@astram/identity 0.10.0 → 0.12.0

package/dist/auth-facts-keys.d.ts

@@ -1,3 +1,19 @@
+import type { ObjectTypeInput } from '@astram/engine';
+/** The auth-facts key universe for identity's objects plus a consumer's `extraObjects`. */
+export interface IdentityAuthKeys {
+    /** Every action key: pass as `ShieldModule.forRoot({ identityActionKeys })`. */
+    readonly actionKeys: string[];
+    /** The control-plane subset: pass as `ShieldModule.forRoot({ identityControlPlaneKeys })`. */
+    readonly controlPlaneKeys: string[];
+}
+/**
+ * Build the auth-facts key universe from identity's objects plus `extraObjects` (pass the same
+ * array as `IdentityFeatureModule.forRoot({ extraObjects })`). Same registry bridge as the record
+ * authorization, so the keys match decide() and the permission catalog exactly.
+ */
+export declare function buildIdentityAuthKeys(extraObjects?: readonly ObjectTypeInput[]): IdentityAuthKeys;
+/** Identity's own action keys (no consumer types; see {@link buildIdentityAuthKeys}). */
 export declare const identityAuthActionKeys: readonly string[];
+/** Identity's own control-plane keys (no consumer types; see {@link buildIdentityAuthKeys}). */
 export declare const identityControlPlaneKeys: readonly string[];
 //# sourceMappingURL=auth-facts-keys.d.ts.map

package/dist/auth-facts-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-facts-keys.d.ts","sourceRoot":"","sources":["../src/auth-facts-keys.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAEZ,CAAC;AAEzC,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGd,CAAC"}
+{"version":3,"file":"auth-facts-keys.d.ts","sourceRoot":"","sources":["../src/auth-facts-keys.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC9B,8FAA8F;IAC9F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,gBAAgB,CAQlB;AAID,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAA4B,CAAC;AAEjF,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAkC,CAAC"}

package/dist/auth-facts-keys.js

@@ -1,24 +1,40 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.identityControlPlaneKeys = exports.identityAuthActionKeys = void 0;
+exports.buildIdentityAuthKeys = buildIdentityAuthKeys;
 /**
- * The framework identity permission-key universe, projected once from `identityObjects` via
+ * The framework identity permission-key universe, projected from `identityObjects` via
  * `@astram/guard`'s registry bridge. Exported for the consumer to pass into
  * `ShieldModule.forRoot({ auth: true, identityActionKeys, identityControlPlaneKeys })` — so the
  * auth-facts adapter (in guard) can expand `identity:*` grants + union root's control-plane keys
  * WITHOUT guard importing this package (the sanctioned graph is identity → guard).
  *
+ * A consumer that registers its own object types passes the SAME list it gives
+ * `IdentityFeatureModule.forRoot({ extraObjects })` to {@link buildIdentityAuthKeys} (KI #70), so
+ * `/auth/facts` covers the same key universe decide() and the permission catalog use.
+ *
  * ⚠ NO MODULE-INIT CYCLE: `identityObjects` is imported from the leaf `./objects.js` (NOT from
  * `./index.js`, which re-exports THIS file). So the array is fully initialized before the
- * `buildIdentityModuleRegistry(...)` call below runs at module-eval time.
+ * `buildIdentityAuthKeys()` call below runs at module-eval time.
  */
 const guard_1 = require("@astram/guard");
 const objects_js_1 = require("./objects.js");
-const registry = (0, guard_1.buildIdentityModuleRegistry)(objects_js_1.identityObjects);
-exports.identityAuthActionKeys = registry
-    .listActions()
-    .map((a) => a.permissionKey);
-exports.identityControlPlaneKeys = registry
-    .listActions()
-    .filter((a) => a.plane === 'control')
-    .map((a) => a.permissionKey);
+/**
+ * Build the auth-facts key universe from identity's objects plus `extraObjects` (pass the same
+ * array as `IdentityFeatureModule.forRoot({ extraObjects })`). Same registry bridge as the record
+ * authorization, so the keys match decide() and the permission catalog exactly.
+ */
+function buildIdentityAuthKeys(extraObjects = []) {
+    const actions = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]).listActions();
+    return {
+        actionKeys: actions.map((a) => a.permissionKey),
+        controlPlaneKeys: actions
+            .filter((a) => a.plane === 'control')
+            .map((a) => a.permissionKey),
+    };
+}
+const identityOnly = buildIdentityAuthKeys();
+/** Identity's own action keys (no consumer types; see {@link buildIdentityAuthKeys}). */
+exports.identityAuthActionKeys = identityOnly.actionKeys;
+/** Identity's own control-plane keys (no consumer types; see {@link buildIdentityAuthKeys}). */
+exports.identityControlPlaneKeys = identityOnly.controlPlaneKeys;

package/dist/cross-tenant-grant.object.d.ts

@@ -13,8 +13,8 @@
  *
  * Mirrors `membership-posting.object.ts`'s shape (system, no trusted columns needed
  * beyond the PK) — the engine's `validateAccess` requires `table` + at least one
- * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD `IDENTITY_ACTIONS`
- * — see `@astram/guard`'s `identity-actions.ts`'s `actionsFor('cross_tenant_grant')` ->
+ * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD verbs: it opts out
+ * (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `CROSS_TENANT_GRANT_ACTIONS` (`share`/`accept`/`revoke`).
  *
  * Ported from astram3's frozen

package/dist/cross-tenant-grant.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant.object.d.ts","sourceRoot":"","sources":["../src/cross-tenant-grant.object.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAOa,gBAAgB;IAE3B,IAAI,EAAG,MAAM,CAAC;IAGd,gBAAgB,EAAG,MAAM,CAAC;IAG1B,iBAAiB,EAAG,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"cross-tenant-grant.object.d.ts","sourceRoot":"","sources":["../src/cross-tenant-grant.object.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBASa,gBAAgB;IAE3B,IAAI,EAAG,MAAM,CAAC;IAGd,gBAAgB,EAAG,MAAM,CAAC;IAG1B,iBAAiB,EAAG,MAAM,CAAC;CAC5B"}

package/dist/cross-tenant-grant.object.js

@@ -11,8 +11,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CrossTenantGrant = void 0;
 const engine_1 = require("@astram/engine");
-/** The physical schema `cross_tenant_grant` lives in (migration 1710000000011). */
-const SCHEMA = 'shield_authz';
+const guard_1 = require("@astram/guard");
+/** The authz-database token `cross_tenant_grant` lives in (migration 1710000000011); the engine
+ *  resolves it at registration (ADR-0037). */
+const SCHEMA = engine_1.FRAMEWORK_SCHEMA.authz;
 /**
  * `cross_tenant_grant` — an AUTHORITY-ONLY @ObjectType, never CRUD'd through the
  * RecordEngine pipe. Its sole purpose is to give `cross_tenant_grant` an entry in the
@@ -28,8 +30,8 @@ const SCHEMA = 'shield_authz';
  *
  * Mirrors `membership-posting.object.ts`'s shape (system, no trusted columns needed
  * beyond the PK) — the engine's `validateAccess` requires `table` + at least one
- * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD `IDENTITY_ACTIONS`
- * — see `@astram/guard`'s `identity-actions.ts`'s `actionsFor('cross_tenant_grant')` ->
+ * `@Field`; the PK satisfies that. Action vocabulary is NOT the CRUD verbs: it opts out
+ * (`crudActions: false`, ADR-0038) and declares exactly `@astram/guard`'s
  * `CROSS_TENANT_GRANT_ACTIONS` (`share`/`accept`/`revoke`).
  *
  * Ported from astram3's frozen
@@ -59,6 +61,8 @@ exports.CrossTenantGrant = CrossTenantGrant = __decorate([
         table: 'cross_tenant_grant',
         schema: SCHEMA,
         access: { plane: 'control', system: true },
+        crudActions: false,
+        actions: guard_1.CROSS_TENANT_GRANT_ACTIONS,
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'ctg_uuid' })
 ], CrossTenantGrant);

package/dist/features/audit/directory-label-resolver.d.ts

@@ -1,5 +1,6 @@
 import type { LabelResolver, LabelKind } from '@astram/core';
 import type { AuditQueryable } from './mariadb-audit-reader.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The id->human-label chokepoint (ADR-0012, design §2.2). A deleted/unknown
  * entity resolves to a FALLBACK label (never the id); a directory OUTAGE throws
@@ -7,7 +8,9 @@ import type { AuditQueryable } from './mariadb-audit-reader.js';
  */
 export declare class DirectoryLabelResolver implements LabelResolver {
     private readonly db;
-    constructor(db: AuditQueryable);
+    private readonly schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(db: AuditQueryable, schemas?: IdentitySchemaNames);
     resolve(kind: LabelKind, id: string, _tenantId?: string): Promise<string>;
     private fallback;
 }

package/dist/features/audit/directory-label-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-label-resolver.d.ts","sourceRoot":"","sources":["../../../src/features/audit/directory-label-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,cAAc;IAEzC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8B/E,OAAO,CAAC,QAAQ;CAMjB"}
+{"version":3,"file":"directory-label-resolver.d.ts","sourceRoot":"","sources":["../../../src/features/audit/directory-label-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,aAAa;IAGxD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,EAAE,EAAE,cAAc,EAClB,OAAO,GAAE,mBAA+C;IAGrE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8B/E,OAAO,CAAC,QAAQ;CAMjB"}

package/dist/features/audit/directory-label-resolver.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DirectoryLabelResolver = void 0;
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /**
  * The id->human-label chokepoint (ADR-0012, design §2.2). A deleted/unknown
  * entity resolves to a FALLBACK label (never the id); a directory OUTAGE throws
@@ -9,23 +9,26 @@ const APP = 'shield_app';
  */
 class DirectoryLabelResolver {
     db;
-    constructor(db) {
+    schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(db, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.db = db;
+        this.schemas = schemas;
     }
     async resolve(kind, id, _tenantId) {
         if (!id)
             return this.fallback(kind);
         switch (kind) {
             case 'principal': {
-                const rows = (await this.db.query(`SELECT u_username AS label FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [id]));
+                const rows = (await this.db.query(`SELECT u_username AS label FROM \`${this.schemas.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [id]));
                 return rows[0]?.label ?? this.fallback(kind);
             }
             case 'tenant': {
-                const rows = (await this.db.query(`SELECT c_name AS label FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [id]));
+                const rows = (await this.db.query(`SELECT c_name AS label FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [id]));
                 return rows[0]?.label ?? this.fallback(kind);
             }
             case 'role': {
-                const rows = (await this.db.query(`SELECT r_name AS label FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [id]));
+                const rows = (await this.db.query(`SELECT r_name AS label FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [id]));
                 return rows[0]?.label ?? this.fallback(kind);
             }
             default:

package/dist/features/audit/mariadb-audit-reader.d.ts

@@ -1,4 +1,4 @@
-import type { AuditReader, AuditEvent } from '@astram/core';
+import { type AuditReader, type AuditEvent } from '@astram/core';
 export interface AuditQueryable {
     query(sql: string, params?: readonly unknown[]): Promise<unknown>;
 }
@@ -11,6 +11,10 @@ export interface AuditQueryable {
 export declare class MariaDbAuditReader implements AuditReader {
     private readonly db;
     private readonly schema;
+    /**
+     * @param opts.schema the audit database. Absent ⇒ the audit name resolved from
+     *   `SHIELD_DB_NAMESPACE` here, once at construction (unset ⇒ the default audit database).
+     */
     constructor(db: AuditQueryable, opts?: {
         schema?: string;
     });

package/dist/features/audit/mariadb-audit-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgBD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,OAAO,CAAC,OAAO;CA+BhB"}
+{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAeD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC;;;OAGG;gBACS,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAQxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,OAAO,CAAC,OAAO;CA+BhB"}

package/dist/features/audit/mariadb-audit-reader.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbAuditReader = void 0;
-const DEFAULT_SCHEMA = 'shield_audit';
+// mariadb-audit-reader.ts
+const core_1 = require("@astram/core");
 const ALL_TENANTS = '*';
 /**
  * The astram3 AuditReader over `shield_audit.audit_log` (design §2.2). Newest-first,
@@ -12,9 +13,16 @@ const ALL_TENANTS = '*';
 class MariaDbAuditReader {
     db;
     schema;
+    /**
+     * @param opts.schema the audit database. Absent ⇒ the audit name resolved from
+     *   `SHIELD_DB_NAMESPACE` here, once at construction (unset ⇒ the default audit database).
+     */
     constructor(db, opts = {}) {
         this.db = db;
-        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        this.schema =
+            opts.schema !== undefined
+                ? (0, core_1.assertSchemaName)(opts.schema, 'MariaDbAuditReader opts.schema')
+                : (0, core_1.resolveFrameworkSchemas)(process.env).audit;
     }
     async read(query) {
         const { where, params } = this.buildScopeClause(query);

package/dist/features/authz/access-bundle-reconcile.job.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { AccessBundleSpec } from '@astram/engine';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** The outcome of one reconcile pass. */
 export interface AccessBundleReconcileReport {
     readonly added: number;
@@ -24,9 +25,11 @@ export interface AccessBundleReconcileReport {
 export declare class AccessBundleReconcileJob {
     private readonly pool;
     private readonly bundles;
+    private readonly schemas;
     private readonly store;
     private running;
-    constructor(pool: Pool, bundles: readonly AccessBundleSpec[]);
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool: Pool, bundles: readonly AccessBundleSpec[], schemas?: IdentitySchemaNames);
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     runOnce(_nowIso: string): Promise<AccessBundleReconcileReport>;
     /** The set of permission keys that are ACTIVE in the live catalog. */

package/dist/features/authz/access-bundle-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAGL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE;IAKvD,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}
+{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAMjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;IAExB,4FAA4F;gBAEzE,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,OAAO,GAAE,mBAA+C;IAK3E,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}

package/dist/features/authz/access-bundle-reconcile.job.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccessBundleReconcileJob = void 0;
 const access_bundle_store_js_1 = require("./access-bundle-store.js");
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /**
  * Reconciles the developer-declared `AccessBundleSpec[]` (from
  * `ENGINE_ALL_ACCESS_BUNDLES`) into `shield_authz.access_bundle` (+ `_permission`),
@@ -20,12 +20,15 @@ const AUTHZ = 'shield_authz';
 class AccessBundleReconcileJob {
     pool;
     bundles;
+    schemas;
     store;
     running = false;
-    constructor(pool, bundles) {
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool, bundles, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.bundles = bundles;
-        this.store = new access_bundle_store_js_1.AccessBundleStore(pool);
+        this.schemas = schemas;
+        this.store = new access_bundle_store_js_1.AccessBundleStore(pool, schemas);
     }
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     async runOnce(_nowIso) {
@@ -77,7 +80,7 @@ class AccessBundleReconcileJob {
     }
     /** The set of permission keys that are ACTIVE in the live catalog. */
     async loadActivePermissionKeys() {
-        const rows = (await this.pool.query(`SELECT perm_key FROM \`${AUTHZ}\`.\`permission\` WHERE perm_status = 'active'`));
+        const rows = (await this.pool.query(`SELECT perm_key FROM \`${this.schemas.authz}\`.\`permission\` WHERE perm_status = 'active'`));
         return new Set(rows.map((r) => r.perm_key));
     }
 }

package/dist/features/authz/access-bundle-store.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { AccessBundleSpec } from '@astram/engine';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** A row from `shield_authz.access_bundle`, resolved to camelCase. */
 export interface AccessBundleRow {
     readonly uuid: string;
@@ -18,7 +19,9 @@ export interface AccessBundleRow {
  */
 export declare class AccessBundleStore {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     /** All bundles (active + orphaned), for the reconciler's declared-vs-present diff. */
     listBundles(): Promise<AccessBundleRow[]>;
     /** Resolve a bundle's UUID by its business key. `null` when absent. */

package/dist/features/authz/access-bundle-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-bundle-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEvC,sFAAsF;IAChF,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB/C,uEAAuE;IACjE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAuBnF;;;OAGG;IACG,yBAAyB,IAAI,OAAO,CACxC,KAAK,CAAC;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC,CACH;IA4CD;;;;;;OAMG;IACG,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;IAuCzF;;;OAGG;IACG,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BvF;;;;OAIG;IACG,YAAY,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUhG"}
+{"version":3,"file":"access-bundle-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAG1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAG3E,sFAAsF;IAChF,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB/C,uEAAuE;IACjE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAuBnF;;;OAGG;IACG,yBAAyB,IAAI,OAAO,CACxC,KAAK,CAAC;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC,CACH;IA4CD;;;;;;OAMG;IACG,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;IAuCzF;;;OAGG;IACG,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BvF;;;;OAIG;IACG,YAAY,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUhG"}

package/dist/features/authz/access-bundle-store.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccessBundleStore = void 0;
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /**
  * Raw-SQL (parameterized, NO ORM) CRUD over `shield_authz.access_bundle` +
  * `access_bundle_permission`, mirroring `mariadb-catalog-store.ts`.
@@ -11,13 +11,16 @@ const AUTHZ = 'shield_authz';
  */
 class AccessBundleStore {
     pool;
-    constructor(pool) {
+    schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     /** All bundles (active + orphaned), for the reconciler's declared-vs-present diff. */
     async listBundles() {
         const rows = (await this.pool.query(`SELECT ab_uuid, ab_key, ab_module, ab_label, ab_description, ab_status
-         FROM \`${AUTHZ}\`.\`access_bundle\``));
+         FROM \`${this.schemas.authz}\`.\`access_bundle\``));
         return rows.map((r) => ({
             uuid: r.ab_uuid,
             key: r.ab_key,
@@ -29,7 +32,7 @@ class AccessBundleStore {
     }
     /** Resolve a bundle's UUID by its business key. `null` when absent. */
     async resolveBundleUuid(module, key) {
-        const rows = (await this.pool.query(`SELECT ab_uuid FROM \`${AUTHZ}\`.\`access_bundle\`
+        const rows = (await this.pool.query(`SELECT ab_uuid FROM \`${this.schemas.authz}\`.\`access_bundle\`
         WHERE ab_module = ? AND ab_key = ? LIMIT 1`, [module, key]));
         return rows[0]?.ab_uuid ?? null;
     }
@@ -42,14 +45,14 @@ class AccessBundleStore {
      */
     async resolveActiveBundleKeys(bundleKey) {
         const rows = (await this.pool.query(`SELECT abp.abp_perm_key AS perm_key
-         FROM \`${AUTHZ}\`.\`access_bundle\` ab
-         JOIN \`${AUTHZ}\`.\`access_bundle_permission\` abp
+         FROM \`${this.schemas.authz}\`.\`access_bundle\` ab
+         JOIN \`${this.schemas.authz}\`.\`access_bundle_permission\` abp
            ON abp.abp_bundle_uuid = ab.ab_uuid
         WHERE ab.ab_key = ? AND ab.ab_status = 'active'
         ORDER BY abp.abp_perm_key`, [bundleKey]));
         if (rows.length === 0) {
             // Distinguish "no such active bundle" from "active bundle with zero keys".
-            const exists = (await this.pool.query(`SELECT 1 FROM \`${AUTHZ}\`.\`access_bundle\`
+            const exists = (await this.pool.query(`SELECT 1 FROM \`${this.schemas.authz}\`.\`access_bundle\`
           WHERE ab_key = ? AND ab_status = 'active' LIMIT 1`, [bundleKey]));
             if (exists.length === 0)
                 return null;
@@ -64,8 +67,8 @@ class AccessBundleStore {
     async listActiveBundlesWithKeys() {
         const rows = (await this.pool.query(`SELECT ab.ab_key AS bundle_key, ab.ab_module AS module, ab.ab_label AS label,
               ab.ab_description AS description, abp.abp_perm_key AS perm_key
-         FROM \`${AUTHZ}\`.\`access_bundle\` ab
-         LEFT JOIN \`${AUTHZ}\`.\`access_bundle_permission\` abp
+         FROM \`${this.schemas.authz}\`.\`access_bundle\` ab
+         LEFT JOIN \`${this.schemas.authz}\`.\`access_bundle_permission\` abp
            ON abp.abp_bundle_uuid = ab.ab_uuid
         WHERE ab.ab_status = 'active'
         ORDER BY ab.ab_module, ab.ab_key, abp.abp_perm_key`));
@@ -97,7 +100,7 @@ class AccessBundleStore {
     async upsertBundle(spec) {
         const description = spec.description ?? null;
         const existing = (await this.pool.query(`SELECT ab_uuid, ab_label, ab_description, ab_status
-         FROM \`${AUTHZ}\`.\`access_bundle\`
+         FROM \`${this.schemas.authz}\`.\`access_bundle\`
         WHERE ab_module = ? AND ab_key = ? LIMIT 1`, [spec.module, spec.key]));
         const cur = existing[0];
         if (cur) {
@@ -106,12 +109,12 @@ class AccessBundleStore {
                 cur.ab_status === 'active';
             if (same)
                 return 'unchanged';
-            await this.pool.query(`UPDATE \`${AUTHZ}\`.\`access_bundle\`
+            await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`access_bundle\`
             SET ab_label = ?, ab_description = ?, ab_status = 'active'
           WHERE ab_uuid = ?`, [spec.label, description, cur.ab_uuid]);
             return 'updated';
         }
-        await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`access_bundle\`
+        await this.pool.query(`INSERT INTO \`${this.schemas.authz}\`.\`access_bundle\`
          (ab_uuid, ab_key, ab_module, ab_label, ab_description, ab_status)
          VALUES (UUID(), ?, ?, ?, ?, 'active')`, [spec.key, spec.module, spec.label, description]);
         return 'inserted';
@@ -121,7 +124,7 @@ class AccessBundleStore {
      * insert the missing ones. Idempotent — a re-sync with the same set is a no-op.
      */
     async syncBundlePermissions(bundleUuid, keys) {
-        const existing = (await this.pool.query(`SELECT abp_perm_key FROM \`${AUTHZ}\`.\`access_bundle_permission\`
+        const existing = (await this.pool.query(`SELECT abp_perm_key FROM \`${this.schemas.authz}\`.\`access_bundle_permission\`
         WHERE abp_bundle_uuid = ?`, [bundleUuid]));
         const have = new Set(existing.map((r) => r.abp_perm_key));
         const want = new Set(keys);
@@ -129,11 +132,11 @@ class AccessBundleStore {
         const toInsert = [...want].filter((k) => !have.has(k));
         if (toDelete.length > 0) {
             const ph = toDelete.map(() => '?').join(', ');
-            await this.pool.query(`DELETE FROM \`${AUTHZ}\`.\`access_bundle_permission\`
+            await this.pool.query(`DELETE FROM \`${this.schemas.authz}\`.\`access_bundle_permission\`
           WHERE abp_bundle_uuid = ? AND abp_perm_key IN (${ph})`, [bundleUuid, ...toDelete]);
         }
         for (const key of toInsert) {
-            await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`access_bundle_permission\`
+            await this.pool.query(`INSERT INTO \`${this.schemas.authz}\`.\`access_bundle_permission\`
            (abp_uuid, abp_bundle_uuid, abp_perm_key)
            VALUES (UUID(), ?, ?)`, [bundleUuid, key]);
         }
@@ -145,7 +148,7 @@ class AccessBundleStore {
      */
     async markOrphaned(modKeysNotDeclared) {
         for (const [module, key] of modKeysNotDeclared) {
-            await this.pool.query(`UPDATE \`${AUTHZ}\`.\`access_bundle\`
+            await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`access_bundle\`
             SET ab_status = 'orphaned'
           WHERE ab_module = ? AND ab_key = ?`, [module, key]);
         }

package/dist/features/authz/catalog-bootstrap.provider.d.ts

@@ -1,5 +1,6 @@
 import { type OnApplicationBootstrap } from '@nestjs/common';
 import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
+import { type RecordAuthorizationInputs } from '@astram/guard';
 import type { ObjectType } from '@astram/engine';
 import { CatalogReconcileJob } from './catalog-reconcile.job.js';
 import { AccessBundleReconcileJob } from './access-bundle-reconcile.job.js';
@@ -23,8 +24,10 @@ export declare class CatalogBootstrapProvider implements OnApplicationBootstrap
     private readonly accessBundleJob;
     private readonly scopeClosure;
     private readonly registrations;
+    private readonly recordAuthorization;
+    private readonly logger;
     private timer;
-    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, job: CatalogReconcileJob, accessBundleJob: AccessBundleReconcileJob, scopeClosure: ScopeClosureService, registrations: readonly ObjectType[]);
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner, reflector: Reflector, job: CatalogReconcileJob, accessBundleJob: AccessBundleReconcileJob, scopeClosure: ScopeClosureService, registrations: readonly ObjectType[], recordAuthorization: RecordAuthorizationInputs);
     onApplicationBootstrap(): Promise<void>;
     /** Rebuild the scope closure; a failure is logged loudly (never silently swallowed) but does
      *  not abort boot or a cron tick — the reconcile is idempotent and retried next interval. */

package/dist/features/authz/catalog-bootstrap.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB;IAInE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAVhC,OAAO,CAAC,KAAK,CAA+B;gBAGzB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EACzC,YAAY,EAAE,mBAAmB,EAEjC,aAAa,EAAE,SAAS,UAAU,EAAE;IAGjD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC7C;iGAC6F;YAC/E,qBAAqB;CAOpC"}
+{"version":3,"file":"catalog-bootstrap.provider.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-bootstrap.provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;;;;;GAUG;AACH,qBACa,wBAAyB,YAAW,sBAAsB;IAKnE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAbtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IACpE,OAAO,CAAC,KAAK,CAA+B;gBAGzB,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,mBAAmB,EACxB,eAAe,EAAE,wBAAwB,EACzC,YAAY,EAAE,mBAAmB,EAEjC,aAAa,EAAE,SAAS,UAAU,EAAE,EAEpC,mBAAmB,EAAE,yBAAyB;IAG3D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAyE7C;iGAC6F;YAC/E,qBAAqB;CAOpC"}

package/dist/features/authz/catalog-bootstrap.provider.js

@@ -11,6 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var CatalogBootstrapProvider_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CatalogBootstrapProvider = void 0;
 // Ported from astram3 `server/src/features/authz/catalog-bootstrap.provider.ts`.
@@ -37,7 +38,7 @@ const RECONCILE_INTERVAL_MS = 60 * 60 * 1000; // hourly; honors DISABLE_ALL_CRON
  * health controller injects — so verify, the post-boot pass, and the endpoint all share
  * one job. This provider owns only the boot verify + the schedule.
  */
-let CatalogBootstrapProvider = class CatalogBootstrapProvider {
+let CatalogBootstrapProvider = CatalogBootstrapProvider_1 = class CatalogBootstrapProvider {
     discovery;
     scanner;
     reflector;
@@ -45,8 +46,10 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
     accessBundleJob;
     scopeClosure;
     registrations;
+    recordAuthorization;
+    logger = new common_1.Logger(CatalogBootstrapProvider_1.name);
     timer = null;
-    constructor(discovery, scanner, reflector, job, accessBundleJob, scopeClosure, registrations) {
+    constructor(discovery, scanner, reflector, job, accessBundleJob, scopeClosure, registrations, recordAuthorization) {
         this.discovery = discovery;
         this.scanner = scanner;
         this.reflector = reflector;
@@ -54,11 +57,38 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
         this.accessBundleJob = accessBundleJob;
         this.scopeClosure = scopeClosure;
         this.registrations = registrations;
+        this.recordAuthorization = recordAuthorization;
     }
     async onApplicationBootstrap() {
-        const registry = (0, guard_1.buildIdentityModuleRegistry)(this.registrations);
+        // ONE key universe (KI #70): verify against the registry decide(), the grant ceiling and the
+        // catalog reconcile job all use (identity objects + the consumer's `extraObjects`).
+        const registry = this.recordAuthorization.registry;
         const inventoryScanner = new guard_1.OperationInventoryScanner(this.discovery, this.scanner, this.reflector);
-        const inventory = inventoryScanner.scan(MODULE_KEY);
+        const scanned = inventoryScanner.scan(MODULE_KEY);
+        // A type registered with `EngineModule.forFeature` but not passed as `extraObjects` is
+        // unknown to decide() (`resource_not_registered`), so every gated access to it is denied
+        // and its keys are not catalogued. Before KI #70 verify ran over the engine registrations,
+        // so such routes booted; keep them booting (no new boot failure for existing consumers) but
+        // say loudly that they can never be allowed.
+        const engineOnly = this.registrations.filter((r) => registry.resolveObjectType(r.typeKey) === undefined);
+        let inventory = scanned;
+        if (engineOnly.length > 0) {
+            const engineOnlyKeys = new Set((0, guard_1.buildIdentityModuleRegistry)(engineOnly)
+                .listActions()
+                .map((a) => a.permissionKey));
+            const denied = scanned.operations.filter((op) => op.permissionKey !== undefined && engineOnlyKeys.has(op.permissionKey));
+            this.logger.warn(`object type(s) ${engineOnly.map((r) => r.typeKey).join(', ')} are registered with ` +
+                'EngineModule.forFeature but not in IdentityFeatureModule.forRoot({ extraObjects }): ' +
+                'decide() denies every gated access to them and their keys are not catalogued' +
+                (denied.length > 0
+                    ? `; always-denied routes: ${denied.map((op) => op.operationId).join(', ')}`
+                    : '') +
+                '. Add them to extraObjects.');
+            inventory = {
+                ...scanned,
+                operations: scanned.operations.filter((op) => !denied.includes(op)),
+            };
+        }
         // Fail-closed (ADR-0002): a route that can't be gated aborts boot.
         new guard_1.CatalogReconciler().verifyGatable(inventory, registry);
         // Mutating reconcile runs AFTER boot (not blocking, not fail-closed).
@@ -97,13 +127,14 @@ let CatalogBootstrapProvider = class CatalogBootstrapProvider {
     }
 };
 exports.CatalogBootstrapProvider = CatalogBootstrapProvider;
-exports.CatalogBootstrapProvider = CatalogBootstrapProvider = __decorate([
+exports.CatalogBootstrapProvider = CatalogBootstrapProvider = CatalogBootstrapProvider_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(6, (0, common_1.Inject)(engine_1.ENGINE_ALL_REGISTRATIONS)),
+    __param(7, (0, common_1.Inject)(guard_1.SHIELD_RECORD_AUTHORIZATION)),
     __metadata("design:paramtypes", [core_1.DiscoveryService,
         core_1.MetadataScanner,
         core_1.Reflector,
         catalog_reconcile_job_js_1.CatalogReconcileJob,
         access_bundle_reconcile_job_js_1.AccessBundleReconcileJob,
-        scope_closure_service_js_1.ScopeClosureService, Array])
+        scope_closure_service_js_1.ScopeClosureService, Array, Object])
 ], CatalogBootstrapProvider);

package/dist/features/authz/catalog-reconcile.job.d.ts

@@ -1,6 +1,7 @@
 import type { Pool } from 'mariadb';
 import { type ReconcileReport } from '@astram/guard';
 import type { ModuleRegistry } from '@astram/core';
+import type { IdentitySchemaNames } from '../../schema.js';
 /**
  * Single-runner wrapper around the framework CatalogReconciler.reconcile (the mutating
  * half). Called once shortly after boot and on a cron. Holds the latest report for
@@ -15,7 +16,8 @@ export declare class CatalogReconcileJob {
     private readonly store;
     private latest;
     private running;
-    constructor(pool: Pool, registry: ModuleRegistry);
+    /** @param schemas resolved framework names for the catalog store (absent ⇒ from the namespace). */
+    constructor(pool: Pool, registry: ModuleRegistry, schemas?: IdentitySchemaNames);
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     runOnce(nowIso: string): Promise<ReconcileReport | null>;
     getLatest(): ReconcileReport | null;

package/dist/features/authz/catalog-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAQ5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAP3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;gBAGtB,IAAI,EAAE,IAAI,EACO,QAAQ,EAAE,cAAc;IAK3C,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAiB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}
+{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAS5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAR3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;IAExB,mGAAmG;gBAEjG,IAAI,EAAE,IAAI,EACO,QAAQ,EAAE,cAAc,EACzC,OAAO,CAAC,EAAE,mBAAmB;IAK/B,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAiB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}

package/dist/features/authz/catalog-reconcile.job.js

@@ -17,9 +17,10 @@ class CatalogReconcileJob {
     store;
     latest = null;
     running = false;
-    constructor(pool, registry) {
+    /** @param schemas resolved framework names for the catalog store (absent ⇒ from the namespace). */
+    constructor(pool, registry, schemas) {
         this.registry = registry;
-        this.store = new mariadb_catalog_store_js_1.MariaDbCatalogStore(pool);
+        this.store = new mariadb_catalog_store_js_1.MariaDbCatalogStore(pool, schemas);
     }
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     async runOnce(nowIso) {