@astram/identity 0.10.0 → 0.12.0

package/dist/features/authz/db-permission-facts.adapter.d.ts

@@ -13,6 +13,7 @@
  */
 import type { Pool } from 'mariadb';
 import type { PermissionFactsPort, CoarseGrants, ModuleRegistry } from '@astram/core';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * Expand raw grant strings (exact or wildcard) to the set of EXACT registered keys.
  * Bounded to `allKeys` — a wildcard can never yield a key that isn't registered.
@@ -31,10 +32,11 @@ export declare function expandGrantKeys(rawKeys: string[], allKeys: string[]): s
  * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
  * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
+ * @param schemas the resolved framework names (the tables live in `schemas.app`).
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
-export declare function readRoleIdsForTenant(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<string[]>;
+export declare function readRoleIdsForTenant(pool: Pool, principalId: string, tenantId: string, schemas: IdentitySchemaNames, now?: () => number): Promise<string[]>;
 /**
  * The next instant (epoch-ms, strictly after `now`) at which this USER's in-effect roles in
  * `tenantId` change by themselves — the earliest future `mp_effective_from_ms` (a posting starts)
@@ -42,7 +44,7 @@ export declare function readRoleIdsForTenant(pool: Pool, principalId: string, te
  * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
  * a service account (its roles have no windows). A query failure propagates (fail closed).
  */
-export declare function readNextPostingBoundaryMs(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<number | null>;
+export declare function readNextPostingBoundaryMs(pool: Pool, principalId: string, tenantId: string, schemas: IdentitySchemaNames, now?: () => number): Promise<number | null>;
 export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
     private readonly pool;
     private readonly registry;
@@ -52,13 +54,17 @@ export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
      * Injectable so a test can fix the clock relative to a seeded expired/active posting.
      */
     private readonly now;
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    private readonly schemas;
     constructor(pool: Pool, registry: ModuleRegistry, 
     /**
      * Injectable clock (epoch-ms) for the posting effective-window compare. Defaults to
      * `Date.now`. Bound as a `?` integer against the BIGINT `_ms` columns — timezone-immune.
      * Injectable so a test can fix the clock relative to a seeded expired/active posting.
      */
-    now?: () => number);
+    now?: () => number, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas?: IdentitySchemaNames);
     currentPermissionsVersion(_principalId: string, tenantId: string): Promise<number>;
     /**
      * The coarse grants + (ADR-0035) the LIVE role ids they were derived from + the time bound of

package/dist/features/authz/db-permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxF;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAuBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}
+{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAIpF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA2CD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;gBATP,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAGrE,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxF;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YA6BtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}

package/dist/features/authz/db-permission-facts.adapter.js

@@ -5,6 +5,7 @@ exports.expandGrantKeys = expandGrantKeys;
 exports.readRoleIdsForTenant = readRoleIdsForTenant;
 exports.readNextPostingBoundaryMs = readNextPostingBoundaryMs;
 const core_1 = require("@astram/core");
+const schema_js_1 = require("../../schema.js");
 const MODULE_PREFIX = 'identity';
 /**
  * Expand raw grant strings (exact or wildcard) to the set of EXACT registered keys.
@@ -58,8 +59,8 @@ function parseRoleIdsJson(v) {
  * membership path). A DISABLED account returns `[]` (in-scope but no roles → deny everything —
  * defense-in-depth alongside the key's own revoke check).
  */
-async function readServiceAccountRoleIds(pool, principalId, tenantId) {
-    const rows = (await pool.query(`SELECT sa_role_ids, sa_status FROM \`shield_app\`.\`service_account\`
+async function readServiceAccountRoleIds(pool, principalId, tenantId, schemas) {
+    const rows = (await pool.query(`SELECT sa_role_ids, sa_status FROM \`${schemas.app}\`.\`service_account\`
       WHERE sa_id = ? AND sa_tenant_id = ? LIMIT 1`, [principalId, tenantId]));
     const row = rows[0];
     if (row === undefined)
@@ -78,12 +79,13 @@ async function readServiceAccountRoleIds(pool, principalId, tenantId) {
  * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
  * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
+ * @param schemas the resolved framework names (the tables live in `schemas.app`).
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
-async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now) {
+async function readRoleIdsForTenant(pool, principalId, tenantId, schemas, now = Date.now) {
     // Service-account path (ADR-0033): its roles live on the account row, not memberships.
-    const saRoles = await readServiceAccountRoleIds(pool, principalId, tenantId);
+    const saRoles = await readServiceAccountRoleIds(pool, principalId, tenantId, schemas);
     if (saRoles !== null)
         return saRoles;
     // Human path: roles from the active membership's in-effect postings — of an ACTIVE account only
@@ -92,9 +94,9 @@ async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now)
     // has a users row).
     const nowMs = now();
     const rows = (await pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
-       FROM \`shield_app\`.\`company_membership\` cm
-       JOIN \`shield_app\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
-       JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+       FROM \`${schemas.app}\`.\`company_membership\` cm
+       JOIN \`${schemas.app}\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
+       JOIN \`${schemas.app}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
       WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1
         AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
         AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [principalId, tenantId, nowMs, nowMs]));
@@ -107,7 +109,7 @@ async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now)
  * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
  * a service account (its roles have no windows). A query failure propagates (fail closed).
  */
-async function readNextPostingBoundaryMs(pool, principalId, tenantId, now = Date.now) {
+async function readNextPostingBoundaryMs(pool, principalId, tenantId, schemas, now = Date.now) {
     const nowMs = now();
     const rows = (await pool.query(`SELECT MIN(CASE
               WHEN mp.mp_effective_from_ms IS NOT NULL AND mp.mp_effective_from_ms > ?
@@ -115,8 +117,8 @@ async function readNextPostingBoundaryMs(pool, principalId, tenantId, now = Date
               WHEN mp.mp_effective_until_ms IS NOT NULL AND mp.mp_effective_until_ms > ?
                 THEN mp.mp_effective_until_ms
             END) AS next_boundary_ms
-       FROM \`shield_app\`.\`company_membership\` cm
-       JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+       FROM \`${schemas.app}\`.\`company_membership\` cm
+       JOIN \`${schemas.app}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
       WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1`, [nowMs, nowMs, principalId, tenantId]));
     const raw = rows[0]?.next_boundary_ms;
     if (raw === null || raw === undefined)
@@ -128,20 +130,24 @@ class DbPermissionFactsAdapter {
     pool;
     registry;
     now;
+    schemas;
     constructor(pool, registry, 
     /**
      * Injectable clock (epoch-ms) for the posting effective-window compare. Defaults to
      * `Date.now`. Bound as a `?` integer against the BIGINT `_ms` columns — timezone-immune.
      * Injectable so a test can fix the clock relative to a seeded expired/active posting.
      */
-    now = Date.now) {
+    now = Date.now, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.registry = registry;
         this.now = now;
+        this.schemas = schemas;
     }
     async currentPermissionsVersion(_principalId, tenantId) {
         try {
-            const rows = (await this.pool.query(`SELECT apv_version FROM \`shield_authz\`.\`authz_permission_version\`
+            const rows = (await this.pool.query(`SELECT apv_version FROM \`${this.schemas.authz}\`.\`authz_permission_version\`
           WHERE apv_tenant_uuid = ? LIMIT 1`, [tenantId]));
             return rows.length > 0 ? Number(rows[0]?.apv_version) : 0;
         }
@@ -166,7 +172,7 @@ class DbPermissionFactsAdapter {
             version = await this.readVersion(tenantId);
             roleIds = await this.readRoleIds(principalId, tenantId);
             rawKeys = roleIds.length === 0 ? [] : await this.readGrantKeys(roleIds);
-            validUntilMs = await readNextPostingBoundaryMs(this.pool, principalId, tenantId, this.now);
+            validUntilMs = await readNextPostingBoundaryMs(this.pool, principalId, tenantId, this.schemas, this.now);
         }
         catch (cause) {
             if (cause instanceof core_1.AuthorizationUnavailableError)
@@ -182,7 +188,7 @@ class DbPermissionFactsAdapter {
         };
     }
     async readVersion(tenantId) {
-        const rows = (await this.pool.query(`SELECT apv_version FROM \`shield_authz\`.\`authz_permission_version\`
+        const rows = (await this.pool.query(`SELECT apv_version FROM \`${this.schemas.authz}\`.\`authz_permission_version\`
         WHERE apv_tenant_uuid = ? LIMIT 1`, [tenantId]));
         return rows.length > 0 ? Number(rows[0]?.apv_version) : 0;
     }
@@ -191,11 +197,11 @@ class DbPermissionFactsAdapter {
      * tenant — delegates to the shared {@link readRoleIdsForTenant} (single source).
      */
     async readRoleIds(principalId, tenantId) {
-        return readRoleIdsForTenant(this.pool, principalId, tenantId, this.now);
+        return readRoleIdsForTenant(this.pool, principalId, tenantId, this.schemas, this.now);
     }
     async readGrantKeys(roleIds) {
         const placeholders = roleIds.map(() => '?').join(', ');
-        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`shield_authz\`.\`role_permission\`
+        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\`
         WHERE rp_role_uuid IN (${placeholders})`, roleIds));
         return rows.map((r) => r.rp_perm_key);
     }

package/dist/features/authz/grant-admin.service.d.ts

@@ -4,6 +4,7 @@ import type { AuditPort } from '@astram/engine';
 import { PermissionVersionBumper } from './permission-version.bumper.js';
 import { AccessBundleStore } from './access-bundle-store.js';
 import { GrantCeiling } from './grant-ceiling.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The caller's reachable subtree, threaded from `req.principal` (Task 4.2). It scopes the
  * grant-admin reads so a caller sees ONLY roles bound within their subtree — the SAME cached
@@ -54,6 +55,7 @@ export declare class GrantAdminService {
     private readonly bumper;
     private readonly ceiling?;
     private readonly audit?;
+    private readonly schemas;
     private readonly bundles;
     /**
      * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold") plus the
@@ -63,8 +65,9 @@ export declare class GrantAdminService {
      *   enforces. Root bypasses regardless.
      * @param audit  The grant-administration audit sink (D6): written on the grant's own transaction
      *   connection, fail-closed. The identity module ALWAYS wires the engine `MariaDbAuditSink`.
+     * @param schemas Resolved framework names (absent ⇒ resolved from the namespace, once, here).
      */
-    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined, audit?: AuditPort | undefined);
+    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined, audit?: AuditPort | undefined, schemas?: IdentitySchemaNames);
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
     listCatalog(): Promise<{
         catalog: CatalogRow[];

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAuC7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;OAQG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA;IAKpC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA0DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAc/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiCpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IAK3E,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA6DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}

package/dist/features/authz/grant-admin.service.js

@@ -8,8 +8,7 @@ const grant_ceiling_js_1 = require("./grant-ceiling.js");
 const role_binding_js_1 = require("./role-binding.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
-const AUTHZ = 'shield_authz';
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /** The grant-admin actions that REMOVE authority from a role's holders (Phase 8 #2). */
 const REVOKE_ACTIONS = new Set([
     'role.permission_revoked',
@@ -42,6 +41,7 @@ class GrantAdminService {
     bumper;
     ceiling;
     audit;
+    schemas;
     bundles;
     /**
      * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold") plus the
@@ -51,20 +51,22 @@ class GrantAdminService {
      *   enforces. Root bypasses regardless.
      * @param audit  The grant-administration audit sink (D6): written on the grant's own transaction
      *   connection, fail-closed. The identity module ALWAYS wires the engine `MariaDbAuditSink`.
+     * @param schemas Resolved framework names (absent ⇒ resolved from the namespace, once, here).
      */
-    constructor(pool, bumper, bundleStore, ceiling, audit) {
+    constructor(pool, bumper, bundleStore, ceiling, audit, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.bumper = bumper;
         this.ceiling = ceiling;
         this.audit = audit;
-        this.bundles = bundleStore ?? new access_bundle_store_js_1.AccessBundleStore(pool);
+        this.schemas = schemas;
+        this.bundles = bundleStore ?? new access_bundle_store_js_1.AccessBundleStore(pool, schemas);
     }
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
     async listCatalog() {
         let rows;
         try {
             rows = (await this.pool.query(`SELECT perm_key, perm_label, perm_module, perm_type_key, perm_action
-           FROM \`${AUTHZ}\`.\`permission\`
+           FROM \`${this.schemas.authz}\`.\`permission\`
           WHERE perm_status = 'active'
           ORDER BY perm_type_key, perm_action`));
         }
@@ -98,15 +100,15 @@ class GrantAdminService {
                 const ph = subtreeScope.nodeIds.map(() => '?').join(', ');
                 // Empty subtree → no placeholders → the check can't match → fail-closed empty.
                 const bound = subtreeScope.nodeIds.length
-                    ? (await this.pool.query(`SELECT 1 FROM \`${APP}\`.\`membership_posting\` mp
-                 JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+                    ? (await this.pool.query(`SELECT 1 FROM \`${this.schemas.app}\`.\`membership_posting\` mp
+                 JOIN \`${this.schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
                 WHERE mp.mp_role_uuid = ? AND cm.cm_company_uuid IN (${ph})
                 LIMIT 1`, [roleUuid, ...subtreeScope.nodeIds]))
                     : [];
                 if (bound.length === 0)
                     return { grants: [] };
             }
-            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid]));
+            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid]));
             return { grants: rows.map((r) => r.rp_perm_key) };
         }
         catch (cause) {
@@ -147,11 +149,9 @@ class GrantAdminService {
             // Lock the role row FIRST — the posting path locks the same row before it inserts — then
             // re-run the binding rule on THIS connection, so a binding committed by a writer we waited
             // for is seen, and a role that became shared in the meantime is refused (rolled back).
-            await conn.query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? FOR UPDATE`, [
-                roleUuid,
-            ]);
+            await conn.query(`SELECT r_uuid FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? FOR UPDATE`, [roleUuid]);
             if (this.ceiling && actor.isRoot !== true) {
-                grant_ceiling_js_1.GrantCeiling.checkAdministrable(await (0, role_binding_js_1.readRoleBinding)(conn, roleUuid, (0, grant_ceiling_js_1.subtreeOf)(actor)));
+                grant_ceiling_js_1.GrantCeiling.checkAdministrable(await (0, role_binding_js_1.readRoleBinding)(conn, roleUuid, (0, grant_ceiling_js_1.subtreeOf)(actor), this.schemas));
                 // Phase 8 #2: a revocation strips authority from every holder of the role, so the actor
                 // must dominate each of them — checked under the role lock (no holder can appear unseen).
                 // Phase 9 #9: that includes the service accounts holding the role, judged as a role
@@ -196,12 +196,12 @@ class GrantAdminService {
         if (!this.audit)
             return;
         const query = (sql, params) => conn.query(sql, params);
-        const roleRows = (await query(`SELECT r_name FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
+        const roleRows = (await query(`SELECT r_name FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
         const tenants = [...new Set(bumpedTenants)];
         const nameOf = new Map();
         if (tenants.length > 0) {
             const ph = tenants.map(() => '?').join(', ');
-            const rows = (await query(`SELECT c_uuid, c_name FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${ph})`, tenants));
+            const rows = (await query(`SELECT c_uuid, c_name FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid IN (${ph})`, tenants));
             for (const r of rows)
                 nameOf.set(r.c_uuid, r.c_name);
         }
@@ -248,11 +248,11 @@ class GrantAdminService {
         const actorUuid = grantor.id;
         await this.writeGrants('role.permission_granted', roleUuid, [key], grantor, async (conn, k) => {
             // Idempotent insert — UNIQUE (rp_role_uuid, rp_perm_key); a duplicate is a no-op.
-            await conn.query(`INSERT INTO \`${AUTHZ}\`.\`role_permission\`
+            await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`role_permission\`
            (rp_uuid, rp_role_uuid, rp_perm_key, rp_granted_at, rp_granted_by)
            SELECT UUID(), ?, ?, UTC_TIMESTAMP(), ?
             WHERE NOT EXISTS (
-              SELECT 1 FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
+              SELECT 1 FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
             )`, [roleUuid, k, actorUuid ?? null, roleUuid, k]);
         });
     }
@@ -267,7 +267,7 @@ class GrantAdminService {
         roleUuid = await this.storedRoleUuid(roleUuid);
         await this.assertMayChangeGrants(roleUuid, [key], actor);
         await this.writeGrants('role.permission_revoked', roleUuid, [key], actor, async (conn, k) => {
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, k]);
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, k]);
         });
     }
     /**
@@ -301,16 +301,14 @@ class GrantAdminService {
             if (this.ceiling && actor.isRoot !== true) {
                 await this.ceiling.assertMayStripRoleFromServiceAccounts(actor, roleUuid, accounts.map((a) => a.sa_tenant_id), 'delete');
             }
-            const keys = (await conn.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid])).map((r) => r.rp_perm_key);
+            const keys = (await conn.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid])).map((r) => r.rp_perm_key);
             const bumped = await this.bumper.bumpForRole(roleUuid, conn);
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ?`, [
-                roleUuid,
-            ]);
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ?`, [roleUuid]);
             const nowMs = Date.now();
             for (const a of accounts) {
                 const remaining = jsonIdArray(a.sa_role_ids).filter((id) => id !== roleUuid);
                 const previous = a.sa_updated_at_ms === null ? 0 : Number(a.sa_updated_at_ms);
-                await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_role_ids = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), Math.max(nowMs, previous + 1), a.sa_id]);
+                await conn.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET sa_role_ids = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), Math.max(nowMs, previous + 1), a.sa_id]);
             }
             await this.auditGrantChange(conn, 'role.permission_revoked', roleUuid, keys, actor, bumped, {
                 roleDeleted: true,
@@ -349,14 +347,11 @@ class GrantAdminService {
     async storedRoleUuid(roleUuid) {
         if (typeof roleUuid !== 'string' || roleUuid.length === 0)
             return roleUuid;
-        const rows = (await this.pool.query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
+        const rows = (await this.pool.query(`SELECT r_uuid FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
         return rows[0]?.r_uuid ?? roleUuid;
     }
     lockAccountsHoldingRole(conn, roleUuid) {
-        return (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_role_ids, sa_updated_at_ms', {
-            sql: 'JSON_CONTAINS(sa_role_ids, JSON_QUOTE(?))',
-            params: [roleUuid],
-        });
+        return (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_role_ids, sa_updated_at_ms', { sql: 'JSON_CONTAINS(sa_role_ids, JSON_QUOTE(?))', params: [roleUuid] }, this.schemas);
     }
     // ── Access bundles ────────────────────────────────────────────────────────
     /** All active bundles + their resolved atomic keys, for the Access UI. */
@@ -385,11 +380,11 @@ class GrantAdminService {
         const actorUuid = grantor.id;
         await this.writeGrants('role.bundle_granted', roleUuid, keys, grantor, async (conn, key) => {
             // Idempotent — UNIQUE (rp_role_uuid, rp_perm_key); a duplicate is a no-op.
-            await conn.query(`INSERT INTO \`${AUTHZ}\`.\`role_permission\`
+            await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`role_permission\`
              (rp_uuid, rp_role_uuid, rp_perm_key, rp_granted_at, rp_granted_by)
              SELECT UUID(), ?, ?, UTC_TIMESTAMP(), ?
               WHERE NOT EXISTS (
-                SELECT 1 FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
+                SELECT 1 FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
               )`, [roleUuid, key, actorUuid ?? null, roleUuid, key]);
         }, { bundle: bundleKey });
     }
@@ -405,7 +400,7 @@ class GrantAdminService {
         const keys = await this.resolveBundleKeysOrThrow(bundleKey);
         await this.assertMayChangeGrants(roleUuid, [...keys], actor);
         await this.writeGrants('role.bundle_revoked', roleUuid, keys, actor, async (conn, key) => {
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, key]);
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, key]);
         }, { bundle: bundleKey });
     }
     /** Resolve a bundle key → its atomic keys; throw BadKeyError when unknown/orphaned. */
@@ -451,14 +446,14 @@ class GrantAdminService {
             // identical on BOTH the count and page queries so they can never disagree.
             const scope = subtreeScope.isRoot
                 ? { sql: '', params: [] }
-                : (0, role_binding_js_1.subtreeExists)(subtreeScope.nodeIds);
+                : (0, role_binding_js_1.subtreeExists)(subtreeScope.nodeIds, this.schemas);
             // Distinct granted roles (a role appears iff it has ≥1 role_permission row), filtered
             // by name search. Bind the LIKE term as a param (wildcards escaped).
             const likeClause = search ? `AND r.r_name LIKE ?` : '';
             const likeArgs = search ? [`%${search.replace(/[%_\\]/g, '\\$&')}%`] : [];
             const [{ total = 0 } = {}] = (await this.pool.query(`SELECT COUNT(DISTINCT rp.rp_role_uuid) AS total
-           FROM \`${AUTHZ}\`.\`role_permission\` rp
-           JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
+           FROM \`${this.schemas.authz}\`.\`role_permission\` rp
+           JOIN \`${this.schemas.app}\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
           WHERE 1 = 1${scope.sql} ${likeClause}`, [...scope.params, ...likeArgs]));
             // The page of role uuids + name + latest-grant metadata. name/grantedAt sort in SQL;
             // permCount falls back to a stable name sort here (re-sorted after aggregation).
@@ -466,8 +461,8 @@ class GrantAdminService {
             const pageRoles = (await this.pool.query(`SELECT rp.rp_role_uuid AS role_uuid,
                 r.r_name        AS role_name,
                 MAX(rp.rp_granted_at) AS latest_at
-           FROM \`${AUTHZ}\`.\`role_permission\` rp
-           JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
+           FROM \`${this.schemas.authz}\`.\`role_permission\` rp
+           JOIN \`${this.schemas.app}\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
           WHERE 1 = 1${scope.sql} ${likeClause}
           GROUP BY rp.rp_role_uuid, r.r_name
           ORDER BY ${orderCol} ${dir}, r.r_name ASC
@@ -482,8 +477,8 @@ class GrantAdminService {
                 rp.rp_perm_key   AS perm_key,
                 rp.rp_granted_at AS granted_at,
                 u.u_username     AS granted_by_name
-           FROM \`${AUTHZ}\`.\`role_permission\` rp
-           LEFT JOIN \`shield_app\`.\`users\` u ON u.u_uuid = rp.rp_granted_by
+           FROM \`${this.schemas.authz}\`.\`role_permission\` rp
+           LEFT JOIN \`${this.schemas.app}\`.\`users\` u ON u.u_uuid = rp.rp_granted_by
           WHERE rp.rp_role_uuid IN (${ph})`, roleUuids));
             const byRole = new Map();
             for (const row of grantRows) {

package/dist/features/authz/grant-ceiling.d.ts

@@ -15,6 +15,7 @@
 import type { Pool } from 'mariadb';
 import type { ModuleRegistry, Principal } from '@astram/core';
 import { type RoleBinding } from './role-binding.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** The grantor exceeds their own authority — cannot grant a key they do not hold (→ 403). */
 export declare class GrantCeilingError extends Error {
     constructor(key: string, message?: string);
@@ -43,6 +44,8 @@ export declare class GrantCeiling {
     private readonly registry;
     /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
     private readonly now;
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    private readonly schemas;
     private readonly rootIds;
     constructor(pool: Pool, registry: ModuleRegistry, 
     /**
@@ -53,7 +56,9 @@ export declare class GrantCeiling {
      */
     rootIds: readonly string[] | null, 
     /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
-    now?: () => number);
+    now?: () => number, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas?: IdentitySchemaNames);
     /** The D1 administer rule over a binding read: used inside and nowhere outside (404 / 403). */
     static checkAdministrable(b: RoleBinding): void;
     /** The #11 assign rule over a binding read: never a role also used outside (403). */

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAetE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWtE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAU3E,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAwB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAM3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}

package/dist/features/authz/grant-ceiling.js

@@ -9,8 +9,7 @@ const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.
 const role_binding_js_1 = require("./role-binding.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const service_account_service_js_1 = require("../service-account/service-account.service.js");
-const AUTHZ = 'shield_authz';
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /** The grantor exceeds their own authority — cannot grant a key they do not hold (→ 403). */
 class GrantCeilingError extends Error {
     constructor(key, message) {
@@ -54,6 +53,7 @@ class GrantCeiling {
     pool;
     registry;
     now;
+    schemas;
     rootIds;
     constructor(pool, registry, 
     /**
@@ -64,10 +64,13 @@ class GrantCeiling {
      */
     rootIds, 
     /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
-    now = Date.now) {
+    now = Date.now, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.registry = registry;
         this.now = now;
+        this.schemas = schemas;
         if (rootIds !== null && !Array.isArray(rootIds)) {
             throw new TypeError('GrantCeiling: rootIds is required (the root allowlist, or null when none is configured)');
         }
@@ -96,7 +99,7 @@ class GrantCeiling {
         if (roleIds.length === 0)
             return [];
         const ph = roleIds.map(() => '?').join(', ');
-        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, [...roleIds]));
+        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, [...roleIds]));
         return rows.map((r) => r.rp_perm_key);
     }
     /** Run a store read, mapping any non-domain failure to AuthorizationUnavailableError (503). */
@@ -118,11 +121,11 @@ class GrantCeiling {
      */
     async effectiveKeys(grantor) {
         try {
-            const roleIds = await (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, grantor.id, grantor.tenantId, this.now);
+            const roleIds = await (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, grantor.id, grantor.tenantId, this.schemas, this.now);
             if (roleIds.length === 0)
                 return new Set();
             const ph = roleIds.map(() => '?').join(', ');
-            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, roleIds));
+            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, roleIds));
             const raw = rows.map((r) => r.rp_perm_key);
             const registered = this.registry.listActions().map((a) => a.permissionKey);
             return new Set((0, db_permission_facts_adapter_js_1.expandGrantKeys)(raw, registered));
@@ -198,13 +201,13 @@ class GrantCeiling {
         }
         const subtree = new Set(subtreeOf(actor));
         const { companies, roleIds, superuser, storedId } = await this.facts('target memberships', async () => {
-            const su = (await this.pool.query(`SELECT u_uuid, u_is_platform_superuser AS su FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
+            const su = (await this.pool.query(`SELECT u_uuid, u_is_platform_superuser AS su FROM \`${this.schemas.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
             const memberships = (await this.pool.query(`SELECT DISTINCT cm_company_uuid AS company
-           FROM \`${APP}\`.\`company_membership\`
+           FROM \`${this.schemas.app}\`.\`company_membership\`
           WHERE cm_user_uuid = ?`, [targetUserId]));
             const postings = (await this.pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
-           FROM \`${APP}\`.\`membership_posting\` mp
-           JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+           FROM \`${this.schemas.app}\`.\`membership_posting\` mp
+           JOIN \`${this.schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
           WHERE cm.cm_user_uuid = ?`, [targetUserId]));
             return {
                 companies: memberships.map((m) => m.company),
@@ -253,8 +256,8 @@ class GrantCeiling {
             return;
         const holders = await this.facts('role holders', async () => {
             const rows = (await this.pool.query(`SELECT DISTINCT cm.cm_user_uuid AS holder
-           FROM \`${APP}\`.\`membership_posting\` mp
-           JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+           FROM \`${this.schemas.app}\`.\`membership_posting\` mp
+           JOIN \`${this.schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
           WHERE mp.mp_role_uuid = ?`, [roleUuid]));
             return rows.map((r) => r.holder);
         });
@@ -298,7 +301,7 @@ class GrantCeiling {
         const nodes = (0, service_account_service_js_1.ceilingOf)(admin, []);
         if (accountTenantIds.some((t) => !(0, service_account_service_js_1.ceilingAllowsNode)(nodes, t)))
             throw refuse();
-        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.now));
+        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.schemas, this.now));
         if (!(0, service_account_service_js_1.ceilingAllowsRole)((0, service_account_service_js_1.ceilingOf)(admin, held), roleUuid))
             throw refuse();
     }
@@ -328,7 +331,7 @@ class GrantCeiling {
             throw refuse();
         if (accounts.every((a) => a.roleIds.length === 0))
             return;
-        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.now));
+        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.schemas, this.now));
         const ceiling = (0, service_account_service_js_1.ceilingOf)(admin, held);
         if (accounts.some((a) => a.roleIds.some((r) => !(0, service_account_service_js_1.ceilingAllowsRole)(ceiling, r)))) {
             throw refuse();
@@ -350,7 +353,7 @@ class GrantCeiling {
                 return;
             if (companyUuid === null)
                 throw new identity_errors_js_1.IdentityBadRequestError(message);
-            const rows = await this.facts('company org units', async () => (await this.pool.query(`SELECT ${unitCol} AS unit FROM \`${APP}\`.\`${table}\`
+            const rows = await this.facts('company org units', async () => (await this.pool.query(`SELECT ${unitCol} AS unit FROM \`${this.schemas.app}\`.\`${table}\`
             WHERE ${companyCol} = ? AND ${unitCol} IN (${wanted.map(() => '?').join(', ')})`, [companyUuid, ...wanted])));
             const linked = new Set(rows.map((r) => r.unit));
             if (wanted.some((u) => !linked.has(u)))
@@ -361,7 +364,7 @@ class GrantCeiling {
     }
     /** Where `roleUuid` is bound relative to the actor's subtree (postings + service accounts). */
     async roleBinding(actor, roleUuid) {
-        return this.facts('role binding', () => (0, role_binding_js_1.readRoleBinding)(this.pool, roleUuid, subtreeOf(actor)));
+        return this.facts('role binding', () => (0, role_binding_js_1.readRoleBinding)(this.pool, roleUuid, subtreeOf(actor), this.schemas));
     }
     /**
      * Assert the actor may ADMINISTER the role — edit its grants, rename or delete it (#1, D1

package/dist/features/authz/mariadb-catalog-store.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { CatalogStore, CatalogPermissionRow } from '@astram/guard';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * CatalogStore impl over shield_authz.permission (raw parameterized SQL, mirroring
  * permission-facts.adapter). The reconciler (framework) calls this; guard does no DB
@@ -7,7 +8,9 @@ import type { CatalogStore, CatalogPermissionRow } from '@astram/guard';
  */
 export declare class MariaDbCatalogStore implements CatalogStore {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     listPermissions(): Promise<CatalogPermissionRow[]>;
     upsertPermission(row: Omit<CatalogPermissionRow, 'status'>): Promise<boolean>;
     markOrphaned(keys: readonly string[]): Promise<void>;

package/dist/features/authz/mariadb-catalog-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-catalog-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/mariadb-catalog-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAIxE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBlD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB7E,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASpD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzD"}
+{"version":3,"file":"mariadb-catalog-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/mariadb-catalog-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IAGpD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAGrE,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBlD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB7E,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASpD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzD"}