `on`). Anything
  * else throws at boot: a typo must not silently fall back to plaintext.

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIpD,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAaD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAS3E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAa7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAaD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CAiBV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAc7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}

package/dist/config/app-config.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
+exports.frameworkSchemasOf = frameworkSchemasOf;
 exports.isDevOrTestNodeEnv = isDevOrTestNodeEnv;
 exports.loadPoolBudget = loadPoolBudget;
 exports.loadDbConfig = loadDbConfig;
@@ -17,6 +18,14 @@ exports.loadObjectStorageConfig = loadObjectStorageConfig;
 exports.evaluatePoolBudget = evaluatePoolBudget;
 const core_1 = require("@astram/core");
 const loopback_host_js_1 = require("./loopback-host.js");
+/**
+ * The resolved framework database names for a config: `config.schemas`, else resolved from
+ * `process.env` (a hand-built config without `schemas`). Call at boot only (Shield #12).
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` (fail closed).
+ */
+function frameworkSchemasOf(config) {
+    return config.schemas ?? (0, core_1.resolveFrameworkSchemas)(process.env);
+}
 /** Plan D3 default: 50 failed logins per client IP per 15 minutes. */
 exports.DEFAULT_LOGIN_IP_LIMIT = {
     maxAttempts: 50,
@@ -102,12 +111,18 @@ function loadPoolBudget(env = process.env) {
 // lifetimes. All pure env-readers with documented defaults; the ONLY hard-
 // required value is the refresh HMAC key (fail-closed).
 // ---------------------------------------------------------------------------
-/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+/** The default-namespace framework names (`SHIELD_DB_NAMESPACE` unset). */
+const DEFAULT_FRAMEWORK_SCHEMAS = (0, core_1.resolveFrameworkSchemas)({});
+/**
+ * Documented defaults for the runtime MariaDB descriptor (local docker substrate), for the
+ * default namespace. Under `SHIELD_DB_NAMESPACE` the user and database follow the namespace
+ * (`<ns>_core`, `<ns>_identity`; see {@link loadDbConfig}).
+ */
 exports.DEFAULT_DB_CONFIG = {
     host: 'localhost',
     port: 3306,
-    user: 'shield_core',
-    database: 'shield_identity',
+    user: (0, core_1.frameworkAccountName)(DEFAULT_FRAMEWORK_SCHEMAS.namespace, 'core'),
+    database: DEFAULT_FRAMEWORK_SCHEMAS.identity,
 };
 /** Documented default Redis url (local docker substrate). */
 exports.DEFAULT_REDIS_URL = 'redis://localhost:6379';
@@ -139,14 +154,29 @@ function parseOptionalPositiveInt(raw) {
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
  * which is a fail-closed security invariant even for unit tests).
+ *
+ * Namespace (configurable-framework-db, spec 5.C): `APP_DB_USER` unset ⇒ `<ns>_core`;
+ * `APP_DB_NAME` unset ⇒ `<ns>_identity`. A set `APP_DB_NAME` must be one of the four resolved
+ * framework names, else this throws naming the variable (fail closed: an unqualified query must
+ * not reach another environment's database). An invalid `SHIELD_DB_NAMESPACE` throws too.
+ *
+ * `schemas` (optional): names the caller already resolved (e.g. `IdentityFeatureModule.forRoot
+ * ({ schemas })`). When given they replace the env namespace for the defaults and the
+ * `APP_DB_NAME` check, so the runtime database cannot drift from them (G-007 QA P2-5).
  */
-function loadDbConfig(env = process.env) {
+function loadDbConfig(env = process.env, schemas = (0, core_1.resolveFrameworkSchemas)(env)) {
+    const database = parseString(env.APP_DB_NAME, schemas.identity);
+    const allowed = [schemas.app, schemas.identity, schemas.authz, schemas.audit];
+    if (!allowed.includes(database)) {
+        throw new core_1.FrameworkSchemaConfigError(`APP_DB_NAME must be one of the framework databases for namespace ` +
+            `"${schemas.namespace}" (${allowed.join(', ')}); unset it for ${schemas.identity}.`);
+    }
     return {
         host: parseString(env.APP_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
         port: parsePort(env.APP_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
-        user: parseString(env.APP_DB_USER, exports.DEFAULT_DB_CONFIG.user),
+        user: parseString(env.APP_DB_USER, (0, core_1.frameworkAccountName)(schemas.namespace, 'core')),
         password: parseString(env.APP_DB_PASSWORD, ''),
-        database: parseString(env.APP_DB_NAME, exports.DEFAULT_DB_CONFIG.database),
+        database,
         tls: loadDbTlsConfig(env),
     };
 }
@@ -281,6 +311,7 @@ function assertRefreshHmacKey(key) {
 function loadAppConfig(env = process.env) {
     const refreshReplayWindowMs = loadRefreshReplayWindowMs(env);
     return {
+        schemas: (0, core_1.resolveFrameworkSchemas)(env),
         port: parsePort(env.PORT, 3000),
         environment: parseEnvironment(env.NODE_ENV),
         pool: loadPoolBudget(env),

package/dist/config/config.module.d.ts

@@ -1,5 +1,12 @@
 /** DI token for the resolved {@link AppConfig}. */
 export declare const APP_CONFIG: unique symbol;
+/**
+ * DI token for the resolved framework database names (core `FrameworkSchemas`:
+ * `{ namespace, app, identity, authz, audit, isDefault }`, frozen; configurable-framework-db,
+ * ADR-0037). Provided and exported app-wide by `ShieldModule` from `APP_CONFIG`, resolved once at
+ * boot; identity and app modules inject it instead of hard-coding `shield_*` names.
+ */
+export declare const FRAMEWORK_SCHEMAS: unique symbol;
 /**
  * Minimal config module (Scaffold).
  *

package/dist/config/config.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.module.d.ts","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,eAAO,MAAM,UAAU,eAAuB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAaa,YAAY;CAAG"}
+{"version":3,"file":"config.module.d.ts","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,eAAO,MAAM,UAAU,eAAuB,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,qBAaa,YAAY;CAAG"}

package/dist/config/config.module.js

@@ -6,12 +6,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigModule = exports.APP_CONFIG = void 0;
+exports.ConfigModule = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = void 0;
 const common_1 = require("@nestjs/common");
 const app_config_js_1 = require("./app-config.js");
 const boot_secrets_js_1 = require("../secrets/boot-secrets.js");
 /** DI token for the resolved {@link AppConfig}. */
 exports.APP_CONFIG = Symbol('APP_CONFIG');
+/**
+ * DI token for the resolved framework database names (core `FrameworkSchemas`:
+ * `{ namespace, app, identity, authz, audit, isDefault }`, frozen; configurable-framework-db,
+ * ADR-0037). Provided and exported app-wide by `ShieldModule` from `APP_CONFIG`, resolved once at
+ * boot; identity and app modules inject it instead of hard-coding `shield_*` names.
+ */
+exports.FRAMEWORK_SCHEMAS = Symbol('FRAMEWORK_SCHEMAS');
 /**
  * Minimal config module (Scaffold).
  *

package/dist/config/framework-schema-names.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The framework database names a guard store or adapter targets (configurable-framework-db,
+ * spec §5.C, ADR-0037). Every store takes them from its constructor; the module wiring passes
+ * `AppConfig.schemas` / `FRAMEWORK_SCHEMAS`, so no SQL in guard carries a database literal.
+ *
+ * SECURITY (Shield #12): names are resolved at CONSTRUCTION (boot), never per request; a store
+ * built outside the wiring resolves `SHIELD_DB_NAMESPACE` once here, so it can never split names
+ * across two namespaces. An invalid namespace throws (fail closed, Shield #1). Names reach SQL
+ * only after core's pattern check, which admits no backtick, quote, dot or whitespace.
+ */
+import { type FrameworkSchemas } from '@astram/core';
+/** The four framework database names (core `FrameworkSchemas` without its metadata). */
+export type FrameworkSchemaNames = Pick<FrameworkSchemas, 'app' | 'identity' | 'authz' | 'audit'>;
+/**
+ * `given` (each name checked with core `assertSchemaName`), else the names resolved from
+ * `SHIELD_DB_NAMESPACE` NOW. Call from a constructor or a boot-time factory only, never on a
+ * request path.
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` or an unsafe given name.
+ */
+export declare function schemaNamesAtConstruction(given?: FrameworkSchemaNames): FrameworkSchemaNames;
+/**
+ * An authz adapter's `opts.schema`: the given name, checked with core `assertSchemaName`, else
+ * the authz name resolved from `SHIELD_DB_NAMESPACE` NOW. Constructors / boot factories only.
+ * @throws FrameworkSchemaConfigError on an unsafe given name or an invalid namespace.
+ */
+export declare function authzSchemaAtConstruction(given?: string): string;
+/** The backtick-quoted `` `schema`.`table` `` reference for a validated database name. */
+export declare function qualifiedTableName(schema: string, table: string): string;
+//# sourceMappingURL=framework-schema-names.d.ts.map

package/dist/config/framework-schema-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-schema-names.d.ts","sourceRoot":"","sources":["../../src/config/framework-schema-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AAEtB,wFAAwF;AACxF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC;AAElG;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAI5F;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/config/framework-schema-names.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schemaNamesAtConstruction = schemaNamesAtConstruction;
+exports.authzSchemaAtConstruction = authzSchemaAtConstruction;
+exports.qualifiedTableName = qualifiedTableName;
+/**
+ * The framework database names a guard store or adapter targets (configurable-framework-db,
+ * spec §5.C, ADR-0037). Every store takes them from its constructor; the module wiring passes
+ * `AppConfig.schemas` / `FRAMEWORK_SCHEMAS`, so no SQL in guard carries a database literal.
+ *
+ * SECURITY (Shield #12): names are resolved at CONSTRUCTION (boot), never per request; a store
+ * built outside the wiring resolves `SHIELD_DB_NAMESPACE` once here, so it can never split names
+ * across two namespaces. An invalid namespace throws (fail closed, Shield #1). Names reach SQL
+ * only after core's pattern check, which admits no backtick, quote, dot or whitespace.
+ */
+const core_1 = require("@astram/core");
+/**
+ * `given` (each name checked with core `assertSchemaName`), else the names resolved from
+ * `SHIELD_DB_NAMESPACE` NOW. Call from a constructor or a boot-time factory only, never on a
+ * request path.
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` or an unsafe given name.
+ */
+function schemaNamesAtConstruction(given) {
+    return given !== undefined
+        ? (0, core_1.assertFrameworkSchemaNames)(given, 'schemas')
+        : (0, core_1.resolveFrameworkSchemas)(process.env);
+}
+/**
+ * An authz adapter's `opts.schema`: the given name, checked with core `assertSchemaName`, else
+ * the authz name resolved from `SHIELD_DB_NAMESPACE` NOW. Constructors / boot factories only.
+ * @throws FrameworkSchemaConfigError on an unsafe given name or an invalid namespace.
+ */
+function authzSchemaAtConstruction(given) {
+    return given !== undefined
+        ? (0, core_1.assertSchemaName)(given, 'opts.schema')
+        : (0, core_1.resolveFrameworkSchemas)(process.env).authz;
+}
+/** The backtick-quoted `` `schema`.`table` `` reference for a validated database name. */
+function qualifiedTableName(schema, table) {
+    return `\`${schema}\`.\`${table}\``;
+}

package/dist/identity/permission-facts.adapter.d.ts

@@ -8,6 +8,7 @@
  * never a fabricated empty projection (that would silently read as "you have no grants").
  */
 import type { Pool } from 'mariadb';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export interface AuthFactDto {
     readonly action: string;
     readonly allowed: boolean;
@@ -29,7 +30,12 @@ export declare class MariaDbPermissionFactsAdapter {
     private readonly listActions;
     private readonly controlPlaneKeys;
     private readonly now;
-    constructor(pool: Pool, listActions: () => readonly string[], controlPlaneKeys: readonly string[], now?: () => number);
+    /** The org (`<app>`) and authorization (`<authz>`) databases, resolved at construction. */
+    private readonly app;
+    private readonly authz;
+    constructor(pool: Pool, listActions: () => readonly string[], controlPlaneKeys: readonly string[], now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     projectFor(principalId: string, tenantId: string, isRoot: boolean): Promise<AuthFactProjection>;
     currentVersionFor(_principalId: string, tenantId: string): Promise<number>;
     private readRoleIdsForTenant;

package/dist/identity/permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAYD,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAHH,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAGzC,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC;IAmBxB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAepB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}
+{"version":3,"file":"permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../src/identity/permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,yFAAyF;AACzF,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,SAA8B;CAIlD;AAYD,qBAAa,6BAA6B;IAMtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EACpC,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAO1B,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,kBAAkB,CAAC;IAmBxB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YASlE,oBAAoB;YAepB,aAAa;YASb,WAAW;IAQzB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAaxB"}