@astram/identity 0.10.0 → 0.12.0

package/dist/features/identity-feature.module.js

@@ -9,8 +9,11 @@ var IdentityFeatureModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdentityFeatureModule = void 0;
 exports.assertRequestPathUsesIdentityAuthorization = assertRequestPathUsesIdentityAuthorization;
+exports.assertFrameworkSchemasAgree = assertFrameworkSchemasAgree;
+exports.assertFrameworkDatabaseAgrees = assertFrameworkDatabaseAgrees;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
+const core_2 = require("@astram/core");
 const engine_1 = require("@astram/engine");
 const guard_1 = require("@astram/guard");
 const objects_js_1 = require("../objects.js");
@@ -22,6 +25,7 @@ const role_service_js_1 = require("./role/role.service.js");
 const role_controller_js_1 = require("./role/role.controller.js");
 const user_service_js_1 = require("./user/user.service.js");
 const email_address_changer_token_js_1 = require("./user/email-address-changer.token.js");
+const framework_schemas_token_js_1 = require("./framework-schemas.token.js");
 const user_controller_js_1 = require("./user/user.controller.js");
 const membership_controller_js_1 = require("./membership/membership.controller.js");
 const membership_service_js_1 = require("./membership/membership.service.js");
@@ -34,6 +38,7 @@ const permission_version_bumper_js_1 = require("./authz/permission-version.bumpe
 const record_authorization_js_1 = require("./authz/record-authorization.js");
 const db_permission_facts_adapter_js_1 = require("./authz/db-permission-facts.adapter.js");
 const session_revocation_check_js_1 = require("./user/session-revocation-check.js");
+const migration_ledger_check_js_1 = require("./migration-ledger-check.js");
 const access_bundle_store_js_1 = require("./authz/access-bundle-store.js");
 const grant_admin_service_js_1 = require("./authz/grant-admin.service.js");
 const grant_admin_controller_js_1 = require("./authz/grant-admin.controller.js");
@@ -56,6 +61,8 @@ const audit_controller_js_1 = require("./audit/audit.controller.js");
 const cross_tenant_grant_read_service_js_1 = require("./cross-tenant/cross-tenant-grant-read.service.js");
 const cross_tenant_grant_controller_js_1 = require("./cross-tenant/cross-tenant-grant.controller.js");
 const grant_authorize_js_1 = require("./cross-tenant/grant-authorize.js");
+const files_service_js_1 = require("./files/files.service.js");
+const files_controller_js_1 = require("./files/files.controller.js");
 /** DI token of the provider that links the guard's Redis version cache to the bumper (ADR-0035). */
 const IDENTITY_VERSION_PUBLISHER_LINK = Symbol('IDENTITY_VERSION_PUBLISHER_LINK');
 /** DI token of the boot check that warns when a user disable cannot revoke sessions. */
@@ -89,9 +96,59 @@ function assertRequestPathUsesIdentityAuthorization(authority) {
     }
     return true;
 }
-/** Map guard's env DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). */
-function engineDbFromEnv() {
-    const db = (0, guard_1.loadDbConfig)();
+/** DI token of the boot check that identity and guard use the same framework database names. */
+const IDENTITY_FRAMEWORK_SCHEMAS_CHECK = Symbol('IDENTITY_FRAMEWORK_SCHEMAS_CHECK');
+/**
+ * The boot check behind {@link IDENTITY_FRAMEWORK_SCHEMAS_CHECK} (configurable-framework-db,
+ * ADR-0037; reviewer R2): the names `IdentityFeatureModule.forRoot` resolved — and handed to the
+ * engine, the audit sinks, the reader and every identity store — must equal guard's
+ * `FRAMEWORK_SCHEMAS`, or engine/guard/identity would split across databases. A guard that
+ * provides no `FRAMEWORK_SCHEMAS` (older than this seam) may only run on the default names.
+ * Throws (fail closed) with the namespaces and names only.
+ */
+function assertFrameworkSchemasAgree(identity, guard) {
+    const names = (s) => `namespace=${s.namespace} app=${s.app} identity=${s.identity} authz=${s.authz} audit=${s.audit}`;
+    if (guard === undefined || guard === null) {
+        if (identity.isDefault)
+            return true;
+        throw new Error(`IdentityFeatureModule: resolved ${names(identity)}, but @astram/guard provides no ` +
+            'FRAMEWORK_SCHEMAS; upgrade @astram/guard so every framework module uses the same names.');
+    }
+    const same = identity.app === guard.app &&
+        identity.identity === guard.identity &&
+        identity.authz === guard.authz &&
+        identity.audit === guard.audit;
+    if (!same) {
+        throw new Error(`IdentityFeatureModule: framework database names disagree — identity ${names(identity)}; ` +
+            `guard ${names(guard)}. Pass the same names (or none) to ShieldModule and ` +
+            'IdentityFeatureModule.');
+    }
+    return true;
+}
+/** DI token of the boot check that guard's runtime database equals identity's (QA P2-5). */
+const IDENTITY_FRAMEWORK_DATABASE_CHECK = Symbol('IDENTITY_FRAMEWORK_DATABASE_CHECK');
+/**
+ * The boot check behind {@link IDENTITY_FRAMEWORK_DATABASE_CHECK} (G-007 QA P2-5): the runtime
+ * database identity's engine and authz pool connect to (derived from `forRoot({ schemas })`)
+ * must equal guard's `APP_CONFIG.db.database`, or unqualified queries of guard and identity would
+ * land in different databases. No guard `APP_CONFIG` visible ⇒ nothing to compare. Throws (fail
+ * closed) with database names only.
+ */
+function assertFrameworkDatabaseAgrees(identityDatabase, guardConfig) {
+    const guardDatabase = guardConfig?.db?.database;
+    if (guardDatabase === undefined || guardDatabase === identityDatabase)
+        return true;
+    throw new Error(`IdentityFeatureModule: runtime database ${identityDatabase} differs from @astram/guard's ` +
+        `${guardDatabase}. Pass the same names (or none) to ShieldModule and ` +
+        'IdentityFeatureModule, and one APP_DB_NAME.');
+}
+/**
+ * Map guard's DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). The
+ * database and default user follow `schemas` (the names `forRoot` resolved or was given); an
+ * explicit `APP_DB_USER` / `APP_DB_NAME` still wins (QA P2-5).
+ */
+function engineDbFromEnv(schemas) {
+    const db = (0, guard_1.loadDbConfig)(process.env, schemas);
     const ssl = (0, guard_1.mariadbSslOption)(db.tls);
     return {
         host: db.host,
@@ -132,22 +189,34 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   cross-tenant / policy authority, grant ceiling, guided rule-builder schema and owner-share
      *   resolver. Without them a consumer type is unregistered everywhere (denied), not policy-
      *   authorable and not shareable ("type '…' is not registered — cannot share").
+     * @param schemas the resolved framework database names (configurable-framework-db, ADR-0037).
+     *   Absent ⇒ resolved ONCE here from `SHIELD_DB_NAMESPACE` (unset ⇒ `shield_*`; invalid ⇒
+     *   throws). The one set is handed to the engine (registrations + its audit sink), the seven
+     *   audit sinks, the audit reader and every identity store; a boot check refuses names that
+     *   differ from guard's `FRAMEWORK_SCHEMAS`. Never read per request.
      */
-    static forRoot({ rootIds, extraObjects = [], } = {}) {
+    static forRoot({ rootIds, extraObjects = [], schemas: givenSchemas, } = {}) {
+        // The framework database names, resolved ONCE (boot) for every SQL path built below.
+        // Caller-supplied names are checked before any SQL is built (fail closed, Shield #1).
+        const schemas = givenSchemas !== undefined
+            ? (0, core_2.assertFrameworkSchemaNames)(givenSchemas, 'IdentityFeatureModule.forRoot schemas')
+            : (0, core_2.resolveFrameworkSchemas)(process.env);
         // ONE shared shield_authz pool for the whole grant-admin stack (ADR-0011): the
         // permission-version bumper, the AccessBundleStore, the GrantAdminService, and the two
         // reconcile jobs all run over this single pool (don't open several). Opened once at
         // forRoot() (not import time) — mirrors the pre-existing bump-pool pattern. Since Phase 9 #7
         // it also backs the request path's decision authority (provided to ShieldModule below).
-        const authzPool = (0, record_authorization_js_1.createIdentityAuthzPool)();
+        const authzPool = (0, record_authorization_js_1.createIdentityAuthzPool)(schemas);
+        // QA P2-5: the engine and the authz pool connect to the database derived from `schemas`.
+        const engineDb = engineDbFromEnv(schemas);
         // The ONE record authorization (Phase 9 #7, closes KI #55/#57): built here from this module's
         // own `extraObjects`, provided to ShieldModule under SHIELD_RECORD_AUTHORIZATION, and reused for
         // every internal authority below. Its registry is the ONE key universe: the grant ceiling sees
         // every key the request path grants (review M5 / Phase 8 #4), and a consumer type is
         // registered for the cross-tenant writer and the policy author too.
-        const recordAuthorization = (0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool, extraObjects);
+        const recordAuthorization = (0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool, extraObjects, schemas);
         const ceilingRegistry = recordAuthorization.registry;
-        const bumper = new permission_version_bumper_js_1.PermissionVersionBumper();
+        const bumper = new permission_version_bumper_js_1.PermissionVersionBumper(undefined, schemas);
         const postingVersionBump = {
             bumpTenant: (tenantUuid) => bumper.bumpForTenant(tenantUuid, authzPool),
             // A user disabled/re-enabled: every membership tenant (autocommit pool → published at once).
@@ -155,16 +224,12 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             // A role delete (Phase 8 #2): its holder tenants, read before the delete cascades postings.
             tenantsForRole: (roleUuid) => bumper.tenantsForRole(roleUuid, authzPool),
         };
-        // The core ModuleRegistry the catalog reconcile job needs, built from the identity
-        // object registrations only (guard's bridge reflects decorated classes → registry): it
-        // catalogs the identity permissions. Authorities use the shared `recordAuthorization.registry`.
-        const identityRegistry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects]);
         // The grant-admin collaborators built at forRoot() over the shared pool (mirrors the
         // postingVersionBump closure pattern above). GrantCeiling (ADR-0029) enforces the
         // self-escalation ceiling: a non-root grantor may only grant a key they themselves hold —
         // resolved over the SAME authz pool + registry the object-type gate uses (one source of
         // truth for "what a principal holds"). ALWAYS wired here, so production always enforces.
-        const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool);
+        const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool, schemas);
         // (`ceilingRegistry` is the shared record-authorization registry built at the top of forRoot.)
         // `rootIds` marks platform roots as never dominated.
         // rootIds is passed EXPLICITLY (review F5): `null` states "not configured". The dominance
@@ -175,30 +240,33 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 'ShieldModule.forRoot({ rootIds }). Platform administrators are still protected via ' +
                 'users.u_is_platform_superuser.');
         }
-        const grantCeiling = new grant_ceiling_js_1.GrantCeiling(authzPool, ceilingRegistry, rootIds ?? null);
+        const grantCeiling = new grant_ceiling_js_1.GrantCeiling(authzPool, ceilingRegistry, rootIds ?? null, undefined, schemas);
+        // Every identity audit sink writes `<audit>.audit_log` of the resolved names (Shield #6: the
+        // audit DB of the same namespace).
+        const auditSinkConfig = { schema: schemas.audit };
         // Grant administration is audited on the grant's own transaction (D6, fail-closed).
-        const grantAdminAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
-        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink);
+        const grantAdminAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
+        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink, schemas);
         // Scope closure (Task 1.2 of the scoped-hierarchy program): the reconciler + node
         // move/delete maintenance, over the SAME shared authzPool (it reaches BOTH shield_app —
         // companies — and shield_authz — scope_closure). Reuses the SAME `bumper` instance so a
         // moveNode's session-invalidation joins the move's transaction. reconcileClosure() is
         // kicked post-boot by the CatalogBootstrapProvider (mirrors the catalog reconcile).
-        const scopeClosureService = new scope_closure_service_js_1.ScopeClosureService(authzPool, bumper);
+        const scopeClosureService = new scope_closure_service_js_1.ScopeClosureService(authzPool, bumper, schemas);
         // Company hierarchy (security hardening #2): the ONLY path that moves/deletes/attaches a company
         // node — through the closure service above — audited on the move/delete transaction.
         const companyHierarchyService = new company_hierarchy_service_js_1.CompanyHierarchyService(authzPool, scopeClosureService, grantCeiling, // Phase 8 #3: a company delete must dominate every member
-        new engine_1.MariaDbAuditSink({}));
+        new engine_1.MariaDbAuditSink(auditSinkConfig), undefined, schemas);
         // Audit viewer (Phase 5): the AuditReader + LabelResolver over the SAME shared authzPool
         // (the reader queries shield_audit + the resolver/actor-lookup query shield_app, both
         // reachable by that pool). `auditNameToId` is the actor-name -> uuid reverse lookup for the
         // actor filter (astram3's exact closure). A mariadb Pool.query(sql, params) structurally
         // satisfies the reader/resolver's `AuditQueryable` — pass authzPool directly. Built at
         // forRoot() (not via Nest DI) because it needs the hand-built pool, then provided useValue.
-        const auditReader = new mariadb_audit_reader_js_1.MariaDbAuditReader(authzPool);
-        const auditLabels = new directory_label_resolver_js_1.DirectoryLabelResolver(authzPool);
+        const auditReader = new mariadb_audit_reader_js_1.MariaDbAuditReader(authzPool, { schema: schemas.audit });
+        const auditLabels = new directory_label_resolver_js_1.DirectoryLabelResolver(authzPool, schemas);
         const auditNameToId = async (name) => {
-            const rows = (await authzPool.query('SELECT u_uuid AS id FROM `shield_app`.`users` WHERE u_username = ? LIMIT 1', [name]));
+            const rows = (await authzPool.query(`SELECT u_uuid AS id FROM \`${schemas.app}\`.\`users\` WHERE u_username = ? LIMIT 1`, [name]));
             return rows[0]?.id ?? null;
         };
         const auditReadService = new audit_read_service_js_1.AuditReadService(auditReader, auditLabels, auditNameToId);
@@ -222,7 +290,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // consumer passes to ShieldModule.forRoot (root-correctness for control-plane grants).
         const authorizeCrossTenantGrant = (0, grant_authorize_js_1.makeAuthorizeCrossTenantGrant)({
             authority: crossTenantAuthority,
-            readRoleIds: (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId),
+            readRoleIds: (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId, schemas),
             isRoot: (principalId) => (rootIds ?? []).includes(principalId),
         });
         // Audit bridge: map guard's `GrantAuditEvent` → the engine's `MariaDbAuditSink` (the SAME
@@ -237,7 +305,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // never happen for a cross-tenant grant) is de-duped to ONE row.
         // BEST-EFFORT: a throw here must NEVER fail the lifecycle write (the writer already swallows a
         // sink throw; we also guard here so a mapping/DB error is inert).
-        const grantAuditSink = new engine_1.MariaDbAuditSink({}); // defaults: shield_audit.audit_log
+        const grantAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const grantAudit = {
             record: async (event) => {
                 try {
@@ -268,11 +336,20 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             db: authzPool,
             authorize: authorizeCrossTenantGrant,
             audit: grantAudit,
+            schema: schemas.authz,
         });
         // The read side (inbox/mine/incoming/offerable-types) over the same pool + the merged object
         // set (offerable = tenantScoped types only, the consumer's included, KI #57) + the per-type
         // action vocabulary.
-        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], guard_1.actionsFor);
+        // The ONE registration-based action lookup (ADR-0038): typeKey → the type's declared
+        // vocabulary (`effectiveActions`, validated) over identity + the consumer's extraObjects.
+        // `undefined` for an unregistered type. Shared by every action-vocabulary consumer here.
+        const actionsByTypeKey = new Map([...objects_js_1.identityObjects, ...extraObjects].map((input) => {
+            const reg = typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
+            return [reg.typeKey, (0, engine_1.effectiveActions)(reg)];
+        }));
+        const actionsByType = (typeKey) => actionsByTypeKey.get(typeKey);
+        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], (typeKey) => actionsByType(typeKey) ?? [], schemas);
         // ── GUIDED RULE-BUILDER (list-scoping engine Phase 5, §9.1) ──────────────────────────────
         // The policy-authoring surface over the guard `MariaDbPolicyStore` + core `makeAuthorPolicy`.
         // Reuses the SAME shared registry + `crossTenantAuthority` (a DecisionAuthority over the
@@ -280,7 +357,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // core AuditSink is one-arg (`record(event)`); the engine `MariaDbAuditSink` is two-arg
         // (`record(event, query)`) — so bind the query to the shared authzPool (mirrors the
         // `grantAudit` bridge above). Best-effort audit (a sink throw must not fail the author).
-        const policyAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const policyAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const policyAudit = {
             record: async (event) => {
                 try {
@@ -291,7 +368,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 }
             },
         };
-        const policyStore = new guard_1.MariaDbPolicyStore(authzPool);
+        const policyStore = new guard_1.MariaDbPolicyStore(authzPool, { schema: schemas.authz });
         // The guided-builder SCHEMA source — the authorable field/action metadata, reflected from the
         // registered identity object types (engine `reflectObjectType` yields fields WITH their
         // `type`, which the core registry descriptor drops). Only tenantScoped, owned DATA-plane types
@@ -304,7 +381,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             return {
                 typeKey: reg.typeKey,
                 label: reg.typeKey,
-                actions: (0, guard_1.actionsFor)(reg.typeKey),
+                actions: actionsByType(reg.typeKey) ?? [],
                 fields: reg.fields.map((f) => ({ key: f.key, type: f.type })),
             };
         });
@@ -329,7 +406,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // and the writer rejects "type 'note' is not registered — cannot share." (Live-acceptance fix.)
         const shareTypeInfoByKey = new Map();
         for (const input of [...objects_js_1.identityObjects, ...extraObjects]) {
-            const reg = typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
+            // R1 / KI #1 (spec v2 §5.B): resolve `FRAMEWORK_SCHEMA` tokens to the resolved names before
+            // the schema reaches `RecordShareWriter` SQL; an unresolvable token throws (fail closed).
+            const reg = (0, engine_1.resolveObjectTypeSchema)(typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input, schemas);
             const owner = (0, engine_1.ownerColumn)(reg);
             const pk = reg.primaryKey.kind === 'uuid' ? (0, engine_1.uuidPkColumn)(reg.primaryKey) : null;
             // Only OWNED types with a uuid PK + an owner column are shareable; others are omitted (the
@@ -349,10 +428,11 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         const shareTypeResolver = {
             resolve: (typeKey) => shareTypeInfoByKey.get(typeKey),
         };
-        const shareAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log
+        const shareAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const recordShareWriter = new guard_1.RecordShareWriter({
             db: authzPool,
             types: shareTypeResolver,
+            schema: schemas.authz,
             audit: {
                 record: async (event) => {
                     try {
@@ -373,18 +453,18 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 },
             },
         });
-        const shareService = new share_service_js_1.ShareService(recordShareWriter, auditLabels);
+        const shareService = new share_service_js_1.ShareService(recordShareWriter, auditLabels, actionsByType);
         // ── SERVICE ACCOUNTS + API KEYS (ADR-0033, Phase 2) ──────────────────────────────────────
         // The machine-identity admin surface: create/scope service accounts + issue/rotate/revoke
         // their `ask_…` API keys. Self-wired here over the SAME shared authzPool (which reaches BOTH
         // shield_app.service_account — the accounts — AND shield_authz.service_account_key — the hashed
         // keys). The guard's MariaDbApiKeyStore + Argon2idPasswordHasher back the credential lifecycle;
         // the service enforces own-tenant + the ADR-0029 ceiling (scope ⊆ mine, roles ⊆ mine).
-        const serviceAccountStore = new service_account_store_js_1.ServiceAccountStore(authzPool);
-        const serviceAccountKeyStore = new guard_1.MariaDbApiKeyStore(authzPool);
+        const serviceAccountStore = new service_account_store_js_1.ServiceAccountStore(authzPool, schemas);
+        const serviceAccountKeyStore = new guard_1.MariaDbApiKeyStore(authzPool, schemas);
         const serviceAccountHasher = new guard_1.Argon2idPasswordHasher();
         // Best-effort audit → the SAME shield_audit sink pattern (a sink throw never fails the op).
-        const serviceAccountAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const serviceAccountAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const serviceAccountAudit = {
             record: async (event) => {
                 try {
@@ -406,18 +486,25 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // shield_app.users lookup the audit actor filter uses (inverted). Unknown → null (view falls
         // back to no name, never an id).
         const resolveActorName = async (id) => {
-            const rows = (await authzPool.query('SELECT u_username AS name FROM `shield_app`.`users` WHERE u_uuid = ? LIMIT 1', [id]));
+            const rows = (await authzPool.query(`SELECT u_username AS name FROM \`${schemas.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [id]));
             return rows[0]?.name ?? null;
         };
         const serviceAccountService = new service_account_service_js_1.ServiceAccountService(serviceAccountStore, serviceAccountKeyStore, serviceAccountHasher, serviceAccountAudit, resolveActorName, 
         // The ceiling's roles: in-effect postings (the same source as gate 5 and GrantCeiling).
-        (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId));
+        (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId, schemas));
         // NOTE: the machine AUTH path (the `ServiceAuthenticator` behind `SHIELD_SERVICE_AUTHENTICATOR`)
         // is provided by the guard's own AuthModule (under `auth: true`), NOT here — a token provided in
         // this later, sibling feature module is invisible to the APP_GUARD in ShieldModule (that DI
         // boundary made an identity-provided authenticator resolve to `undefined` → `ask_…` bearers
         // 401'd). This module owns only the ACCOUNT ADMIN surface (store + service + controller); the
         // guard owns authentication. (ADR-0033.)
+        // Stored files (file-storage SPEC §5 I-K): `file_access` events go to the SAME shield_audit
+        // sink over the shared authzPool. Not best-effort here: FilesService decides (a read event
+        // that cannot be written withholds the bytes).
+        const filesAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
+        const filesAudit = {
+            record: (event) => filesAuditSink.record(event, (sql, params) => authzPool.query(sql, params)),
+        };
         return {
             module: IdentityFeatureModule_1,
             imports: [
@@ -429,10 +516,13 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // snapshot is empty and no bundles reconcile into shield_authz.access_bundle.
                 engine_1.EngineModule.forFeature([], { accessBundles: index_js_1.identityAccessBundles }),
                 // The engine's runtime CRUD pipe + the identity object registrations.
+                // R2: the SAME resolved names, so the engine's registrations (FRAMEWORK_SCHEMA tokens) and
+                // its audit sink cannot land in another namespace than identity's own SQL.
                 engine_1.EngineModule.forRoot({
-                    db: engineDbFromEnv(),
+                    db: engineDb,
                     registrations: [...objects_js_1.identityObjects],
                     listScope,
+                    schemas,
                 }),
                 // NestJS DiscoveryService/MetadataScanner — the boot bootstrap provider reflects the
                 // live controllers through this to build the OperationInventory.
@@ -469,6 +559,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Service accounts (ADR-0033) — `service-accounts/*` collides with nothing; its static
                 // sub-paths (/keys, /keys/rotate, /keys/revoke) sit under `:id` and are method-distinct.
                 service_account_controller_js_1.ServiceAccountController,
+                // Stored-file download (file-storage SPEC §3) — `files/:uuid` collides with nothing.
+                // Gated on `stored_file:read`; answers 501 when no object store is bound. Appended last.
+                files_controller_js_1.FilesController,
             ],
             providers: [
                 company_service_js_1.CompanyService,
@@ -483,8 +576,11 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // (collision refusal + login-hint follow in one transaction), over the shared authz pool.
                 {
                     provide: email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER,
-                    useValue: new guard_1.MariaDbEmailAddressChanger(authzPool),
+                    useValue: new guard_1.MariaDbEmailAddressChanger(authzPool, Date.now, schemas),
                 },
+                // The same resolved names for identity services Nest constructs (UserService's
+                // email-change audit sink), never a second env read.
+                { provide: framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS, useValue: schemas },
                 // ADR-0035 (GAPS #6): attach the guard's Redis permission-version cache to the ONE shared
                 // bumper, so every committed bump (postings, grants, hierarchy) is published to Redis,
                 // where gate 5 reads it. Provided by the auth surface under `auth: true` (through the
@@ -506,6 +602,27 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                     useFactory: assertRequestPathUsesIdentityAuthorization,
                     inject: [{ token: guard_1.SHIELD_DECISION_AUTHORITY, optional: true }],
                 },
+                // configurable-framework-db (R2): fail the boot unless guard's FRAMEWORK_SCHEMAS equal the
+                // names this module resolved (and gave the engine, the sinks and every store).
+                {
+                    provide: IDENTITY_FRAMEWORK_SCHEMAS_CHECK,
+                    useFactory: (guardSchemas) => assertFrameworkSchemasAgree(schemas, guardSchemas),
+                    inject: [{ token: guard_1.FRAMEWORK_SCHEMAS, optional: true }],
+                },
+                // QA P2-5: and guard's runtime database must be the one identity connects to.
+                {
+                    provide: IDENTITY_FRAMEWORK_DATABASE_CHECK,
+                    useFactory: (guardConfig) => assertFrameworkDatabaseAgrees(engineDb.database, guardConfig),
+                    inject: [{ token: guard_1.APP_CONFIG, optional: true }],
+                },
+                // configurable-framework-db spec 5.D: the identity migrations are in the ledger, checked
+                // once at application bootstrap over the shared runtime pool (production fails, dev warns).
+                // Guard + identity ids; one ledger read shared with AuthModule's check (guard's registry).
+                {
+                    provide: migration_ledger_check_js_1.IDENTITY_MIGRATION_LEDGER_CHECK,
+                    useFactory: (registry) => (0, migration_ledger_check_js_1.identityMigrationLedgerCheck)(authzPool, schemas, process.env, registry ?? null),
+                    inject: [{ token: guard_1.SHIELD_MIGRATION_LEDGER_REGISTRY, optional: true }],
+                },
                 {
                     provide: IDENTITY_VERSION_PUBLISHER_LINK,
                     useFactory: (cache) => {
@@ -541,16 +658,18 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // enforcement guard can authenticate `ask_…` bearers out-of-the-box. Both useValue.
                 { provide: service_account_service_js_1.ServiceAccountService, useValue: serviceAccountService },
                 // The mutating half of auto-catalog: a single CatalogReconcileJob (post-boot pass +
-                // cron), over the shared pool + the identity registry.
+                // cron), over the shared pool + the ONE record-authorization registry (identity objects +
+                // `extraObjects`, KI #70): the catalog holds exactly the keys decide() and the grant
+                // ceiling know, so a consumer type's keys are grantable and its rows are not orphaned.
                 {
                     provide: catalog_reconcile_job_js_1.CatalogReconcileJob,
-                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, identityRegistry),
+                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, recordAuthorization.registry, schemas),
                 },
                 // The bundle half: reconciles the merged AccessBundleSpec[] (ENGINE_ALL_ACCESS_BUNDLES,
                 // reflected by the engine from identityAccessBundles) into shield_authz.access_bundle.
                 {
                     provide: access_bundle_reconcile_job_js_1.AccessBundleReconcileJob,
-                    useFactory: (bundles) => new access_bundle_reconcile_job_js_1.AccessBundleReconcileJob(authzPool, bundles),
+                    useFactory: (bundles) => new access_bundle_reconcile_job_js_1.AccessBundleReconcileJob(authzPool, bundles, schemas),
                     inject: [engine_1.ENGINE_ALL_ACCESS_BUNDLES],
                 },
                 // Scope closure reconciler + node move/delete maintenance (Task 1.2), built at forRoot()
@@ -560,10 +679,18 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // Boot: read-only verifyGatable (fail-closed). Post-boot: kicks the jobs once (catalog
                 // THEN bundles, THEN the scope-closure reconcile) + schedules them (DISABLE_ALL_CRONS-
                 // gated). Injects DiscoveryService/MetadataScanner/Reflector (from DiscoveryModule
-                // above), the jobs, the ScopeClosureService, and ENGINE_ALL_REGISTRATIONS.
+                // above), the jobs, the ScopeClosureService, ENGINE_ALL_REGISTRATIONS and the record
+                // authorization (whose registry is the verify key universe, KI #70).
                 catalog_bootstrap_provider_js_1.CatalogBootstrapProvider,
+                // Stored files (file-storage Phase 5): the request-principal RecordsService + the guard's
+                // object store (`null`/absent ⇒ every method answers 501) + the file_access audit bridge.
+                {
+                    provide: files_service_js_1.FilesService,
+                    useFactory: (records, store) => new files_service_js_1.FilesService(records, store ?? null, filesAudit),
+                    inject: [engine_1.RecordsService, { token: guard_1.SHIELD_OBJECT_STORE, optional: true }],
+                },
             ],
-            exports: [company_service_js_1.CompanyService, role_service_js_1.RoleService, user_service_js_1.UserService],
+            exports: [company_service_js_1.CompanyService, role_service_js_1.RoleService, user_service_js_1.UserService, files_service_js_1.FilesService],
         };
     }
 };

package/dist/features/membership/membership-checker.d.ts

@@ -30,9 +30,15 @@
  * a switch. All SQL values are `?`-bound (never interpolated).
  */
 import type { Pool } from 'mariadb';
+import { type IdentitySchemaNames } from '../../schema.js';
 export declare class DbMembershipChecker {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /**
+     * @param schemas resolved framework names; the membership table lives in `schemas.app`.
+     *   Absent ⇒ resolved from the namespace, once, here.
+     */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     /**
      * Does `principalId` hold an ACTIVE membership at `nodeId`? A single existence read —
      * `true` iff a row with `cm_is_active = 1 AND cm_status = 'active'` exists. Throws on a

package/dist/features/membership/membership-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership-checker.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAKpC,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEvC;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWjF"}
+{"version":3,"file":"membership-checker.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,qBAAa,mBAAmB;IAM5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B;;;OAGG;gBAEgB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAG3E;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWjF"}

package/dist/features/membership/membership-checker.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbMembershipChecker = void 0;
-/** Schema the membership table lives in (the app schema). */
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 class DbMembershipChecker {
     pool;
-    constructor(pool) {
+    schemas;
+    /**
+     * @param schemas resolved framework names; the membership table lives in `schemas.app`.
+     *   Absent ⇒ resolved from the namespace, once, here.
+     */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     /**
      * Does `principalId` hold an ACTIVE membership at `nodeId`? A single existence read —
@@ -15,7 +20,7 @@ class DbMembershipChecker {
      */
     async hasActiveMembership(principalId, nodeId) {
         const rows = (await this.pool.query(`SELECT 1 AS ok
-         FROM \`${APP}\`.\`company_membership\`
+         FROM \`${this.schemas.app}\`.\`company_membership\`
         WHERE cm_user_uuid = ? AND cm_company_uuid = ?
           AND cm_is_active = 1 AND cm_status = 'active'
         LIMIT 1`, [principalId, nodeId]));

package/dist/features/migration-ledger-check.d.ts

@@ -0,0 +1,15 @@
+import type { FrameworkSchemas } from '@astram/core';
+import { FrameworkMigrationLedgerCheck, type MigrationLedgerRegistry } from '@astram/guard';
+/** DI token of identity's ledger check (guard's `AuthModule` uses its own token). */
+export declare const IDENTITY_MIGRATION_LEDGER_CHECK: unique symbol;
+/**
+ * configurable-framework-db spec 5.D: the boot hook that checks every guard AND identity
+ * migration is in the `@astram/migrate` ledger (identity reads guard's authz tables; guard never
+ * imports identity, ADR-0003). Runs once at application bootstrap, never per request (Shield
+ * #12). With guard's per-app `registry`, it shares one ledger read with `AuthModule`'s check.
+ * Outside `NODE_ENV` development/test a missing id, ledger table or unreadable ledger fails boot.
+ */
+export declare function identityMigrationLedgerCheck(pool: {
+    query(sql: string): Promise<unknown>;
+}, schemas: FrameworkSchemas, env?: NodeJS.ProcessEnv, registry?: MigrationLedgerRegistry | null): FrameworkMigrationLedgerCheck;
+//# sourceMappingURL=migration-ledger-check.d.ts.map

package/dist/features/migration-ledger-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-ledger-check.d.ts","sourceRoot":"","sources":["../../src/features/migration-ledger-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,6BAA6B,EAG7B,KAAK,uBAAuB,EAC7B,MAAM,eAAe,CAAC;AAGvB,qFAAqF;AACrF,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE;IAAE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EAC9C,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,uBAAuB,GAAG,IAAW,GAC9C,6BAA6B,CAY/B"}

package/dist/features/migration-ledger-check.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_MIGRATION_LEDGER_CHECK = void 0;
+exports.identityMigrationLedgerCheck = identityMigrationLedgerCheck;
+const common_1 = require("@nestjs/common");
+const guard_1 = require("@astram/guard");
+const migrations_dir_js_1 = require("../migrations-dir.js");
+/** DI token of identity's ledger check (guard's `AuthModule` uses its own token). */
+exports.IDENTITY_MIGRATION_LEDGER_CHECK = Symbol('IDENTITY_MIGRATION_LEDGER_CHECK');
+/**
+ * configurable-framework-db spec 5.D: the boot hook that checks every guard AND identity
+ * migration is in the `@astram/migrate` ledger (identity reads guard's authz tables; guard never
+ * imports identity, ADR-0003). Runs once at application bootstrap, never per request (Shield
+ * #12). With guard's per-app `registry`, it shares one ledger read with `AuthModule`'s check.
+ * Outside `NODE_ENV` development/test a missing id, ledger table or unreadable ledger fails boot.
+ */
+function identityMigrationLedgerCheck(pool, schemas, env = process.env, registry = null) {
+    return new guard_1.FrameworkMigrationLedgerCheck({
+        query: (sql) => pool.query(sql),
+        // Same candidates as guard's check (G-007 QA P1), so the registry shares one probe + read.
+        ...(0, guard_1.resolveMigrationLedgerCheck)(env, schemas),
+        migrationsDir: [guard_1.guardMigrationsDir, migrations_dir_js_1.identityMigrationsDir],
+        nodeEnv: env.NODE_ENV,
+        logger: new common_1.Logger('IdentityFeatureModule'),
+    }, registry);
+}

package/dist/features/policy/policy.service.d.ts

@@ -91,7 +91,8 @@ export interface PolicyServiceDeps {
     /**
      * The authorable-type field/action metadata (built in the module from the reflected object
      * types). Drives `schema()` — the guided builder's field + operator dropdowns. A type absent
-     * here is NOT authorable via the builder (schema → NotFound).
+     * here is NOT authorable via the builder (schema → NotFound), and `author` rejects any non-`'*'`
+     * action for it (declared-action check, fail closed — SPEC v2 §5G).
      */
     readonly schemaSource?: readonly TypeSchemaSource[];
     readonly now?: () => number;

package/dist/features/policy/policy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.service.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,MAAM,EACN,SAAS,EACV,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,wFAAwF;AACxF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAA2B;CAI/C;AAED,kGAAkG;AAClG,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAoC;CAIxD;AAED,mGAAmG;AACnG,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAsB;CAI1C;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5E,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E;AAED,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;AAE5F,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,wFAAwF;IACxF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC1D;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC/C;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,IAAI,GACJ,KAAK,GACL,KAAK,GACL,UAAU,GACV,cAAc,GACd,SAAS,GACT,aAAa,CAAC;AAElB,+FAA+F;AAC/F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;CACtC;AAUD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,kBAAkB,EAAE,CAgB7F;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,GAAG,eAAe,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsC;IACnE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;gBAEzD,IAAI,EAAE,iBAAiB;IAanC;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB;IAmBzC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBrE,+FAA+F;IACzF,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIzE;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhE"}
+{"version":3,"file":"policy.service.d.ts","sourceRoot":"","sources":["../../../src/features/policy/policy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,MAAM,EACN,SAAS,EACV,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,wFAAwF;AACxF,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAA2B;CAI/C;AAED,kGAAkG;AAClG,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAoC;CAIxD;AAED,mGAAmG;AACnG,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAsB;CAI1C;AAED,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5E,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5E;AAED,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;AAE5F,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,wFAAwF;IACxF,QAAQ,CAAC,gBAAgB,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC1D;AAED,wFAAwF;AACxF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC/C;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,IAAI,GACJ,KAAK,GACL,KAAK,GACL,UAAU,GACV,cAAc,GACd,SAAS,GACT,aAAa,CAAC;AAElB,+FAA+F;AAC/F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;CACtC;AAUD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,kBAAkB,EAAE,CAgB7F;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,GAAG,eAAe,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsC;IACnE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;gBAEzD,IAAI,EAAE,iBAAiB;IAanC;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB;IAmBzC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IAqCrE,+FAA+F;IACzF,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAIzE;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMhE"}

package/dist/features/policy/policy.service.js

@@ -106,6 +106,21 @@ class PolicyService {
      * reasons to typed errors; a transient throw PROPAGATES (→ 503).
      */
     async author(actor, policy) {
+        // Declared-action check (SPEC v2 §5G): before core `makeAuthorPolicy`, so an undeclared
+        // action saves nothing and audits nothing. `'*'` stays allowed. Fail closed: with no schema
+        // source (or no entry for the type) every non-'*' action is undeclared.
+        // SPEC v3 §11 rule 6: a record rule on `create` is rejected even when `create` is declared.
+        // Record rules are evaluated per record (core gate 6) and the create gate is type level, so
+        // such a rule would never take effect. `'*'` stays allowed (it applies to the other actions).
+        if (policy.action === 'create') {
+            throw new InvalidPolicyError("Record rules are evaluated per record and never apply at create; a rule on action 'create' would never take effect. Use the object-type create grant instead.");
+        }
+        if (policy.action !== '*') {
+            const declared = this.schemaByType.get(policy.typeKey)?.actions;
+            if (declared === undefined || !declared.includes(policy.action)) {
+                throw new InvalidPolicyError(`Action '${policy.action}' is not declared on type '${policy.typeKey}'.`);
+            }
+        }
         const mutation = {
             kind: 'author_policy',
             admin: actor,

package/dist/features/scope/scope-closure.service.d.ts

@@ -1,4 +1,5 @@
 import { type ScopeEdge } from '@astram/guard';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The minimal query surface a transaction connection must expose. A `mariadb`
  * `PoolConnection` satisfies it structurally; kept framework-agnostic (mirrors `Queryable`
@@ -30,7 +31,13 @@ export interface ScopeVersionBumper {
 export declare class ScopeClosureService {
     private readonly pool;
     private readonly bumper;
-    constructor(pool: ScopePool, bumper: ScopeVersionBumper);
+    private readonly schemas;
+    /**
+     * @param schemas resolved framework names: the node tree (`companies`) lives in `schemas.app`,
+     *   the closure table in `schemas.authz` (ADR-0011 / Task 1.1). Absent ⇒ resolved from the
+     *   namespace, once, here.
+     */
+    constructor(pool: ScopePool, bumper: ScopeVersionBumper, schemas?: IdentitySchemaNames);
     /**
      * Rebuild `scope_closure` from the current `companies.c_parent_uuid` edges. Idempotent
      * (delete-then-insert in a tx → a second run over the same tree writes the identical set).