@astram/identity 0.10.0 → 0.12.0

package/dist/features/authz/mariadb-catalog-store.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCatalogStore = void 0;
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /**
  * CatalogStore impl over shield_authz.permission (raw parameterized SQL, mirroring
  * permission-facts.adapter). The reconciler (framework) calls this; guard does no DB
@@ -9,12 +9,15 @@ const AUTHZ = 'shield_authz';
  */
 class MariaDbCatalogStore {
     pool;
-    constructor(pool) {
+    schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     async listPermissions() {
         const rows = (await this.pool.query(`SELECT perm_key, perm_module, perm_type_key, perm_action, perm_label, perm_tier, perm_status
-         FROM \`${AUTHZ}\`.\`permission\``));
+         FROM \`${this.schemas.authz}\`.\`permission\``));
         return rows.map((r) => ({
             permissionKey: r.perm_key,
             moduleKey: r.perm_module,
@@ -26,10 +29,10 @@ class MariaDbCatalogStore {
         }));
     }
     async upsertPermission(row) {
-        const res = (await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`permission\`
+        const res = (await this.pool.query(`INSERT INTO \`${this.schemas.authz}\`.\`permission\`
          (perm_uuid, perm_key, perm_module, perm_type_key, perm_action, perm_label, perm_tier, perm_status)
          SELECT UUID(), ?, ?, ?, ?, ?, ?, 'active'
-          WHERE NOT EXISTS (SELECT 1 FROM \`${AUTHZ}\`.\`permission\` WHERE perm_key = ?)`, [
+          WHERE NOT EXISTS (SELECT 1 FROM \`${this.schemas.authz}\`.\`permission\` WHERE perm_key = ?)`, [
             row.permissionKey,
             row.moduleKey,
             row.typeKey,
@@ -44,13 +47,13 @@ class MariaDbCatalogStore {
         if (keys.length === 0)
             return;
         const ph = keys.map(() => '?').join(', ');
-        await this.pool.query(`UPDATE \`${AUTHZ}\`.\`permission\` SET perm_status = 'orphaned' WHERE perm_key IN (${ph})`, [...keys]);
+        await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`permission\` SET perm_status = 'orphaned' WHERE perm_key IN (${ph})`, [...keys]);
     }
     async markActive(keys) {
         if (keys.length === 0)
             return;
         const ph = keys.map(() => '?').join(', ');
-        await this.pool.query(`UPDATE \`${AUTHZ}\`.\`permission\` SET perm_status = 'active' WHERE perm_key IN (${ph})`, [...keys]);
+        await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`permission\` SET perm_status = 'active' WHERE perm_key IN (${ph})`, [...keys]);
     }
 }
 exports.MariaDbCatalogStore = MariaDbCatalogStore;

package/dist/features/authz/permission-version.bumper.d.ts

@@ -1,3 +1,4 @@
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The minimal query surface this writer needs — a `mariadb` `Pool` (or `PoolConnection`)
  * satisfies it structurally, but the type itself stays framework-agnostic so this signature
@@ -29,6 +30,7 @@ export interface VersionPublisher {
 }
 export declare class PermissionVersionBumper {
     private publisher?;
+    private readonly schemas;
     /**
      * Bumped versions waiting for their transaction to commit, per connection (ADR-0035). A
      * transaction connection is a pooled object reused across requests, so callers either publish
@@ -39,8 +41,11 @@ export declare class PermissionVersionBumper {
     /**
      * @param publisher OPTIONAL Redis publisher (ADR-0035). Absent → DB-only bumps, exactly as
      *   before (no read-back). `IdentityFeatureModule` attaches the guard's cache through DI.
+     * @param schemas resolved framework names: `authz_permission_version` lives in `schemas.authz`
+     *   (ADR-0011), the membership/posting join `bumpForRole` walks in `schemas.app`. Absent ⇒
+     *   resolved from the namespace, once, here.
      */
-    constructor(publisher?: VersionPublisher | undefined);
+    constructor(publisher?: VersionPublisher | undefined, schemas?: IdentitySchemaNames);
     /** Attach the Redis publisher once it is resolved through DI (first attach wins). */
     attachVersionPublisher(publisher: VersionPublisher): void;
     /**

package/dist/features/authz/permission-version.bumper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-version.bumper.d.ts","sourceRoot":"","sources":["../../../src/features/authz/permission-version.bumper.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;;;;;;;;;;;GAaG;AACH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAOD,qBAAa,uBAAuB;IAatB,OAAO,CAAC,SAAS,CAAC;IAZ9B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE;;;OAGG;gBACiB,SAAS,CAAC,EAAE,gBAAgB,YAAA;IAEhD,qFAAqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI;IAIzD;;;OAGG;IACG,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,kFAAkF;IAClF,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;YAIvB,WAAW;IAUzB;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmB1E;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBvE;;;;;;OAMG;YACW,UAAU;CA4BzB"}
+{"version":3,"file":"permission-version.bumper.d.ts","sourceRoot":"","sources":["../../../src/features/authz/permission-version.bumper.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;;;;;;;;;;;GAaG;AACH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAOD,qBAAa,uBAAuB;IAiBhC,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAjB1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE;;;;;;OAMG;gBAEO,SAAS,CAAC,EAAE,gBAAgB,YAAA,EACnB,OAAO,GAAE,mBAA+C;IAG3E,qFAAqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI;IAIzD;;;OAGG;IACG,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,kFAAkF;IAClF,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;YAIvB,WAAW;IAUzB;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmB1E;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBvE;;;;;;OAMG;YACW,UAAU;CA4BzB"}

package/dist/features/authz/permission-version.bumper.js

@@ -3,16 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PermissionVersionBumper = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@astram/core");
-/** Schema the `authz_permission_version` table lives in (ADR-0011). */
-const AUTHZ = 'shield_authz';
-/** Schema the membership/posting tables live in — the join `bumpForRole` walks. */
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /** An autocommit pool (it hands out connections) rather than one transaction's connection. */
 function isAutocommitPool(conn) {
     return typeof conn.getConnection === 'function';
 }
 class PermissionVersionBumper {
     publisher;
+    schemas;
     /**
      * Bumped versions waiting for their transaction to commit, per connection (ADR-0035). A
      * transaction connection is a pooled object reused across requests, so callers either publish
@@ -23,9 +21,13 @@ class PermissionVersionBumper {
     /**
      * @param publisher OPTIONAL Redis publisher (ADR-0035). Absent → DB-only bumps, exactly as
      *   before (no read-back). `IdentityFeatureModule` attaches the guard's cache through DI.
+     * @param schemas resolved framework names: `authz_permission_version` lives in `schemas.authz`
+     *   (ADR-0011), the membership/posting join `bumpForRole` walks in `schemas.app`. Absent ⇒
+     *   resolved from the namespace, once, here.
      */
-    constructor(publisher) {
+    constructor(publisher, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.publisher = publisher;
+        this.schemas = schemas;
     }
     /** Attach the Redis publisher once it is resolved through DI (first attach wins). */
     attachVersionPublisher(publisher) {
@@ -100,13 +102,13 @@ class PermissionVersionBumper {
      */
     async tenantsForRole(roleUuid, conn) {
         const rows = (await conn.query(`SELECT DISTINCT cm.cm_company_uuid AS tenant
-         FROM \`${APP}\`.\`company_membership\` cm
-         JOIN \`${APP}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+         FROM \`${this.schemas.app}\`.\`company_membership\` cm
+         JOIN \`${this.schemas.app}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
         WHERE mp.mp_role_uuid = ? AND cm.cm_is_active = 1`, [roleUuid]));
         // Service accounts (ADR-0033) hold roles on `sa_role_ids`, not postings: a role held only by
         // machine principals must still invalidate their tenants' cached grants (security hardening).
         const saRows = (await conn.query(`SELECT DISTINCT sa.sa_tenant_id AS tenant
-         FROM \`${APP}\`.\`service_account\` sa
+         FROM \`${this.schemas.app}\`.\`service_account\` sa
         WHERE JSON_CONTAINS(sa.sa_role_ids, JSON_QUOTE(?))`, [roleUuid]));
         return [...new Set([...rows, ...saRows].map((r) => r.tenant))];
     }
@@ -120,7 +122,7 @@ class PermissionVersionBumper {
     async bumpForUser(userUuid, conn) {
         try {
             const rows = (await conn.query(`SELECT DISTINCT cm.cm_company_uuid AS tenant
-           FROM \`${APP}\`.\`company_membership\` cm
+           FROM \`${this.schemas.app}\`.\`company_membership\` cm
           WHERE cm.cm_user_uuid = ?`, [userUuid]));
             const tenants = [...new Set(rows.map((r) => r.tenant))];
             for (const tenant of tenants)
@@ -139,14 +141,14 @@ class PermissionVersionBumper {
      * (the TTL bounds it) and never fails the bump.
      */
     async bumpTenant(tenantUuid, conn) {
-        await conn.query(`INSERT INTO \`${AUTHZ}\`.\`authz_permission_version\` (apv_tenant_uuid, apv_version)
+        await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`authz_permission_version\` (apv_tenant_uuid, apv_version)
          VALUES (?, 1)
        ON DUPLICATE KEY UPDATE apv_version = apv_version + 1`, [tenantUuid]);
         if (this.publisher === undefined)
             return;
         let version;
         try {
-            const rows = (await conn.query(`SELECT apv_version FROM \`${AUTHZ}\`.\`authz_permission_version\`
+            const rows = (await conn.query(`SELECT apv_version FROM \`${this.schemas.authz}\`.\`authz_permission_version\`
           WHERE apv_tenant_uuid = ? LIMIT 1`, [tenantUuid]));
             version = Number(rows[0]?.apv_version);
         }

package/dist/features/authz/record-authorization.d.ts

@@ -12,14 +12,18 @@
  * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix (`APP_DB_*`).
  */
 import { type Pool } from 'mariadb';
+import type { FrameworkSchemas } from '@astram/core';
 import { type RecordAuthorizationInputs } from '@astram/guard';
 import type { ObjectTypeInput } from '@astram/engine';
+import type { IdentitySchemaNames } from '../../schema.js';
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
  * Opens the pool at CALL time (never at import) — the caller owns closing it.
+ * `schemas` (the names `forRoot` resolved or was given) set the default database and user; absent
+ * ⇒ from the env namespace. An explicit `APP_DB_USER` / `APP_DB_NAME` wins (QA P2-5).
  */
-export declare function createIdentityAuthzPool(): Pool;
+export declare function createIdentityAuthzPool(schemas?: FrameworkSchemas): Pool;
 /**
  * Build the `RecordAuthorizationInputs` over `pool`. `@astram/identity` supplies only the
  * app-schema ports:
@@ -31,5 +35,7 @@ export declare function createIdentityAuthzPool(): Pool;
  *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
  */
-export declare function buildRecordAuthorizationInputs(pool: Pool, extraObjects?: readonly ObjectTypeInput[]): RecordAuthorizationInputs;
+export declare function buildRecordAuthorizationInputs(pool: Pool, extraObjects?: readonly ObjectTypeInput[], 
+/** Resolved framework names for the facts adapter (absent ⇒ from the namespace, once). */
+schemas?: IdentitySchemaNames): RecordAuthorizationInputs;
 //# sourceMappingURL=record-authorization.d.ts.map

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAa9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAS3B"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}

package/dist/features/authz/record-authorization.js

@@ -27,9 +27,11 @@ const session_facts_reader_js_1 = require("./session-facts.reader.js");
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
  * Opens the pool at CALL time (never at import) — the caller owns closing it.
+ * `schemas` (the names `forRoot` resolved or was given) set the default database and user; absent
+ * ⇒ from the env namespace. An explicit `APP_DB_USER` / `APP_DB_NAME` wins (QA P2-5).
  */
-function createIdentityAuthzPool() {
-    const db = (0, guard_1.loadDbConfig)();
+function createIdentityAuthzPool(schemas) {
+    const db = schemas === undefined ? (0, guard_1.loadDbConfig)() : (0, guard_1.loadDbConfig)(process.env, schemas);
     const ssl = (0, guard_1.mariadbSslOption)(db.tls);
     return mariadb_1.default.createPool({
         host: db.host,
@@ -53,11 +55,13 @@ function createIdentityAuthzPool() {
  *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
  */
-function buildRecordAuthorizationInputs(pool, extraObjects = []) {
+function buildRecordAuthorizationInputs(pool, extraObjects = [], 
+/** Resolved framework names for the facts adapter (absent ⇒ from the namespace, once). */
+schemas) {
     const registry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
     return {
         pool,
-        permissionFacts: new db_permission_facts_adapter_js_1.DbPermissionFactsAdapter(pool, registry),
+        permissionFacts: new db_permission_facts_adapter_js_1.DbPermissionFactsAdapter(pool, registry, undefined, schemas),
         sessionFacts: new session_facts_reader_js_1.AlsSessionFactsReader(),
         registry,
         operationManifest: [],

package/dist/features/authz/role-binding.d.ts

@@ -13,6 +13,7 @@
  * the role id are `?`-bound (never interpolated).
  */
 import type { Queryable } from './permission-version.bumper.js';
+import type { IdentitySchemaNames } from '../../schema.js';
 /** Where a role is bound relative to a set of subtree nodes. */
 export interface RoleBinding {
     readonly inside: boolean;
@@ -23,7 +24,7 @@ export interface RoleBinding {
  * qualifies only if it is bound (`membership_posting → company_membership`) to a node in the
  * subtree. The caller splices `params` where `sql` sits in the surrounding query.
  */
-export declare function subtreeExists(nodeIds: readonly string[]): {
+export declare function subtreeExists(nodeIds: readonly string[], schemas: IdentitySchemaNames): {
     sql: string;
     params: string[];
 };
@@ -32,5 +33,5 @@ export declare function subtreeExists(nodeIds: readonly string[]): {
  * query. An empty `nodeIds` is treated as "nothing is inside" (every binding is outside) — fail
  * closed, never an `IN ()` syntax error.
  */
-export declare function readRoleBinding(q: Queryable, roleUuid: string, nodeIds: readonly string[]): Promise<RoleBinding>;
+export declare function readRoleBinding(q: Queryable, roleUuid: string, nodeIds: readonly string[], schemas: IdentitySchemaNames): Promise<RoleBinding>;
 //# sourceMappingURL=role-binding.d.ts.map

package/dist/features/authz/role-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-binding.d.ts","sourceRoot":"","sources":["../../../src/features/authz/role-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAIhE,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAQ3F;AASD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,SAAS,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,WAAW,CAAC,CAwBtB"}
+{"version":3,"file":"role-binding.d.ts","sourceRoot":"","sources":["../../../src/features/authz/role-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,mBAAmB,GAC3B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAQnC;AASD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,SAAS,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAwBtB"}

package/dist/features/authz/role-binding.js

@@ -2,17 +2,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.subtreeExists = subtreeExists;
 exports.readRoleBinding = readRoleBinding;
-const APP = 'shield_app';
 /**
  * The shared EXISTS-subtree fragment for a non-root caller's READS (Task 4.2): a role row `r`
  * qualifies only if it is bound (`membership_posting → company_membership`) to a node in the
  * subtree. The caller splices `params` where `sql` sits in the surrounding query.
  */
-function subtreeExists(nodeIds) {
+function subtreeExists(nodeIds, schemas) {
     const ph = nodeIds.map(() => '?').join(', ');
     const sql = ` AND EXISTS (` +
-        `SELECT 1 FROM \`${APP}\`.\`membership_posting\` mp` +
-        ` JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid` +
+        `SELECT 1 FROM \`${schemas.app}\`.\`membership_posting\` mp` +
+        ` JOIN \`${schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid` +
         ` WHERE mp.mp_role_uuid = r.r_uuid AND cm.cm_company_uuid IN (${ph}))`;
     return { sql, params: [...nodeIds] };
 }
@@ -29,7 +28,7 @@ function truthy(v) {
  * query. An empty `nodeIds` is treated as "nothing is inside" (every binding is outside) — fail
  * closed, never an `IN ()` syntax error.
  */
-async function readRoleBinding(q, roleUuid, nodeIds) {
+async function readRoleBinding(q, roleUuid, nodeIds, schemas) {
     const ids = nodeIds.length > 0 ? [...nodeIds] : [];
     const inList = ids.length > 0 ? ids.map(() => '?').join(', ') : 'NULL';
     // `x IN (NULL)` is NULL (never true) and `x NOT IN (NULL)` is NULL too, so for an empty list the
@@ -40,12 +39,12 @@ async function readRoleBinding(q, roleUuid, nodeIds) {
             COALESCE(MAX(${outsideExpr}), 0) AS bound_outside
        FROM (
          SELECT cm.cm_company_uuid AS node
-           FROM \`${APP}\`.\`membership_posting\` mp
-           JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+           FROM \`${schemas.app}\`.\`membership_posting\` mp
+           JOIN \`${schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
           WHERE mp.mp_role_uuid = ?
          UNION ALL
          SELECT sa.sa_tenant_id AS node
-           FROM \`${APP}\`.\`service_account\` sa
+           FROM \`${schemas.app}\`.\`service_account\` sa
           WHERE JSON_CONTAINS(sa.sa_role_ids, JSON_QUOTE(?))
        ) b`, [...ids, ...ids, roleUuid, roleUuid]));
     const row = rows[0];

package/dist/features/company/company-hierarchy.service.d.ts

@@ -21,6 +21,7 @@
 import type { Principal } from '@astram/core';
 import type { AuditPort } from '@astram/engine';
 import { ScopeClosureService } from '../scope/scope-closure.service.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** The read surface used for existence/name lookups (the shared authz pool satisfies it). */
 export interface HierarchyQueryable {
     query(sql: string, params?: readonly unknown[]): Promise<unknown>;
@@ -49,9 +50,13 @@ export declare class CompanyHierarchyService {
     private readonly ceiling;
     private readonly audit?;
     private readonly now;
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    private readonly schemas;
     constructor(pool: HierarchyQueryable, closure: ScopeClosureService, 
     /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
-    ceiling: MemberDominance, audit?: AuditPort | undefined, now?: () => number);
+    ceiling: MemberDominance, audit?: AuditPort | undefined, now?: () => number, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas?: IdentitySchemaNames);
     /** The actor's own root node (see {@link ownRootOf}). */
     private ownRoot;
     /**

package/dist/features/company/company-hierarchy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAWxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAuCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBALH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAiF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IA+BpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAQxF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAqCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAPP,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAG3E,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAkF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IAgCpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/features/company/company-hierarchy.service.js

@@ -6,8 +6,7 @@ const http_js_1 = require("../shared/http.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
-const APP = 'shield_app';
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /** A JSON-array column (the driver returns an array OR a string) → its string items; else []. */
 function jsonIdArray(v) {
     let arr = v;
@@ -34,14 +33,18 @@ class CompanyHierarchyService {
     ceiling;
     audit;
     now;
+    schemas;
     constructor(pool, closure, 
     /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
-    ceiling, audit, now = Date.now) {
+    ceiling, audit, now = Date.now, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.closure = closure;
         this.ceiling = ceiling;
         this.audit = audit;
         this.now = now;
+        this.schemas = schemas;
     }
     /** The actor's own root node (see {@link ownRootOf}). */
     ownRoot(actor) {
@@ -54,7 +57,7 @@ class CompanyHierarchyService {
      * stored spelling once and passes that down. Unknown → the input unchanged (later steps 404).
      */
     async storedUuid(uuid) {
-        const rows = (await this.pool.query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [uuid]));
+        const rows = (await this.pool.query(`SELECT c_uuid FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [uuid]));
         return rows[0]?.c_uuid ?? uuid;
     }
     /** Names of the given companies (unknown → absent). */
@@ -62,7 +65,7 @@ class CompanyHierarchyService {
         const unique = [...new Set(ids)];
         if (unique.length === 0)
             return new Map();
-        const rows = (await q.query(`SELECT c_uuid, c_name FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${unique.map(() => '?').join(', ')})`, unique));
+        const rows = (await q.query(`SELECT c_uuid, c_name FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid IN (${unique.map(() => '?').join(', ')})`, unique));
         return new Map(rows.map((r) => [r.c_uuid, r.c_name]));
     }
     async recordAudit(conn, actor, action, attributes, tenantId = actor.tenantId) {
@@ -109,7 +112,7 @@ class CompanyHierarchyService {
         if (newParentUuid !== null && !names.has(newParentUuid)) {
             throw new identity_errors_js_1.IdentityNotFoundError('Parent company not found.');
         }
-        const oldParentRows = (await this.pool.query(`SELECT c_parent_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [nodeUuid]));
+        const oldParentRows = (await this.pool.query(`SELECT c_parent_uuid FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [nodeUuid]));
         const oldParent = oldParentRows[0]?.c_parent_uuid ?? null;
         const oldParentName = oldParent
             ? (await this.names(this.pool, [oldParent])).get(oldParent)
@@ -183,7 +186,7 @@ class CompanyHierarchyService {
         const agents = await (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_updated_at_ms', {
             sql: 'sa_tenant_id = ? OR JSON_CONTAINS(sa_scope_subtree, JSON_QUOTE(?))',
             params: [nodeUuid, nodeUuid],
-        });
+        }, this.schemas);
         const own = agents.filter((a) => a.sa_tenant_id === nodeUuid);
         const others = agents.filter((a) => a.sa_tenant_id !== nodeUuid);
         // Root bypasses inside; a refusal (403, names no agent) rolls the whole delete back.
@@ -196,8 +199,8 @@ class CompanyHierarchyService {
         const touched = new Set();
         const editStamp = (a) => Math.max(nowMs, (a.sa_updated_at_ms == null ? 0 : Number(a.sa_updated_at_ms)) + 1);
         const retire = async (a, reason) => {
-            await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_status = 'disabled', sa_updated_at_ms = ? WHERE sa_id = ?`, [editStamp(a), a.sa_id]);
-            const res = (await conn.query(`UPDATE \`${AUTHZ}\`.\`service_account_key\`
+            await conn.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET sa_status = 'disabled', sa_updated_at_ms = ? WHERE sa_id = ?`, [editStamp(a), a.sa_id]);
+            const res = (await conn.query(`UPDATE \`${this.schemas.authz}\`.\`service_account_key\`
             SET sak_revoked_at_ms = ?
           WHERE sak_account_id = ? AND sak_revoked_at_ms IS NULL`, [nowMs, a.sa_id]));
             touched.add(a.sa_tenant_id);
@@ -218,7 +221,7 @@ class CompanyHierarchyService {
                 await retire(a, 'scope_company_deleted');
                 continue;
             }
-            await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_scope_subtree = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), editStamp(a), a.sa_id]);
+            await conn.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET sa_scope_subtree = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), editStamp(a), a.sa_id]);
             touched.add(a.sa_tenant_id);
             await this.recordAudit(conn, actor, 'service_account.updated', {
                 eventType: 'service_account',
@@ -236,7 +239,7 @@ class CompanyHierarchyService {
     async revokeGrantsNaming(conn, actor, nodeUuid, companyName) {
         const grants = (await conn.query(`SELECT ctg_uuid, ctg_owning_tenant_uuid, ctg_grantee_tenant_uuid, ctg_grantee_kind,
               ctg_grantee_uuid, ctg_type_key, ctg_scope, ctg_allowed_actions
-         FROM \`${AUTHZ}\`.\`cross_tenant_grant\`
+         FROM \`${this.schemas.authz}\`.\`cross_tenant_grant\`
         WHERE (ctg_owning_tenant_uuid = ? OR ctg_grantee_tenant_uuid = ?)
           AND ctg_status <> 'revoked'
         ORDER BY ctg_uuid
@@ -247,7 +250,7 @@ class CompanyHierarchyService {
         const otherSides = grants.map((g) => g.ctg_owning_tenant_uuid === nodeUuid ? g.ctg_grantee_tenant_uuid : g.ctg_owning_tenant_uuid);
         const names = await this.names(conn, otherSides);
         for (const [i, g] of grants.entries()) {
-            await conn.query(`UPDATE \`${AUTHZ}\`.\`cross_tenant_grant\`
+            await conn.query(`UPDATE \`${this.schemas.authz}\`.\`cross_tenant_grant\`
             SET ctg_status = 'revoked', ctg_revoked_at = ?
           WHERE ctg_uuid = ? AND ctg_status <> 'revoked'`, [revokedAt, g.ctg_uuid]);
             const other = otherSides[i];
@@ -273,12 +276,10 @@ class CompanyHierarchyService {
     }
     /** Lock the company, then require dominance over each of its members (see `remove`). */
     async assertMayDeleteMembers(conn, actor, nodeUuid) {
-        await conn.query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? FOR UPDATE`, [
-            nodeUuid,
-        ]);
+        await conn.query(`SELECT c_uuid FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? FOR UPDATE`, [nodeUuid]);
         if (actor.isRoot === true)
             return;
-        const rows = (await conn.query(`SELECT cm_user_uuid AS member FROM \`${APP}\`.\`company_membership\`
+        const rows = (await conn.query(`SELECT cm_user_uuid AS member FROM \`${this.schemas.app}\`.\`company_membership\`
         WHERE cm_company_uuid = ? FOR UPDATE`, [nodeUuid]));
         const members = [...new Set(rows.map((r) => r.member))].sort();
         for (const member of members) {

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { ObjectTypeInput } from '@astram/engine';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** One row in the grantee's pending-offers inbox. */
 export interface InboxGrantRow {
     uuid: string;
@@ -59,13 +60,17 @@ export declare class CrossTenantGrantReadService {
      *   surface uses, so a future tenantScoped type is picked up the same way it becomes
      *   shareable.
      * @param actionsByType per-typeKey action vocabulary for the offerable-types read
-     *   (decision 1: "the actions per type come from the type's own action set"). Callers
-     *   pass `actionsFor`, which defaults every type to the CRUD `IDENTITY_ACTIONS` except
-     *   a type with its own override (e.g. `cross_tenant_grant` -> share/accept/revoke) —
-     *   the single source every action-vocabulary consumer uses, so a per-type set can
-     *   never drift between callers.
+     *   (decision 1: "the actions per type come from the type's own action set"). The
+     *   module passes its registration-based lookup (`effectiveActions` over the same
+     *   `[...identityObjects, ...extraObjects]`, ADR-0038): CRUD plus a type's declared
+     *   extras, or exactly its declared list for `crudActions: false` (e.g.
+     *   `cross_tenant_grant` -> share/accept/revoke) — the single source every
+     *   action-vocabulary consumer uses, so a per-type set can never drift between callers.
      */
-    constructor(pool: Pool, offerableTypeInputs: readonly ObjectTypeInput[], actionsByType: (typeKey: string) => readonly string[]);
+    /** The shared FROM/JOIN block, built once from the resolved names. */
+    private readonly joins;
+    /** (`schemas`: resolved framework names; absent ⇒ resolved from the namespace, once, here.) */
+    constructor(pool: Pool, offerableTypeInputs: readonly ObjectTypeInput[], actionsByType: (typeKey: string) => readonly string[], schemas?: IdentitySchemaNames);
     /**
      * Pending offers sitting in the CALLER's tenant inbox: `ctg_grantee_tenant_uuid =
      * tenantId AND ctg_status = 'offered' AND ctg_expires_at_ms > nowMs` (an expired

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant-read.service.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+FD,qBACa,2BAA2B;IAiBpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAlBhC;;;;;;;;;;;;;;OAcG;gBAEgB,IAAI,EAAE,IAAI,EACV,mBAAmB,EAAE,SAAS,eAAe,EAAE,EAC/C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE;IAGxE;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA0B1E;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAyBzD;;;;;;;OAOG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyBjE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAWxD"}
+{"version":3,"file":"cross-tenant-grant-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant-read.service.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAgGD,qBACa,2BAA2B;IAsBpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAvBhC;;;;;;;;;;;;;;;OAeG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAE/B,+FAA+F;gBAE5E,IAAI,EAAE,IAAI,EACV,mBAAmB,EAAE,SAAS,eAAe,EAAE,EAC/C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,EACtE,OAAO,GAAE,mBAA+C;IAK1D;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA0B1E;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAyBzD;;;;;;;OAOG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyBjE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAWxD"}

package/dist/features/cross-tenant/cross-tenant-grant-read.service.js

@@ -36,8 +36,7 @@ exports.CrossTenantGrantReadService = void 0;
  */
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
-const AUTHZ = 'shield_authz';
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /**
  * Parse `ctg_allowed_actions` to a `string[]`, accepting BOTH an already-parsed array
  * (production — the mariadb driver auto-parses the JSON column) and a JSON string
@@ -99,13 +98,14 @@ const SELECT_COLUMNS = `
   ctg.ctg_expires_at_ms,
   ctg.ctg_created_at
 `;
-const JOINS = `
-  FROM \`${AUTHZ}\`.\`cross_tenant_grant\` ctg
-  LEFT JOIN \`${APP}\`.\`companies\` owner_co ON owner_co.c_uuid = ctg.ctg_owning_tenant_uuid
-  LEFT JOIN \`${APP}\`.\`companies\` grantee_co ON grantee_co.c_uuid = ctg.ctg_grantee_tenant_uuid
-  LEFT JOIN \`${APP}\`.\`users\` gu ON ctg.ctg_grantee_kind = 'user' AND gu.u_uuid = ctg.ctg_grantee_uuid
-  LEFT JOIN \`${APP}\`.\`roles\` gr ON ctg.ctg_grantee_kind = 'role' AND gr.r_uuid = ctg.ctg_grantee_uuid
-  LEFT JOIN \`${APP}\`.\`users\` offerer ON offerer.u_uuid = ctg.ctg_offered_by
+/** The FROM/JOIN block every read shares, over the resolved framework names. */
+const joinsFor = ({ app, authz }) => `
+  FROM \`${authz}\`.\`cross_tenant_grant\` ctg
+  LEFT JOIN \`${app}\`.\`companies\` owner_co ON owner_co.c_uuid = ctg.ctg_owning_tenant_uuid
+  LEFT JOIN \`${app}\`.\`companies\` grantee_co ON grantee_co.c_uuid = ctg.ctg_grantee_tenant_uuid
+  LEFT JOIN \`${app}\`.\`users\` gu ON ctg.ctg_grantee_kind = 'user' AND gu.u_uuid = ctg.ctg_grantee_uuid
+  LEFT JOIN \`${app}\`.\`roles\` gr ON ctg.ctg_grantee_kind = 'role' AND gr.r_uuid = ctg.ctg_grantee_uuid
+  LEFT JOIN \`${app}\`.\`users\` offerer ON offerer.u_uuid = ctg.ctg_offered_by
 `;
 let CrossTenantGrantReadService = class CrossTenantGrantReadService {
     pool;
@@ -120,16 +120,21 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
      *   surface uses, so a future tenantScoped type is picked up the same way it becomes
      *   shareable.
      * @param actionsByType per-typeKey action vocabulary for the offerable-types read
-     *   (decision 1: "the actions per type come from the type's own action set"). Callers
-     *   pass `actionsFor`, which defaults every type to the CRUD `IDENTITY_ACTIONS` except
-     *   a type with its own override (e.g. `cross_tenant_grant` -> share/accept/revoke) —
-     *   the single source every action-vocabulary consumer uses, so a per-type set can
-     *   never drift between callers.
+     *   (decision 1: "the actions per type come from the type's own action set"). The
+     *   module passes its registration-based lookup (`effectiveActions` over the same
+     *   `[...identityObjects, ...extraObjects]`, ADR-0038): CRUD plus a type's declared
+     *   extras, or exactly its declared list for `crudActions: false` (e.g.
+     *   `cross_tenant_grant` -> share/accept/revoke) — the single source every
+     *   action-vocabulary consumer uses, so a per-type set can never drift between callers.
      */
-    constructor(pool, offerableTypeInputs, actionsByType) {
+    /** The shared FROM/JOIN block, built once from the resolved names. */
+    joins;
+    /** (`schemas`: resolved framework names; absent ⇒ resolved from the namespace, once, here.) */
+    constructor(pool, offerableTypeInputs, actionsByType, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.offerableTypeInputs = offerableTypeInputs;
         this.actionsByType = actionsByType;
+        this.joins = joinsFor(schemas);
     }
     /**
      * Pending offers sitting in the CALLER's tenant inbox: `ctg_grantee_tenant_uuid =
@@ -141,7 +146,7 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
         if (!tenantId)
             return [];
         const rows = (await this.pool.query(`SELECT ${SELECT_COLUMNS}
-       ${JOINS}
+       ${this.joins}
        WHERE ctg.ctg_grantee_tenant_uuid = ?
          AND ctg.ctg_status = 'offered'
          AND ctg.ctg_expires_at_ms > ?
@@ -169,7 +174,7 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
         if (!tenantId)
             return [];
         const rows = (await this.pool.query(`SELECT ${SELECT_COLUMNS}
-       ${JOINS}
+       ${this.joins}
        WHERE ctg.ctg_owning_tenant_uuid = ?
        ORDER BY ctg.ctg_created_at DESC`, [tenantId]));
         return rows.map((row) => ({
@@ -198,7 +203,7 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
         if (!tenantId)
             return [];
         const rows = (await this.pool.query(`SELECT ${SELECT_COLUMNS}
-       ${JOINS}
+       ${this.joins}
        WHERE ctg.ctg_grantee_tenant_uuid = ?
          AND ctg.ctg_status = 'accepted'
        ORDER BY ctg.ctg_expires_at_ms ASC`, [tenantId]));
@@ -272,5 +277,5 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
 exports.CrossTenantGrantReadService = CrossTenantGrantReadService;
 exports.CrossTenantGrantReadService = CrossTenantGrantReadService = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [Object, Array, Function])
+    __metadata("design:paramtypes", [Object, Array, Function, Object])
 ], CrossTenantGrantReadService);