@astram/identity 0.11.0 → 0.12.0

package/dist/features/identity-feature.module.js

@@ -9,8 +9,11 @@ var IdentityFeatureModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IdentityFeatureModule = void 0;
 exports.assertRequestPathUsesIdentityAuthorization = assertRequestPathUsesIdentityAuthorization;
+exports.assertFrameworkSchemasAgree = assertFrameworkSchemasAgree;
+exports.assertFrameworkDatabaseAgrees = assertFrameworkDatabaseAgrees;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
+const core_2 = require("@astram/core");
 const engine_1 = require("@astram/engine");
 const guard_1 = require("@astram/guard");
 const objects_js_1 = require("../objects.js");
@@ -22,6 +25,7 @@ const role_service_js_1 = require("./role/role.service.js");
 const role_controller_js_1 = require("./role/role.controller.js");
 const user_service_js_1 = require("./user/user.service.js");
 const email_address_changer_token_js_1 = require("./user/email-address-changer.token.js");
+const framework_schemas_token_js_1 = require("./framework-schemas.token.js");
 const user_controller_js_1 = require("./user/user.controller.js");
 const membership_controller_js_1 = require("./membership/membership.controller.js");
 const membership_service_js_1 = require("./membership/membership.service.js");
@@ -34,6 +38,7 @@ const permission_version_bumper_js_1 = require("./authz/permission-version.bumpe
 const record_authorization_js_1 = require("./authz/record-authorization.js");
 const db_permission_facts_adapter_js_1 = require("./authz/db-permission-facts.adapter.js");
 const session_revocation_check_js_1 = require("./user/session-revocation-check.js");
+const migration_ledger_check_js_1 = require("./migration-ledger-check.js");
 const access_bundle_store_js_1 = require("./authz/access-bundle-store.js");
 const grant_admin_service_js_1 = require("./authz/grant-admin.service.js");
 const grant_admin_controller_js_1 = require("./authz/grant-admin.controller.js");
@@ -91,9 +96,59 @@ function assertRequestPathUsesIdentityAuthorization(authority) {
     }
     return true;
 }
-/** Map guard's env DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). */
-function engineDbFromEnv() {
-    const db = (0, guard_1.loadDbConfig)();
+/** DI token of the boot check that identity and guard use the same framework database names. */
+const IDENTITY_FRAMEWORK_SCHEMAS_CHECK = Symbol('IDENTITY_FRAMEWORK_SCHEMAS_CHECK');
+/**
+ * The boot check behind {@link IDENTITY_FRAMEWORK_SCHEMAS_CHECK} (configurable-framework-db,
+ * ADR-0037; reviewer R2): the names `IdentityFeatureModule.forRoot` resolved — and handed to the
+ * engine, the audit sinks, the reader and every identity store — must equal guard's
+ * `FRAMEWORK_SCHEMAS`, or engine/guard/identity would split across databases. A guard that
+ * provides no `FRAMEWORK_SCHEMAS` (older than this seam) may only run on the default names.
+ * Throws (fail closed) with the namespaces and names only.
+ */
+function assertFrameworkSchemasAgree(identity, guard) {
+    const names = (s) => `namespace=${s.namespace} app=${s.app} identity=${s.identity} authz=${s.authz} audit=${s.audit}`;
+    if (guard === undefined || guard === null) {
+        if (identity.isDefault)
+            return true;
+        throw new Error(`IdentityFeatureModule: resolved ${names(identity)}, but @astram/guard provides no ` +
+            'FRAMEWORK_SCHEMAS; upgrade @astram/guard so every framework module uses the same names.');
+    }
+    const same = identity.app === guard.app &&
+        identity.identity === guard.identity &&
+        identity.authz === guard.authz &&
+        identity.audit === guard.audit;
+    if (!same) {
+        throw new Error(`IdentityFeatureModule: framework database names disagree — identity ${names(identity)}; ` +
+            `guard ${names(guard)}. Pass the same names (or none) to ShieldModule and ` +
+            'IdentityFeatureModule.');
+    }
+    return true;
+}
+/** DI token of the boot check that guard's runtime database equals identity's (QA P2-5). */
+const IDENTITY_FRAMEWORK_DATABASE_CHECK = Symbol('IDENTITY_FRAMEWORK_DATABASE_CHECK');
+/**
+ * The boot check behind {@link IDENTITY_FRAMEWORK_DATABASE_CHECK} (G-007 QA P2-5): the runtime
+ * database identity's engine and authz pool connect to (derived from `forRoot({ schemas })`)
+ * must equal guard's `APP_CONFIG.db.database`, or unqualified queries of guard and identity would
+ * land in different databases. No guard `APP_CONFIG` visible ⇒ nothing to compare. Throws (fail
+ * closed) with database names only.
+ */
+function assertFrameworkDatabaseAgrees(identityDatabase, guardConfig) {
+    const guardDatabase = guardConfig?.db?.database;
+    if (guardDatabase === undefined || guardDatabase === identityDatabase)
+        return true;
+    throw new Error(`IdentityFeatureModule: runtime database ${identityDatabase} differs from @astram/guard's ` +
+        `${guardDatabase}. Pass the same names (or none) to ShieldModule and ` +
+        'IdentityFeatureModule, and one APP_DB_NAME.');
+}
+/**
+ * Map guard's DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). The
+ * database and default user follow `schemas` (the names `forRoot` resolved or was given); an
+ * explicit `APP_DB_USER` / `APP_DB_NAME` still wins (QA P2-5).
+ */
+function engineDbFromEnv(schemas) {
+    const db = (0, guard_1.loadDbConfig)(process.env, schemas);
     const ssl = (0, guard_1.mariadbSslOption)(db.tls);
     return {
         host: db.host,
@@ -134,22 +189,34 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
      *   cross-tenant / policy authority, grant ceiling, guided rule-builder schema and owner-share
      *   resolver. Without them a consumer type is unregistered everywhere (denied), not policy-
      *   authorable and not shareable ("type '…' is not registered — cannot share").
+     * @param schemas the resolved framework database names (configurable-framework-db, ADR-0037).
+     *   Absent ⇒ resolved ONCE here from `SHIELD_DB_NAMESPACE` (unset ⇒ `shield_*`; invalid ⇒
+     *   throws). The one set is handed to the engine (registrations + its audit sink), the seven
+     *   audit sinks, the audit reader and every identity store; a boot check refuses names that
+     *   differ from guard's `FRAMEWORK_SCHEMAS`. Never read per request.
      */
-    static forRoot({ rootIds, extraObjects = [], } = {}) {
+    static forRoot({ rootIds, extraObjects = [], schemas: givenSchemas, } = {}) {
+        // The framework database names, resolved ONCE (boot) for every SQL path built below.
+        // Caller-supplied names are checked before any SQL is built (fail closed, Shield #1).
+        const schemas = givenSchemas !== undefined
+            ? (0, core_2.assertFrameworkSchemaNames)(givenSchemas, 'IdentityFeatureModule.forRoot schemas')
+            : (0, core_2.resolveFrameworkSchemas)(process.env);
         // ONE shared shield_authz pool for the whole grant-admin stack (ADR-0011): the
         // permission-version bumper, the AccessBundleStore, the GrantAdminService, and the two
         // reconcile jobs all run over this single pool (don't open several). Opened once at
         // forRoot() (not import time) — mirrors the pre-existing bump-pool pattern. Since Phase 9 #7
         // it also backs the request path's decision authority (provided to ShieldModule below).
-        const authzPool = (0, record_authorization_js_1.createIdentityAuthzPool)();
+        const authzPool = (0, record_authorization_js_1.createIdentityAuthzPool)(schemas);
+        // QA P2-5: the engine and the authz pool connect to the database derived from `schemas`.
+        const engineDb = engineDbFromEnv(schemas);
         // The ONE record authorization (Phase 9 #7, closes KI #55/#57): built here from this module's
         // own `extraObjects`, provided to ShieldModule under SHIELD_RECORD_AUTHORIZATION, and reused for
         // every internal authority below. Its registry is the ONE key universe: the grant ceiling sees
         // every key the request path grants (review M5 / Phase 8 #4), and a consumer type is
         // registered for the cross-tenant writer and the policy author too.
-        const recordAuthorization = (0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool, extraObjects);
+        const recordAuthorization = (0, record_authorization_js_1.buildRecordAuthorizationInputs)(authzPool, extraObjects, schemas);
         const ceilingRegistry = recordAuthorization.registry;
-        const bumper = new permission_version_bumper_js_1.PermissionVersionBumper();
+        const bumper = new permission_version_bumper_js_1.PermissionVersionBumper(undefined, schemas);
         const postingVersionBump = {
             bumpTenant: (tenantUuid) => bumper.bumpForTenant(tenantUuid, authzPool),
             // A user disabled/re-enabled: every membership tenant (autocommit pool → published at once).
@@ -162,7 +229,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // self-escalation ceiling: a non-root grantor may only grant a key they themselves hold —
         // resolved over the SAME authz pool + registry the object-type gate uses (one source of
         // truth for "what a principal holds"). ALWAYS wired here, so production always enforces.
-        const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool);
+        const accessBundleStore = new access_bundle_store_js_1.AccessBundleStore(authzPool, schemas);
         // (`ceilingRegistry` is the shared record-authorization registry built at the top of forRoot.)
         // `rootIds` marks platform roots as never dominated.
         // rootIds is passed EXPLICITLY (review F5): `null` states "not configured". The dominance
@@ -173,30 +240,33 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 'ShieldModule.forRoot({ rootIds }). Platform administrators are still protected via ' +
                 'users.u_is_platform_superuser.');
         }
-        const grantCeiling = new grant_ceiling_js_1.GrantCeiling(authzPool, ceilingRegistry, rootIds ?? null);
+        const grantCeiling = new grant_ceiling_js_1.GrantCeiling(authzPool, ceilingRegistry, rootIds ?? null, undefined, schemas);
+        // Every identity audit sink writes `<audit>.audit_log` of the resolved names (Shield #6: the
+        // audit DB of the same namespace).
+        const auditSinkConfig = { schema: schemas.audit };
         // Grant administration is audited on the grant's own transaction (D6, fail-closed).
-        const grantAdminAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
-        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink);
+        const grantAdminAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
+        const grantAdminService = new grant_admin_service_js_1.GrantAdminService(authzPool, bumper, accessBundleStore, grantCeiling, grantAdminAuditSink, schemas);
         // Scope closure (Task 1.2 of the scoped-hierarchy program): the reconciler + node
         // move/delete maintenance, over the SAME shared authzPool (it reaches BOTH shield_app —
         // companies — and shield_authz — scope_closure). Reuses the SAME `bumper` instance so a
         // moveNode's session-invalidation joins the move's transaction. reconcileClosure() is
         // kicked post-boot by the CatalogBootstrapProvider (mirrors the catalog reconcile).
-        const scopeClosureService = new scope_closure_service_js_1.ScopeClosureService(authzPool, bumper);
+        const scopeClosureService = new scope_closure_service_js_1.ScopeClosureService(authzPool, bumper, schemas);
         // Company hierarchy (security hardening #2): the ONLY path that moves/deletes/attaches a company
         // node — through the closure service above — audited on the move/delete transaction.
         const companyHierarchyService = new company_hierarchy_service_js_1.CompanyHierarchyService(authzPool, scopeClosureService, grantCeiling, // Phase 8 #3: a company delete must dominate every member
-        new engine_1.MariaDbAuditSink({}));
+        new engine_1.MariaDbAuditSink(auditSinkConfig), undefined, schemas);
         // Audit viewer (Phase 5): the AuditReader + LabelResolver over the SAME shared authzPool
         // (the reader queries shield_audit + the resolver/actor-lookup query shield_app, both
         // reachable by that pool). `auditNameToId` is the actor-name -> uuid reverse lookup for the
         // actor filter (astram3's exact closure). A mariadb Pool.query(sql, params) structurally
         // satisfies the reader/resolver's `AuditQueryable` — pass authzPool directly. Built at
         // forRoot() (not via Nest DI) because it needs the hand-built pool, then provided useValue.
-        const auditReader = new mariadb_audit_reader_js_1.MariaDbAuditReader(authzPool);
-        const auditLabels = new directory_label_resolver_js_1.DirectoryLabelResolver(authzPool);
+        const auditReader = new mariadb_audit_reader_js_1.MariaDbAuditReader(authzPool, { schema: schemas.audit });
+        const auditLabels = new directory_label_resolver_js_1.DirectoryLabelResolver(authzPool, schemas);
         const auditNameToId = async (name) => {
-            const rows = (await authzPool.query('SELECT u_uuid AS id FROM `shield_app`.`users` WHERE u_username = ? LIMIT 1', [name]));
+            const rows = (await authzPool.query(`SELECT u_uuid AS id FROM \`${schemas.app}\`.\`users\` WHERE u_username = ? LIMIT 1`, [name]));
             return rows[0]?.id ?? null;
         };
         const auditReadService = new audit_read_service_js_1.AuditReadService(auditReader, auditLabels, auditNameToId);
@@ -220,7 +290,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // consumer passes to ShieldModule.forRoot (root-correctness for control-plane grants).
         const authorizeCrossTenantGrant = (0, grant_authorize_js_1.makeAuthorizeCrossTenantGrant)({
             authority: crossTenantAuthority,
-            readRoleIds: (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId),
+            readRoleIds: (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId, schemas),
             isRoot: (principalId) => (rootIds ?? []).includes(principalId),
         });
         // Audit bridge: map guard's `GrantAuditEvent` → the engine's `MariaDbAuditSink` (the SAME
@@ -235,7 +305,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // never happen for a cross-tenant grant) is de-duped to ONE row.
         // BEST-EFFORT: a throw here must NEVER fail the lifecycle write (the writer already swallows a
         // sink throw; we also guard here so a mapping/DB error is inert).
-        const grantAuditSink = new engine_1.MariaDbAuditSink({}); // defaults: shield_audit.audit_log
+        const grantAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const grantAudit = {
             record: async (event) => {
                 try {
@@ -266,6 +336,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             db: authzPool,
             authorize: authorizeCrossTenantGrant,
             audit: grantAudit,
+            schema: schemas.authz,
         });
         // The read side (inbox/mine/incoming/offerable-types) over the same pool + the merged object
         // set (offerable = tenantScoped types only, the consumer's included, KI #57) + the per-type
@@ -278,7 +349,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
             return [reg.typeKey, (0, engine_1.effectiveActions)(reg)];
         }));
         const actionsByType = (typeKey) => actionsByTypeKey.get(typeKey);
-        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], (typeKey) => actionsByType(typeKey) ?? []);
+        const crossTenantGrantReadService = new cross_tenant_grant_read_service_js_1.CrossTenantGrantReadService(authzPool, [...objects_js_1.identityObjects, ...extraObjects], (typeKey) => actionsByType(typeKey) ?? [], schemas);
         // ── GUIDED RULE-BUILDER (list-scoping engine Phase 5, §9.1) ──────────────────────────────
         // The policy-authoring surface over the guard `MariaDbPolicyStore` + core `makeAuthorPolicy`.
         // Reuses the SAME shared registry + `crossTenantAuthority` (a DecisionAuthority over the
@@ -286,7 +357,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // core AuditSink is one-arg (`record(event)`); the engine `MariaDbAuditSink` is two-arg
         // (`record(event, query)`) — so bind the query to the shared authzPool (mirrors the
         // `grantAudit` bridge above). Best-effort audit (a sink throw must not fail the author).
-        const policyAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const policyAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const policyAudit = {
             record: async (event) => {
                 try {
@@ -297,7 +368,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 }
             },
         };
-        const policyStore = new guard_1.MariaDbPolicyStore(authzPool);
+        const policyStore = new guard_1.MariaDbPolicyStore(authzPool, { schema: schemas.authz });
         // The guided-builder SCHEMA source — the authorable field/action metadata, reflected from the
         // registered identity object types (engine `reflectObjectType` yields fields WITH their
         // `type`, which the core registry descriptor drops). Only tenantScoped, owned DATA-plane types
@@ -335,7 +406,9 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // and the writer rejects "type 'note' is not registered — cannot share." (Live-acceptance fix.)
         const shareTypeInfoByKey = new Map();
         for (const input of [...objects_js_1.identityObjects, ...extraObjects]) {
-            const reg = typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input;
+            // R1 / KI #1 (spec v2 §5.B): resolve `FRAMEWORK_SCHEMA` tokens to the resolved names before
+            // the schema reaches `RecordShareWriter` SQL; an unresolvable token throws (fail closed).
+            const reg = (0, engine_1.resolveObjectTypeSchema)(typeof input === 'function' ? (0, engine_1.reflectObjectType)(input) : input, schemas);
             const owner = (0, engine_1.ownerColumn)(reg);
             const pk = reg.primaryKey.kind === 'uuid' ? (0, engine_1.uuidPkColumn)(reg.primaryKey) : null;
             // Only OWNED types with a uuid PK + an owner column are shareable; others are omitted (the
@@ -355,10 +428,11 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         const shareTypeResolver = {
             resolve: (typeKey) => shareTypeInfoByKey.get(typeKey),
         };
-        const shareAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log
+        const shareAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const recordShareWriter = new guard_1.RecordShareWriter({
             db: authzPool,
             types: shareTypeResolver,
+            schema: schemas.authz,
             audit: {
                 record: async (event) => {
                     try {
@@ -386,11 +460,11 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // shield_app.service_account — the accounts — AND shield_authz.service_account_key — the hashed
         // keys). The guard's MariaDbApiKeyStore + Argon2idPasswordHasher back the credential lifecycle;
         // the service enforces own-tenant + the ADR-0029 ceiling (scope ⊆ mine, roles ⊆ mine).
-        const serviceAccountStore = new service_account_store_js_1.ServiceAccountStore(authzPool);
-        const serviceAccountKeyStore = new guard_1.MariaDbApiKeyStore(authzPool);
+        const serviceAccountStore = new service_account_store_js_1.ServiceAccountStore(authzPool, schemas);
+        const serviceAccountKeyStore = new guard_1.MariaDbApiKeyStore(authzPool, schemas);
         const serviceAccountHasher = new guard_1.Argon2idPasswordHasher();
         // Best-effort audit → the SAME shield_audit sink pattern (a sink throw never fails the op).
-        const serviceAccountAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const serviceAccountAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const serviceAccountAudit = {
             record: async (event) => {
                 try {
@@ -412,12 +486,12 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // shield_app.users lookup the audit actor filter uses (inverted). Unknown → null (view falls
         // back to no name, never an id).
         const resolveActorName = async (id) => {
-            const rows = (await authzPool.query('SELECT u_username AS name FROM `shield_app`.`users` WHERE u_uuid = ? LIMIT 1', [id]));
+            const rows = (await authzPool.query(`SELECT u_username AS name FROM \`${schemas.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [id]));
             return rows[0]?.name ?? null;
         };
         const serviceAccountService = new service_account_service_js_1.ServiceAccountService(serviceAccountStore, serviceAccountKeyStore, serviceAccountHasher, serviceAccountAudit, resolveActorName, 
         // The ceiling's roles: in-effect postings (the same source as gate 5 and GrantCeiling).
-        (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId));
+        (principalId, tenantId) => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(authzPool, principalId, tenantId, schemas));
         // NOTE: the machine AUTH path (the `ServiceAuthenticator` behind `SHIELD_SERVICE_AUTHENTICATOR`)
         // is provided by the guard's own AuthModule (under `auth: true`), NOT here — a token provided in
         // this later, sibling feature module is invisible to the APP_GUARD in ShieldModule (that DI
@@ -427,7 +501,7 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
         // Stored files (file-storage SPEC §5 I-K): `file_access` events go to the SAME shield_audit
         // sink over the shared authzPool. Not best-effort here: FilesService decides (a read event
         // that cannot be written withholds the bytes).
-        const filesAuditSink = new engine_1.MariaDbAuditSink({}); // shield_audit.audit_log defaults
+        const filesAuditSink = new engine_1.MariaDbAuditSink(auditSinkConfig);
         const filesAudit = {
             record: (event) => filesAuditSink.record(event, (sql, params) => authzPool.query(sql, params)),
         };
@@ -442,10 +516,13 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // snapshot is empty and no bundles reconcile into shield_authz.access_bundle.
                 engine_1.EngineModule.forFeature([], { accessBundles: index_js_1.identityAccessBundles }),
                 // The engine's runtime CRUD pipe + the identity object registrations.
+                // R2: the SAME resolved names, so the engine's registrations (FRAMEWORK_SCHEMA tokens) and
+                // its audit sink cannot land in another namespace than identity's own SQL.
                 engine_1.EngineModule.forRoot({
-                    db: engineDbFromEnv(),
+                    db: engineDb,
                     registrations: [...objects_js_1.identityObjects],
                     listScope,
+                    schemas,
                 }),
                 // NestJS DiscoveryService/MetadataScanner — the boot bootstrap provider reflects the
                 // live controllers through this to build the OperationInventory.
@@ -499,8 +576,11 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // (collision refusal + login-hint follow in one transaction), over the shared authz pool.
                 {
                     provide: email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER,
-                    useValue: new guard_1.MariaDbEmailAddressChanger(authzPool),
+                    useValue: new guard_1.MariaDbEmailAddressChanger(authzPool, Date.now, schemas),
                 },
+                // The same resolved names for identity services Nest constructs (UserService's
+                // email-change audit sink), never a second env read.
+                { provide: framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS, useValue: schemas },
                 // ADR-0035 (GAPS #6): attach the guard's Redis permission-version cache to the ONE shared
                 // bumper, so every committed bump (postings, grants, hierarchy) is published to Redis,
                 // where gate 5 reads it. Provided by the auth surface under `auth: true` (through the
@@ -522,6 +602,27 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                     useFactory: assertRequestPathUsesIdentityAuthorization,
                     inject: [{ token: guard_1.SHIELD_DECISION_AUTHORITY, optional: true }],
                 },
+                // configurable-framework-db (R2): fail the boot unless guard's FRAMEWORK_SCHEMAS equal the
+                // names this module resolved (and gave the engine, the sinks and every store).
+                {
+                    provide: IDENTITY_FRAMEWORK_SCHEMAS_CHECK,
+                    useFactory: (guardSchemas) => assertFrameworkSchemasAgree(schemas, guardSchemas),
+                    inject: [{ token: guard_1.FRAMEWORK_SCHEMAS, optional: true }],
+                },
+                // QA P2-5: and guard's runtime database must be the one identity connects to.
+                {
+                    provide: IDENTITY_FRAMEWORK_DATABASE_CHECK,
+                    useFactory: (guardConfig) => assertFrameworkDatabaseAgrees(engineDb.database, guardConfig),
+                    inject: [{ token: guard_1.APP_CONFIG, optional: true }],
+                },
+                // configurable-framework-db spec 5.D: the identity migrations are in the ledger, checked
+                // once at application bootstrap over the shared runtime pool (production fails, dev warns).
+                // Guard + identity ids; one ledger read shared with AuthModule's check (guard's registry).
+                {
+                    provide: migration_ledger_check_js_1.IDENTITY_MIGRATION_LEDGER_CHECK,
+                    useFactory: (registry) => (0, migration_ledger_check_js_1.identityMigrationLedgerCheck)(authzPool, schemas, process.env, registry ?? null),
+                    inject: [{ token: guard_1.SHIELD_MIGRATION_LEDGER_REGISTRY, optional: true }],
+                },
                 {
                     provide: IDENTITY_VERSION_PUBLISHER_LINK,
                     useFactory: (cache) => {
@@ -562,13 +663,13 @@ let IdentityFeatureModule = IdentityFeatureModule_1 = class IdentityFeatureModul
                 // ceiling know, so a consumer type's keys are grantable and its rows are not orphaned.
                 {
                     provide: catalog_reconcile_job_js_1.CatalogReconcileJob,
-                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, recordAuthorization.registry),
+                    useValue: new catalog_reconcile_job_js_1.CatalogReconcileJob(authzPool, recordAuthorization.registry, schemas),
                 },
                 // The bundle half: reconciles the merged AccessBundleSpec[] (ENGINE_ALL_ACCESS_BUNDLES,
                 // reflected by the engine from identityAccessBundles) into shield_authz.access_bundle.
                 {
                     provide: access_bundle_reconcile_job_js_1.AccessBundleReconcileJob,
-                    useFactory: (bundles) => new access_bundle_reconcile_job_js_1.AccessBundleReconcileJob(authzPool, bundles),
+                    useFactory: (bundles) => new access_bundle_reconcile_job_js_1.AccessBundleReconcileJob(authzPool, bundles, schemas),
                     inject: [engine_1.ENGINE_ALL_ACCESS_BUNDLES],
                 },
                 // Scope closure reconciler + node move/delete maintenance (Task 1.2), built at forRoot()

package/dist/features/membership/membership-checker.d.ts

@@ -30,9 +30,15 @@
  * a switch. All SQL values are `?`-bound (never interpolated).
  */
 import type { Pool } from 'mariadb';
+import { type IdentitySchemaNames } from '../../schema.js';
 export declare class DbMembershipChecker {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /**
+     * @param schemas resolved framework names; the membership table lives in `schemas.app`.
+     *   Absent ⇒ resolved from the namespace, once, here.
+     */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     /**
      * Does `principalId` hold an ACTIVE membership at `nodeId`? A single existence read —
      * `true` iff a row with `cm_is_active = 1 AND cm_status = 'active'` exists. Throws on a

package/dist/features/membership/membership-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership-checker.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAKpC,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEvC;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWjF"}
+{"version":3,"file":"membership-checker.d.ts","sourceRoot":"","sources":["../../../src/features/membership/membership-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,qBAAa,mBAAmB;IAM5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B;;;OAGG;gBAEgB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAG3E;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAWjF"}

package/dist/features/membership/membership-checker.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbMembershipChecker = void 0;
-/** Schema the membership table lives in (the app schema). */
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 class DbMembershipChecker {
     pool;
-    constructor(pool) {
+    schemas;
+    /**
+     * @param schemas resolved framework names; the membership table lives in `schemas.app`.
+     *   Absent ⇒ resolved from the namespace, once, here.
+     */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     /**
      * Does `principalId` hold an ACTIVE membership at `nodeId`? A single existence read —
@@ -15,7 +20,7 @@ class DbMembershipChecker {
      */
     async hasActiveMembership(principalId, nodeId) {
         const rows = (await this.pool.query(`SELECT 1 AS ok
-         FROM \`${APP}\`.\`company_membership\`
+         FROM \`${this.schemas.app}\`.\`company_membership\`
         WHERE cm_user_uuid = ? AND cm_company_uuid = ?
           AND cm_is_active = 1 AND cm_status = 'active'
         LIMIT 1`, [principalId, nodeId]));

package/dist/features/migration-ledger-check.d.ts

@@ -0,0 +1,15 @@
+import type { FrameworkSchemas } from '@astram/core';
+import { FrameworkMigrationLedgerCheck, type MigrationLedgerRegistry } from '@astram/guard';
+/** DI token of identity's ledger check (guard's `AuthModule` uses its own token). */
+export declare const IDENTITY_MIGRATION_LEDGER_CHECK: unique symbol;
+/**
+ * configurable-framework-db spec 5.D: the boot hook that checks every guard AND identity
+ * migration is in the `@astram/migrate` ledger (identity reads guard's authz tables; guard never
+ * imports identity, ADR-0003). Runs once at application bootstrap, never per request (Shield
+ * #12). With guard's per-app `registry`, it shares one ledger read with `AuthModule`'s check.
+ * Outside `NODE_ENV` development/test a missing id, ledger table or unreadable ledger fails boot.
+ */
+export declare function identityMigrationLedgerCheck(pool: {
+    query(sql: string): Promise<unknown>;
+}, schemas: FrameworkSchemas, env?: NodeJS.ProcessEnv, registry?: MigrationLedgerRegistry | null): FrameworkMigrationLedgerCheck;
+//# sourceMappingURL=migration-ledger-check.d.ts.map

package/dist/features/migration-ledger-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-ledger-check.d.ts","sourceRoot":"","sources":["../../src/features/migration-ledger-check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,6BAA6B,EAG7B,KAAK,uBAAuB,EAC7B,MAAM,eAAe,CAAC;AAGvB,qFAAqF;AACrF,eAAO,MAAM,+BAA+B,eAA4C,CAAC;AAEzF;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE;IAAE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,EAC9C,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,uBAAuB,GAAG,IAAW,GAC9C,6BAA6B,CAY/B"}

package/dist/features/migration-ledger-check.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_MIGRATION_LEDGER_CHECK = void 0;
+exports.identityMigrationLedgerCheck = identityMigrationLedgerCheck;
+const common_1 = require("@nestjs/common");
+const guard_1 = require("@astram/guard");
+const migrations_dir_js_1 = require("../migrations-dir.js");
+/** DI token of identity's ledger check (guard's `AuthModule` uses its own token). */
+exports.IDENTITY_MIGRATION_LEDGER_CHECK = Symbol('IDENTITY_MIGRATION_LEDGER_CHECK');
+/**
+ * configurable-framework-db spec 5.D: the boot hook that checks every guard AND identity
+ * migration is in the `@astram/migrate` ledger (identity reads guard's authz tables; guard never
+ * imports identity, ADR-0003). Runs once at application bootstrap, never per request (Shield
+ * #12). With guard's per-app `registry`, it shares one ledger read with `AuthModule`'s check.
+ * Outside `NODE_ENV` development/test a missing id, ledger table or unreadable ledger fails boot.
+ */
+function identityMigrationLedgerCheck(pool, schemas, env = process.env, registry = null) {
+    return new guard_1.FrameworkMigrationLedgerCheck({
+        query: (sql) => pool.query(sql),
+        // Same candidates as guard's check (G-007 QA P1), so the registry shares one probe + read.
+        ...(0, guard_1.resolveMigrationLedgerCheck)(env, schemas),
+        migrationsDir: [guard_1.guardMigrationsDir, migrations_dir_js_1.identityMigrationsDir],
+        nodeEnv: env.NODE_ENV,
+        logger: new common_1.Logger('IdentityFeatureModule'),
+    }, registry);
+}

package/dist/features/scope/scope-closure.service.d.ts

@@ -1,4 +1,5 @@
 import { type ScopeEdge } from '@astram/guard';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The minimal query surface a transaction connection must expose. A `mariadb`
  * `PoolConnection` satisfies it structurally; kept framework-agnostic (mirrors `Queryable`
@@ -30,7 +31,13 @@ export interface ScopeVersionBumper {
 export declare class ScopeClosureService {
     private readonly pool;
     private readonly bumper;
-    constructor(pool: ScopePool, bumper: ScopeVersionBumper);
+    private readonly schemas;
+    /**
+     * @param schemas resolved framework names: the node tree (`companies`) lives in `schemas.app`,
+     *   the closure table in `schemas.authz` (ADR-0011 / Task 1.1). Absent ⇒ resolved from the
+     *   namespace, once, here.
+     */
+    constructor(pool: ScopePool, bumper: ScopeVersionBumper, schemas?: IdentitySchemaNames);
     /**
      * Rebuild `scope_closure` from the current `companies.c_parent_uuid` edges. Idempotent
      * (delete-then-insert in a tx → a second run over the same tree writes the identical set).

package/dist/features/scope/scope-closure.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAOlF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB;IAG7C;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC;IA6ChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}
+{"version":3,"file":"scope-closure.service.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-closure.service.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,iGAAiG;AACjG,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,aAAa,IAAI,OAAO,CACtB,SAAS,GAAG;QACV,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,2FAA2F;QAC3F,OAAO,CAAC,IAAI,IAAI,CAAC;KAClB,CACF,CAAC;CACH;AAOD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,+FAA+F;IAC/F,gBAAgB,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,qFAAqF;IACrF,cAAc,CAAC,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;CACxC;AAED,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B;;;;OAIG;gBAEgB,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,mBAA+C;IAG3E;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsBvF;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjD;;;;;;;OAOG;YACW,UAAU;IAwCxB;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GAAG,IAAI;IAC5B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC;IAiFhB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,QAAQ,EAAE,MAAM;IAChB,iGAAiG;IACjG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,GAAG,SAAS,MAAM,EAAE,CAAC,GACpE,OAAO,CAAC,IAAI,CAAC;IA+ChB,yFAAyF;YAC3E,SAAS;IAOvB;;;;OAIG;YACW,cAAc;CAiB7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG;IAC7D,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CA8BA;AAED,kGAAkG;AAClG,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,QAAQ,EAAE,MAAM;CAQ7B"}

package/dist/features/scope/scope-closure.service.js

@@ -40,10 +40,7 @@ exports.quarantineCycles = quarantineCycles;
  */
 const core_1 = require("@astram/core");
 const guard_1 = require("@astram/guard");
-/** Schema the node tree (`companies`) lives in. */
-const APP = 'shield_app';
-/** Schema the closure table lives in (ADR-0011 / Task 1.1). */
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /** The named lock every hierarchy writer holds (security review F3). */
 const TREE_LOCK = 'shield_scope_closure';
 /** Seconds to wait for it before failing closed. */
@@ -51,9 +48,16 @@ const TREE_LOCK_TIMEOUT_S = 10;
 class ScopeClosureService {
     pool;
     bumper;
-    constructor(pool, bumper) {
+    schemas;
+    /**
+     * @param schemas resolved framework names: the node tree (`companies`) lives in `schemas.app`,
+     *   the closure table in `schemas.authz` (ADR-0011 / Task 1.1). Absent ⇒ resolved from the
+     *   namespace, once, here.
+     */
+    constructor(pool, bumper, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.bumper = bumper;
+        this.schemas = schemas;
     }
     /**
      * Rebuild `scope_closure` from the current `companies.c_parent_uuid` edges. Idempotent
@@ -183,7 +187,7 @@ class ScopeClosureService {
             if (newParentUuid !== null) {
                 // Cycle guard: the new parent must NOT be at/under the moved node. A closure hit means
                 // newParent is a descendant of node → re-parenting node under it would form a cycle.
-                const cyclic = (await conn.query(`SELECT 1 FROM \`${AUTHZ}\`.\`scope_closure\`
+                const cyclic = (await conn.query(`SELECT 1 FROM \`${this.schemas.authz}\`.\`scope_closure\`
           WHERE ancestor_uuid = ? AND descendant_uuid = ? LIMIT 1`, [nodeUuid, newParentUuid]));
                 if (cyclic.length > 0) {
                     throw new guard_1.ScopeCycleError(nodeUuid);
@@ -191,14 +195,14 @@ class ScopeClosureService {
             }
             // The moved subtree — the nodes whose ancestry changes (node + all descendants). Read
             // BEFORE the update (the move doesn't change the subtree's internal membership).
-            const subtreeRows = (await conn.query(`SELECT descendant_uuid FROM \`${AUTHZ}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeUuid]));
+            const subtreeRows = (await conn.query(`SELECT descendant_uuid FROM \`${this.schemas.authz}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeUuid]));
             // The FORMER-PARENT ANCESTRY — the nodes ABOVE `node` in the OLD tree (its ancestors,
             // excluding self). They just LOST `node`'s subtree from their reach, so their admins' cached
             // session subtrees are now stale (they'd otherwise keep reaching the moved-away tenant — the
             // HIGH stale-subtree-after-move leak). Read BEFORE the update (the pre-move closure has the
             // old ancestry). Bump these too so those sessions re-derive their (now-smaller) subtree at
             // their next refresh (ADR-0011 bound — no forced re-login).
-            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
+            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${this.schemas.authz}\`.\`scope_closure\`
         WHERE descendant_uuid = ? AND ancestor_uuid <> ?`, [nodeUuid, nodeUuid]));
             // Fall back to the node itself if the closure has no self-row yet (pre-first-reconcile).
             const movedSubtree = subtreeRows.length > 0 ? subtreeRows.map((r) => r.descendant_uuid) : [nodeUuid];
@@ -209,10 +213,7 @@ class ScopeClosureService {
             ];
             {
                 // 1) Re-parent the edge.
-                await conn.query(`UPDATE \`${APP}\`.\`companies\` SET c_parent_uuid = ? WHERE c_uuid = ?`, [
-                    newParentUuid,
-                    nodeUuid,
-                ]);
+                await conn.query(`UPDATE \`${this.schemas.app}\`.\`companies\` SET c_parent_uuid = ? WHERE c_uuid = ?`, [newParentUuid, nodeUuid]);
                 // 2) Rebuild the whole closure from the now-updated edges (full rebuild — safe + simple;
                 //    a targeted subtree rebuild is a later optimization). Re-reads edges over the SAME tx
                 //    connection so it sees the UPDATE. Fail-loud propagates → the whole move rolls back.
@@ -267,20 +268,22 @@ class ScopeClosureService {
         // Under the tree lock (review F3): a concurrent move cannot hang a child under this node
         // between the children check and the delete.
         await this.inTreeLock(async (conn) => {
-            const children = (await conn.query(`SELECT 1 FROM \`${APP}\`.\`companies\` WHERE c_parent_uuid = ? LIMIT 1`, [nodeUuid]));
+            const children = (await conn.query(`SELECT 1 FROM \`${this.schemas.app}\`.\`companies\` WHERE c_parent_uuid = ? LIMIT 1`, [nodeUuid]));
             if (children.length > 0) {
                 throw new NodeHasChildrenError(nodeUuid);
             }
             const touched = (beforeDelete ? await beforeDelete(conn) : undefined) ?? [];
             // The former-parent ancestry — the deleted node's ancestors (excluding self). They lose the
             // node from their reach → bump so their sessions re-derive. Read BEFORE the delete.
-            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
+            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${this.schemas.authz}\`.\`scope_closure\`
           WHERE descendant_uuid = ? AND ancestor_uuid <> ?`, [nodeUuid, nodeUuid]));
             // Remove the node's closure rows (self-row + any it appears in as ancestor/descendant).
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`scope_closure\`
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`scope_closure\`
           WHERE ancestor_uuid = ? OR descendant_uuid = ?`, [nodeUuid, nodeUuid]);
             // Remove the company row itself.
-            await conn.query(`DELETE FROM \`${APP}\`.\`companies\` WHERE c_uuid = ?`, [nodeUuid]);
+            await conn.query(`DELETE FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ?`, [
+                nodeUuid,
+            ]);
             // Bump the former-parent ancestry so their cached subtrees re-derive at next refresh, and the
             // deleted node's OWN tenant (Phase 8 #3): its memberships and postings cascade away, so
             // sessions cached in it must reload (and find nothing). A leaf has no descendants to bump.
@@ -299,7 +302,7 @@ class ScopeClosureService {
     }
     /** Read the node forest's parent edges (`c_uuid` → `c_parent_uuid`) as `ScopeEdge[]`. */
     async readEdges(q) {
-        const rows = (await q.query(`SELECT c_uuid, c_parent_uuid FROM \`${APP}\`.\`companies\``));
+        const rows = (await q.query(`SELECT c_uuid, c_parent_uuid FROM \`${this.schemas.app}\`.\`companies\``));
         return rows.map((r) => ({ node: r.c_uuid, parent: r.c_parent_uuid ?? null }));
     }
     /**
@@ -308,7 +311,7 @@ class ScopeClosureService {
      * idempotent (a re-run writes the identical target set) and correct for a full rebuild.
      */
     async rewriteClosure(conn, rows) {
-        await conn.query(`DELETE FROM \`${AUTHZ}\`.\`scope_closure\``);
+        await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`scope_closure\``);
         if (rows.length === 0)
             return;
         const placeholders = rows.map(() => '(?, ?, ?)').join(', ');
@@ -316,7 +319,7 @@ class ScopeClosureService {
         for (const r of rows) {
             params.push(r.ancestor, r.descendant, r.depth);
         }
-        await conn.query(`INSERT INTO \`${AUTHZ}\`.\`scope_closure\` (ancestor_uuid, descendant_uuid, depth)
+        await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`scope_closure\` (ancestor_uuid, descendant_uuid, depth)
          VALUES ${placeholders}`, params);
     }
 }