@astram/identity 0.11.0 → 0.12.0

package/dist/cross-tenant-grant.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant.object.d.ts","sourceRoot":"","sources":["../src/cross-tenant-grant.object.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBASa,gBAAgB;IAE3B,IAAI,EAAG,MAAM,CAAC;IAGd,gBAAgB,EAAG,MAAM,CAAC;IAG1B,iBAAiB,EAAG,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"cross-tenant-grant.object.d.ts","sourceRoot":"","sources":["../src/cross-tenant-grant.object.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBASa,gBAAgB;IAE3B,IAAI,EAAG,MAAM,CAAC;IAGd,gBAAgB,EAAG,MAAM,CAAC;IAG1B,iBAAiB,EAAG,MAAM,CAAC;CAC5B"}

package/dist/cross-tenant-grant.object.js

@@ -12,8 +12,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CrossTenantGrant = void 0;
 const engine_1 = require("@astram/engine");
 const guard_1 = require("@astram/guard");
-/** The physical schema `cross_tenant_grant` lives in (migration 1710000000011). */
-const SCHEMA = 'shield_authz';
+/** The authz-database token `cross_tenant_grant` lives in (migration 1710000000011); the engine
+ *  resolves it at registration (ADR-0037). */
+const SCHEMA = engine_1.FRAMEWORK_SCHEMA.authz;
 /**
  * `cross_tenant_grant` — an AUTHORITY-ONLY @ObjectType, never CRUD'd through the
  * RecordEngine pipe. Its sole purpose is to give `cross_tenant_grant` an entry in the

package/dist/features/audit/directory-label-resolver.d.ts

@@ -1,5 +1,6 @@
 import type { LabelResolver, LabelKind } from '@astram/core';
 import type { AuditQueryable } from './mariadb-audit-reader.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The id->human-label chokepoint (ADR-0012, design §2.2). A deleted/unknown
  * entity resolves to a FALLBACK label (never the id); a directory OUTAGE throws
@@ -7,7 +8,9 @@ import type { AuditQueryable } from './mariadb-audit-reader.js';
  */
 export declare class DirectoryLabelResolver implements LabelResolver {
     private readonly db;
-    constructor(db: AuditQueryable);
+    private readonly schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(db: AuditQueryable, schemas?: IdentitySchemaNames);
     resolve(kind: LabelKind, id: string, _tenantId?: string): Promise<string>;
     private fallback;
 }

package/dist/features/audit/directory-label-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-label-resolver.d.ts","sourceRoot":"","sources":["../../../src/features/audit/directory-label-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAIhE;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,cAAc;IAEzC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8B/E,OAAO,CAAC,QAAQ;CAMjB"}
+{"version":3,"file":"directory-label-resolver.d.ts","sourceRoot":"","sources":["../../../src/features/audit/directory-label-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,aAAa;IAGxD,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,EAAE,EAAE,cAAc,EAClB,OAAO,GAAE,mBAA+C;IAGrE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8B/E,OAAO,CAAC,QAAQ;CAMjB"}

package/dist/features/audit/directory-label-resolver.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DirectoryLabelResolver = void 0;
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /**
  * The id->human-label chokepoint (ADR-0012, design §2.2). A deleted/unknown
  * entity resolves to a FALLBACK label (never the id); a directory OUTAGE throws
@@ -9,23 +9,26 @@ const APP = 'shield_app';
  */
 class DirectoryLabelResolver {
     db;
-    constructor(db) {
+    schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(db, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.db = db;
+        this.schemas = schemas;
     }
     async resolve(kind, id, _tenantId) {
         if (!id)
             return this.fallback(kind);
         switch (kind) {
             case 'principal': {
-                const rows = (await this.db.query(`SELECT u_username AS label FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [id]));
+                const rows = (await this.db.query(`SELECT u_username AS label FROM \`${this.schemas.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [id]));
                 return rows[0]?.label ?? this.fallback(kind);
             }
             case 'tenant': {
-                const rows = (await this.db.query(`SELECT c_name AS label FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [id]));
+                const rows = (await this.db.query(`SELECT c_name AS label FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [id]));
                 return rows[0]?.label ?? this.fallback(kind);
             }
             case 'role': {
-                const rows = (await this.db.query(`SELECT r_name AS label FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [id]));
+                const rows = (await this.db.query(`SELECT r_name AS label FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [id]));
                 return rows[0]?.label ?? this.fallback(kind);
             }
             default:

package/dist/features/audit/mariadb-audit-reader.d.ts

@@ -1,4 +1,4 @@
-import type { AuditReader, AuditEvent } from '@astram/core';
+import { type AuditReader, type AuditEvent } from '@astram/core';
 export interface AuditQueryable {
     query(sql: string, params?: readonly unknown[]): Promise<unknown>;
 }
@@ -11,6 +11,10 @@ export interface AuditQueryable {
 export declare class MariaDbAuditReader implements AuditReader {
     private readonly db;
     private readonly schema;
+    /**
+     * @param opts.schema the audit database. Absent ⇒ the audit name resolved from
+     *   `SHIELD_DB_NAMESPACE` here, once at construction (unset ⇒ the default audit database).
+     */
     constructor(db: AuditQueryable, opts?: {
         schema?: string;
     });

package/dist/features/audit/mariadb-audit-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAgBD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,OAAO,CAAC,OAAO;CA+BhB"}
+{"version":3,"file":"mariadb-audit-reader.d.ts","sourceRoot":"","sources":["../../../src/features/audit/mariadb-audit-reader.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAeD;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC;;;OAGG;gBACS,EAAE,EAAE,cAAc,EAAE,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAQxD,IAAI,CAAC,KAAK,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;IAgClC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1F;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,OAAO,CAAC,OAAO;CA+BhB"}

package/dist/features/audit/mariadb-audit-reader.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbAuditReader = void 0;
-const DEFAULT_SCHEMA = 'shield_audit';
+// mariadb-audit-reader.ts
+const core_1 = require("@astram/core");
 const ALL_TENANTS = '*';
 /**
  * The astram3 AuditReader over `shield_audit.audit_log` (design §2.2). Newest-first,
@@ -12,9 +13,16 @@ const ALL_TENANTS = '*';
 class MariaDbAuditReader {
     db;
     schema;
+    /**
+     * @param opts.schema the audit database. Absent ⇒ the audit name resolved from
+     *   `SHIELD_DB_NAMESPACE` here, once at construction (unset ⇒ the default audit database).
+     */
     constructor(db, opts = {}) {
         this.db = db;
-        this.schema = opts.schema ?? DEFAULT_SCHEMA;
+        this.schema =
+            opts.schema !== undefined
+                ? (0, core_1.assertSchemaName)(opts.schema, 'MariaDbAuditReader opts.schema')
+                : (0, core_1.resolveFrameworkSchemas)(process.env).audit;
     }
     async read(query) {
         const { where, params } = this.buildScopeClause(query);

package/dist/features/authz/access-bundle-reconcile.job.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { AccessBundleSpec } from '@astram/engine';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** The outcome of one reconcile pass. */
 export interface AccessBundleReconcileReport {
     readonly added: number;
@@ -24,9 +25,11 @@ export interface AccessBundleReconcileReport {
 export declare class AccessBundleReconcileJob {
     private readonly pool;
     private readonly bundles;
+    private readonly schemas;
     private readonly store;
     private running;
-    constructor(pool: Pool, bundles: readonly AccessBundleSpec[]);
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool: Pool, bundles: readonly AccessBundleSpec[], schemas?: IdentitySchemaNames);
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     runOnce(_nowIso: string): Promise<AccessBundleReconcileReport>;
     /** The set of permission keys that are ACTIVE in the live catalog. */

package/dist/features/authz/access-bundle-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAKvD,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAKjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAGL,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE;IAKvD,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}
+{"version":3,"file":"access-bundle-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,yCAAyC;AACzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,wBAAwB;IAMjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,OAAO,CAAS;IAExB,4FAA4F;gBAEzE,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,OAAO,GAAE,mBAA+C;IAK3E,6EAA6E;IACvE,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAqDpE,sEAAsE;YACxD,wBAAwB;CAMvC"}

package/dist/features/authz/access-bundle-reconcile.job.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccessBundleReconcileJob = void 0;
 const access_bundle_store_js_1 = require("./access-bundle-store.js");
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /**
  * Reconciles the developer-declared `AccessBundleSpec[]` (from
  * `ENGINE_ALL_ACCESS_BUNDLES`) into `shield_authz.access_bundle` (+ `_permission`),
@@ -20,12 +20,15 @@ const AUTHZ = 'shield_authz';
 class AccessBundleReconcileJob {
     pool;
     bundles;
+    schemas;
     store;
     running = false;
-    constructor(pool, bundles) {
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool, bundles, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.bundles = bundles;
-        this.store = new access_bundle_store_js_1.AccessBundleStore(pool);
+        this.schemas = schemas;
+        this.store = new access_bundle_store_js_1.AccessBundleStore(pool, schemas);
     }
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     async runOnce(_nowIso) {
@@ -77,7 +80,7 @@ class AccessBundleReconcileJob {
     }
     /** The set of permission keys that are ACTIVE in the live catalog. */
     async loadActivePermissionKeys() {
-        const rows = (await this.pool.query(`SELECT perm_key FROM \`${AUTHZ}\`.\`permission\` WHERE perm_status = 'active'`));
+        const rows = (await this.pool.query(`SELECT perm_key FROM \`${this.schemas.authz}\`.\`permission\` WHERE perm_status = 'active'`));
         return new Set(rows.map((r) => r.perm_key));
     }
 }

package/dist/features/authz/access-bundle-store.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { AccessBundleSpec } from '@astram/engine';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** A row from `shield_authz.access_bundle`, resolved to camelCase. */
 export interface AccessBundleRow {
     readonly uuid: string;
@@ -18,7 +19,9 @@ export interface AccessBundleRow {
  */
 export declare class AccessBundleStore {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     /** All bundles (active + orphaned), for the reconciler's declared-vs-present diff. */
     listBundles(): Promise<AccessBundleRow[]>;
     /** Resolve a bundle's UUID by its business key. `null` when absent. */

package/dist/features/authz/access-bundle-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-bundle-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIvD,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEvC,sFAAsF;IAChF,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB/C,uEAAuE;IACjE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAuBnF;;;OAGG;IACG,yBAAyB,IAAI,OAAO,CACxC,KAAK,CAAC;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC,CACH;IA4CD;;;;;;OAMG;IACG,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;IAuCzF;;;OAGG;IACG,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BvF;;;;OAIG;IACG,YAAY,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUhG"}
+{"version":3,"file":"access-bundle-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/access-bundle-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;CACxC;AAED;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAG1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAG3E,sFAAsF;IAChF,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAsB/C,uEAAuE;IACjE,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAuBnF;;;OAGG;IACG,yBAAyB,IAAI,OAAO,CACxC,KAAK,CAAC;QACJ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,CAAC,CACH;IA4CD;;;;;;OAMG;IACG,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;IAuCzF;;;OAGG;IACG,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BvF;;;;OAIG;IACG,YAAY,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAUhG"}

package/dist/features/authz/access-bundle-store.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccessBundleStore = void 0;
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /**
  * Raw-SQL (parameterized, NO ORM) CRUD over `shield_authz.access_bundle` +
  * `access_bundle_permission`, mirroring `mariadb-catalog-store.ts`.
@@ -11,13 +11,16 @@ const AUTHZ = 'shield_authz';
  */
 class AccessBundleStore {
     pool;
-    constructor(pool) {
+    schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     /** All bundles (active + orphaned), for the reconciler's declared-vs-present diff. */
     async listBundles() {
         const rows = (await this.pool.query(`SELECT ab_uuid, ab_key, ab_module, ab_label, ab_description, ab_status
-         FROM \`${AUTHZ}\`.\`access_bundle\``));
+         FROM \`${this.schemas.authz}\`.\`access_bundle\``));
         return rows.map((r) => ({
             uuid: r.ab_uuid,
             key: r.ab_key,
@@ -29,7 +32,7 @@ class AccessBundleStore {
     }
     /** Resolve a bundle's UUID by its business key. `null` when absent. */
     async resolveBundleUuid(module, key) {
-        const rows = (await this.pool.query(`SELECT ab_uuid FROM \`${AUTHZ}\`.\`access_bundle\`
+        const rows = (await this.pool.query(`SELECT ab_uuid FROM \`${this.schemas.authz}\`.\`access_bundle\`
         WHERE ab_module = ? AND ab_key = ? LIMIT 1`, [module, key]));
         return rows[0]?.ab_uuid ?? null;
     }
@@ -42,14 +45,14 @@ class AccessBundleStore {
      */
     async resolveActiveBundleKeys(bundleKey) {
         const rows = (await this.pool.query(`SELECT abp.abp_perm_key AS perm_key
-         FROM \`${AUTHZ}\`.\`access_bundle\` ab
-         JOIN \`${AUTHZ}\`.\`access_bundle_permission\` abp
+         FROM \`${this.schemas.authz}\`.\`access_bundle\` ab
+         JOIN \`${this.schemas.authz}\`.\`access_bundle_permission\` abp
            ON abp.abp_bundle_uuid = ab.ab_uuid
         WHERE ab.ab_key = ? AND ab.ab_status = 'active'
         ORDER BY abp.abp_perm_key`, [bundleKey]));
         if (rows.length === 0) {
             // Distinguish "no such active bundle" from "active bundle with zero keys".
-            const exists = (await this.pool.query(`SELECT 1 FROM \`${AUTHZ}\`.\`access_bundle\`
+            const exists = (await this.pool.query(`SELECT 1 FROM \`${this.schemas.authz}\`.\`access_bundle\`
           WHERE ab_key = ? AND ab_status = 'active' LIMIT 1`, [bundleKey]));
             if (exists.length === 0)
                 return null;
@@ -64,8 +67,8 @@ class AccessBundleStore {
     async listActiveBundlesWithKeys() {
         const rows = (await this.pool.query(`SELECT ab.ab_key AS bundle_key, ab.ab_module AS module, ab.ab_label AS label,
               ab.ab_description AS description, abp.abp_perm_key AS perm_key
-         FROM \`${AUTHZ}\`.\`access_bundle\` ab
-         LEFT JOIN \`${AUTHZ}\`.\`access_bundle_permission\` abp
+         FROM \`${this.schemas.authz}\`.\`access_bundle\` ab
+         LEFT JOIN \`${this.schemas.authz}\`.\`access_bundle_permission\` abp
            ON abp.abp_bundle_uuid = ab.ab_uuid
         WHERE ab.ab_status = 'active'
         ORDER BY ab.ab_module, ab.ab_key, abp.abp_perm_key`));
@@ -97,7 +100,7 @@ class AccessBundleStore {
     async upsertBundle(spec) {
         const description = spec.description ?? null;
         const existing = (await this.pool.query(`SELECT ab_uuid, ab_label, ab_description, ab_status
-         FROM \`${AUTHZ}\`.\`access_bundle\`
+         FROM \`${this.schemas.authz}\`.\`access_bundle\`
         WHERE ab_module = ? AND ab_key = ? LIMIT 1`, [spec.module, spec.key]));
         const cur = existing[0];
         if (cur) {
@@ -106,12 +109,12 @@ class AccessBundleStore {
                 cur.ab_status === 'active';
             if (same)
                 return 'unchanged';
-            await this.pool.query(`UPDATE \`${AUTHZ}\`.\`access_bundle\`
+            await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`access_bundle\`
             SET ab_label = ?, ab_description = ?, ab_status = 'active'
           WHERE ab_uuid = ?`, [spec.label, description, cur.ab_uuid]);
             return 'updated';
         }
-        await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`access_bundle\`
+        await this.pool.query(`INSERT INTO \`${this.schemas.authz}\`.\`access_bundle\`
          (ab_uuid, ab_key, ab_module, ab_label, ab_description, ab_status)
          VALUES (UUID(), ?, ?, ?, ?, 'active')`, [spec.key, spec.module, spec.label, description]);
         return 'inserted';
@@ -121,7 +124,7 @@ class AccessBundleStore {
      * insert the missing ones. Idempotent — a re-sync with the same set is a no-op.
      */
     async syncBundlePermissions(bundleUuid, keys) {
-        const existing = (await this.pool.query(`SELECT abp_perm_key FROM \`${AUTHZ}\`.\`access_bundle_permission\`
+        const existing = (await this.pool.query(`SELECT abp_perm_key FROM \`${this.schemas.authz}\`.\`access_bundle_permission\`
         WHERE abp_bundle_uuid = ?`, [bundleUuid]));
         const have = new Set(existing.map((r) => r.abp_perm_key));
         const want = new Set(keys);
@@ -129,11 +132,11 @@ class AccessBundleStore {
         const toInsert = [...want].filter((k) => !have.has(k));
         if (toDelete.length > 0) {
             const ph = toDelete.map(() => '?').join(', ');
-            await this.pool.query(`DELETE FROM \`${AUTHZ}\`.\`access_bundle_permission\`
+            await this.pool.query(`DELETE FROM \`${this.schemas.authz}\`.\`access_bundle_permission\`
           WHERE abp_bundle_uuid = ? AND abp_perm_key IN (${ph})`, [bundleUuid, ...toDelete]);
         }
         for (const key of toInsert) {
-            await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`access_bundle_permission\`
+            await this.pool.query(`INSERT INTO \`${this.schemas.authz}\`.\`access_bundle_permission\`
            (abp_uuid, abp_bundle_uuid, abp_perm_key)
            VALUES (UUID(), ?, ?)`, [bundleUuid, key]);
         }
@@ -145,7 +148,7 @@ class AccessBundleStore {
      */
     async markOrphaned(modKeysNotDeclared) {
         for (const [module, key] of modKeysNotDeclared) {
-            await this.pool.query(`UPDATE \`${AUTHZ}\`.\`access_bundle\`
+            await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`access_bundle\`
             SET ab_status = 'orphaned'
           WHERE ab_module = ? AND ab_key = ?`, [module, key]);
         }

package/dist/features/authz/catalog-reconcile.job.d.ts

@@ -1,6 +1,7 @@
 import type { Pool } from 'mariadb';
 import { type ReconcileReport } from '@astram/guard';
 import type { ModuleRegistry } from '@astram/core';
+import type { IdentitySchemaNames } from '../../schema.js';
 /**
  * Single-runner wrapper around the framework CatalogReconciler.reconcile (the mutating
  * half). Called once shortly after boot and on a cron. Holds the latest report for
@@ -15,7 +16,8 @@ export declare class CatalogReconcileJob {
     private readonly store;
     private latest;
     private running;
-    constructor(pool: Pool, registry: ModuleRegistry);
+    /** @param schemas resolved framework names for the catalog store (absent ⇒ from the namespace). */
+    constructor(pool: Pool, registry: ModuleRegistry, schemas?: IdentitySchemaNames);
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     runOnce(nowIso: string): Promise<ReconcileReport | null>;
     getLatest(): ReconcileReport | null;

package/dist/features/authz/catalog-reconcile.job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAQ5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAP3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;gBAGtB,IAAI,EAAE,IAAI,EACO,QAAQ,EAAE,cAAc;IAK3C,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAiB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}
+{"version":3,"file":"catalog-reconcile.job.d.ts","sourceRoot":"","sources":["../../../src/features/authz/catalog-reconcile.job.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAS5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAR3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA2B;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,OAAO,CAAS;IAExB,mGAAmG;gBAEjG,IAAI,EAAE,IAAI,EACO,QAAQ,EAAE,cAAc,EACzC,OAAO,CAAC,EAAE,mBAAmB;IAK/B,6EAA6E;IACvE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAiB9D,SAAS,IAAI,eAAe,GAAG,IAAI;CAGpC"}

package/dist/features/authz/catalog-reconcile.job.js

@@ -17,9 +17,10 @@ class CatalogReconcileJob {
     store;
     latest = null;
     running = false;
-    constructor(pool, registry) {
+    /** @param schemas resolved framework names for the catalog store (absent ⇒ from the namespace). */
+    constructor(pool, registry, schemas) {
         this.registry = registry;
-        this.store = new mariadb_catalog_store_js_1.MariaDbCatalogStore(pool);
+        this.store = new mariadb_catalog_store_js_1.MariaDbCatalogStore(pool, schemas);
     }
     /** Idempotent single pass. Guarded so overlapping ticks don't double-run. */
     async runOnce(nowIso) {

package/dist/features/authz/db-permission-facts.adapter.d.ts

@@ -13,6 +13,7 @@
  */
 import type { Pool } from 'mariadb';
 import type { PermissionFactsPort, CoarseGrants, ModuleRegistry } from '@astram/core';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * Expand raw grant strings (exact or wildcard) to the set of EXACT registered keys.
  * Bounded to `allKeys` — a wildcard can never yield a key that isn't registered.
@@ -31,10 +32,11 @@ export declare function expandGrantKeys(rawKeys: string[], allKeys: string[]): s
  * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
  * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
+ * @param schemas the resolved framework names (the tables live in `schemas.app`).
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
-export declare function readRoleIdsForTenant(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<string[]>;
+export declare function readRoleIdsForTenant(pool: Pool, principalId: string, tenantId: string, schemas: IdentitySchemaNames, now?: () => number): Promise<string[]>;
 /**
  * The next instant (epoch-ms, strictly after `now`) at which this USER's in-effect roles in
  * `tenantId` change by themselves — the earliest future `mp_effective_from_ms` (a posting starts)
@@ -42,7 +44,7 @@ export declare function readRoleIdsForTenant(pool: Pool, principalId: string, te
  * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
  * a service account (its roles have no windows). A query failure propagates (fail closed).
  */
-export declare function readNextPostingBoundaryMs(pool: Pool, principalId: string, tenantId: string, now?: () => number): Promise<number | null>;
+export declare function readNextPostingBoundaryMs(pool: Pool, principalId: string, tenantId: string, schemas: IdentitySchemaNames, now?: () => number): Promise<number | null>;
 export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
     private readonly pool;
     private readonly registry;
@@ -52,13 +54,17 @@ export declare class DbPermissionFactsAdapter implements PermissionFactsPort {
      * Injectable so a test can fix the clock relative to a seeded expired/active posting.
      */
     private readonly now;
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    private readonly schemas;
     constructor(pool: Pool, registry: ModuleRegistry, 
     /**
      * Injectable clock (epoch-ms) for the posting effective-window compare. Defaults to
      * `Date.now`. Bound as a `?` integer against the BIGINT `_ms` columns — timezone-immune.
      * Injectable so a test can fix the clock relative to a seeded expired/active posting.
      */
-    now?: () => number);
+    now?: () => number, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas?: IdentitySchemaNames);
     currentPermissionsVersion(_principalId: string, tenantId: string): Promise<number>;
     /**
      * The coarse grants + (ADR-0035) the LIVE role ids they were derived from + the time bound of

package/dist/features/authz/db-permission-facts.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAKtF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA0CD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAPH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAGzC,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxF;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YAuBtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}
+{"version":3,"file":"db-permission-facts.adapter.d.ts","sourceRoot":"","sources":["../../../src/features/authz/db-permission-facts.adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEtF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAIpF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9E;AA2CD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBnB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED,qBAAa,wBAAyB,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;gBATP,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;OAIG;IACc,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAGrE,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAaxF;;;;;;;OAOG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;YA6BtE,WAAW;IASzB;;;OAGG;YACW,WAAW;YAIX,aAAa;CAS5B"}

package/dist/features/authz/db-permission-facts.adapter.js

@@ -5,6 +5,7 @@ exports.expandGrantKeys = expandGrantKeys;
 exports.readRoleIdsForTenant = readRoleIdsForTenant;
 exports.readNextPostingBoundaryMs = readNextPostingBoundaryMs;
 const core_1 = require("@astram/core");
+const schema_js_1 = require("../../schema.js");
 const MODULE_PREFIX = 'identity';
 /**
  * Expand raw grant strings (exact or wildcard) to the set of EXACT registered keys.
@@ -58,8 +59,8 @@ function parseRoleIdsJson(v) {
  * membership path). A DISABLED account returns `[]` (in-scope but no roles → deny everything —
  * defense-in-depth alongside the key's own revoke check).
  */
-async function readServiceAccountRoleIds(pool, principalId, tenantId) {
-    const rows = (await pool.query(`SELECT sa_role_ids, sa_status FROM \`shield_app\`.\`service_account\`
+async function readServiceAccountRoleIds(pool, principalId, tenantId, schemas) {
+    const rows = (await pool.query(`SELECT sa_role_ids, sa_status FROM \`${schemas.app}\`.\`service_account\`
       WHERE sa_id = ? AND sa_tenant_id = ? LIMIT 1`, [principalId, tenantId]));
     const row = rows[0];
     if (row === undefined)
@@ -78,12 +79,13 @@ async function readServiceAccountRoleIds(pool, principalId, tenantId) {
  * window read. Making THIS function kind-aware gives all three callers correct grants uniformly
  * (one definition of "a principal's roles"), preserving the single `decide()` path.
  *
+ * @param schemas the resolved framework names (the tables live in `schemas.app`).
  * @param now injectable clock (epoch-ms), defaults to `Date.now` — bound as a `?`
  *   integer against the BIGINT `mp_effective_*_ms` columns (timezone-immune).
  */
-async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now) {
+async function readRoleIdsForTenant(pool, principalId, tenantId, schemas, now = Date.now) {
     // Service-account path (ADR-0033): its roles live on the account row, not memberships.
-    const saRoles = await readServiceAccountRoleIds(pool, principalId, tenantId);
+    const saRoles = await readServiceAccountRoleIds(pool, principalId, tenantId, schemas);
     if (saRoles !== null)
         return saRoles;
     // Human path: roles from the active membership's in-effect postings — of an ACTIVE account only
@@ -92,9 +94,9 @@ async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now)
     // has a users row).
     const nowMs = now();
     const rows = (await pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
-       FROM \`shield_app\`.\`company_membership\` cm
-       JOIN \`shield_app\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
-       JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+       FROM \`${schemas.app}\`.\`company_membership\` cm
+       JOIN \`${schemas.app}\`.\`users\` u ON u.u_uuid = cm.cm_user_uuid AND u.u_status = 'active'
+       JOIN \`${schemas.app}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
       WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1
         AND (mp.mp_effective_from_ms IS NULL OR mp.mp_effective_from_ms <= ?)
         AND (mp.mp_effective_until_ms IS NULL OR mp.mp_effective_until_ms > ?)`, [principalId, tenantId, nowMs, nowMs]));
@@ -107,7 +109,7 @@ async function readRoleIdsForTenant(pool, principalId, tenantId, now = Date.now)
  * these moments, so cached facts must expire there (ADR-0035). `null` when there is none, and for
  * a service account (its roles have no windows). A query failure propagates (fail closed).
  */
-async function readNextPostingBoundaryMs(pool, principalId, tenantId, now = Date.now) {
+async function readNextPostingBoundaryMs(pool, principalId, tenantId, schemas, now = Date.now) {
     const nowMs = now();
     const rows = (await pool.query(`SELECT MIN(CASE
               WHEN mp.mp_effective_from_ms IS NOT NULL AND mp.mp_effective_from_ms > ?
@@ -115,8 +117,8 @@ async function readNextPostingBoundaryMs(pool, principalId, tenantId, now = Date
               WHEN mp.mp_effective_until_ms IS NOT NULL AND mp.mp_effective_until_ms > ?
                 THEN mp.mp_effective_until_ms
             END) AS next_boundary_ms
-       FROM \`shield_app\`.\`company_membership\` cm
-       JOIN \`shield_app\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+       FROM \`${schemas.app}\`.\`company_membership\` cm
+       JOIN \`${schemas.app}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
       WHERE cm.cm_user_uuid = ? AND cm.cm_company_uuid = ? AND cm.cm_is_active = 1`, [nowMs, nowMs, principalId, tenantId]));
     const raw = rows[0]?.next_boundary_ms;
     if (raw === null || raw === undefined)
@@ -128,20 +130,24 @@ class DbPermissionFactsAdapter {
     pool;
     registry;
     now;
+    schemas;
     constructor(pool, registry, 
     /**
      * Injectable clock (epoch-ms) for the posting effective-window compare. Defaults to
      * `Date.now`. Bound as a `?` integer against the BIGINT `_ms` columns — timezone-immune.
      * Injectable so a test can fix the clock relative to a seeded expired/active posting.
      */
-    now = Date.now) {
+    now = Date.now, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.registry = registry;
         this.now = now;
+        this.schemas = schemas;
     }
     async currentPermissionsVersion(_principalId, tenantId) {
         try {
-            const rows = (await this.pool.query(`SELECT apv_version FROM \`shield_authz\`.\`authz_permission_version\`
+            const rows = (await this.pool.query(`SELECT apv_version FROM \`${this.schemas.authz}\`.\`authz_permission_version\`
           WHERE apv_tenant_uuid = ? LIMIT 1`, [tenantId]));
             return rows.length > 0 ? Number(rows[0]?.apv_version) : 0;
         }
@@ -166,7 +172,7 @@ class DbPermissionFactsAdapter {
             version = await this.readVersion(tenantId);
             roleIds = await this.readRoleIds(principalId, tenantId);
             rawKeys = roleIds.length === 0 ? [] : await this.readGrantKeys(roleIds);
-            validUntilMs = await readNextPostingBoundaryMs(this.pool, principalId, tenantId, this.now);
+            validUntilMs = await readNextPostingBoundaryMs(this.pool, principalId, tenantId, this.schemas, this.now);
         }
         catch (cause) {
             if (cause instanceof core_1.AuthorizationUnavailableError)
@@ -182,7 +188,7 @@ class DbPermissionFactsAdapter {
         };
     }
     async readVersion(tenantId) {
-        const rows = (await this.pool.query(`SELECT apv_version FROM \`shield_authz\`.\`authz_permission_version\`
+        const rows = (await this.pool.query(`SELECT apv_version FROM \`${this.schemas.authz}\`.\`authz_permission_version\`
         WHERE apv_tenant_uuid = ? LIMIT 1`, [tenantId]));
         return rows.length > 0 ? Number(rows[0]?.apv_version) : 0;
     }
@@ -191,11 +197,11 @@ class DbPermissionFactsAdapter {
      * tenant — delegates to the shared {@link readRoleIdsForTenant} (single source).
      */
     async readRoleIds(principalId, tenantId) {
-        return readRoleIdsForTenant(this.pool, principalId, tenantId, this.now);
+        return readRoleIdsForTenant(this.pool, principalId, tenantId, this.schemas, this.now);
     }
     async readGrantKeys(roleIds) {
         const placeholders = roleIds.map(() => '?').join(', ');
-        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`shield_authz\`.\`role_permission\`
+        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\`
         WHERE rp_role_uuid IN (${placeholders})`, roleIds));
         return rows.map((r) => r.rp_perm_key);
     }

package/dist/features/authz/grant-admin.service.d.ts

@@ -4,6 +4,7 @@ import type { AuditPort } from '@astram/engine';
 import { PermissionVersionBumper } from './permission-version.bumper.js';
 import { AccessBundleStore } from './access-bundle-store.js';
 import { GrantCeiling } from './grant-ceiling.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The caller's reachable subtree, threaded from `req.principal` (Task 4.2). It scopes the
  * grant-admin reads so a caller sees ONLY roles bound within their subtree — the SAME cached
@@ -54,6 +55,7 @@ export declare class GrantAdminService {
     private readonly bumper;
     private readonly ceiling?;
     private readonly audit?;
+    private readonly schemas;
     private readonly bundles;
     /**
      * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold") plus the
@@ -63,8 +65,9 @@ export declare class GrantAdminService {
      *   enforces. Root bypasses regardless.
      * @param audit  The grant-administration audit sink (D6): written on the grant's own transaction
      *   connection, fail-closed. The identity module ALWAYS wires the engine `MariaDbAuditSink`.
+     * @param schemas Resolved framework names (absent ⇒ resolved from the namespace, once, here).
      */
-    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined, audit?: AuditPort | undefined);
+    constructor(pool: Pool, bumper: PermissionVersionBumper, bundleStore?: AccessBundleStore, ceiling?: GrantCeiling | undefined, audit?: AuditPort | undefined, schemas?: IdentitySchemaNames);
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
     listCatalog(): Promise<{
         catalog: CatalogRow[];

package/dist/features/authz/grant-admin.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAuC7D;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAa1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAhBzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;OAQG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA;IAKpC,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA0DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAc/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}
+{"version":3,"file":"grant-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-admin.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAa,MAAM,oBAAoB,CAAC;AAI7D,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAiCpF;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;6EAC6E;AAC7E,qBAAa,WAAY,SAAQ,KAAK;gBACxB,GAAG,EAAE,MAAM;CAIxB;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElG,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,qBAAa,iBAAiB;IAc1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;IAE5C;;;;;;;;;OASG;gBAEgB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,uBAAuB,EAChD,WAAW,CAAC,EAAE,iBAAiB,EACd,OAAO,CAAC,EAAE,YAAY,YAAA,EACtB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,OAAO,GAAE,mBAA+C;IAK3E,+EAA+E;IACzE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmC5E;;;;OAIG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA0BhC,0FAA0F;YAC5E,cAAc;IAM5B;;;;;;OAMG;YACW,qBAAqB;IAUnC;;;;;OAKG;YACW,WAAW;IA6DzB;;;;;;OAMG;YACW,gBAAgB;IA0D9B;;;;;OAKG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB7E;;;;;;OAMG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqDtE;;;;;;OAMG;IACH;;;;;;OAMG;YACW,cAAc;IAS5B,OAAO,CAAC,uBAAuB;IAgB/B,0EAA0E;IACpE,WAAW,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IASvD;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzF;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBxF,uFAAuF;YACzE,wBAAwB;IAWtC;;;;;;;;;;;;OAYG;IACG,iBAAiB,CACrB,MAAM,EACF;QACE,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;KAC5B,GACD,SAAS,EACb,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAgIrF"}