@astram/guard 0.14.0 → 0.16.0

package/dist/auth/auth.module.d.ts

@@ -62,7 +62,7 @@
  * `createIdentityBroker`/`createTotpFactorVerifier`) are pure; the adapters + the
  * node:crypto HMAC live in guard. Core stays zero-dep + unchanged.
  */
-import { type DynamicModule } from '@nestjs/common';
+import { type DynamicModule, type Provider } from '@nestjs/common';
 import type { CredentialResolver, HmacSha1, FactorVerifier } from '@astram/core';
 import type { SessionFactsProjector } from './ports/session-facts-projector.js';
 import type { ScopeSubtreeResolver } from './ports/scope-subtree-resolver.js';
@@ -106,6 +106,13 @@ export declare function resolveTotpVerifier(override: FactorVerifier | null | un
  * consumer's built CJS dist. Async because of {@link loadCore}.
  */
 export declare function makeDefaultTotpVerifier(): Promise<FactorVerifier>;
+/** DI token for the single-layout privilege probe hook (a no-op in the four layout). */
+export declare const SHIELD_SINGLE_LAYOUT_PROBE: unique symbol;
+/**
+ * Single-database-layout spec §5.F (ADR-0041): the privilege probe runs once at bootstrap on this
+ * module's runtime pool, single layout only (four layout: a no-op hook). Never blocks boot.
+ */
+export declare const singleLayoutProbeProvider: Provider;
 /**
  * Options for {@link AuthModule.forRoot} — registration-time collaborators the
  * consumer plugs through {@link ShieldModule.forRoot}.

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAanF,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AAoGtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAyhBD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAwID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAiGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA2K/D"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAaxB,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EAIf,MAAM,cAAc,CAAC;AA8GtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAsPD,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAWvC,CAAC;AAyUF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;oGAEgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,uGAAuG;IACvG,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA6ID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAcrF;AAmGD;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAgL/D"}

package/dist/auth/auth.module.js

@@ -104,7 +104,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 var AuthModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthModule = exports.hmacSha1 = void 0;
+exports.AuthModule = exports.singleLayoutProbeProvider = exports.SHIELD_SINGLE_LAYOUT_PROBE = exports.hmacSha1 = void 0;
 exports.resolveTotpVerifier = resolveTotpVerifier;
 exports.makeDefaultTotpVerifier = makeDefaultTotpVerifier;
 exports.resolveDefaultEmailSender = resolveDefaultEmailSender;
@@ -112,6 +112,9 @@ const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
 const app_config_js_1 = require("../config/app-config.js");
 const config_module_js_1 = require("../config/config.module.js");
+const migration_ledger_check_js_1 = require("../boot/migration-ledger-check.js");
+const single_layout_probe_js_1 = require("../boot/single-layout-probe.js");
+const migrations_dir_js_1 = require("../migrations-dir.js");
 const argon2id_password_hasher_js_1 = require("../authentication/argon2id-password-hasher.js");
 const mariadb_credential_resolver_js_1 = require("../authentication/mariadb-credential-resolver.js");
 const mariadb_profile_resolver_js_1 = require("../authentication/mariadb-profile-resolver.js");
@@ -251,8 +254,8 @@ function makeCredentialResolverProvider(override) {
             provide: tokens_js_1.SHIELD_CREDENTIAL_RESOLVER,
             // #7: the default resolver folds the principal's CONFIRMED MFA devices into a
             // `totp` required factor, so enrolled MFA is enforced at every password login.
-            useFactory: (pool, devices) => new mariadb_credential_resolver_js_1.MariaDbCredentialResolver(pool, devices),
-            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_MFA_DEVICE_STORE],
+            useFactory: (pool, devices, config) => new mariadb_credential_resolver_js_1.MariaDbCredentialResolver(pool, devices, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_1.SHIELD_MFA_DEVICE_STORE, config_module_js_1.APP_CONFIG],
         };
 }
 /**
@@ -272,11 +275,11 @@ const sessionLifetimesProvider = {
  */
 const sessionRecordStoreProvider = {
     provide: index_js_1.SHIELD_SESSION_RECORD_STORE,
-    useFactory: (pool, binder) => {
-        const durable = new index_js_1.MariaDbSessionRecordStore(pool);
+    useFactory: (pool, binder, config) => {
+        const durable = new index_js_1.MariaDbSessionRecordStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config));
         return new index_js_1.HotRevokingSessionRecordStore(durable, binder, durable);
     },
-    inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER],
+    inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER, config_module_js_1.APP_CONFIG],
 };
 /**
  * The Redis permission-version cache (ADR-0035, GAPS #6): gate 5 reads the tenant's version from
@@ -295,8 +298,8 @@ const permissionVersionCacheProvider = {
  */
 const sessionRestrictionStoreProvider = {
     provide: tokens_js_1.SHIELD_SESSION_RESTRICTIONS,
-    useFactory: (pool) => new session_restriction_store_js_1.MariaDbSessionRestrictionStore(pool),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    useFactory: (pool, config) => new session_restriction_store_js_1.MariaDbSessionRestrictionStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
 /** Hot session store (Redis adapter, injected with the live client). */
 const hotSessionStoreProvider = {
@@ -356,11 +359,50 @@ const mfaLimiterProvider = {
  */
 const serviceAuthenticatorProvider = {
     provide: tokens_js_2.SHIELD_SERVICE_AUTHENTICATOR,
-    useFactory: (pool) => (0, core_1.createServiceAuthenticator)({
-        store: new mariadb_api_key_store_js_1.MariaDbApiKeyStore(pool),
+    useFactory: (pool, config) => (0, core_1.createServiceAuthenticator)({
+        store: new mariadb_api_key_store_js_1.MariaDbApiKeyStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
         hasher: new argon2id_password_hasher_js_1.Argon2idPasswordHasher(),
     }),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
+};
+/**
+ * configurable-framework-db spec 5.D: at application bootstrap (once, never per request, Shield
+ * #12) check that every guard migration is in the `@astram/migrate` ledger, read with ONE SELECT
+ * over this module's runtime pool. Lives here, not in `BootModule`, because this is the only
+ * guard module holding a pool (the raw pool stays unexported, Phase 8 #5); an enforcement-only
+ * app opens no pool and reads no guard table, so it has nothing to check.
+ */
+const migrationLedgerCheckProvider = {
+    // Its own token (identity provides another), so a merged module can never shadow one check.
+    provide: migration_ledger_check_js_1.SHIELD_GUARD_MIGRATION_LEDGER_CHECK,
+    useFactory: (pool, config, registry) => new migration_ledger_check_js_1.FrameworkMigrationLedgerCheck({
+        query: (sql) => pool.query(sql),
+        // The ledger candidates (G-007 QA P1): `<ns>_app`, or DDL_DB_NAME / APP_DB_NAME /
+        // shield_app probed in order in default mode.
+        ...(0, migration_ledger_check_js_1.resolveMigrationLedgerCheck)(process.env, (0, app_config_js_1.frameworkSchemasOf)(config)),
+        migrationsDir: migrations_dir_js_1.guardMigrationsDir,
+        nodeEnv: process.env.NODE_ENV,
+        logger: new common_1.Logger('Shield'),
+    }, 
+    // ShieldModule's per-app registry: one ledger read shared with identity's check.
+    registry ?? null),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG, { token: migration_ledger_check_js_1.SHIELD_MIGRATION_LEDGER_REGISTRY, optional: true }],
+};
+/** DI token for the single-layout privilege probe hook (a no-op in the four layout). */
+exports.SHIELD_SINGLE_LAYOUT_PROBE = Symbol('SHIELD_SINGLE_LAYOUT_PROBE');
+/**
+ * Single-database-layout spec §5.F (ADR-0041): the privilege probe runs once at bootstrap on this
+ * module's runtime pool, single layout only (four layout: a no-op hook). Never blocks boot.
+ */
+exports.singleLayoutProbeProvider = {
+    provide: exports.SHIELD_SINGLE_LAYOUT_PROBE,
+    useFactory: (pool, config) => {
+        const schemas = (0, app_config_js_1.frameworkSchemasOf)(config);
+        if (schemas.layout !== 'single')
+            return { onApplicationBootstrap: () => undefined };
+        return new single_layout_probe_js_1.SingleLayoutProbeBoot(async (sql, params) => (await pool.query(sql, params)), schemas.app);
+    },
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
 /** Boot-time warnings from the auth composition (dev email logger, disabled email, …). */
 const authBootLogger = new common_1.Logger('ShieldAuth');
@@ -656,8 +698,8 @@ function makeProfileResolverProvider(override) {
         ? { provide: tokens_js_1.SHIELD_PROFILE_RESOLVER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_PROFILE_RESOLVER,
-            useFactory: (pool) => new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_profile_resolver_js_1.MariaDbProfileResolver(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 /**
@@ -671,8 +713,8 @@ function makeCredentialWriterProvider(override) {
         ? { provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_CREDENTIAL_WRITER,
-            useFactory: (pool) => new mariadb_credential_writer_js_1.MariaDbCredentialWriter(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_credential_writer_js_1.MariaDbCredentialWriter(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 function makeResetTokenStoreProvider(override) {
@@ -680,8 +722,8 @@ function makeResetTokenStoreProvider(override) {
         ? { provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_RESET_TOKEN_STORE,
-            useFactory: (pool) => new mariadb_reset_token_store_js_1.MariaDbResetTokenStore(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_reset_token_store_js_1.MariaDbResetTokenStore(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 /**
@@ -690,14 +732,14 @@ function makeResetTokenStoreProvider(override) {
  */
 const emailChangeTokenStoreProvider = {
     provide: tokens_js_1.SHIELD_EMAIL_CHANGE_TOKEN_STORE,
-    useFactory: (pool) => new mariadb_email_change_token_store_js_1.MariaDbEmailChangeTokenStore(pool),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    useFactory: (pool, config) => new mariadb_email_change_token_store_js_1.MariaDbEmailChangeTokenStore(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
 /** The ONE email read/write path for an email change (Phase 12): the framework default. */
 const emailAddressChangerProvider = {
     provide: tokens_js_1.SHIELD_EMAIL_ADDRESS_CHANGER,
-    useFactory: (pool) => new mariadb_email_address_changer_js_1.MariaDbEmailAddressChanger(pool),
-    inject: [tokens_js_1.SHIELD_DB_POOL],
+    useFactory: (pool, config) => new mariadb_email_address_changer_js_1.MariaDbEmailAddressChanger(pool, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
 };
 /**
  * The per-account email-change REQUEST limiter (Phase 12) — `email-change:pid:<id>`, 3 per 60-min
@@ -781,8 +823,8 @@ function makeRecoveryCodeStoreProvider(override) {
         ? { provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_RECOVERY_CODE_STORE,
-            useFactory: (pool, hasher) => new mariadb_recovery_code_store_js_1.MariaDbRecoveryCodeStore(pool, hasher),
-            inject: [tokens_js_1.SHIELD_DB_POOL, argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER],
+            useFactory: (pool, hasher, config) => new mariadb_recovery_code_store_js_1.MariaDbRecoveryCodeStore(pool, hasher, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, argon2id_password_hasher_js_1.SHIELD_PASSWORD_HASHER, config_module_js_1.APP_CONFIG],
         };
 }
 function makeProfileWriterProvider(override) {
@@ -790,8 +832,8 @@ function makeProfileWriterProvider(override) {
         ? { provide: tokens_js_1.SHIELD_PROFILE_WRITER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_PROFILE_WRITER,
-            useFactory: (pool) => new mariadb_profile_writer_js_1.MariaDbProfileWriter(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_profile_writer_js_1.MariaDbProfileWriter(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 function makeSessionSweeperProvider(override) {
@@ -799,8 +841,8 @@ function makeSessionSweeperProvider(override) {
         ? { provide: tokens_js_1.SHIELD_SESSION_SWEEPER, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_SESSION_SWEEPER,
-            useFactory: (pool, binder) => new mariadb_session_sweeper_js_1.MariaDbSessionSweeper(pool, binder),
-            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER],
+            useFactory: (pool, binder, config) => new mariadb_session_sweeper_js_1.MariaDbSessionSweeper(pool, binder, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, tokens_js_2.SHIELD_SESSION_TOKEN_BINDER, config_module_js_1.APP_CONFIG],
         };
 }
 function makeMfaDeviceStoreProvider(override) {
@@ -808,8 +850,8 @@ function makeMfaDeviceStoreProvider(override) {
         ? { provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE, useValue: override }
         : {
             provide: tokens_js_1.SHIELD_MFA_DEVICE_STORE,
-            useFactory: (pool) => new mariadb_mfa_device_store_js_1.MariaDbMfaDeviceStore(pool),
-            inject: [tokens_js_1.SHIELD_DB_POOL],
+            useFactory: (pool, config) => new mariadb_mfa_device_store_js_1.MariaDbMfaDeviceStore(pool, (0, app_config_js_1.frameworkSchemasOf)(config)),
+            inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
         };
 }
 function makeAuditSinkProvider(override) {
@@ -947,8 +989,8 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 // keys. The keys are CLOSED-OVER option values (never a guard→identity import).
                 {
                     provide: tokens_js_1.SHIELD_PERMISSION_FACTS,
-                    useFactory: (pool) => new permission_facts_adapter_js_1.MariaDbPermissionFactsAdapter(pool, () => identityActionKeys, identityControlPlaneKeys),
-                    inject: [tokens_js_1.SHIELD_DB_POOL],
+                    useFactory: (pool, config) => new permission_facts_adapter_js_1.MariaDbPermissionFactsAdapter(pool, () => identityActionKeys, identityControlPlaneKeys, undefined, (0, app_config_js_1.frameworkSchemasOf)(config)),
+                    inject: [tokens_js_1.SHIELD_DB_POOL, config_module_js_1.APP_CONFIG],
                 },
                 // The reset-link base URL value the forgot-password handler composes into the
                 // emailed link (framework-owned URL composition; EmailSender stays dumb).
@@ -1002,6 +1044,9 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 forgotLimiterProvider,
                 forgotHintLimiterProvider,
                 resetLimiterProvider,
+                // spec 5.D: the guard migrations are in the ledger (once at bootstrap; production fails).
+                migrationLedgerCheckProvider,
+                exports.singleLayoutProbeProvider,
             ],
             exports: [
                 tokens_js_1.SHIELD_AUTHENTICATOR,

package/dist/authentication/mariadb-api-key-store.d.ts

@@ -20,9 +20,18 @@
  */
 import type { Pool } from 'mariadb';
 import type { ApiKeyStore, ApiKeyRecord } from '@astram/core';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbApiKeyStore implements ApiKeyStore {
     private readonly pool;
-    constructor(pool: Pool);
+    /** `<authz>`.`service_account_key`. */
+    private readonly keyTable;
+    /** The account rows (`<app>`.`service_account`, created by the identity migration `…018`). */
+    private readonly accountTable;
+    /** `<app>`.`companies` (the account's tenant company). */
+    private readonly companyTable;
+    constructor(pool: Pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     getByAccountId(accountId: string): Promise<ApiKeyRecord | null>;
     /**
      * Persist a NEW key version for an account (issue or rotate). Only the HASH is stored. `version`

package/dist/authentication/mariadb-api-key-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-api-key-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-api-key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA+C9D,qBAAa,kBAAmB,YAAW,WAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA0DrE;;;;OAIG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB,iGAAiG;IAC3F,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxD,+FAA+F;IACzF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ7D"}
+{"version":3,"file":"mariadb-api-key-store.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-api-key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AA2C7C,qBAAa,kBAAmB,YAAW,WAAW;IASlD,OAAO,CAAC,QAAQ,CAAC,IAAI;IARvB,uCAAuC;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAGnB,IAAI,EAAE,IAAI;IAC3B,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA0DrE;;;;OAIG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB,iGAAiG;IAC3F,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxD,+FAA+F;IACzF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ7D"}

package/dist/authentication/mariadb-api-key-store.js

@@ -1,9 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbApiKeyStore = void 0;
-const AUTHZ = 'shield_authz';
-/** The account rows (`service_account`, created by the identity migration `…018`). */
-const APP = 'shield_app';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /**
  * Read a JSON-array column into a `string[]`. The mariadb driver returns a JSON/`longtext` column
  * EITHER already-parsed (an array/object — its default for JSON columns) OR as a raw string,
@@ -28,8 +26,20 @@ function parseJsonArray(v) {
 }
 class MariaDbApiKeyStore {
     pool;
-    constructor(pool) {
+    /** `<authz>`.`service_account_key`. */
+    keyTable;
+    /** The account rows (`<app>`.`service_account`, created by the identity migration `…018`). */
+    accountTable;
+    /** `<app>`.`companies` (the account's tenant company). */
+    companyTable;
+    constructor(pool, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.keyTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.authz, 'service_account_key');
+        this.accountTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'service_account');
+        this.companyTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'companies');
     }
     async getByAccountId(accountId) {
         // The CURRENT key = highest version for the account. (Rotation inserts a new version; the old
@@ -56,9 +66,9 @@ class MariaDbApiKeyStore {
               k.sak_secret_hash, k.sak_version, k.sak_expires_at_ms, k.sak_revoked_at_ms,
               sa.sa_scope_subtree, sa.sa_role_ids, sa.sa_status, sa.sa_tenant_id,
               c.c_uuid AS tenant_company_uuid
-         FROM \`${AUTHZ}\`.\`service_account_key\` k
-         JOIN \`${APP}\`.\`service_account\` sa ON sa.sa_id = k.sak_account_id
-         LEFT JOIN \`${APP}\`.\`companies\` c ON c.c_uuid = sa.sa_tenant_id
+         FROM ${this.keyTable} k
+         JOIN ${this.accountTable} sa ON sa.sa_id = k.sak_account_id
+         LEFT JOIN ${this.companyTable} c ON c.c_uuid = sa.sa_tenant_id
         WHERE k.sak_account_id = ?
         ORDER BY k.sak_version DESC
         LIMIT 1`, [accountId]));
@@ -94,7 +104,7 @@ class MariaDbApiKeyStore {
      * the natural key `(account, version)`.
      */
     async putVersion(input) {
-        await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`service_account_key\`
+        await this.pool.query(`INSERT INTO ${this.keyTable}
          (sak_account_id, sak_tenant_id, sak_scope_subtree, sak_role_ids,
           sak_secret_hash, sak_version, sak_expires_at_ms, sak_revoked_at_ms, sak_created_at_ms)
        VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`, [
@@ -110,12 +120,12 @@ class MariaDbApiKeyStore {
     }
     /** The current highest version for an account (0 if none) — for computing the next on rotate. */
     async currentVersion(accountId) {
-        const rows = (await this.pool.query(`SELECT MAX(sak_version) AS v FROM \`${AUTHZ}\`.\`service_account_key\` WHERE sak_account_id = ?`, [accountId]));
+        const rows = (await this.pool.query(`SELECT MAX(sak_version) AS v FROM ${this.keyTable} WHERE sak_account_id = ?`, [accountId]));
         return rows[0]?.v != null ? Number(rows[0].v) : 0;
     }
     /** Revoke ALL of an account's keys (immediate fail-closed on the next request). Idempotent. */
     async revoke(accountId, atMs) {
-        await this.pool.query(`UPDATE \`${AUTHZ}\`.\`service_account_key\`
+        await this.pool.query(`UPDATE ${this.keyTable}
           SET sak_revoked_at_ms = ?
         WHERE sak_account_id = ? AND sak_revoked_at_ms IS NULL`, [atMs, accountId]);
     }

package/dist/authentication/mariadb-credential-resolver.d.ts

@@ -60,6 +60,7 @@
 import type { Pool } from 'mariadb';
 import type { CredentialResolver, ResolvedCredential } from '@astram/core';
 import type { MfaDeviceStore } from '../auth/ports/mfa-device-store.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 /** DI token for the resolver — re-exported from the shared auth tokens module. */
 export { SHIELD_CREDENTIAL_RESOLVER } from '../auth/tokens.js';
 /**
@@ -83,6 +84,10 @@ export declare class MariaDbCredentialResolver implements CredentialResolver {
      * installed or migrated while the process runs) is enforced without a restart.
      */
     private usersTableMissingUntil;
+    /** `<identity>`.`identity_credential`. */
+    private readonly credentialTable;
+    /** `<app>`.`users` (the account status JOIN). */
+    private readonly usersTable;
     constructor(pool: Pool, 
     /**
      * The device store whose CONFIRMED keys become the login's `totp` required factor.
@@ -91,7 +96,9 @@ export declare class MariaDbCredentialResolver implements CredentialResolver {
      */
     mfaDevices?: (Pick<MfaDeviceStore, "listConfirmedSecrets"> | null) | undefined, 
     /** Clock (epoch-ms) for the users-table re-probe window. */
-    now?: () => number);
+    now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     /**
      * Resolve `identityHint` → {@link ResolvedCredential}, or `null` when no such
      * principal exists.

package/dist/authentication/mariadb-credential-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-credential-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAkB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAExE,kFAAkF;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA6D/D;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAShE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG;IAhBtB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAK;gBAGhB,IAAI,EAAE,IAAI;IAC3B;;;;OAIG;IACc,UAAU,CAAC,GAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IACjF,4DAA4D;IAC3C,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoCvE;;;;;;OAMG;YACW,MAAM;IAyBpB;;;OAGG;YACW,kBAAkB;CAQjC"}
+{"version":3,"file":"mariadb-credential-resolver.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,kBAAkB,EAAkB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,kFAAkF;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA6D/D;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,kBAAkB;IAchE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG;IArBtB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAAK;IAEnC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,iDAAiD;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI;IAC3B;;;;OAIG;IACc,UAAU,CAAC,GAAE,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,GAAG,IAAI,aAAA;IACjF,4DAA4D;IAC3C,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAOhC;;;;;;;;;;;;;OAaG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoCvE;;;;;;OAMG;YACW,MAAM;IAyBpB;;;OAGG;YACW,kBAAkB;CAQjC"}

package/dist/authentication/mariadb-credential-resolver.js

@@ -60,10 +60,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCredentialResolver = exports.SHIELD_CREDENTIAL_RESOLVER = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** DI token for the resolver — re-exported from the shared auth tokens module. */
 var tokens_js_1 = require("../auth/tokens.js");
 Object.defineProperty(exports, "SHIELD_CREDENTIAL_RESOLVER", { enumerable: true, get: function () { return tokens_js_1.SHIELD_CREDENTIAL_RESOLVER; } });
-/** MariaDB `ER_NO_SUCH_TABLE`: the app keeps no `shield_app.users` table. */
+/** MariaDB `ER_NO_SUCH_TABLE`: the app keeps no `<app>.users` table. */
 const ER_NO_SUCH_TABLE = 1146;
 /** How long the credential-only fallback is used before the users JOIN is tried again. */
 const USERS_TABLE_REPROBE_MS = 60_000;
@@ -113,6 +114,10 @@ class MariaDbCredentialResolver {
      * installed or migrated while the process runs) is enforced without a restart.
      */
     usersTableMissingUntil = 0;
+    /** `<identity>`.`identity_credential`. */
+    credentialTable;
+    /** `<app>`.`users` (the account status JOIN). */
+    usersTable;
     constructor(pool, 
     /**
      * The device store whose CONFIRMED keys become the login's `totp` required factor.
@@ -121,10 +126,15 @@ class MariaDbCredentialResolver {
      */
     mfaDevices, 
     /** Clock (epoch-ms) for the users-table re-probe window. */
-    now = Date.now) {
+    now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.mfaDevices = mfaDevices;
         this.now = now;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.credentialTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'identity_credential');
+        this.usersTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'users');
     }
     /**
      * Resolve `identityHint` → {@link ResolvedCredential}, or `null` when no such
@@ -182,8 +192,8 @@ class MariaDbCredentialResolver {
         if (this.now() >= this.usersTableMissingUntil) {
             try {
                 return (await this.pool.query(`SELECT ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles, u.u_status
-             FROM shield_identity.identity_credential
-             LEFT JOIN shield_app.users u ON u.u_uuid = ic_principal_id
+             FROM ${this.credentialTable}
+             LEFT JOIN ${this.usersTable} u ON u.u_uuid = ic_principal_id
             WHERE ic_identity_hint = ?
             LIMIT 1`, [identityHint]));
             }
@@ -194,7 +204,7 @@ class MariaDbCredentialResolver {
             }
         }
         return (await this.pool.query(`SELECT ic_password_hash, ic_principal_id, ic_tenant_id, ic_roles
-         FROM shield_identity.identity_credential
+         FROM ${this.credentialTable}
         WHERE ic_identity_hint = ?
         LIMIT 1`, [identityHint]));
     }

package/dist/authentication/mariadb-credential-writer.d.ts

@@ -6,10 +6,15 @@
  */
 import type { Pool } from 'mariadb';
 import type { CredentialWriter } from '../auth/ports/credential-writer.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbCredentialWriter implements CredentialWriter {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    private readonly table;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     setPassword(principalId: string, passwordHash: string): Promise<void>;
     getPasswordHash(principalId: string): Promise<string | null>;
 }

package/dist/authentication/mariadb-credential-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-credential-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAM3E,qBAAa,uBAAwB,YAAW,gBAAgB;IAE5D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAOnE"}
+{"version":3,"file":"mariadb-credential-writer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-credential-writer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAM7C,qBAAa,uBAAwB,YAAW,gBAAgB;IAK5D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAOnE"}

package/dist/authentication/mariadb-credential-writer.js

@@ -1,18 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCredentialWriter = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 class MariaDbCredentialWriter {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<identity>`.`identity_credential`, resolved at construction. */
+    table;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        this.table = (0, framework_schema_names_js_1.qualifiedTableName)((0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas).identity, 'identity_credential');
     }
     async setPassword(principalId, passwordHash) {
-        await this.pool.query('UPDATE `shield_identity`.`identity_credential` SET ic_password_hash = ?, ic_updated_at_ms = ? WHERE ic_principal_id = ?', [passwordHash, this.now(), principalId]);
+        await this.pool.query(`UPDATE ${this.table} SET ic_password_hash = ?, ic_updated_at_ms = ? WHERE ic_principal_id = ?`, [passwordHash, this.now(), principalId]);
     }
     async getPasswordHash(principalId) {
-        const rows = (await this.pool.query('SELECT ic_password_hash FROM `shield_identity`.`identity_credential` WHERE ic_principal_id = ? LIMIT 1', [principalId]));
+        const rows = (await this.pool.query(`SELECT ic_password_hash FROM ${this.table} WHERE ic_principal_id = ? LIMIT 1`, [principalId]));
         return rows[0]?.ic_password_hash ?? null;
     }
 }

package/dist/authentication/mariadb-email-address-changer.d.ts

@@ -29,10 +29,19 @@
  */
 import type { Pool } from 'mariadb';
 import type { CurrentEmail, EmailAddressChanger, EmailChangeOutcome, EmailChangeRequest } from '../auth/ports/email-address-changer.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 export declare class MariaDbEmailAddressChanger implements EmailAddressChanger {
     private readonly pool;
     private readonly now;
-    constructor(pool: Pool, now?: () => number);
+    /** `<app>`.`users`. */
+    private readonly usersTable;
+    /** `<identity>`.`identity_credential`. */
+    private readonly credentialTable;
+    /** `<identity>`.`email_change_token`. */
+    private readonly tokenTable;
+    constructor(pool: Pool, now?: () => number, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas?: FrameworkSchemaNames);
     readCurrent(principalId: string, candidate: string): Promise<CurrentEmail | null>;
     change(request: EmailChangeRequest): Promise<EmailChangeOutcome>;
     private changeLocked;

package/dist/authentication/mariadb-email-address-changer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAqBhD,qBAAa,0BAA2B,YAAW,mBAAmB;IAElE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAGzC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA6BxD,YAAY;CAqE3B"}
+{"version":3,"file":"mariadb-email-address-changer.d.ts","sourceRoot":"","sources":["../../src/authentication/mariadb-email-address-changer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAkB,MAAM,SAAS,CAAC;AACpD,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAqB7C,qBAAa,0BAA2B,YAAW,mBAAmB;IASlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,uBAAuB;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,0CAA0C;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGjB,IAAI,EAAE,IAAI,EACV,GAAG,GAAE,MAAM,MAAiB;IAC7C,yFAAyF;IACzF,OAAO,CAAC,EAAE,oBAAoB;IAQ1B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAejF,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YA6BxD,YAAY;CAqE3B"}

package/dist/authentication/mariadb-email-address-changer.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbEmailAddressChanger = void 0;
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** Seconds to wait for the email-change named lock before giving up (caller → 503). */
 const LOCK_TIMEOUT_S = 10;
 /** MariaDB `ER_DUP_ENTRY`: a unique index (here `uq_users_email` or the hint PK) refused a write. */
@@ -15,13 +16,25 @@ function isDuplicateKey(err) {
 class MariaDbEmailAddressChanger {
     pool;
     now;
-    constructor(pool, now = Date.now) {
+    /** `<app>`.`users`. */
+    usersTable;
+    /** `<identity>`.`identity_credential`. */
+    credentialTable;
+    /** `<identity>`.`email_change_token`. */
+    tokenTable;
+    constructor(pool, now = Date.now, 
+    /** Framework database names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` here, once. */
+    schemas) {
         this.pool = pool;
         this.now = now;
+        const s = (0, framework_schema_names_js_1.schemaNamesAtConstruction)(schemas);
+        this.usersTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.app, 'users');
+        this.credentialTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'identity_credential');
+        this.tokenTable = (0, framework_schema_names_js_1.qualifiedTableName)(s.identity, 'email_change_token');
     }
     async readCurrent(principalId, candidate) {
         const rows = (await this.pool.query(`SELECT u_email, u_status, (u_email = ?) AS same_as_candidate
-         FROM \`shield_app\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [candidate, principalId]));
+         FROM ${this.usersTable} WHERE u_uuid = ? LIMIT 1`, [candidate, principalId]));
         const row = rows[0];
         if (row === undefined)
             return null;
@@ -66,7 +79,7 @@ class MariaDbEmailAddressChanger {
     }
     async changeLocked(conn, request) {
         const { principalId, newEmail } = request;
-        const self = (await conn.query('SELECT u_email, u_status FROM `shield_app`.`users` WHERE u_uuid = ? FOR UPDATE', [principalId]));
+        const self = (await conn.query(`SELECT u_email, u_status FROM ${this.usersTable} WHERE u_uuid = ? FOR UPDATE`, [principalId]));
         const row = self[0];
         if (row === undefined)
             return { status: 'not_found' };
@@ -76,24 +89,24 @@ class MariaDbEmailAddressChanger {
         if (request.expectedOldEmail !== undefined && oldEmail !== request.expectedOldEmail) {
             return { status: 'stale' };
         }
-        const otherUser = (await conn.query('SELECT u_uuid FROM `shield_app`.`users` WHERE u_email = ? AND u_uuid <> ? LIMIT 1 FOR UPDATE', [newEmail, principalId]));
+        const otherUser = (await conn.query(`SELECT u_uuid FROM ${this.usersTable} WHERE u_email = ? AND u_uuid <> ? LIMIT 1 FOR UPDATE`, [newEmail, principalId]));
         if (otherUser.length > 0)
             return { status: 'unavailable' };
-        const hintOwners = (await conn.query('SELECT ic_principal_id FROM `shield_identity`.`identity_credential` WHERE ic_identity_hint = ? FOR UPDATE', [newEmail]));
+        const hintOwners = (await conn.query(`SELECT ic_principal_id FROM ${this.credentialTable} WHERE ic_identity_hint = ? FOR UPDATE`, [newEmail]));
         if (hintOwners.some((h) => h.ic_principal_id !== principalId))
             return { status: 'unavailable' };
         const selfAlreadyHasNewHint = hintOwners.length > 0;
-        await conn.query('SELECT ic_identity_hint FROM `shield_identity`.`identity_credential` WHERE ic_principal_id = ? FOR UPDATE', [principalId]);
+        await conn.query(`SELECT ic_identity_hint FROM ${this.credentialTable} WHERE ic_principal_id = ? FOR UPDATE`, [principalId]);
         // Steps 3–4: a duplicate key here is a row the locked reads could not see (written by a path
         // without the named lock); the index refuses it → `unavailable`, and `change` rolls back.
         let hintMoved = false;
         try {
-            await conn.query('UPDATE `shield_app`.`users` SET u_email = ? WHERE u_uuid = ?', [
+            await conn.query(`UPDATE ${this.usersTable} SET u_email = ? WHERE u_uuid = ?`, [
                 newEmail,
                 principalId,
             ]);
             if (oldEmail !== null && oldEmail !== '' && !selfAlreadyHasNewHint) {
-                const moved = (await conn.query(`UPDATE \`shield_identity\`.\`identity_credential\`
+                const moved = (await conn.query(`UPDATE ${this.credentialTable}
               SET ic_identity_hint = ?, ic_updated_at_ms = ?
             WHERE ic_principal_id = ? AND ic_identity_hint = ?`, [newEmail, this.now(), principalId, oldEmail]));
                 hintMoved = moved.affectedRows > 0;
@@ -104,7 +117,7 @@ class MariaDbEmailAddressChanger {
                 return { status: 'unavailable' }; // the driver message is dropped
             throw err;
         }
-        await conn.query(`UPDATE \`shield_identity\`.\`email_change_token\` SET ect_consumed_at_ms = ?
+        await conn.query(`UPDATE ${this.tokenTable} SET ect_consumed_at_ms = ?
         WHERE ect_principal_id = ? AND ect_consumed_at_ms IS NULL`, [this.now(), principalId]);
         if (request.withinTransaction !== undefined) {
             await request.withinTransaction((sql, params) => conn.query(sql, params ?? []), { oldEmail, hintMoved });