@astram/identity 0.11.0 → 0.13.0

package/dist/features/authz/grant-admin.service.js

@@ -8,8 +8,7 @@ const grant_ceiling_js_1 = require("./grant-ceiling.js");
 const role_binding_js_1 = require("./role-binding.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
-const AUTHZ = 'shield_authz';
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /** The grant-admin actions that REMOVE authority from a role's holders (Phase 8 #2). */
 const REVOKE_ACTIONS = new Set([
     'role.permission_revoked',
@@ -42,6 +41,7 @@ class GrantAdminService {
     bumper;
     ceiling;
     audit;
+    schemas;
     bundles;
     /**
      * @param ceiling  The ADR-0029 self-escalation ceiling ("only grant what you hold") plus the
@@ -51,20 +51,22 @@ class GrantAdminService {
      *   enforces. Root bypasses regardless.
      * @param audit  The grant-administration audit sink (D6): written on the grant's own transaction
      *   connection, fail-closed. The identity module ALWAYS wires the engine `MariaDbAuditSink`.
+     * @param schemas Resolved framework names (absent ⇒ resolved from the namespace, once, here).
      */
-    constructor(pool, bumper, bundleStore, ceiling, audit) {
+    constructor(pool, bumper, bundleStore, ceiling, audit, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.bumper = bumper;
         this.ceiling = ceiling;
         this.audit = audit;
-        this.bundles = bundleStore ?? new access_bundle_store_js_1.AccessBundleStore(pool);
+        this.schemas = schemas;
+        this.bundles = bundleStore ?? new access_bundle_store_js_1.AccessBundleStore(pool, schemas);
     }
     /** All grantable exact keys (from the catalog) + the computed wildcard set. */
     async listCatalog() {
         let rows;
         try {
             rows = (await this.pool.query(`SELECT perm_key, perm_label, perm_module, perm_type_key, perm_action
-           FROM \`${AUTHZ}\`.\`permission\`
+           FROM \`${this.schemas.authz}\`.\`permission\`
           WHERE perm_status = 'active'
           ORDER BY perm_type_key, perm_action`));
         }
@@ -98,15 +100,15 @@ class GrantAdminService {
                 const ph = subtreeScope.nodeIds.map(() => '?').join(', ');
                 // Empty subtree → no placeholders → the check can't match → fail-closed empty.
                 const bound = subtreeScope.nodeIds.length
-                    ? (await this.pool.query(`SELECT 1 FROM \`${APP}\`.\`membership_posting\` mp
-                 JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+                    ? (await this.pool.query(`SELECT 1 FROM \`${this.schemas.app}\`.\`membership_posting\` mp
+                 JOIN \`${this.schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
                 WHERE mp.mp_role_uuid = ? AND cm.cm_company_uuid IN (${ph})
                 LIMIT 1`, [roleUuid, ...subtreeScope.nodeIds]))
                     : [];
                 if (bound.length === 0)
                     return { grants: [] };
             }
-            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid]));
+            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid]));
             return { grants: rows.map((r) => r.rp_perm_key) };
         }
         catch (cause) {
@@ -147,11 +149,9 @@ class GrantAdminService {
             // Lock the role row FIRST — the posting path locks the same row before it inserts — then
             // re-run the binding rule on THIS connection, so a binding committed by a writer we waited
             // for is seen, and a role that became shared in the meantime is refused (rolled back).
-            await conn.query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? FOR UPDATE`, [
-                roleUuid,
-            ]);
+            await conn.query(`SELECT r_uuid FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? FOR UPDATE`, [roleUuid]);
             if (this.ceiling && actor.isRoot !== true) {
-                grant_ceiling_js_1.GrantCeiling.checkAdministrable(await (0, role_binding_js_1.readRoleBinding)(conn, roleUuid, (0, grant_ceiling_js_1.subtreeOf)(actor)));
+                grant_ceiling_js_1.GrantCeiling.checkAdministrable(await (0, role_binding_js_1.readRoleBinding)(conn, roleUuid, (0, grant_ceiling_js_1.subtreeOf)(actor), this.schemas));
                 // Phase 8 #2: a revocation strips authority from every holder of the role, so the actor
                 // must dominate each of them — checked under the role lock (no holder can appear unseen).
                 // Phase 9 #9: that includes the service accounts holding the role, judged as a role
@@ -196,12 +196,12 @@ class GrantAdminService {
         if (!this.audit)
             return;
         const query = (sql, params) => conn.query(sql, params);
-        const roleRows = (await query(`SELECT r_name FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
+        const roleRows = (await query(`SELECT r_name FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
         const tenants = [...new Set(bumpedTenants)];
         const nameOf = new Map();
         if (tenants.length > 0) {
             const ph = tenants.map(() => '?').join(', ');
-            const rows = (await query(`SELECT c_uuid, c_name FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${ph})`, tenants));
+            const rows = (await query(`SELECT c_uuid, c_name FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid IN (${ph})`, tenants));
             for (const r of rows)
                 nameOf.set(r.c_uuid, r.c_name);
         }
@@ -248,11 +248,11 @@ class GrantAdminService {
         const actorUuid = grantor.id;
         await this.writeGrants('role.permission_granted', roleUuid, [key], grantor, async (conn, k) => {
             // Idempotent insert — UNIQUE (rp_role_uuid, rp_perm_key); a duplicate is a no-op.
-            await conn.query(`INSERT INTO \`${AUTHZ}\`.\`role_permission\`
+            await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`role_permission\`
            (rp_uuid, rp_role_uuid, rp_perm_key, rp_granted_at, rp_granted_by)
            SELECT UUID(), ?, ?, UTC_TIMESTAMP(), ?
             WHERE NOT EXISTS (
-              SELECT 1 FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
+              SELECT 1 FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
             )`, [roleUuid, k, actorUuid ?? null, roleUuid, k]);
         });
     }
@@ -267,7 +267,7 @@ class GrantAdminService {
         roleUuid = await this.storedRoleUuid(roleUuid);
         await this.assertMayChangeGrants(roleUuid, [key], actor);
         await this.writeGrants('role.permission_revoked', roleUuid, [key], actor, async (conn, k) => {
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, k]);
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, k]);
         });
     }
     /**
@@ -301,16 +301,14 @@ class GrantAdminService {
             if (this.ceiling && actor.isRoot !== true) {
                 await this.ceiling.assertMayStripRoleFromServiceAccounts(actor, roleUuid, accounts.map((a) => a.sa_tenant_id), 'delete');
             }
-            const keys = (await conn.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid])).map((r) => r.rp_perm_key);
+            const keys = (await conn.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? ORDER BY rp_perm_key`, [roleUuid])).map((r) => r.rp_perm_key);
             const bumped = await this.bumper.bumpForRole(roleUuid, conn);
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ?`, [
-                roleUuid,
-            ]);
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ?`, [roleUuid]);
             const nowMs = Date.now();
             for (const a of accounts) {
                 const remaining = jsonIdArray(a.sa_role_ids).filter((id) => id !== roleUuid);
                 const previous = a.sa_updated_at_ms === null ? 0 : Number(a.sa_updated_at_ms);
-                await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_role_ids = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), Math.max(nowMs, previous + 1), a.sa_id]);
+                await conn.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET sa_role_ids = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), Math.max(nowMs, previous + 1), a.sa_id]);
             }
             await this.auditGrantChange(conn, 'role.permission_revoked', roleUuid, keys, actor, bumped, {
                 roleDeleted: true,
@@ -349,14 +347,11 @@ class GrantAdminService {
     async storedRoleUuid(roleUuid) {
         if (typeof roleUuid !== 'string' || roleUuid.length === 0)
             return roleUuid;
-        const rows = (await this.pool.query(`SELECT r_uuid FROM \`${APP}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
+        const rows = (await this.pool.query(`SELECT r_uuid FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid = ? LIMIT 1`, [roleUuid]));
         return rows[0]?.r_uuid ?? roleUuid;
     }
     lockAccountsHoldingRole(conn, roleUuid) {
-        return (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_role_ids, sa_updated_at_ms', {
-            sql: 'JSON_CONTAINS(sa_role_ids, JSON_QUOTE(?))',
-            params: [roleUuid],
-        });
+        return (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_role_ids, sa_updated_at_ms', { sql: 'JSON_CONTAINS(sa_role_ids, JSON_QUOTE(?))', params: [roleUuid] }, this.schemas);
     }
     // ── Access bundles ────────────────────────────────────────────────────────
     /** All active bundles + their resolved atomic keys, for the Access UI. */
@@ -385,11 +380,11 @@ class GrantAdminService {
         const actorUuid = grantor.id;
         await this.writeGrants('role.bundle_granted', roleUuid, keys, grantor, async (conn, key) => {
             // Idempotent — UNIQUE (rp_role_uuid, rp_perm_key); a duplicate is a no-op.
-            await conn.query(`INSERT INTO \`${AUTHZ}\`.\`role_permission\`
+            await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`role_permission\`
              (rp_uuid, rp_role_uuid, rp_perm_key, rp_granted_at, rp_granted_by)
              SELECT UUID(), ?, ?, UTC_TIMESTAMP(), ?
               WHERE NOT EXISTS (
-                SELECT 1 FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
+                SELECT 1 FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?
               )`, [roleUuid, key, actorUuid ?? null, roleUuid, key]);
         }, { bundle: bundleKey });
     }
@@ -405,7 +400,7 @@ class GrantAdminService {
         const keys = await this.resolveBundleKeysOrThrow(bundleKey);
         await this.assertMayChangeGrants(roleUuid, [...keys], actor);
         await this.writeGrants('role.bundle_revoked', roleUuid, keys, actor, async (conn, key) => {
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, key]);
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid = ? AND rp_perm_key = ?`, [roleUuid, key]);
         }, { bundle: bundleKey });
     }
     /** Resolve a bundle key → its atomic keys; throw BadKeyError when unknown/orphaned. */
@@ -451,14 +446,14 @@ class GrantAdminService {
             // identical on BOTH the count and page queries so they can never disagree.
             const scope = subtreeScope.isRoot
                 ? { sql: '', params: [] }
-                : (0, role_binding_js_1.subtreeExists)(subtreeScope.nodeIds);
+                : (0, role_binding_js_1.subtreeExists)(subtreeScope.nodeIds, this.schemas);
             // Distinct granted roles (a role appears iff it has ≥1 role_permission row), filtered
             // by name search. Bind the LIKE term as a param (wildcards escaped).
             const likeClause = search ? `AND r.r_name LIKE ?` : '';
             const likeArgs = search ? [`%${search.replace(/[%_\\]/g, '\\$&')}%`] : [];
             const [{ total = 0 } = {}] = (await this.pool.query(`SELECT COUNT(DISTINCT rp.rp_role_uuid) AS total
-           FROM \`${AUTHZ}\`.\`role_permission\` rp
-           JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
+           FROM \`${this.schemas.authz}\`.\`role_permission\` rp
+           JOIN \`${this.schemas.app}\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
           WHERE 1 = 1${scope.sql} ${likeClause}`, [...scope.params, ...likeArgs]));
             // The page of role uuids + name + latest-grant metadata. name/grantedAt sort in SQL;
             // permCount falls back to a stable name sort here (re-sorted after aggregation).
@@ -466,8 +461,8 @@ class GrantAdminService {
             const pageRoles = (await this.pool.query(`SELECT rp.rp_role_uuid AS role_uuid,
                 r.r_name        AS role_name,
                 MAX(rp.rp_granted_at) AS latest_at
-           FROM \`${AUTHZ}\`.\`role_permission\` rp
-           JOIN \`shield_app\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
+           FROM \`${this.schemas.authz}\`.\`role_permission\` rp
+           JOIN \`${this.schemas.app}\`.\`roles\` r ON r.r_uuid = rp.rp_role_uuid
           WHERE 1 = 1${scope.sql} ${likeClause}
           GROUP BY rp.rp_role_uuid, r.r_name
           ORDER BY ${orderCol} ${dir}, r.r_name ASC
@@ -482,8 +477,8 @@ class GrantAdminService {
                 rp.rp_perm_key   AS perm_key,
                 rp.rp_granted_at AS granted_at,
                 u.u_username     AS granted_by_name
-           FROM \`${AUTHZ}\`.\`role_permission\` rp
-           LEFT JOIN \`shield_app\`.\`users\` u ON u.u_uuid = rp.rp_granted_by
+           FROM \`${this.schemas.authz}\`.\`role_permission\` rp
+           LEFT JOIN \`${this.schemas.app}\`.\`users\` u ON u.u_uuid = rp.rp_granted_by
           WHERE rp.rp_role_uuid IN (${ph})`, roleUuids));
             const byRole = new Map();
             for (const row of grantRows) {

package/dist/features/authz/grant-ceiling.d.ts

@@ -15,6 +15,7 @@
 import type { Pool } from 'mariadb';
 import type { ModuleRegistry, Principal } from '@astram/core';
 import { type RoleBinding } from './role-binding.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** The grantor exceeds their own authority — cannot grant a key they do not hold (→ 403). */
 export declare class GrantCeilingError extends Error {
     constructor(key: string, message?: string);
@@ -43,6 +44,8 @@ export declare class GrantCeiling {
     private readonly registry;
     /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
     private readonly now;
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    private readonly schemas;
     private readonly rootIds;
     constructor(pool: Pool, registry: ModuleRegistry, 
     /**
@@ -53,7 +56,9 @@ export declare class GrantCeiling {
      */
     rootIds: readonly string[] | null, 
     /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
-    now?: () => number);
+    now?: () => number, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas?: IdentitySchemaNames);
     /** The D1 administer rule over a binding read: used inside and nowhere outside (404 / 403). */
     static checkAdministrable(b: RoleBinding): void;
     /** The #11 assign rule over a binding read: never a role also used outside (403). */

package/dist/features/authz/grant-ceiling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAetE,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IAbtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAU/C,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}
+{"version":3,"file":"grant-ceiling.d.ts","sourceRoot":"","sources":["../../../src/features/authz/grant-ceiling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAWtE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI1C;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,OAAO,EAAE,MAAM,GACd,OAAO,CAST;AAED;;;GAGG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAQzB,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAf1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoB;gBAGzB,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc;IACzC;;;;;OAKG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IACjC,+FAA+F;IAC9E,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAU3E,+FAA+F;IAC/F,MAAM,CAAC,kBAAkB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAS/C,qFAAqF;IACrF,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI;IAQ5C,oEAAoE;IACpE,OAAO,CAAC,cAAc;IAItB,+FAA+F;YACjF,cAAc;IAU5B,+FAA+F;YACjF,KAAK;IASnB;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAwB7D;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAahF;;;;;;OAMG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvF;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;OAMG;IACG,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+D5E;;;;;;;;;;;;OAYG;IACG,0BAA0B,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BnF;;;;;;;;;OASG;IACG,qCAAqC,CACzC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,SAAS,GAAE,QAAQ,GAAG,QAAmB,GACxC,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;;OAQG;IACG,8BAA8B,CAClC,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;;;;;;OAQG;IACG,uBAAuB,CAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,KAAK,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAC9F,OAAO,CAAC,IAAI,CAAC;IAuChB,+FAA+F;IACzF,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAM3E;;;;;OAKG;IACG,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhF;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI9E"}

package/dist/features/authz/grant-ceiling.js

@@ -9,8 +9,7 @@ const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.
 const role_binding_js_1 = require("./role-binding.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const service_account_service_js_1 = require("../service-account/service-account.service.js");
-const AUTHZ = 'shield_authz';
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /** The grantor exceeds their own authority — cannot grant a key they do not hold (→ 403). */
 class GrantCeilingError extends Error {
     constructor(key, message) {
@@ -54,6 +53,7 @@ class GrantCeiling {
     pool;
     registry;
     now;
+    schemas;
     rootIds;
     constructor(pool, registry, 
     /**
@@ -64,10 +64,13 @@ class GrantCeiling {
      */
     rootIds, 
     /** Injectable clock (epoch-ms) for the posting effective-window read; defaults to Date.now. */
-    now = Date.now) {
+    now = Date.now, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.registry = registry;
         this.now = now;
+        this.schemas = schemas;
         if (rootIds !== null && !Array.isArray(rootIds)) {
             throw new TypeError('GrantCeiling: rootIds is required (the root allowlist, or null when none is configured)');
         }
@@ -96,7 +99,7 @@ class GrantCeiling {
         if (roleIds.length === 0)
             return [];
         const ph = roleIds.map(() => '?').join(', ');
-        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, [...roleIds]));
+        const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, [...roleIds]));
         return rows.map((r) => r.rp_perm_key);
     }
     /** Run a store read, mapping any non-domain failure to AuthorizationUnavailableError (503). */
@@ -118,11 +121,11 @@ class GrantCeiling {
      */
     async effectiveKeys(grantor) {
         try {
-            const roleIds = await (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, grantor.id, grantor.tenantId, this.now);
+            const roleIds = await (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, grantor.id, grantor.tenantId, this.schemas, this.now);
             if (roleIds.length === 0)
                 return new Set();
             const ph = roleIds.map(() => '?').join(', ');
-            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${AUTHZ}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, roleIds));
+            const rows = (await this.pool.query(`SELECT rp_perm_key FROM \`${this.schemas.authz}\`.\`role_permission\` WHERE rp_role_uuid IN (${ph})`, roleIds));
             const raw = rows.map((r) => r.rp_perm_key);
             const registered = this.registry.listActions().map((a) => a.permissionKey);
             return new Set((0, db_permission_facts_adapter_js_1.expandGrantKeys)(raw, registered));
@@ -198,13 +201,13 @@ class GrantCeiling {
         }
         const subtree = new Set(subtreeOf(actor));
         const { companies, roleIds, superuser, storedId } = await this.facts('target memberships', async () => {
-            const su = (await this.pool.query(`SELECT u_uuid, u_is_platform_superuser AS su FROM \`${APP}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
+            const su = (await this.pool.query(`SELECT u_uuid, u_is_platform_superuser AS su FROM \`${this.schemas.app}\`.\`users\` WHERE u_uuid = ? LIMIT 1`, [targetUserId]));
             const memberships = (await this.pool.query(`SELECT DISTINCT cm_company_uuid AS company
-           FROM \`${APP}\`.\`company_membership\`
+           FROM \`${this.schemas.app}\`.\`company_membership\`
           WHERE cm_user_uuid = ?`, [targetUserId]));
             const postings = (await this.pool.query(`SELECT DISTINCT mp.mp_role_uuid AS role_uuid
-           FROM \`${APP}\`.\`membership_posting\` mp
-           JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+           FROM \`${this.schemas.app}\`.\`membership_posting\` mp
+           JOIN \`${this.schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
           WHERE cm.cm_user_uuid = ?`, [targetUserId]));
             return {
                 companies: memberships.map((m) => m.company),
@@ -253,8 +256,8 @@ class GrantCeiling {
             return;
         const holders = await this.facts('role holders', async () => {
             const rows = (await this.pool.query(`SELECT DISTINCT cm.cm_user_uuid AS holder
-           FROM \`${APP}\`.\`membership_posting\` mp
-           JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+           FROM \`${this.schemas.app}\`.\`membership_posting\` mp
+           JOIN \`${this.schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
           WHERE mp.mp_role_uuid = ?`, [roleUuid]));
             return rows.map((r) => r.holder);
         });
@@ -298,7 +301,7 @@ class GrantCeiling {
         const nodes = (0, service_account_service_js_1.ceilingOf)(admin, []);
         if (accountTenantIds.some((t) => !(0, service_account_service_js_1.ceilingAllowsNode)(nodes, t)))
             throw refuse();
-        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.now));
+        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.schemas, this.now));
         if (!(0, service_account_service_js_1.ceilingAllowsRole)((0, service_account_service_js_1.ceilingOf)(admin, held), roleUuid))
             throw refuse();
     }
@@ -328,7 +331,7 @@ class GrantCeiling {
             throw refuse();
         if (accounts.every((a) => a.roleIds.length === 0))
             return;
-        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.now));
+        const held = await this.facts('held roles', () => (0, db_permission_facts_adapter_js_1.readRoleIdsForTenant)(this.pool, actor.id, actor.tenantId, this.schemas, this.now));
         const ceiling = (0, service_account_service_js_1.ceilingOf)(admin, held);
         if (accounts.some((a) => a.roleIds.some((r) => !(0, service_account_service_js_1.ceilingAllowsRole)(ceiling, r)))) {
             throw refuse();
@@ -350,7 +353,7 @@ class GrantCeiling {
                 return;
             if (companyUuid === null)
                 throw new identity_errors_js_1.IdentityBadRequestError(message);
-            const rows = await this.facts('company org units', async () => (await this.pool.query(`SELECT ${unitCol} AS unit FROM \`${APP}\`.\`${table}\`
+            const rows = await this.facts('company org units', async () => (await this.pool.query(`SELECT ${unitCol} AS unit FROM \`${this.schemas.app}\`.\`${table}\`
             WHERE ${companyCol} = ? AND ${unitCol} IN (${wanted.map(() => '?').join(', ')})`, [companyUuid, ...wanted])));
             const linked = new Set(rows.map((r) => r.unit));
             if (wanted.some((u) => !linked.has(u)))
@@ -361,7 +364,7 @@ class GrantCeiling {
     }
     /** Where `roleUuid` is bound relative to the actor's subtree (postings + service accounts). */
     async roleBinding(actor, roleUuid) {
-        return this.facts('role binding', () => (0, role_binding_js_1.readRoleBinding)(this.pool, roleUuid, subtreeOf(actor)));
+        return this.facts('role binding', () => (0, role_binding_js_1.readRoleBinding)(this.pool, roleUuid, subtreeOf(actor), this.schemas));
     }
     /**
      * Assert the actor may ADMINISTER the role — edit its grants, rename or delete it (#1, D1

package/dist/features/authz/mariadb-catalog-store.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { CatalogStore, CatalogPermissionRow } from '@astram/guard';
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * CatalogStore impl over shield_authz.permission (raw parameterized SQL, mirroring
  * permission-facts.adapter). The reconciler (framework) calls this; guard does no DB
@@ -7,7 +8,9 @@ import type { CatalogStore, CatalogPermissionRow } from '@astram/guard';
  */
 export declare class MariaDbCatalogStore implements CatalogStore {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     listPermissions(): Promise<CatalogPermissionRow[]>;
     upsertPermission(row: Omit<CatalogPermissionRow, 'status'>): Promise<boolean>;
     markOrphaned(keys: readonly string[]): Promise<void>;

package/dist/features/authz/mariadb-catalog-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mariadb-catalog-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/mariadb-catalog-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAIxE;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEjC,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBlD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB7E,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASpD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzD"}
+{"version":3,"file":"mariadb-catalog-store.d.ts","sourceRoot":"","sources":["../../../src/features/authz/mariadb-catalog-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IAGpD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,4FAA4F;gBAEzE,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAGrE,eAAe,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBlD,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB7E,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IASpD,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzD"}

package/dist/features/authz/mariadb-catalog-store.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MariaDbCatalogStore = void 0;
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /**
  * CatalogStore impl over shield_authz.permission (raw parameterized SQL, mirroring
  * permission-facts.adapter). The reconciler (framework) calls this; guard does no DB
@@ -9,12 +9,15 @@ const AUTHZ = 'shield_authz';
  */
 class MariaDbCatalogStore {
     pool;
-    constructor(pool) {
+    schemas;
+    /** @param schemas resolved framework names (absent ⇒ resolved from the namespace, once). */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     async listPermissions() {
         const rows = (await this.pool.query(`SELECT perm_key, perm_module, perm_type_key, perm_action, perm_label, perm_tier, perm_status
-         FROM \`${AUTHZ}\`.\`permission\``));
+         FROM \`${this.schemas.authz}\`.\`permission\``));
         return rows.map((r) => ({
             permissionKey: r.perm_key,
             moduleKey: r.perm_module,
@@ -26,10 +29,10 @@ class MariaDbCatalogStore {
         }));
     }
     async upsertPermission(row) {
-        const res = (await this.pool.query(`INSERT INTO \`${AUTHZ}\`.\`permission\`
+        const res = (await this.pool.query(`INSERT INTO \`${this.schemas.authz}\`.\`permission\`
          (perm_uuid, perm_key, perm_module, perm_type_key, perm_action, perm_label, perm_tier, perm_status)
          SELECT UUID(), ?, ?, ?, ?, ?, ?, 'active'
-          WHERE NOT EXISTS (SELECT 1 FROM \`${AUTHZ}\`.\`permission\` WHERE perm_key = ?)`, [
+          WHERE NOT EXISTS (SELECT 1 FROM \`${this.schemas.authz}\`.\`permission\` WHERE perm_key = ?)`, [
             row.permissionKey,
             row.moduleKey,
             row.typeKey,
@@ -44,13 +47,13 @@ class MariaDbCatalogStore {
         if (keys.length === 0)
             return;
         const ph = keys.map(() => '?').join(', ');
-        await this.pool.query(`UPDATE \`${AUTHZ}\`.\`permission\` SET perm_status = 'orphaned' WHERE perm_key IN (${ph})`, [...keys]);
+        await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`permission\` SET perm_status = 'orphaned' WHERE perm_key IN (${ph})`, [...keys]);
     }
     async markActive(keys) {
         if (keys.length === 0)
             return;
         const ph = keys.map(() => '?').join(', ');
-        await this.pool.query(`UPDATE \`${AUTHZ}\`.\`permission\` SET perm_status = 'active' WHERE perm_key IN (${ph})`, [...keys]);
+        await this.pool.query(`UPDATE \`${this.schemas.authz}\`.\`permission\` SET perm_status = 'active' WHERE perm_key IN (${ph})`, [...keys]);
     }
 }
 exports.MariaDbCatalogStore = MariaDbCatalogStore;

package/dist/features/authz/permission-version.bumper.d.ts

@@ -1,3 +1,4 @@
+import { type IdentitySchemaNames } from '../../schema.js';
 /**
  * The minimal query surface this writer needs — a `mariadb` `Pool` (or `PoolConnection`)
  * satisfies it structurally, but the type itself stays framework-agnostic so this signature
@@ -29,6 +30,7 @@ export interface VersionPublisher {
 }
 export declare class PermissionVersionBumper {
     private publisher?;
+    private readonly schemas;
     /**
      * Bumped versions waiting for their transaction to commit, per connection (ADR-0035). A
      * transaction connection is a pooled object reused across requests, so callers either publish
@@ -39,8 +41,11 @@ export declare class PermissionVersionBumper {
     /**
      * @param publisher OPTIONAL Redis publisher (ADR-0035). Absent → DB-only bumps, exactly as
      *   before (no read-back). `IdentityFeatureModule` attaches the guard's cache through DI.
+     * @param schemas resolved framework names: `authz_permission_version` lives in `schemas.authz`
+     *   (ADR-0011), the membership/posting join `bumpForRole` walks in `schemas.app`. Absent ⇒
+     *   resolved from the namespace, once, here.
      */
-    constructor(publisher?: VersionPublisher | undefined);
+    constructor(publisher?: VersionPublisher | undefined, schemas?: IdentitySchemaNames);
     /** Attach the Redis publisher once it is resolved through DI (first attach wins). */
     attachVersionPublisher(publisher: VersionPublisher): void;
     /**

package/dist/features/authz/permission-version.bumper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-version.bumper.d.ts","sourceRoot":"","sources":["../../../src/features/authz/permission-version.bumper.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;;;;;;;;;;;GAaG;AACH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAOD,qBAAa,uBAAuB;IAatB,OAAO,CAAC,SAAS,CAAC;IAZ9B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE;;;OAGG;gBACiB,SAAS,CAAC,EAAE,gBAAgB,YAAA;IAEhD,qFAAqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI;IAIzD;;;OAGG;IACG,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,kFAAkF;IAClF,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;YAIvB,WAAW;IAUzB;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmB1E;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBvE;;;;;;OAMG;YACW,UAAU;CA4BzB"}
+{"version":3,"file":"permission-version.bumper.d.ts","sourceRoot":"","sources":["../../../src/features/authz/permission-version.bumper.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;;;;;;;;;;;GAaG;AACH;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAOD,qBAAa,uBAAuB;IAiBhC,OAAO,CAAC,SAAS,CAAC;IAClB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAjB1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE;;;;;;OAMG;gBAEO,SAAS,CAAC,EAAE,gBAAgB,YAAA,EACnB,OAAO,GAAE,mBAA+C;IAG3E,qFAAqF;IACrF,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,GAAG,IAAI;IAIzD;;;OAGG;IACG,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,kFAAkF;IAClF,cAAc,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI;YAIvB,WAAW;IAUzB;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYvE;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmB1E;;;;;;OAMG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBvE;;;;;;OAMG;YACW,UAAU;CA4BzB"}

package/dist/features/authz/permission-version.bumper.js

@@ -3,16 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PermissionVersionBumper = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@astram/core");
-/** Schema the `authz_permission_version` table lives in (ADR-0011). */
-const AUTHZ = 'shield_authz';
-/** Schema the membership/posting tables live in — the join `bumpForRole` walks. */
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /** An autocommit pool (it hands out connections) rather than one transaction's connection. */
 function isAutocommitPool(conn) {
     return typeof conn.getConnection === 'function';
 }
 class PermissionVersionBumper {
     publisher;
+    schemas;
     /**
      * Bumped versions waiting for their transaction to commit, per connection (ADR-0035). A
      * transaction connection is a pooled object reused across requests, so callers either publish
@@ -23,9 +21,13 @@ class PermissionVersionBumper {
     /**
      * @param publisher OPTIONAL Redis publisher (ADR-0035). Absent → DB-only bumps, exactly as
      *   before (no read-back). `IdentityFeatureModule` attaches the guard's cache through DI.
+     * @param schemas resolved framework names: `authz_permission_version` lives in `schemas.authz`
+     *   (ADR-0011), the membership/posting join `bumpForRole` walks in `schemas.app`. Absent ⇒
+     *   resolved from the namespace, once, here.
      */
-    constructor(publisher) {
+    constructor(publisher, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.publisher = publisher;
+        this.schemas = schemas;
     }
     /** Attach the Redis publisher once it is resolved through DI (first attach wins). */
     attachVersionPublisher(publisher) {
@@ -100,13 +102,13 @@ class PermissionVersionBumper {
      */
     async tenantsForRole(roleUuid, conn) {
         const rows = (await conn.query(`SELECT DISTINCT cm.cm_company_uuid AS tenant
-         FROM \`${APP}\`.\`company_membership\` cm
-         JOIN \`${APP}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
+         FROM \`${this.schemas.app}\`.\`company_membership\` cm
+         JOIN \`${this.schemas.app}\`.\`membership_posting\` mp ON mp.mp_membership_uuid = cm.cm_uuid
         WHERE mp.mp_role_uuid = ? AND cm.cm_is_active = 1`, [roleUuid]));
         // Service accounts (ADR-0033) hold roles on `sa_role_ids`, not postings: a role held only by
         // machine principals must still invalidate their tenants' cached grants (security hardening).
         const saRows = (await conn.query(`SELECT DISTINCT sa.sa_tenant_id AS tenant
-         FROM \`${APP}\`.\`service_account\` sa
+         FROM \`${this.schemas.app}\`.\`service_account\` sa
         WHERE JSON_CONTAINS(sa.sa_role_ids, JSON_QUOTE(?))`, [roleUuid]));
         return [...new Set([...rows, ...saRows].map((r) => r.tenant))];
     }
@@ -120,7 +122,7 @@ class PermissionVersionBumper {
     async bumpForUser(userUuid, conn) {
         try {
             const rows = (await conn.query(`SELECT DISTINCT cm.cm_company_uuid AS tenant
-           FROM \`${APP}\`.\`company_membership\` cm
+           FROM \`${this.schemas.app}\`.\`company_membership\` cm
           WHERE cm.cm_user_uuid = ?`, [userUuid]));
             const tenants = [...new Set(rows.map((r) => r.tenant))];
             for (const tenant of tenants)
@@ -139,14 +141,14 @@ class PermissionVersionBumper {
      * (the TTL bounds it) and never fails the bump.
      */
     async bumpTenant(tenantUuid, conn) {
-        await conn.query(`INSERT INTO \`${AUTHZ}\`.\`authz_permission_version\` (apv_tenant_uuid, apv_version)
+        await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`authz_permission_version\` (apv_tenant_uuid, apv_version)
          VALUES (?, 1)
        ON DUPLICATE KEY UPDATE apv_version = apv_version + 1`, [tenantUuid]);
         if (this.publisher === undefined)
             return;
         let version;
         try {
-            const rows = (await conn.query(`SELECT apv_version FROM \`${AUTHZ}\`.\`authz_permission_version\`
+            const rows = (await conn.query(`SELECT apv_version FROM \`${this.schemas.authz}\`.\`authz_permission_version\`
           WHERE apv_tenant_uuid = ? LIMIT 1`, [tenantUuid]));
             version = Number(rows[0]?.apv_version);
         }

package/dist/features/authz/record-authorization.d.ts

@@ -12,14 +12,26 @@
  * adapted to `@astram/identity`'s own registrations (`identityObjects`) and env prefix (`APP_DB_*`).
  */
 import { type Pool } from 'mariadb';
+import type { FrameworkSchemas } from '@astram/core';
 import { type RecordAuthorizationInputs } from '@astram/guard';
 import type { ObjectTypeInput } from '@astram/engine';
+import type { IdentitySchemaNames } from '../../schema.js';
+/**
+ * A pool-size variable: unset or blank gives `undefined`; otherwise plain digits, a positive safe
+ * integer, or it throws naming the variable (never the value). The single-layout pool budget in
+ * `@astram/guard` (`loadPoolBudget`) applies the same rule, so the budget counts the pools that open.
+ */
+export declare function strictPoolSize(raw: string | undefined, name: string): number | undefined;
+/** The authz pool cap: `APP_AUTHZ_POOL_MAX` (strict), else 4. */
+export declare function authzPoolLimit(env?: NodeJS.ProcessEnv): number;
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
  * Opens the pool at CALL time (never at import) — the caller owns closing it.
+ * `schemas` (the names `forRoot` resolved or was given) set the default database and user; absent
+ * ⇒ from the env namespace. An explicit `APP_DB_USER` / `APP_DB_NAME` wins (QA P2-5).
  */
-export declare function createIdentityAuthzPool(): Pool;
+export declare function createIdentityAuthzPool(schemas?: FrameworkSchemas): Pool;
 /**
  * Build the `RecordAuthorizationInputs` over `pool`. `@astram/identity` supplies only the
  * app-schema ports:
@@ -31,5 +43,7 @@ export declare function createIdentityAuthzPool(): Pool;
  *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
  */
-export declare function buildRecordAuthorizationInputs(pool: Pool, extraObjects?: readonly ObjectTypeInput[]): RecordAuthorizationInputs;
+export declare function buildRecordAuthorizationInputs(pool: Pool, extraObjects?: readonly ObjectTypeInput[], 
+/** Resolved framework names for the facts adapter (absent ⇒ from the namespace, once). */
+schemas?: IdentitySchemaNames): RecordAuthorizationInputs;
 //# sourceMappingURL=record-authorization.d.ts.map

package/dist/features/authz/record-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAa9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO,GAC5C,yBAAyB,CAS3B"}
+{"version":3,"file":"record-authorization.d.ts","sourceRoot":"","sources":["../../../src/features/authz/record-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAgB,EAAE,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAItD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxF;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAaxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,IAAI,EACV,YAAY,GAAE,SAAS,eAAe,EAAO;AAC7C,0FAA0F;AAC1F,OAAO,CAAC,EAAE,mBAAmB,GAC5B,yBAAyB,CAS3B"}