@astram/guard 0.14.0 → 0.16.0

package/dist/boot/single-layout-probe.js

@@ -0,0 +1,334 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SingleLayoutProbeBoot = void 0;
+exports.probeSingleLayoutPrivileges = probeSingleLayoutPrivileges;
+exports.singleLayoutWarningLines = singleLayoutWarningLines;
+/**
+ * Single-database-layout boot privilege probe (single-database-layout spec §5.F, Req 7, AC-8,
+ * ADR-0041).
+ *
+ * With `SHIELD_DB_LAYOUT=single` the four framework modules share one database, so the isolation
+ * the four-database grant matrix gave is partly gone. Which protections are really lost depends on
+ * what the runtime account may do, so this reads (never writes) `information_schema`
+ * USER_PRIVILEGES / SCHEMA_PRIVILEGES / TABLE_PRIVILEGES / COLUMN_PRIVILEGES / APPLICABLE_ROLES for `CURRENT_USER()`, once at boot, and
+ * derives the five protections lost (spec §5.F). It does not look for `prune_audit`: MariaDB hides
+ * a routine from an account without EXECUTE on it, which the runtime account must not have (spec
+ * v3); `audit:prune` reports a missing routine itself.
+ *
+ * `GRANT ... TO PUBLIC` (MariaDB 10.11+) applies to every account but information_schema shows
+ * those rows only to privileged accounts (verified on 10.11 and 11.4: a plain account sees none).
+ * `SHOW GRANTS` for the current user needs no privilege and does list them, so its `TO PUBLIC`
+ * lines are parsed and merged with the information_schema rows. Its routine-level lines
+ * (`ON PROCEDURE|FUNCTION`) are the only view of routine privileges the account has: any such grant
+ * on the database loses the retention floor. An unparsable line of the account's own is ignored, an
+ * unparsable PUBLIC or routine line fails closed; a failing `SHOW GRANTS`
+ * fails closed like any other failed read.
+ *
+ * The probe never blocks boot (the operator's ack already accepted the risk) and is never on the
+ * request path (Shield #12). Warning lines carry no credential and no host (Shield #10): a failed
+ * query's driver message is dropped.
+ */
+const common_1 = require("@nestjs/common");
+const PROTECTIONS = {
+    'append-only-audit': {
+        id: 'append-only-audit',
+        invariant: 'Shield #6',
+        text: 'Append-only audit: the runtime account can UPDATE or DELETE audit_log.',
+    },
+    'no-runtime-ddl': {
+        id: 'no-runtime-ddl',
+        invariant: 'Shield #11',
+        text: 'No runtime DDL: the runtime account holds DDL privileges on the database.',
+    },
+    'schema-separation': {
+        id: 'schema-separation',
+        invariant: 'Shield #11 (ADR-0014)',
+        text: 'Schema separation: identity, authz and audit tables share one database with app tables ' +
+            '(always lost in the single layout).',
+    },
+    'retention-floor': {
+        id: 'retention-floor',
+        invariant: 'Shield #6',
+        text: 'DB-enforced retention floor: audit rows can be deleted directly, around prune_audit, or ' +
+            'the runtime account holds a grant on prune_audit.',
+    },
+    'separate-ddl-account': {
+        id: 'separate-ddl-account',
+        invariant: 'Shield #11',
+        text: 'Separate deploy-time DDL account: the runtime account can run migrations, so locking the ' +
+            'migrate account between deploys is not possible.',
+    },
+};
+const ALL_IDS = Object.keys(PROTECTIONS);
+/** Aligned with `scripts/db-grants/lib.mjs` DDL_PRIVS (GRANT OPTION is judged via IS_GRANTABLE too). */
+const DDL_PRIVILEGES = new Set([
+    'CREATE',
+    'ALTER',
+    'DROP',
+    'INDEX',
+    'CREATE VIEW',
+    'SHOW VIEW',
+    'TRIGGER',
+    'CREATE ROUTINE',
+    'ALTER ROUTINE',
+    'EVENT',
+    'REFERENCES',
+    'CREATE TEMPORARY TABLES',
+    'LOCK TABLES',
+    'DELETE HISTORY',
+    'GRANT OPTION',
+]);
+const AUDIT_TABLE = 'audit_log';
+/** `'user'@'host'` for CURRENT_USER(), built in SQL (never from env). */
+const GRANTEE_SQL = `CONCAT("'", SUBSTRING_INDEX(CURRENT_USER(),'@',1), "'@'", ` +
+    `SUBSTRING_INDEX(CURRENT_USER(),'@',-1), "'")`;
+/** Does a GRANT schema pattern (`\_` escaped, `_`/`%` wildcards) cover `database`? */
+function schemaCovers(pattern, database) {
+    let re = '';
+    for (let i = 0; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (c === '\\' && i + 1 < pattern.length) {
+            re += pattern[++i].replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        }
+        else if (c === '%')
+            re += '.*';
+        else if (c === '_')
+            re += '.';
+        else
+            re += c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(`^${re}$`, 'i').test(database);
+}
+/** Splits `a, b (c, d), e` at top-level commas, respecting backticks and parentheses. */
+function splitTopLevel(text) {
+    const out = [];
+    let cur = '';
+    let depth = 0;
+    let tick = false;
+    for (const c of text) {
+        if (c === '`')
+            tick = !tick;
+        else if (!tick && c === '(')
+            depth++;
+        else if (!tick && c === ')')
+            depth = Math.max(0, depth - 1);
+        if (c === ',' && depth === 0 && !tick) {
+            out.push(cur);
+            cur = '';
+        }
+        else
+            cur += c;
+    }
+    out.push(cur);
+    return out.map((x) => x.trim()).filter((x) => x.length > 0);
+}
+// `*`, backtick-quoted, ANSI_QUOTES double-quoted, or bare (sql_quote_show_create=0).
+const IDENT = '(\\*|`(?:[^`]|``)*`|"(?:[^"]|"")*"|[^\\s.`"]+)';
+const GRANT_LINE = /^GRANT\s+(.+?)\s+ON\s+(.+?)\s+TO\s+(.+?)(\s+WITH\s+GRANT\s+OPTION)?\s*$/is;
+const TARGET = new RegExp(`^(?:(PROCEDURE|FUNCTION|PACKAGE|PACKAGE BODY)\\s+)?${IDENT}\\.${IDENT}$`, 'i');
+const unquote = (id) => id.startsWith('`')
+    ? id.slice(1, -1).replace(/``/g, '`')
+    : id.startsWith('"')
+        ? id.slice(1, -1).replace(/""/g, '"')
+        : id;
+const ROUTINE_TARGET = /^(PROCEDURE|FUNCTION|PACKAGE)\b/i;
+/**
+ * Reads `TO PUBLIC` privileges and routine-level grants out of `SHOW GRANTS` lines. An
+ * unparsable `TO PUBLIC` or routine line sets `unreadable` (the probe then fails closed); any
+ * other unparsable line is the account's own and is skipped. Never throws.
+ */
+function parseShowGrants(lines) {
+    const out = {
+        user: [],
+        schema: [],
+        table: [],
+        column: [],
+        routineSchemas: [],
+        unreadable: false,
+    };
+    for (const line of lines) {
+        const m = GRANT_LINE.exec(line);
+        if (!m)
+            continue;
+        const rawTarget = m[2].trim();
+        const target = TARGET.exec(rawTarget);
+        if (!target) {
+            if (/^PUBLIC$/i.test(m[3].trim()) || ROUTINE_TARGET.test(rawTarget)) {
+                out.unreadable = true;
+            }
+            continue;
+        }
+        const kind = target[1];
+        const schema = unquote(target[2]);
+        const name = unquote(target[3]);
+        if (kind) {
+            out.routineSchemas.push(schema);
+            continue;
+        }
+        if (!/^PUBLIC$/i.test(m[3].trim()))
+            continue;
+        const is = m[4] ? 'YES' : 'NO';
+        for (const item of splitTopLevel(m[1])) {
+            const paren = item.indexOf('(');
+            const type = (paren < 0 ? item : item.slice(0, paren)).trim().toUpperCase();
+            if (!type)
+                continue;
+            if (paren >= 0) {
+                // Column-level: one row per column (the name only matters for the table).
+                out.column.push({
+                    TABLE_SCHEMA: schema,
+                    TABLE_NAME: name,
+                    PRIVILEGE_TYPE: type,
+                    IS_GRANTABLE: is,
+                });
+            }
+            else if (schema === '*') {
+                out.user.push({ PRIVILEGE_TYPE: type, IS_GRANTABLE: is });
+            }
+            else if (name === '*') {
+                out.schema.push({ TABLE_SCHEMA: schema, PRIVILEGE_TYPE: type, IS_GRANTABLE: is });
+            }
+            else {
+                out.table.push({
+                    TABLE_SCHEMA: schema,
+                    TABLE_NAME: name,
+                    PRIVILEGE_TYPE: type,
+                    IS_GRANTABLE: is,
+                });
+            }
+        }
+    }
+    return out;
+}
+const priv = (r) => String(r.PRIVILEGE_TYPE ?? '').toUpperCase();
+const grantable = (r) => String(r.IS_GRANTABLE ?? '').toUpperCase() === 'YES';
+const failed = () => ({
+    lost: ALL_IDS.map((id) => PROTECTIONS[id]),
+    readFailed: true,
+});
+/**
+ * Derive the protections the runtime account has lost. Never throws, and never reports the audit
+ * wall intact when it cannot see the grants: a failed query, a runtime account whose own
+ * SELECT+INSERT on the database is invisible, or an account with roles (not inspected) reports all
+ * five with `readFailed`.
+ */
+async function probeSingleLayoutPrivileges(query, database) {
+    try {
+        const userInfo = (await query(`SELECT PRIVILEGE_TYPE, IS_GRANTABLE FROM information_schema.USER_PRIVILEGES ` +
+            `WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const schemaInfo = (await query(`SELECT TABLE_SCHEMA, PRIVILEGE_TYPE, IS_GRANTABLE FROM information_schema.SCHEMA_PRIVILEGES ` +
+            `WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const tableInfo = (await query(`SELECT TABLE_SCHEMA, TABLE_NAME, PRIVILEGE_TYPE, IS_GRANTABLE ` +
+            `FROM information_schema.TABLE_PRIVILEGES WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const columnInfo = (await query(`SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME, PRIVILEGE_TYPE, IS_GRANTABLE ` +
+            `FROM information_schema.COLUMN_PRIVILEGES WHERE GRANTEE = ${GRANTEE_SQL}`));
+        const roles = (await query(`SELECT ROLE_NAME FROM information_schema.APPLICABLE_ROLES WHERE GRANTEE = ${GRANTEE_SQL}`));
+        // Privileges granted through roles are not inspected: do not claim a wall we cannot see.
+        if (roles.length > 0)
+            return failed();
+        // PUBLIC grants and routine grants: invisible in information_schema to this account.
+        const shown = (await query('SHOW GRANTS'));
+        const pub = parseShowGrants(shown.map((row) => String(Object.values(row ?? {})[0] ?? '')).filter((l) => l.length > 0));
+        if (pub.unreadable)
+            return failed();
+        const user = [...userInfo, ...pub.user];
+        const schema = [...schemaInfo, ...pub.schema];
+        const table = [...tableInfo, ...pub.table];
+        const column = [...columnInfo, ...pub.column];
+        const inDb = (r) => schemaCovers(String(r.TABLE_SCHEMA ?? ''), database);
+        const schemaRows = schema.filter(inDb);
+        const tables = table.filter(inDb);
+        const columns = column.filter(inDb);
+        // Any routine-level grant on the database (EXECUTE, ALTER ROUTINE, ...): prune_audit is reachable.
+        const routineGrant = pub.routineSchemas.some((sch) => schemaCovers(sch, database));
+        // Privileges that reach the whole database: global plus matching schema grants.
+        const db = new Set([...user.map(priv), ...schemaRows.map(priv)]);
+        const all = db.has('ALL PRIVILEGES') || db.has('ALL');
+        // The account booted, so it holds SELECT and INSERT on the database. Not seeing them means
+        // the grants are invisible (restricted view, odd grantee form): fail closed.
+        if (!all && !(db.has('SELECT') && db.has('INSERT')))
+            return failed();
+        // WITH GRANT OPTION anywhere on the database: the account can give itself anything.
+        const selfGrant = [...user, ...schemaRows, ...tables, ...columns].some(grantable);
+        const auditWrite = selfGrant ||
+            all ||
+            db.has('UPDATE') ||
+            db.has('DELETE') ||
+            // DROP allows TRUNCATE and dropping audit_log; ALTER rewrites it.
+            db.has('DROP') ||
+            db.has('ALTER') ||
+            tables.some((r) => String(r.TABLE_NAME ?? '').toLowerCase() === AUDIT_TABLE &&
+                ['UPDATE', 'DELETE', 'DROP', 'ALTER', 'ALL PRIVILEGES'].includes(priv(r))) ||
+            // Column-level UPDATE rewrites audit rows (there is no column-level DELETE).
+            columns.some((r) => String(r.TABLE_NAME ?? '').toLowerCase() === AUDIT_TABLE && priv(r) === 'UPDATE');
+        const ddl = selfGrant ||
+            all ||
+            [...db].some((p) => DDL_PRIVILEGES.has(p)) ||
+            tables.some((r) => DDL_PRIVILEGES.has(priv(r)));
+        // Database-level or global EXECUTE reaches prune_audit.
+        const execute = db.has('EXECUTE');
+        const lost = new Set(['schema-separation']);
+        if (auditWrite || routineGrant || execute) {
+            // The floor lives in prune_audit; a direct write on audit_log, or any grant on a routine
+            // of the database (EXECUTE / ALTER ROUTINE on prune_audit), gets around or weakens it.
+            lost.add('retention-floor');
+        }
+        if (auditWrite)
+            lost.add('append-only-audit');
+        if (ddl) {
+            lost.add('no-runtime-ddl');
+            lost.add('separate-ddl-account');
+        }
+        return {
+            lost: ALL_IDS.filter((id) => lost.has(id)).map((id) => PROTECTIONS[id]),
+            readFailed: false,
+        };
+    }
+    catch {
+        return failed();
+    }
+}
+/**
+ * The boot warning: a header naming the database and ADR-0041, then one line per lost protection
+ * citing its invariant. No credential, host or driver message.
+ */
+function singleLayoutWarningLines(probe, database) {
+    const lines = [
+        `Shield single database layout on "${database}" (ADR-0041): reduced isolation accepted; ` +
+            `protections lost:`,
+    ];
+    if (probe.readFailed) {
+        lines.push('Runtime privileges could not be read; assuming all protections are lost.');
+    }
+    for (const p of probe.lost)
+        lines.push(`- ${p.text} (${p.invariant})`);
+    const ids = new Set(probe.lost.map((p) => p.id));
+    if (!probe.readFailed &&
+        !ids.has('append-only-audit') &&
+        !ids.has('no-runtime-ddl') &&
+        !ids.has('retention-floor')) {
+        lines.push('Two-account setup: audit wall intact (no direct UPDATE/DELETE/DDL/grant rights seen for ' +
+            'this account).');
+    }
+    return lines;
+}
+/**
+ * Runs the probe once at application bootstrap on the runtime pool and logs the warning. Never
+ * throws, so boot is never blocked (spec §5.F).
+ */
+class SingleLayoutProbeBoot {
+    query;
+    database;
+    logger;
+    constructor(query, database, logger = new common_1.Logger('Shield')) {
+        this.query = query;
+        this.database = database;
+        this.logger = logger;
+    }
+    async onApplicationBootstrap() {
+        const probe = await probeSingleLayoutPrivileges(this.query, this.database);
+        for (const line of singleLayoutWarningLines(probe, this.database))
+            this.logger.warn(line);
+    }
+}
+exports.SingleLayoutProbeBoot = SingleLayoutProbeBoot;

package/dist/config/app-config.d.ts

@@ -23,7 +23,7 @@
  *   8 × (12 + 8 + 1) + 40 = 208 ≤ 250  ✓
  * ─────────────────────────────────────────────────────────────────────────────
  */
-import type { SecretsProvider } from '@astram/core';
+import type { FrameworkSchemas, SecretsProvider } from '@astram/core';
 export interface AppConfig {
     /** HTTP port the Nest app listens on. */
     readonly port: number;
@@ -74,7 +74,20 @@ export interface AppConfig {
      * composition (boot fails loud).
      */
     readonly refreshReplayWindowMs?: number;
+    /**
+     * The four framework database names (configurable-framework-db, ADR-0037), resolved once from
+     * `SHIELD_DB_NAMESPACE` by core `resolveFrameworkSchemas` (unset ⇒ the `shield_*` defaults).
+     * Optional so hand-built configs keep compiling; absent ⇒ {@link frameworkSchemasOf} resolves
+     * from `process.env` once at boot. Provided app-wide under `FRAMEWORK_SCHEMAS`.
+     */
+    readonly schemas?: FrameworkSchemas;
 }
+/**
+ * The resolved framework database names for a config: `config.schemas`, else resolved from
+ * `process.env` (a hand-built config without `schemas`). Call at boot only (Shield #12).
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` (fail closed).
+ */
+export declare function frameworkSchemasOf(config: Pick<AppConfig, 'schemas'>): FrameworkSchemas;
 /** The per-client-IP login failure limit (failures within `windowMs` that lock the IP). */
 export interface LoginIpLimitConfig {
     readonly maxAttempts: number;
@@ -169,6 +182,18 @@ export interface PoolBudgetConfig {
     readonly headroom: number;
     /** Per-account RUNTIME pool caps (multiplied by `workers` in the budget). */
     readonly perAccountMax: RuntimeAccountPools;
+    /**
+     * `'single'` when `SHIELD_DB_LAYOUT=single` (single-database-layout spec §5.C, AC-12, ADR-0041):
+     * one account opens the core, engine and authz pools, so the budget sums those instead.
+     * Absent in the four layout (today's math, unchanged).
+     */
+    readonly layout?: 'single';
+    /** Single layout: the engine pool cap (`POOL_MAX_ENGINE ?? APP_DB_MAX_CONNECTIONS ?? 10`). */
+    readonly engineMax?: number;
+    /** Single layout: the identity authz pool cap (`APP_AUTHZ_POOL_MAX ?? 4`). */
+    readonly authzMax?: number;
+    /** Single layout: the account's `MAX_USER_CONNECTIONS` (`APP_DB_MAX_USER_CONNECTIONS`), if set. */
+    readonly maxUserConnections?: number;
 }
 /**
  * Per-account maximum pool sizes for the RUNTIME accounts (the ones each worker
@@ -205,7 +230,11 @@ export declare function isDevOrTestNodeEnv(raw: string | undefined): boolean;
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
  */
 export declare function loadPoolBudget(env?: NodeJS.ProcessEnv): PoolBudgetConfig;
-/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+/**
+ * Documented defaults for the runtime MariaDB descriptor (local docker substrate), for the
+ * default namespace. Under `SHIELD_DB_NAMESPACE` the user and database follow the namespace
+ * (`<ns>_core`, `<ns>_identity`; see {@link loadDbConfig}).
+ */
 export declare const DEFAULT_DB_CONFIG: Omit<DbConfig, 'password'>;
 /** Documented default Redis url (local docker substrate). */
 export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
@@ -219,8 +248,17 @@ export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
  * which is a fail-closed security invariant even for unit tests).
+ *
+ * Namespace (configurable-framework-db, spec 5.C): `APP_DB_USER` unset ⇒ `<ns>_core`;
+ * `APP_DB_NAME` unset ⇒ `<ns>_identity`. A set `APP_DB_NAME` must be one of the four resolved
+ * framework names, else this throws naming the variable (fail closed: an unqualified query must
+ * not reach another environment's database). An invalid `SHIELD_DB_NAMESPACE` throws too.
+ *
+ * `schemas` (optional): names the caller already resolved (e.g. `IdentityFeatureModule.forRoot
+ * ({ schemas })`). When given they replace the env namespace for the defaults and the
+ * `APP_DB_NAME` check, so the runtime database cannot drift from them (G-007 QA P2-5).
  */
-export declare function loadDbConfig(env?: NodeJS.ProcessEnv): DbConfig;
+export declare function loadDbConfig(env?: NodeJS.ProcessEnv, schemas?: FrameworkSchemas): DbConfig;
 /**
  * `APP_DB_TLS` = `off` (default) | `on`; `APP_DB_TLS_CA` = PEM path (only with `on`). Anything
  * else throws at boot: a typo must not silently fall back to plaintext.
@@ -367,6 +405,11 @@ export interface PoolBudgetEvaluation {
     readonly withinBudget: boolean;
     /** True iff shield_schema_svc pool ≤ {@link SCHEMA_SVC_POOL_HARD_CAP}. */
     readonly schemaSvcWithinHardCap: boolean;
+    /**
+     * True iff requiredConnections ≤ `maxUserConnections` (always true when unset or in the four
+     * layout). Single layout only (spec AC-12).
+     */
+    readonly withinUserBudget: boolean;
 }
 /**
  * Evaluate a pool budget. Pure: no throwing, no I/O — the caller decides how to

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAIpD,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAaD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAS3E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAa7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mGAAmG;IACnG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AA2BD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA4CrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CA0BV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAc7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAyB9E"}

package/dist/config/app-config.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_OBJECT_STORAGE_MAX_BYTES = exports.DEFAULT_REDIS_URL = exports.DEFAULT_DB_CONFIG = exports.SCHEMA_SVC_POOL_HARD_CAP = exports.DEFAULT_POOL_BUDGET = exports.DEFAULT_REDIS_COMMAND_TIMEOUT_MS = exports.DEFAULT_LOGIN_IP_LIMIT = void 0;
+exports.frameworkSchemasOf = frameworkSchemasOf;
 exports.isDevOrTestNodeEnv = isDevOrTestNodeEnv;
 exports.loadPoolBudget = loadPoolBudget;
 exports.loadDbConfig = loadDbConfig;
@@ -17,6 +18,14 @@ exports.loadObjectStorageConfig = loadObjectStorageConfig;
 exports.evaluatePoolBudget = evaluatePoolBudget;
 const core_1 = require("@astram/core");
 const loopback_host_js_1 = require("./loopback-host.js");
+/**
+ * The resolved framework database names for a config: `config.schemas`, else resolved from
+ * `process.env` (a hand-built config without `schemas`). Call at boot only (Shield #12).
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` (fail closed).
+ */
+function frameworkSchemasOf(config) {
+    return config.schemas ?? (0, core_1.resolveFrameworkSchemas)(process.env);
+}
 /** Plan D3 default: 50 failed logins per client IP per 15 minutes. */
 exports.DEFAULT_LOGIN_IP_LIMIT = {
     maxAttempts: 50,
@@ -75,6 +84,21 @@ function parsePositiveInt(raw, fallback) {
     const n = Number.parseInt(raw, 10);
     return Number.isInteger(n) && n > 0 ? n : fallback;
 }
+/**
+ * A pool-size variable: unset or blank gives `undefined`; otherwise a positive integer in plain
+ * digits (surrounding whitespace allowed) or it throws naming the variable (never the value; fail
+ * closed). Identity's engine and authz pools apply the same rule, so the budget counts exactly the
+ * pools that open.
+ */
+function strictOptionalPoolInt(raw, name) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const t = raw.trim();
+    const n = /^[0-9]+$/.test(t) ? Number(t) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < 1)
+        throw new Error(`${name} must be a positive integer`);
+    return n;
+}
 /**
  * Build the {@link PoolBudgetConfig} from env with documented defaults.
  * Field ↔ env name:
@@ -86,7 +110,27 @@ function parsePositiveInt(raw, fallback) {
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
  */
 function loadPoolBudget(env = process.env) {
+    const single = env.SHIELD_DB_LAYOUT === 'single';
+    const maxUser = single
+        ? strictOptionalPoolInt(env.APP_DB_MAX_USER_CONNECTIONS, 'APP_DB_MAX_USER_CONNECTIONS')
+        : undefined;
     return {
+        ...(single
+            ? {
+                layout: 'single',
+                // Same rule as the engine pool identity opens (`engineDbFromEnv`): POOL_MAX_ENGINE, else
+                // today's APP_DB_MAX_CONNECTIONS fallback, else 10. The budget must count the pool that
+                // really opens, so an unset POOL_MAX_ENGINE with a large APP_DB_MAX_CONNECTIONS fails the
+                // budget instead of under-counting it (spec AC-12).
+                // The numbers are parsed exactly as identity's pools parse them (strict: a set but
+                // invalid value throws naming the variable, never a lenient fallback).
+                engineMax: strictOptionalPoolInt(env.POOL_MAX_ENGINE, 'POOL_MAX_ENGINE') ??
+                    strictOptionalPoolInt(env.APP_DB_MAX_CONNECTIONS, 'APP_DB_MAX_CONNECTIONS') ??
+                    10,
+                authzMax: strictOptionalPoolInt(env.APP_AUTHZ_POOL_MAX, 'APP_AUTHZ_POOL_MAX') ?? 4,
+                ...(maxUser !== undefined ? { maxUserConnections: maxUser } : {}),
+            }
+            : {}),
         workers: parsePositiveInt(env.POOL_WORKERS, exports.DEFAULT_POOL_BUDGET.workers),
         maxConnections: parsePositiveInt(env.APP_DB_MAX_CONNECTIONS, exports.DEFAULT_POOL_BUDGET.maxConnections),
         headroom: parsePositiveInt(env.POOL_HEADROOM, exports.DEFAULT_POOL_BUDGET.headroom),
@@ -102,12 +146,18 @@ function loadPoolBudget(env = process.env) {
 // lifetimes. All pure env-readers with documented defaults; the ONLY hard-
 // required value is the refresh HMAC key (fail-closed).
 // ---------------------------------------------------------------------------
-/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+/** The default-namespace framework names (`SHIELD_DB_NAMESPACE` unset). */
+const DEFAULT_FRAMEWORK_SCHEMAS = (0, core_1.resolveFrameworkSchemas)({});
+/**
+ * Documented defaults for the runtime MariaDB descriptor (local docker substrate), for the
+ * default namespace. Under `SHIELD_DB_NAMESPACE` the user and database follow the namespace
+ * (`<ns>_core`, `<ns>_identity`; see {@link loadDbConfig}).
+ */
 exports.DEFAULT_DB_CONFIG = {
     host: 'localhost',
     port: 3306,
-    user: 'shield_core',
-    database: 'shield_identity',
+    user: (0, core_1.frameworkAccountName)(DEFAULT_FRAMEWORK_SCHEMAS.namespace, 'core'),
+    database: DEFAULT_FRAMEWORK_SCHEMAS.identity,
 };
 /** Documented default Redis url (local docker substrate). */
 exports.DEFAULT_REDIS_URL = 'redis://localhost:6379';
@@ -139,14 +189,35 @@ function parseOptionalPositiveInt(raw) {
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
  * which is a fail-closed security invariant even for unit tests).
+ *
+ * Namespace (configurable-framework-db, spec 5.C): `APP_DB_USER` unset ⇒ `<ns>_core`;
+ * `APP_DB_NAME` unset ⇒ `<ns>_identity`. A set `APP_DB_NAME` must be one of the four resolved
+ * framework names, else this throws naming the variable (fail closed: an unqualified query must
+ * not reach another environment's database). An invalid `SHIELD_DB_NAMESPACE` throws too.
+ *
+ * `schemas` (optional): names the caller already resolved (e.g. `IdentityFeatureModule.forRoot
+ * ({ schemas })`). When given they replace the env namespace for the defaults and the
+ * `APP_DB_NAME` check, so the runtime database cannot drift from them (G-007 QA P2-5).
  */
-function loadDbConfig(env = process.env) {
+function loadDbConfig(env = process.env, schemas = (0, core_1.resolveFrameworkSchemas)(env)) {
+    const database = parseString(env.APP_DB_NAME, schemas.identity);
+    // Single layout (spec §5.C): no `<ns>_core` account exists to default to; fail closed.
+    if (schemas.layout === 'single' && parseString(env.APP_DB_USER, '') === '') {
+        throw new core_1.FrameworkSchemaConfigError('APP_DB_USER is required when SHIELD_DB_LAYOUT=single (there is no default runtime account).');
+    }
+    const allowed = [schemas.app, schemas.identity, schemas.authz, schemas.audit];
+    if (!allowed.includes(database)) {
+        throw new core_1.FrameworkSchemaConfigError(`APP_DB_NAME must be one of the framework databases for namespace ` +
+            `"${schemas.namespace}" (${allowed.join(', ')}); unset it for ${schemas.identity}.`);
+    }
     return {
         host: parseString(env.APP_DB_HOST, exports.DEFAULT_DB_CONFIG.host),
         port: parsePort(env.APP_DB_PORT, exports.DEFAULT_DB_CONFIG.port),
-        user: parseString(env.APP_DB_USER, exports.DEFAULT_DB_CONFIG.user),
+        user: schemas.layout === 'single'
+            ? parseString(env.APP_DB_USER, '')
+            : parseString(env.APP_DB_USER, (0, core_1.frameworkAccountName)(schemas.namespace, 'core')),
         password: parseString(env.APP_DB_PASSWORD, ''),
-        database: parseString(env.APP_DB_NAME, exports.DEFAULT_DB_CONFIG.database),
+        database,
         tls: loadDbTlsConfig(env),
     };
 }
@@ -281,6 +352,7 @@ function assertRefreshHmacKey(key) {
 function loadAppConfig(env = process.env) {
     const refreshReplayWindowMs = loadRefreshReplayWindowMs(env);
     return {
+        schemas: (0, core_1.resolveFrameworkSchemas)(env),
         port: parsePort(env.PORT, 3000),
         environment: parseEnvironment(env.NODE_ENV),
         pool: loadPoolBudget(env),
@@ -406,18 +478,25 @@ function parseStorageMaxBytes(raw) {
  * react (the boot assertion throws; tests inspect the fields).
  */
 function evaluatePoolBudget(cfg) {
-    const perWorkerConnections = cfg.perAccountMax.shield_core +
-        cfg.perAccountMax.shield_app_crud +
-        cfg.perAccountMax.shield_schema_svc;
+    // Single layout (AC-12): one account opens core + engine + authz; app_crud/schema_svc are never opened.
+    const perWorkerConnections = cfg.layout === 'single'
+        ? cfg.perAccountMax.shield_core + (cfg.engineMax ?? 10) + (cfg.authzMax ?? 4)
+        : cfg.perAccountMax.shield_core +
+            cfg.perAccountMax.shield_app_crud +
+            cfg.perAccountMax.shield_schema_svc;
     const runtimeConnections = cfg.workers * perWorkerConnections;
     const requiredConnections = runtimeConnections + cfg.headroom;
     const slack = cfg.maxConnections - requiredConnections;
+    const withinUserBudget = cfg.layout !== 'single' ||
+        cfg.maxUserConnections === undefined ||
+        requiredConnections <= cfg.maxUserConnections;
     return {
         perWorkerConnections,
         runtimeConnections,
         requiredConnections,
         slack,
-        withinBudget: requiredConnections <= cfg.maxConnections,
-        schemaSvcWithinHardCap: cfg.perAccountMax.shield_schema_svc <= exports.SCHEMA_SVC_POOL_HARD_CAP,
+        withinBudget: requiredConnections <= cfg.maxConnections && withinUserBudget,
+        schemaSvcWithinHardCap: cfg.layout === 'single' || cfg.perAccountMax.shield_schema_svc <= exports.SCHEMA_SVC_POOL_HARD_CAP,
+        withinUserBudget,
     };
 }

package/dist/config/config.module.d.ts

@@ -1,5 +1,12 @@
 /** DI token for the resolved {@link AppConfig}. */
 export declare const APP_CONFIG: unique symbol;
+/**
+ * DI token for the resolved framework database names (core `FrameworkSchemas`:
+ * `{ namespace, app, identity, authz, audit, isDefault }`, frozen; configurable-framework-db,
+ * ADR-0037). Provided and exported app-wide by `ShieldModule` from `APP_CONFIG`, resolved once at
+ * boot; identity and app modules inject it instead of hard-coding `shield_*` names.
+ */
+export declare const FRAMEWORK_SCHEMAS: unique symbol;
 /**
  * Minimal config module (Scaffold).
  *

package/dist/config/config.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.module.d.ts","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,eAAO,MAAM,UAAU,eAAuB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAaa,YAAY;CAAG"}
+{"version":3,"file":"config.module.d.ts","sourceRoot":"","sources":["../../src/config/config.module.ts"],"names":[],"mappings":"AAIA,mDAAmD;AACnD,eAAO,MAAM,UAAU,eAAuB,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,qBAaa,YAAY;CAAG"}

package/dist/config/config.module.js

@@ -6,12 +6,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigModule = exports.APP_CONFIG = void 0;
+exports.ConfigModule = exports.FRAMEWORK_SCHEMAS = exports.APP_CONFIG = void 0;
 const common_1 = require("@nestjs/common");
 const app_config_js_1 = require("./app-config.js");
 const boot_secrets_js_1 = require("../secrets/boot-secrets.js");
 /** DI token for the resolved {@link AppConfig}. */
 exports.APP_CONFIG = Symbol('APP_CONFIG');
+/**
+ * DI token for the resolved framework database names (core `FrameworkSchemas`:
+ * `{ namespace, app, identity, authz, audit, isDefault }`, frozen; configurable-framework-db,
+ * ADR-0037). Provided and exported app-wide by `ShieldModule` from `APP_CONFIG`, resolved once at
+ * boot; identity and app modules inject it instead of hard-coding `shield_*` names.
+ */
+exports.FRAMEWORK_SCHEMAS = Symbol('FRAMEWORK_SCHEMAS');
 /**
  * Minimal config module (Scaffold).
  *