@astram/guard 0.14.0 → 0.16.0

package/dist/authz/cross-tenant-grant-writer.js

@@ -63,8 +63,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CrossTenantGrantWriter = exports.GrantStoreUnavailableError = exports.InvalidGrantError = exports.GrantNotPermittedError = exports.SHIELD_CROSS_TENANT_GRANT_WRITER = void 0;
 const node_crypto_1 = require("node:crypto");
-/** Schema the `cross_tenant_grant` table lives in (astram3 ships the migration). */
-const DEFAULT_SCHEMA = 'shield_authz';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the writer is bound under. */
 exports.SHIELD_CROSS_TENANT_GRANT_WRITER = Symbol('SHIELD_CROSS_TENANT_GRANT_WRITER');
 /** Thrown when the who-may-grant bound rejects an offer/accept/revoke (fail-closed). */
@@ -122,7 +121,9 @@ class CrossTenantGrantWriter {
         this.db = deps.db;
         this.authorize = deps.authorize;
         this.audit = deps.audit;
-        this.schema = deps.schema ?? DEFAULT_SCHEMA;
+        // The `cross_tenant_grant` database: `deps.schema` (checked), else the resolved authz name
+        // (configurable-framework-db), fixed at construction.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(deps.schema);
         this.now = deps.nowMs ?? (() => Date.now());
     }
     /**

package/dist/authz/list-scope-sql.d.ts

@@ -107,9 +107,17 @@ export declare class UnknownScopeFieldError extends Error {
  * @returns `{ sql, params }` — `sql` carries ONLY `?` + backtick columns; `params` the
  *          bound values in `?`-order.
  * @throws {@link UnknownScopeFieldError} if any condition names an unregistered field.
+ * @throws FrameworkSchemaConfigError (core) if `opts.schema` is missing or not a safe name.
  */
-export declare function translateListScope(spec: ListScopeSpec, reg: ObjectType, principal: ListScopePrincipal, opts?: {
-    schema?: string;
+export declare function translateListScope(spec: ListScopeSpec, reg: ObjectType, principal: ListScopePrincipal, opts: {
+    /**
+     * REQUIRED: the authz database holding `record_share` / `cross_tenant_grant` (configurable-
+     * framework-db). No default: this pure translator runs per request and never reads env, and
+     * a silent `shield_authz` default would read another environment's grants under a namespace.
+     * The wiring (`buildListScopeFn`) passes the resolved `schemas.authz`. Checked with core
+     * `assertSchemaName` on every call (fail closed).
+     */
+    schema: string;
     nowMs?: () => number;
     /**
      * The OWNING tenant's deny AND-groups (Task 4.2 — the fail-open leak fix). Applied ONLY to

package/dist/authz/list-scope-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-scope-sql.d.ts","sourceRoot":"","sources":["../../src/authz/list-scope-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAKxB,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAO3C;AAmID;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,kBAAkB,EAC7B,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,SAAS,cAAc,EAAE,CAAC,EAAE,CAAC;CACtD,GACL,mBAAmB,CAoJrB"}
+{"version":3,"file":"list-scope-sql.d.ts","sourceRoot":"","sources":["../../src/authz/list-scope-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAIf,MAAM,cAAc,CAAC;AACtB,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,gBAAgB,CAAC;AAGxB,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,yFAAyF;AACzF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAO3C;AAmID;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE;IACJ;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,SAAS,cAAc,EAAE,CAAC,EAAE,CAAC;CAC3D,GACA,mBAAmB,CAoJrB"}

package/dist/authz/list-scope-sql.js

@@ -80,8 +80,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UnknownScopeFieldError = void 0;
 exports.translateListScope = translateListScope;
 const engine_1 = require("@astram/engine");
-/** Schema the `record_share` table lives in (parity with the share adapter). */
-const DEFAULT_SCHEMA = 'shield_authz';
+const core_1 = require("@astram/core");
 /** Error thrown when a scope condition references a field the type does not register. */
 class UnknownScopeFieldError extends Error {
     constructor(typeKey, field) {
@@ -211,9 +210,10 @@ function translateGroups(groups, reg, principal, p) {
  * @returns `{ sql, params }` — `sql` carries ONLY `?` + backtick columns; `params` the
  *          bound values in `?`-order.
  * @throws {@link UnknownScopeFieldError} if any condition names an unregistered field.
+ * @throws FrameworkSchemaConfigError (core) if `opts.schema` is missing or not a safe name.
  */
-function translateListScope(spec, reg, principal, opts = {}) {
-    const schema = opts.schema ?? DEFAULT_SCHEMA;
+function translateListScope(spec, reg, principal, opts) {
+    const schema = (0, core_1.assertSchemaName)(opts?.schema, 'translateListScope opts.schema');
     // The cross-tenant expiry filter binds THIS clock's epoch-ms against the BIGINT
     // `ctg_expires_at_ms` column — timezone-immune (mirrors MariaDbCrossTenantGrantAdapter's
     // injectable clock). Injectable for deterministic tests.

package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-cross-tenant-grant-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-cross-tenant-grant-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,cAAc,CAAC;AAGtB,wFAAwF;AACxF,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAKvF,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAsDD;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,oBAAoB;IACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAQ9E,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAwFrF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAkCtB"}
+{"version":3,"file":"mariadb-cross-tenant-grant-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-cross-tenant-grant-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EAEtB,MAAM,cAAc,CAAC;AAItB,wFAAwF;AACxF,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAsDD;;;;GAIG;AACH,qBAAa,8BAA+B,YAAW,oBAAoB;IACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAU9E,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAwFrF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,uBAAuB,CAAC,KAAK,EAAE;QACnC,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAkCtB"}

package/dist/authz/mariadb-cross-tenant-grant-adapter.js

@@ -69,10 +69,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCrossTenantGrantAdapter = exports.SHIELD_CROSS_TENANT_GRANT_PORT = void 0;
 const core_1 = require("@astram/core");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the adapter is bound under (parity with the share/rule-port tokens). */
 exports.SHIELD_CROSS_TENANT_GRANT_PORT = Symbol('SHIELD_CROSS_TENANT_GRANT_PORT');
-/** Schema the `cross_tenant_grant` table lives in (astram3 ships the migration). */
-const DEFAULT_SCHEMA = 'shield_authz';
 /**
  * Parse `ctg_allowed_actions` to a `string[]`. ⚠️ The `ctg_allowed_actions` column is a JSON
  * column, and the mariadb driver AUTO-PARSES it into a JS ARRAY on read — so `raw` is ALREADY an
@@ -123,7 +122,9 @@ class MariaDbCrossTenantGrantAdapter {
     now;
     constructor(db, opts = {}) {
         this.db = db;
-        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        // The `cross_tenant_grant` database: `opts.schema` (checked), else the resolved authz name
+        // (configurable-framework-db), fixed at construction.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(opts.schema);
         // The expiry filter binds THIS clock's epoch-ms against the BIGINT `ctg_expires_at_ms`
         // column — timezone-immune (no Date/`NOW()` skew). Injectable for deterministic tests.
         this.now = opts.nowMs ?? (() => Date.now());

package/dist/authz/mariadb-list-scope-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-list-scope-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-list-scope-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAGjB,MAAM,cAAc,CAAC;AAGtB,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAKvE,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAoCD;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IAC3D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAK5D,oBAAoB,CACxB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC;CA8EjC"}
+{"version":3,"file":"mariadb-list-scope-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-list-scope-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAGjB,MAAM,cAAc,CAAC;AAItB,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,eAAmC,CAAC;AAEvE,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAoCD;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IAC3D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAO5D,oBAAoB,CACxB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC;CA8EjC"}

package/dist/authz/mariadb-list-scope-adapter.js

@@ -43,10 +43,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbListScopeAdapter = exports.SHIELD_LIST_SCOPE_PORT = void 0;
 const core_1 = require("@astram/core");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the adapter is bound under (parity with the rule-port token). */
 exports.SHIELD_LIST_SCOPE_PORT = Symbol('SHIELD_LIST_SCOPE_PORT');
-/** Schema the `record_permission_rule` table lives in (framework migration ...009). */
-const DEFAULT_SCHEMA = 'shield_authz';
 /**
  * Whether a rule group's SUBJECT matches the requesting principal — the EXACT mirror of the
  * per-record rule adapter's `subjectMatches` ({@link MariaDbRecordPermissionRuleAdapter}):
@@ -79,7 +78,9 @@ class MariaDbListScopeAdapter {
     schema;
     constructor(db, opts = {}) {
         this.db = db;
-        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        // The `record_permission_rule` database (framework migration ...009): `opts.schema`
+        // (checked), else the resolved authz name (configurable-framework-db), fixed here.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(opts.schema);
     }
     async listPolicyConditions(typeKey, tenantNodeIds, action, subject) {
         // The caller's reachable subtree (active node + descendants, ADR-0027). A rule scoped to

package/dist/authz/mariadb-policy-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-policy-store.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-policy-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAmB,MAAM,cAAc,CAAC;AAEvF,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAKjE,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgCD;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAK7D;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA4CzE;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAiDjF;;;;OAIG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD;;;;;;;;;;OAUG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CASjF"}
+{"version":3,"file":"mariadb-policy-store.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-policy-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAmB,MAAM,cAAc,CAAC;AAGvF,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgCD;;;;GAIG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAO7D;;;;;OAKG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA4CzE;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAiDjF;;;;OAIG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD;;;;;;;;;;OAUG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CASjF"}

package/dist/authz/mariadb-policy-store.js

@@ -69,10 +69,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbPolicyStore = exports.SHIELD_POLICY_STORE = void 0;
 const node_crypto_1 = require("node:crypto");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the policy store is bound under (parity with the rule-port token). */
 exports.SHIELD_POLICY_STORE = Symbol('SHIELD_POLICY_STORE');
-/** Schema the `record_permission_rule` table lives in (framework migration ...009). */
-const DEFAULT_SCHEMA = 'shield_authz';
 /**
  * The operators that take NO operand (the read adapter ignores `rpr_value` for
  * these). Their conditions persist `rpr_value = NULL` so a round-trip yields the
@@ -103,7 +102,9 @@ class MariaDbPolicyStore {
     schema;
     constructor(db, opts = {}) {
         this.db = db;
-        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        // The `record_permission_rule` database (framework migration ...009): `opts.schema`
+        // (checked), else the resolved authz name (configurable-framework-db), fixed here.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(opts.schema);
     }
     /**
      * Persist a guided policy as N `record_permission_rule` rows (ONE row for a

package/dist/authz/mariadb-record-rule-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-record-rule-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-record-rule-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAG1F,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAKzE,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAmLD;;;GAGG;AACH,qBAAa,kCAAmC,YAAW,wBAAwB;IACjF,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKvD,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;CAuE5D"}
+{"version":3,"file":"mariadb-record-rule-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-record-rule-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAI1F,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAmLD;;;GAGG;AACH,qBAAa,kCAAmC,YAAW,wBAAwB;IACjF,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,aAAa,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAOvD,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;CAuE5D"}

package/dist/authz/mariadb-record-rule-adapter.js

@@ -46,10 +46,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbRecordPermissionRuleAdapter = exports.SHIELD_RECORD_RULE_PORT = void 0;
 const core_1 = require("@astram/core");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the adapter is bound under (parity with the session store token). */
 exports.SHIELD_RECORD_RULE_PORT = Symbol('SHIELD_RECORD_RULE_PORT');
-/** Schema the `record_permission_rule` table lives in (astram3 ships the migration). */
-const DEFAULT_SCHEMA = 'shield_authz';
 /** Whether the rule's subject matches this principal (role membership / everyone). */
 function subjectMatches(row, input) {
     const kind = row.rpr_subject_kind;
@@ -222,7 +221,9 @@ class MariaDbRecordPermissionRuleAdapter {
     schema;
     constructor(db, opts = {}) {
         this.db = db;
-        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        // The `record_permission_rule` database: `opts.schema` (checked), else the resolved authz
+        // name (configurable-framework-db), fixed at construction.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(opts.schema);
     }
     async evaluate(input) {
         // tenant scoping: match rows for the resource's tenant OR the global/system baseline

package/dist/authz/mariadb-record-share-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-record-share-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-record-share-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAK3E,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAOD;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,eAAe;IAC/D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;CAqCpB"}
+{"version":3,"file":"mariadb-record-share-adapter.d.ts","sourceRoot":"","sources":["../../src/authz/mariadb-record-share-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIpD,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,eAAqC,CAAC;AAE3E,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAOD;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,eAAe;IAC/D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAOxD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;CAqCpB"}

package/dist/authz/mariadb-record-share-adapter.js

@@ -57,10 +57,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbRecordShareAdapter = exports.SHIELD_RECORD_SHARE_PORT = void 0;
 const core_1 = require("@astram/core");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the adapter is bound under (parity with the rule-port token). */
 exports.SHIELD_RECORD_SHARE_PORT = Symbol('SHIELD_RECORD_SHARE_PORT');
-/** Schema the `record_share` table lives in (astram3 ships the migration). */
-const DEFAULT_SCHEMA = 'shield_authz';
 /**
  * The concrete per-record share adapter. Answers `hasShare` from `record_share`, matching
  * user- and role-granted shares with exact-or-wildcard action.
@@ -70,7 +69,9 @@ class MariaDbRecordShareAdapter {
     schema;
     constructor(db, opts = {}) {
         this.db = db;
-        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        // The `record_share` database: `opts.schema` (checked), else the resolved authz name
+        // (configurable-framework-db), fixed at construction.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(opts.schema);
     }
     async hasShare(principalId, roleIds, typeKey, recordId, action) {
         // Grantee predicate: the user share OR (only when roles exist) a role share. The role

package/dist/authz/record-share-cascade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-share-cascade.d.ts","sourceRoot":"","sources":["../../src/authz/record-share-cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,iBAAiB,CAcxF"}
+{"version":3,"file":"record-share-cascade.d.ts","sourceRoot":"","sources":["../../src/authz/record-share-cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,iBAAiB,CAgBxF"}

package/dist/authz/record-share-cascade.js

@@ -32,8 +32,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeShareDeleteCascade = makeShareDeleteCascade;
-/** Schema the `record_share` table lives in. */
-const DEFAULT_SCHEMA = 'shield_authz';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /**
  * Build the delete-cascade function (a {@link RecordDeletedHook}) the consumer wires into
  * the engine as `onRecordDeleted`. Removes a deleted record's `record_share` rows,
@@ -41,7 +40,9 @@ const DEFAULT_SCHEMA = 'shield_authz';
  * no pool — the query fn is supplied by the engine on every call.
  */
 function makeShareDeleteCascade(opts = {}) {
-    const schema = opts.schema ?? DEFAULT_SCHEMA;
+    // The `record_share` database: explicit, else the resolved authz name, fixed here at build
+    // time (configurable-framework-db) — the hook itself never reads env.
+    const schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(opts.schema);
     return async (query, typeKey, recordId, tenantId) => {
         await query(`DELETE FROM \`${schema}\`.\`record_share\`` +
             ` WHERE rs_tenant_uuid = ? AND rs_type_key = ? AND rs_record_uuid = ?`, [tenantId, typeKey, recordId]);

package/dist/authz/record-share-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-share-writer.d.ts","sourceRoot":"","sources":["../../src/authz/record-share-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKxE,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;CACrD;AAED,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC;IACnD,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oCAAoC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAOD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB,KAAK,EAAE,iBAAiB,CAAC;QACzB,kFAAkF;QAClF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAQD;;;;;;;;OAQG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B7C;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B/C;;;;;;;;;;OAUG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IA0CD;;;;OAIG;YACW,cAAc;IAoC5B;;;;OAIG;YACW,sBAAsB;IA6BpC,OAAO,CAAC,cAAc;IAItB,sFAAsF;YACxE,IAAI;CAsBnB"}
+{"version":3,"file":"record-share-writer.d.ts","sourceRoot":"","sources":["../../src/authz/record-share-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGxE,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;CACrD;AAED,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAAC;IACnD,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,6DAA6D;AAC7D,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oCAAoC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,iFAAiF;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM;CAI5B;AAOD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE;QAChB,EAAE,EAAE,cAAc,CAAC;QACnB,KAAK,EAAE,iBAAiB,CAAC;QACzB,kFAAkF;QAClF,KAAK,CAAC,EAAE,cAAc,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACtB;IAUD;;;;;;;;OAQG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B7C;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B/C;;;;;;;;;;OAUG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAC/B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CACT,aAAa,CAAC;QACZ,WAAW,EAAE,gBAAgB,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CACH;IA0CD;;;;OAIG;YACW,cAAc;IAoC5B;;;;OAIG;YACW,sBAAsB;IA6BpC,OAAO,CAAC,cAAc;IAItB,sFAAsF;YACxE,IAAI;CAsBnB"}

package/dist/authz/record-share-writer.js

@@ -42,8 +42,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecordShareWriter = exports.ShareStoreUnavailableError = exports.ShareNotPermittedError = exports.SHIELD_RECORD_SHARE_WRITER = void 0;
 const node_crypto_1 = require("node:crypto");
-/** Schema the `record_share` table lives in (astram3 ships the migration). */
-const DEFAULT_SCHEMA = 'shield_authz';
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 /** The DI token the writer is bound under. */
 exports.SHIELD_RECORD_SHARE_WRITER = Symbol('SHIELD_RECORD_SHARE_WRITER');
 /** Thrown when the who-may-share bound rejects a share/unshare (fail-closed). */
@@ -72,7 +71,9 @@ class RecordShareWriter {
         this.db = deps.db;
         this.types = deps.types;
         this.audit = deps.audit;
-        this.schema = deps.schema ?? DEFAULT_SCHEMA;
+        // The `record_share` database: `deps.schema` (checked), else the resolved authz name
+        // (configurable-framework-db), fixed at construction.
+        this.schema = (0, framework_schema_names_js_1.authzSchemaAtConstruction)(deps.schema);
         this.now = deps.nowMs ?? (() => Date.now());
     }
     /**

package/dist/authz/wire-record-authorization.d.ts

@@ -27,6 +27,7 @@ import type { DecisionAuthority, ModuleRegistry, PermissionFactsPort, Principal,
 import type { PermissionVersionReader } from './permission-version-cache.js';
 import type { ObjectType } from '@astram/engine';
 import { type RuleQueryable } from './mariadb-record-rule-adapter.js';
+import { type FrameworkSchemaNames } from '../config/framework-schema-names.js';
 import { type OperationManifestEntry } from './manifest-operation-authority-adapter.js';
 /**
  * The pieces a consumer supplies for the framework to build the real record-tier
@@ -57,6 +58,13 @@ export interface RecordAuthorizationInputs {
      * ENTRIES; the framework owns the ADAPTER.
      */
     readonly operationManifest?: readonly OperationManifestEntry[];
+    /**
+     * The resolved framework database names (configurable-framework-db, ADR-0037): every
+     * framework-built adapter reads `schemas.authz`. Inject `FRAMEWORK_SCHEMAS`. Absent ⇒ resolved
+     * from `SHIELD_DB_NAMESPACE` once, when the authority / list fn is built (never per request);
+     * `ShieldModule` fills it from `AppConfig.schemas` when the inputs omit it.
+     */
+    readonly schemas?: FrameworkSchemaNames;
 }
 /**
  * Construct the four framework-owned record-tier adapters over the supplied pool +

package/dist/authz/wire-record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAM1C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAChE;AAED;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA2BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAuE/E"}
+{"version":3,"file":"wire-record-authorization.d.ts","sourceRoot":"","sources":["../../src/authz/wire-record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EAEd,mBAAmB,EACnB,SAAS,EAET,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAMtB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAM1C,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,2CAA2C,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;IAC9C,6FAA6F;IAC7F,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;CACzC;AAOD;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,uBAAuB,GAC7B,mBAAmB,CA2BrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,+BAA+B;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,yBAAyB,EACjC,OAAO,GAAE,+BAAoC,GAC5C,iBAAiB,CA4BnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,yBAAyB,GAAG,WAAW,CAyE/E"}

package/dist/authz/wire-record-authorization.js

@@ -10,7 +10,12 @@ const mariadb_cross_tenant_grant_adapter_js_1 = require("./mariadb-cross-tenant-
 const mariadb_list_scope_adapter_js_1 = require("./mariadb-list-scope-adapter.js");
 const list_scope_sql_js_1 = require("./list-scope-sql.js");
 const session_facts_als_js_1 = require("../request-auth/session-facts-als.js");
+const framework_schema_names_js_1 = require("../config/framework-schema-names.js");
 const manifest_operation_authority_adapter_js_1 = require("./manifest-operation-authority-adapter.js");
+/** The authz database the framework-built adapters read: `inputs.schemas`, else resolved now. */
+function authzSchemaOf(inputs) {
+    return (0, framework_schema_names_js_1.schemaNamesAtConstruction)(inputs.schemas).authz;
+}
 /**
  * Construct the four framework-owned record-tier adapters over the supplied pool +
  * manifest, and return the fully-wired core {@link DecisionAuthority}. Behavior-identical
@@ -65,6 +70,7 @@ function buildRecordAuthorization(inputs, options = {}) {
     const facts = options.versionCache !== undefined
         ? withRedisPermissionVersion(inputs.permissionFacts, options.versionCache)
         : inputs.permissionFacts;
+    const schema = authzSchemaOf(inputs);
     return (0, core_1.createWiredDecisionAuthority)({
         registry: inputs.registry,
         // The app-owned port, wrapped so a gate-5 reload inside an enforcement request notifies the
@@ -76,13 +82,13 @@ function buildRecordAuthorization(inputs, options = {}) {
         // ── The FOUR framework-owned record-tier adapters — constructed HERE, and ONLY here.
         // Record-permit ADMIN rules over `shield_authz.record_permission_rule` (widen the
         // core-owned owner baseline, deny-wins). Empty table ⇒ owner-only (NOT a lockout).
-        recordRule: new mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter(inputs.pool),
+        recordRule: new mariadb_record_rule_adapter_js_1.MariaDbRecordPermissionRuleAdapter(inputs.pool, { schema }),
         // Per-record SHARE source over `shield_authz.record_share` (widening permit, union
         // with baseline under deny-wins). No share ⇒ false (baseline still governs).
-        recordShare: new mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter(inputs.pool),
+        recordShare: new mariadb_record_share_adapter_js_1.MariaDbRecordShareAdapter(inputs.pool, { schema }),
         // Cross-tenant consented grants over `shield_authz.cross_tenant_grant`. No active
         // grant ⇒ null (deny-by-default for the cross-tenant reach).
-        crossTenantGrant: new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool),
+        crossTenantGrant: new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool, { schema }),
         // Delegation / trusted-operation authority over the DECLARED manifest (no DB).
         // Empty ⇒ pass-through. The app supplies the entries; the framework owns the adapter.
         operationAuthority: new manifest_operation_authority_adapter_js_1.ManifestOperationAuthorityAdapter(inputs.operationManifest ?? []),
@@ -107,13 +113,15 @@ function buildRecordAuthorization(inputs, options = {}) {
  *    unknown-field rejection) PROPAGATES so the read fails, NEVER falls open to unbounded.
  */
 function buildListScopeFn(inputs) {
+    // The authz database, resolved ONCE here (build time) and captured by the per-request fn.
+    const schema = authzSchemaOf(inputs);
     // Framework-constructed over `inputs.pool` — UN-overridable (not a field of the inputs).
-    const listScopePort = new mariadb_list_scope_adapter_js_1.MariaDbListScopeAdapter(inputs.pool);
+    const listScopePort = new mariadb_list_scope_adapter_js_1.MariaDbListScopeAdapter(inputs.pool, { schema });
     // The cross-tenant grant adapter — reused HERE to resolve the OWNING tenants a grantee
     // reaches, so the list can apply the OWNING tenant's deny rules to the cross-tenant branch
     // (deny-wins per the resource's tenant — the fail-open leak the Phase-4 review found). Same
     // un-overridable `inputs.pool`.
-    const crossTenantAdapter = new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool);
+    const crossTenantAdapter = new mariadb_cross_tenant_grant_adapter_js_1.MariaDbCrossTenantGrantAdapter(inputs.pool, { schema });
     return async (reg, actor, action) => {
         // Bridge the engine `ObjectType` → the core `ComputeListScopeDeps.registry` shape.
         // `computeListScope` reads ONLY `descriptor.access` for the owner-baseline posture
@@ -156,7 +164,7 @@ function buildListScopeFn(inputs) {
         }
         // Translate the abstract spec → SAFE parameterized WHERE fragment. An unknown-field
         // rejection here also PROPAGATES (fail-closed).
-        const translated = (0, list_scope_sql_js_1.translateListScope)(spec, reg, { principalId: actor.id, principalTenantId: actor.tenantId }, { owningTenantDeny });
+        const translated = (0, list_scope_sql_js_1.translateListScope)(spec, reg, { principalId: actor.id, principalTenantId: actor.tenantId }, { owningTenantDeny, schema });
         return { sql: translated.sql, params: translated.params };
     };
 }

package/dist/boot/boot-sequence.d.ts

@@ -1,4 +1,5 @@
 import { type OnApplicationBootstrap } from '@nestjs/common';
+import type { FrameworkSchemas } from '@astram/core';
 import { type AppConfig, type PoolBudgetConfig } from '../config/app-config.js';
 /**
  * Boot sequence extension point (Infrastructure layer — ADR-0018).
@@ -17,6 +18,7 @@ import { type AppConfig, type PoolBudgetConfig } from '../config/app-config.js';
  */
 export declare class BootSequence implements OnApplicationBootstrap {
     private readonly config;
+    private readonly logger;
     constructor(config: AppConfig);
     onApplicationBootstrap(): Promise<void>;
     /**
@@ -31,6 +33,14 @@ export declare class BootSequence implements OnApplicationBootstrap {
      */
     private assertConnectionPoolReady;
 }
+/** The boot log line naming the resolved framework databases (names only, spec 5.E). */
+export declare function frameworkDatabasesLogLine(s: FrameworkSchemas): string;
+/**
+ * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
+ * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
+ * variable only, never its value.
+ */
+export declare function shieldDbNameIgnoredWarning(env: NodeJS.ProcessEnv): string | undefined;
 /**
  * Validate a {@link PoolBudgetConfig} against the ADR-0018 budget. Exported so
  * unit tests can assert the throw/no-throw contract directly without booting

package/dist/boot/boot-sequence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAAsB,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAuB5D"}
+{"version":3,"file":"boot-sequence.d.ts","sourceRoot":"","sources":["../../src/boot/boot-sequence.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,qBACa,YAAa,YAAW,sBAAsB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFvD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;gBAEE,MAAM,EAAE,SAAS;IAE5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7C;;;;;;;;;OASG;YACW,yBAAyB;CAIxC;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAMrE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAKrF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAsC5D"}

package/dist/boot/boot-sequence.js

@@ -13,6 +13,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BootSequence = void 0;
+exports.frameworkDatabasesLogLine = frameworkDatabasesLogLine;
+exports.shieldDbNameIgnoredWarning = shieldDbNameIgnoredWarning;
 exports.assertPoolBudget = assertPoolBudget;
 const common_1 = require("@nestjs/common");
 const config_module_js_1 = require("../config/config.module.js");
@@ -34,12 +36,22 @@ const app_config_js_1 = require("../config/app-config.js");
  */
 let BootSequence = class BootSequence {
     config;
+    logger = new common_1.Logger('Shield');
     constructor(config) {
         this.config = config;
     }
     async onApplicationBootstrap() {
+        // configurable-framework-db spec 5.E: the resolved database names, once per boot. Names
+        // only — never a user, password, host or connection string.
+        this.logger.log(frameworkDatabasesLogLine((0, app_config_js_1.frameworkSchemasOf)(this.config)));
+        // Spec 5.C/AC-1: SHIELD_DB_NAME is read only in the single layout; say so when it is ignored.
+        const ignored = shieldDbNameIgnoredWarning(process.env);
+        if (ignored !== undefined)
+            this.logger.warn(ignored);
         await this.assertConnectionPoolReady();
-        // Future boot-time assertions attach here (each fail-closed).
+        // Future boot-time assertions attach here (each fail-closed). The migration ledger check
+        // (spec 5.D) needs the runtime pool, so it runs from AuthModule (`auth: true`) and from
+        // IdentityFeatureModule: see ./migration-ledger-check.ts.
     }
     /**
      * ADR-0018: assert the configured connection-pool budget fits under the DB
@@ -62,6 +74,26 @@ exports.BootSequence = BootSequence = __decorate([
     __param(0, (0, common_1.Inject)(config_module_js_1.APP_CONFIG)),
     __metadata("design:paramtypes", [Object])
 ], BootSequence);
+/** The boot log line naming the resolved framework databases (names only, spec 5.E). */
+function frameworkDatabasesLogLine(s) {
+    if (s.layout === 'single')
+        return `Shield databases: layout=single database=${s.app}`;
+    return (`Shield databases: namespace=${s.namespace} app=${s.app} identity=${s.identity} ` +
+        `authz=${s.authz} audit=${s.audit}`);
+}
+/**
+ * Single-database-layout spec §5.C, AC-1 (ADR-0041): the warning for `SHIELD_DB_NAME` set under
+ * the four layout (it is read only when `SHIELD_DB_LAYOUT=single`), else `undefined`. Names the
+ * variable only, never its value.
+ */
+function shieldDbNameIgnoredWarning(env) {
+    if (env.SHIELD_DB_LAYOUT === 'single')
+        return undefined;
+    const v = env.SHIELD_DB_NAME;
+    if (v === undefined || v.trim() === '')
+        return undefined;
+    return 'SHIELD_DB_NAME is read only when SHIELD_DB_LAYOUT=single; ignored.';
+}
 /**
  * Validate a {@link PoolBudgetConfig} against the ADR-0018 budget. Exported so
  * unit tests can assert the throw/no-throw contract directly without booting
@@ -78,13 +110,25 @@ function assertPoolBudget(cfg) {
             'which exceeds the hard cap of 2. DDL is rare + serialized per tenant ' +
             '(ADR-0014 §7) — keep this pool tiny (1–2).');
     }
+    if (!e.withinUserBudget) {
+        throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): single layout needs ' +
+            `${e.requiredConnections} connections (workers(${cfg.workers}) × ` +
+            `${e.perWorkerConnections} + headroom(${cfg.headroom})) but the account allows ` +
+            `${cfg.maxUserConnections} (APP_DB_MAX_USER_CONNECTIONS). Reduce POOL_MAX_CORE, ` +
+            'POOL_MAX_ENGINE, APP_AUTHZ_POOL_MAX, POOL_WORKERS or POOL_HEADROOM, or raise ' +
+            'MAX_USER_CONNECTIONS on the account (ADR-0041).');
+    }
     if (!e.withinBudget) {
         throw new Error('[ADR-0018] connection-pool assertion FAILED (fail-closed): required ' +
             `connections ${e.requiredConnections} exceed max_connections ` +
             `${cfg.maxConnections}. Budget = workers(${cfg.workers}) × ` +
             `Σ(per-account pool max)(${e.perWorkerConnections}) + headroom(` +
             `${cfg.headroom}) = ${e.requiredConnections} > ${cfg.maxConnections}. ` +
-            'Reduce a per-account pool cap, the worker count, or raise ' +
-            'max_connections (and MariaDB my.cnf) to restore the budget.');
+            (cfg.layout === 'single'
+                ? 'Single layout: one account opens POOL_MAX_CORE + POOL_MAX_ENGINE (unset ⇒ ' +
+                    'APP_DB_MAX_CONNECTIONS, else 10) + APP_AUTHZ_POOL_MAX per worker; set POOL_MAX_ENGINE ' +
+                    'explicitly, lower a pool cap or the worker count, or raise max_connections.'
+                : 'Reduce a per-account pool cap, the worker count, or raise ' +
+                    'max_connections (and MariaDB my.cnf) to restore the budget.'));
     }
 }

package/dist/boot/migration-ledger-check.d.ts

@@ -0,0 +1,94 @@
+import type { OnApplicationBootstrap } from '@nestjs/common';
+import { type FrameworkSchemas, type MigrationLedgerLocation } from '@astram/core';
+/** Runs one SELECT on the runtime pool (a mariadb `Pool.query` fits). */
+export type LedgerQuery = (sql: string) => Promise<unknown>;
+/** Where the boot check looks for warnings. */
+export interface LedgerCheckLogger {
+    warn(message: string): void;
+}
+export type { MigrationLedgerLocation };
+export interface FrameworkMigrationsCheckOptions extends MigrationLedgerLocation {
+    /**
+     * Further ledger locations, tried in order after `database`/`table` (G-007 QA P1). Empty or
+     * absent ⇒ `database`/`table` is read directly. Otherwise each location is probed
+     * (information_schema) and the first whose table exists is read; none ⇒ fail closed.
+     */
+    readonly alternatives?: readonly MigrationLedgerLocation[];
+    readonly query: LedgerQuery;
+    /**
+     * Directory (or directories) of shipped `.cjs` migrations (`guardMigrationsDir`,
+     * `identityMigrationsDir`); ids of several directories are checked as one set.
+     */
+    readonly migrationsDir: string | readonly string[];
+    /** The raw `NODE_ENV`; only `development` and `test` downgrade a failure to a warning. */
+    readonly nodeEnv: string | undefined;
+    readonly logger: LedgerCheckLogger;
+}
+export interface FrameworkMigrationsCheckResult {
+    /** `true` when every shipped id is in the ledger. */
+    readonly ok: boolean;
+    /** Shipped ids absent from the ledger (all of them when the ledger is missing or unreadable). */
+    readonly missing: readonly string[];
+}
+/** The migration ids shipped in `dir` (`.cjs` files only), ascending. */
+export declare function frameworkMigrationIds(dir: string): string[];
+/**
+ * The migrate CLI's ledger location rule (core `resolveMigrationLedgerLocation`: `<ns>_app` when
+ * namespaced, else `DDL_DB_NAME ?? <default app>`). The boot check itself uses
+ * {@link resolveMigrationLedgerCheck}, which also tries the runtime `APP_DB_NAME`.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+export declare function resolveMigrationLedger(env: NodeJS.ProcessEnv, schemas: FrameworkSchemas): MigrationLedgerLocation;
+/** Where the boot check looks: the first candidate plus the ones tried after it. */
+export interface MigrationLedgerCheckLocation extends MigrationLedgerLocation {
+    readonly alternatives: readonly MigrationLedgerLocation[];
+}
+/**
+ * The boot check's ledger locations for this process's env (G-007 QA P1): core
+ * `migrationLedgerCandidates`, split into the first location and its `alternatives`. Namespace
+ * set ⇒ `<ns>_app` only; default ⇒ `DDL_DB_NAME`, the runtime `APP_DB_NAME`, `shield_app`.
+ * Spread it into {@link FrameworkMigrationsCheckOptions}.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+export declare function resolveMigrationLedgerCheck(env: NodeJS.ProcessEnv, schemas: FrameworkSchemas): MigrationLedgerCheckLocation;
+/**
+ * Compare the shipped migration ids in `migrationsDir` with the ledger; throw (production) or
+ * warn (development/test) when any is missing or the ledger cannot be read.
+ * @throws Error naming the database and up to 10 missing ids, outside development/test; and in
+ *   every environment for an invalid ledger database or table name (checked before any query).
+ */
+export declare function assertFrameworkMigrationsApplied(options: FrameworkMigrationsCheckOptions): Promise<FrameworkMigrationsCheckResult>;
+/** DI token of the per-app {@link MigrationLedgerRegistry} (provided by `ShieldModule`). */
+export declare const SHIELD_MIGRATION_LEDGER_REGISTRY: unique symbol;
+/** DI token of guard's own check (`AuthModule`); identity provides its check under its own token. */
+export declare const SHIELD_GUARD_MIGRATION_LEDGER_CHECK: unique symbol;
+/**
+ * Merges the ledger checks of one application (guard's `AuthModule` and identity) so each ledger
+ * location is read once. Hooks {@link register} at construction (all providers exist before any
+ * bootstrap hook runs); the first {@link run} for a location checks the union of every registered
+ * directory and caches that promise, so later hooks share the result, rejection included.
+ */
+export declare class MigrationLedgerRegistry {
+    private readonly entries;
+    /** The whole candidate list: hooks with the same list share one probe + read. */
+    private static key;
+    /** Add `options.migrationsDir` to the check of `options`' ledger location. */
+    register(options: FrameworkMigrationsCheckOptions): void;
+    /** The (shared) check of `location`'s ledger over every registered directory. */
+    run(location: MigrationLedgerLocation & {
+        alternatives?: readonly MigrationLedgerLocation[];
+    }): Promise<FrameworkMigrationsCheckResult>;
+}
+/**
+ * The boot hook: runs {@link assertFrameworkMigrationsApplied} once, when Nest bootstraps the
+ * application (after module init, before the HTTP server listens). Never on a request. With a
+ * {@link MigrationLedgerRegistry}, it shares one read per ledger location with the app's other
+ * hooks; without one (`null`/absent), it checks alone.
+ */
+export declare class FrameworkMigrationLedgerCheck implements OnApplicationBootstrap {
+    private readonly options;
+    private readonly registry;
+    constructor(options: FrameworkMigrationsCheckOptions, registry?: MigrationLedgerRegistry | null);
+    onApplicationBootstrap(): Promise<void>;
+}
+//# sourceMappingURL=migration-ledger-check.d.ts.map