@astram/identity 0.11.0 → 0.13.0

package/dist/features/authz/record-authorization.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.strictPoolSize = strictPoolSize;
+exports.authzPoolLimit = authzPoolLimit;
 exports.createIdentityAuthzPool = createIdentityAuthzPool;
 exports.buildRecordAuthorizationInputs = buildRecordAuthorizationInputs;
 /**
@@ -23,13 +25,33 @@ const guard_1 = require("@astram/guard");
 const objects_js_1 = require("../../objects.js");
 const db_permission_facts_adapter_js_1 = require("./db-permission-facts.adapter.js");
 const session_facts_reader_js_1 = require("./session-facts.reader.js");
+/**
+ * A pool-size variable: unset or blank gives `undefined`; otherwise plain digits, a positive safe
+ * integer, or it throws naming the variable (never the value). The single-layout pool budget in
+ * `@astram/guard` (`loadPoolBudget`) applies the same rule, so the budget counts the pools that open.
+ */
+function strictPoolSize(raw, name) {
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const t = raw.trim();
+    const n = /^[0-9]+$/.test(t) ? Number(t) : Number.NaN;
+    if (!Number.isSafeInteger(n) || n < 1)
+        throw new Error(`${name} must be a positive integer`);
+    return n;
+}
+/** The authz pool cap: `APP_AUTHZ_POOL_MAX` (strict), else 4. */
+function authzPoolLimit(env = process.env) {
+    return strictPoolSize(env.APP_AUTHZ_POOL_MAX, 'APP_AUTHZ_POOL_MAX') ?? 4;
+}
 /**
  * A lean `mariadb` pool for the authz grant-reads (built from `APP_DB_*` env via guard's
  * `loadDbConfig`). Kept small — these are pre-gate coarse-grant reads, not the main CRUD pool.
  * Opens the pool at CALL time (never at import) — the caller owns closing it.
+ * `schemas` (the names `forRoot` resolved or was given) set the default database and user; absent
+ * ⇒ from the env namespace. An explicit `APP_DB_USER` / `APP_DB_NAME` wins (QA P2-5).
  */
-function createIdentityAuthzPool() {
-    const db = (0, guard_1.loadDbConfig)();
+function createIdentityAuthzPool(schemas) {
+    const db = schemas === undefined ? (0, guard_1.loadDbConfig)() : (0, guard_1.loadDbConfig)(process.env, schemas);
     const ssl = (0, guard_1.mariadbSslOption)(db.tls);
     return mariadb_1.default.createPool({
         host: db.host,
@@ -37,7 +59,7 @@ function createIdentityAuthzPool() {
         user: db.user,
         password: db.password,
         database: db.database,
-        connectionLimit: Number(process.env.APP_AUTHZ_POOL_MAX ?? 4),
+        connectionLimit: authzPoolLimit(process.env),
         // Phase 16: APP_DB_TLS / APP_DB_TLS_CA (production accounts are REQUIRE SSL).
         ...(ssl ? { ssl } : {}),
     });
@@ -53,11 +75,13 @@ function createIdentityAuthzPool() {
  *     consumer type is `resource_not_registered`),
  *   - `operationManifest` — empty (identity declares no trusted delegated operations).
  */
-function buildRecordAuthorizationInputs(pool, extraObjects = []) {
+function buildRecordAuthorizationInputs(pool, extraObjects = [], 
+/** Resolved framework names for the facts adapter (absent ⇒ from the namespace, once). */
+schemas) {
     const registry = (0, guard_1.buildIdentityModuleRegistry)([...objects_js_1.identityObjects, ...extraObjects]);
     return {
         pool,
-        permissionFacts: new db_permission_facts_adapter_js_1.DbPermissionFactsAdapter(pool, registry),
+        permissionFacts: new db_permission_facts_adapter_js_1.DbPermissionFactsAdapter(pool, registry, undefined, schemas),
         sessionFacts: new session_facts_reader_js_1.AlsSessionFactsReader(),
         registry,
         operationManifest: [],

package/dist/features/authz/role-binding.d.ts

@@ -13,6 +13,7 @@
  * the role id are `?`-bound (never interpolated).
  */
 import type { Queryable } from './permission-version.bumper.js';
+import type { IdentitySchemaNames } from '../../schema.js';
 /** Where a role is bound relative to a set of subtree nodes. */
 export interface RoleBinding {
     readonly inside: boolean;
@@ -23,7 +24,7 @@ export interface RoleBinding {
  * qualifies only if it is bound (`membership_posting → company_membership`) to a node in the
  * subtree. The caller splices `params` where `sql` sits in the surrounding query.
  */
-export declare function subtreeExists(nodeIds: readonly string[]): {
+export declare function subtreeExists(nodeIds: readonly string[], schemas: IdentitySchemaNames): {
     sql: string;
     params: string[];
 };
@@ -32,5 +33,5 @@ export declare function subtreeExists(nodeIds: readonly string[]): {
  * query. An empty `nodeIds` is treated as "nothing is inside" (every binding is outside) — fail
  * closed, never an `IN ()` syntax error.
  */
-export declare function readRoleBinding(q: Queryable, roleUuid: string, nodeIds: readonly string[]): Promise<RoleBinding>;
+export declare function readRoleBinding(q: Queryable, roleUuid: string, nodeIds: readonly string[], schemas: IdentitySchemaNames): Promise<RoleBinding>;
 //# sourceMappingURL=role-binding.d.ts.map

package/dist/features/authz/role-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-binding.d.ts","sourceRoot":"","sources":["../../../src/features/authz/role-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAIhE,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAQ3F;AASD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,SAAS,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,WAAW,CAAC,CAwBtB"}
+{"version":3,"file":"role-binding.d.ts","sourceRoot":"","sources":["../../../src/features/authz/role-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,mBAAmB,GAC3B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAQnC;AASD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,SAAS,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,CAAC,CAwBtB"}

package/dist/features/authz/role-binding.js

@@ -2,17 +2,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.subtreeExists = subtreeExists;
 exports.readRoleBinding = readRoleBinding;
-const APP = 'shield_app';
 /**
  * The shared EXISTS-subtree fragment for a non-root caller's READS (Task 4.2): a role row `r`
  * qualifies only if it is bound (`membership_posting → company_membership`) to a node in the
  * subtree. The caller splices `params` where `sql` sits in the surrounding query.
  */
-function subtreeExists(nodeIds) {
+function subtreeExists(nodeIds, schemas) {
     const ph = nodeIds.map(() => '?').join(', ');
     const sql = ` AND EXISTS (` +
-        `SELECT 1 FROM \`${APP}\`.\`membership_posting\` mp` +
-        ` JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid` +
+        `SELECT 1 FROM \`${schemas.app}\`.\`membership_posting\` mp` +
+        ` JOIN \`${schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid` +
         ` WHERE mp.mp_role_uuid = r.r_uuid AND cm.cm_company_uuid IN (${ph}))`;
     return { sql, params: [...nodeIds] };
 }
@@ -29,7 +28,7 @@ function truthy(v) {
  * query. An empty `nodeIds` is treated as "nothing is inside" (every binding is outside) — fail
  * closed, never an `IN ()` syntax error.
  */
-async function readRoleBinding(q, roleUuid, nodeIds) {
+async function readRoleBinding(q, roleUuid, nodeIds, schemas) {
     const ids = nodeIds.length > 0 ? [...nodeIds] : [];
     const inList = ids.length > 0 ? ids.map(() => '?').join(', ') : 'NULL';
     // `x IN (NULL)` is NULL (never true) and `x NOT IN (NULL)` is NULL too, so for an empty list the
@@ -40,12 +39,12 @@ async function readRoleBinding(q, roleUuid, nodeIds) {
             COALESCE(MAX(${outsideExpr}), 0) AS bound_outside
        FROM (
          SELECT cm.cm_company_uuid AS node
-           FROM \`${APP}\`.\`membership_posting\` mp
-           JOIN \`${APP}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
+           FROM \`${schemas.app}\`.\`membership_posting\` mp
+           JOIN \`${schemas.app}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid
           WHERE mp.mp_role_uuid = ?
          UNION ALL
          SELECT sa.sa_tenant_id AS node
-           FROM \`${APP}\`.\`service_account\` sa
+           FROM \`${schemas.app}\`.\`service_account\` sa
           WHERE JSON_CONTAINS(sa.sa_role_ids, JSON_QUOTE(?))
        ) b`, [...ids, ...ids, roleUuid, roleUuid]));
     const row = rows[0];

package/dist/features/company/company-hierarchy.service.d.ts

@@ -21,6 +21,7 @@
 import type { Principal } from '@astram/core';
 import type { AuditPort } from '@astram/engine';
 import { ScopeClosureService } from '../scope/scope-closure.service.js';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** The read surface used for existence/name lookups (the shared authz pool satisfies it). */
 export interface HierarchyQueryable {
     query(sql: string, params?: readonly unknown[]): Promise<unknown>;
@@ -49,9 +50,13 @@ export declare class CompanyHierarchyService {
     private readonly ceiling;
     private readonly audit?;
     private readonly now;
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    private readonly schemas;
     constructor(pool: HierarchyQueryable, closure: ScopeClosureService, 
     /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
-    ceiling: MemberDominance, audit?: AuditPort | undefined, now?: () => number);
+    ceiling: MemberDominance, audit?: AuditPort | undefined, now?: () => number, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas?: IdentitySchemaNames);
     /** The actor's own root node (see {@link ownRootOf}). */
     private ownRoot;
     /**

package/dist/features/company/company-hierarchy.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAWxF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAuCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBALH,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAiF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IA+BpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}
+{"version":3,"file":"company-hierarchy.service.d.ts","sourceRoot":"","sources":["../../../src/features/company/company-hierarchy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAkB,MAAM,mCAAmC,CAAC;AAQxF,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,8BAA8B,CAC5B,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAqCD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAElD;AAED,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAPP,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,mBAAmB;IAC7C,2FAA2F;IAC1E,OAAO,EAAE,eAAe,EACxB,KAAK,CAAC,EAAE,SAAS,YAAA,EACjB,GAAG,GAAE,MAAM,MAAiB;IAC7C,mFAAmF;IAClE,OAAO,GAAE,mBAA+C;IAG3E,yDAAyD;IACzD,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;YACW,UAAU;IAQxB,uDAAuD;YACzC,KAAK;YAUL,WAAW;IAqBzB,iGAAiG;IAC3F,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD3F;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAkF9B,0FAA0F;YAC5E,kBAAkB;IAmDhC,wFAAwF;YAC1E,sBAAsB;IAgCpC,wFAAwF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/features/company/company-hierarchy.service.js

@@ -6,8 +6,7 @@ const http_js_1 = require("../shared/http.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const lock_service_accounts_js_1 = require("../service-account/lock-service-accounts.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
-const APP = 'shield_app';
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /** A JSON-array column (the driver returns an array OR a string) → its string items; else []. */
 function jsonIdArray(v) {
     let arr = v;
@@ -34,14 +33,18 @@ class CompanyHierarchyService {
     ceiling;
     audit;
     now;
+    schemas;
     constructor(pool, closure, 
     /** Phase 8 #3: required — a company delete must dominate every member (no silent skip). */
-    ceiling, audit, now = Date.now) {
+    ceiling, audit, now = Date.now, 
+    /** Resolved framework names (absent ⇒ resolved from the namespace, once, here). */
+    schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.closure = closure;
         this.ceiling = ceiling;
         this.audit = audit;
         this.now = now;
+        this.schemas = schemas;
     }
     /** The actor's own root node (see {@link ownRootOf}). */
     ownRoot(actor) {
@@ -54,7 +57,7 @@ class CompanyHierarchyService {
      * stored spelling once and passes that down. Unknown → the input unchanged (later steps 404).
      */
     async storedUuid(uuid) {
-        const rows = (await this.pool.query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [uuid]));
+        const rows = (await this.pool.query(`SELECT c_uuid FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [uuid]));
         return rows[0]?.c_uuid ?? uuid;
     }
     /** Names of the given companies (unknown → absent). */
@@ -62,7 +65,7 @@ class CompanyHierarchyService {
         const unique = [...new Set(ids)];
         if (unique.length === 0)
             return new Map();
-        const rows = (await q.query(`SELECT c_uuid, c_name FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${unique.map(() => '?').join(', ')})`, unique));
+        const rows = (await q.query(`SELECT c_uuid, c_name FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid IN (${unique.map(() => '?').join(', ')})`, unique));
         return new Map(rows.map((r) => [r.c_uuid, r.c_name]));
     }
     async recordAudit(conn, actor, action, attributes, tenantId = actor.tenantId) {
@@ -109,7 +112,7 @@ class CompanyHierarchyService {
         if (newParentUuid !== null && !names.has(newParentUuid)) {
             throw new identity_errors_js_1.IdentityNotFoundError('Parent company not found.');
         }
-        const oldParentRows = (await this.pool.query(`SELECT c_parent_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [nodeUuid]));
+        const oldParentRows = (await this.pool.query(`SELECT c_parent_uuid FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? LIMIT 1`, [nodeUuid]));
         const oldParent = oldParentRows[0]?.c_parent_uuid ?? null;
         const oldParentName = oldParent
             ? (await this.names(this.pool, [oldParent])).get(oldParent)
@@ -183,7 +186,7 @@ class CompanyHierarchyService {
         const agents = await (0, lock_service_accounts_js_1.lockServiceAccountsWhere)(conn, 'sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_updated_at_ms', {
             sql: 'sa_tenant_id = ? OR JSON_CONTAINS(sa_scope_subtree, JSON_QUOTE(?))',
             params: [nodeUuid, nodeUuid],
-        });
+        }, this.schemas);
         const own = agents.filter((a) => a.sa_tenant_id === nodeUuid);
         const others = agents.filter((a) => a.sa_tenant_id !== nodeUuid);
         // Root bypasses inside; a refusal (403, names no agent) rolls the whole delete back.
@@ -196,8 +199,8 @@ class CompanyHierarchyService {
         const touched = new Set();
         const editStamp = (a) => Math.max(nowMs, (a.sa_updated_at_ms == null ? 0 : Number(a.sa_updated_at_ms)) + 1);
         const retire = async (a, reason) => {
-            await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_status = 'disabled', sa_updated_at_ms = ? WHERE sa_id = ?`, [editStamp(a), a.sa_id]);
-            const res = (await conn.query(`UPDATE \`${AUTHZ}\`.\`service_account_key\`
+            await conn.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET sa_status = 'disabled', sa_updated_at_ms = ? WHERE sa_id = ?`, [editStamp(a), a.sa_id]);
+            const res = (await conn.query(`UPDATE \`${this.schemas.authz}\`.\`service_account_key\`
             SET sak_revoked_at_ms = ?
           WHERE sak_account_id = ? AND sak_revoked_at_ms IS NULL`, [nowMs, a.sa_id]));
             touched.add(a.sa_tenant_id);
@@ -218,7 +221,7 @@ class CompanyHierarchyService {
                 await retire(a, 'scope_company_deleted');
                 continue;
             }
-            await conn.query(`UPDATE \`${APP}\`.\`service_account\` SET sa_scope_subtree = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), editStamp(a), a.sa_id]);
+            await conn.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET sa_scope_subtree = ?, sa_updated_at_ms = ? WHERE sa_id = ?`, [JSON.stringify(remaining), editStamp(a), a.sa_id]);
             touched.add(a.sa_tenant_id);
             await this.recordAudit(conn, actor, 'service_account.updated', {
                 eventType: 'service_account',
@@ -236,7 +239,7 @@ class CompanyHierarchyService {
     async revokeGrantsNaming(conn, actor, nodeUuid, companyName) {
         const grants = (await conn.query(`SELECT ctg_uuid, ctg_owning_tenant_uuid, ctg_grantee_tenant_uuid, ctg_grantee_kind,
               ctg_grantee_uuid, ctg_type_key, ctg_scope, ctg_allowed_actions
-         FROM \`${AUTHZ}\`.\`cross_tenant_grant\`
+         FROM \`${this.schemas.authz}\`.\`cross_tenant_grant\`
         WHERE (ctg_owning_tenant_uuid = ? OR ctg_grantee_tenant_uuid = ?)
           AND ctg_status <> 'revoked'
         ORDER BY ctg_uuid
@@ -247,7 +250,7 @@ class CompanyHierarchyService {
         const otherSides = grants.map((g) => g.ctg_owning_tenant_uuid === nodeUuid ? g.ctg_grantee_tenant_uuid : g.ctg_owning_tenant_uuid);
         const names = await this.names(conn, otherSides);
         for (const [i, g] of grants.entries()) {
-            await conn.query(`UPDATE \`${AUTHZ}\`.\`cross_tenant_grant\`
+            await conn.query(`UPDATE \`${this.schemas.authz}\`.\`cross_tenant_grant\`
             SET ctg_status = 'revoked', ctg_revoked_at = ?
           WHERE ctg_uuid = ? AND ctg_status <> 'revoked'`, [revokedAt, g.ctg_uuid]);
             const other = otherSides[i];
@@ -273,12 +276,10 @@ class CompanyHierarchyService {
     }
     /** Lock the company, then require dominance over each of its members (see `remove`). */
     async assertMayDeleteMembers(conn, actor, nodeUuid) {
-        await conn.query(`SELECT c_uuid FROM \`${APP}\`.\`companies\` WHERE c_uuid = ? FOR UPDATE`, [
-            nodeUuid,
-        ]);
+        await conn.query(`SELECT c_uuid FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ? FOR UPDATE`, [nodeUuid]);
         if (actor.isRoot === true)
             return;
-        const rows = (await conn.query(`SELECT cm_user_uuid AS member FROM \`${APP}\`.\`company_membership\`
+        const rows = (await conn.query(`SELECT cm_user_uuid AS member FROM \`${this.schemas.app}\`.\`company_membership\`
         WHERE cm_company_uuid = ? FOR UPDATE`, [nodeUuid]));
         const members = [...new Set(rows.map((r) => r.member))].sort();
         for (const member of members) {

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts

@@ -1,5 +1,6 @@
 import type { Pool } from 'mariadb';
 import type { ObjectTypeInput } from '@astram/engine';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** One row in the grantee's pending-offers inbox. */
 export interface InboxGrantRow {
     uuid: string;
@@ -66,7 +67,10 @@ export declare class CrossTenantGrantReadService {
      *   `cross_tenant_grant` -> share/accept/revoke) — the single source every
      *   action-vocabulary consumer uses, so a per-type set can never drift between callers.
      */
-    constructor(pool: Pool, offerableTypeInputs: readonly ObjectTypeInput[], actionsByType: (typeKey: string) => readonly string[]);
+    /** The shared FROM/JOIN block, built once from the resolved names. */
+    private readonly joins;
+    /** (`schemas`: resolved framework names; absent ⇒ resolved from the namespace, once, here.) */
+    constructor(pool: Pool, offerableTypeInputs: readonly ObjectTypeInput[], actionsByType: (typeKey: string) => readonly string[], schemas?: IdentitySchemaNames);
     /**
      * Pending offers sitting in the CALLER's tenant inbox: `ctg_grantee_tenant_uuid =
      * tenantId AND ctg_status = 'offered' AND ctg_expires_at_ms > nowMs` (an expired

package/dist/features/cross-tenant/cross-tenant-grant-read.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-tenant-grant-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant-read.service.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAMtD,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+FD,qBACa,2BAA2B;IAkBpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAnBhC;;;;;;;;;;;;;;;OAeG;gBAEgB,IAAI,EAAE,IAAI,EACV,mBAAmB,EAAE,SAAS,eAAe,EAAE,EAC/C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE;IAGxE;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA0B1E;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAyBzD;;;;;;;OAOG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyBjE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAWxD"}
+{"version":3,"file":"cross-tenant-grant-read.service.d.ts","sourceRoot":"","sources":["../../../src/features/cross-tenant/cross-tenant-grant-read.service.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAgGD,qBACa,2BAA2B;IAsBpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAvBhC;;;;;;;;;;;;;;;OAeG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAE/B,+FAA+F;gBAE5E,IAAI,EAAE,IAAI,EACV,mBAAmB,EAAE,SAAS,eAAe,EAAE,EAC/C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,EACtE,OAAO,GAAE,mBAA+C;IAK1D;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA0B1E;;;;;OAKG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAyBzD;;;;;;;OAOG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAyBjE;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIzC;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAWxD"}

package/dist/features/cross-tenant/cross-tenant-grant-read.service.js

@@ -36,8 +36,7 @@ exports.CrossTenantGrantReadService = void 0;
  */
 const common_1 = require("@nestjs/common");
 const engine_1 = require("@astram/engine");
-const AUTHZ = 'shield_authz';
-const APP = 'shield_app';
+const schema_js_1 = require("../../schema.js");
 /**
  * Parse `ctg_allowed_actions` to a `string[]`, accepting BOTH an already-parsed array
  * (production — the mariadb driver auto-parses the JSON column) and a JSON string
@@ -99,13 +98,14 @@ const SELECT_COLUMNS = `
   ctg.ctg_expires_at_ms,
   ctg.ctg_created_at
 `;
-const JOINS = `
-  FROM \`${AUTHZ}\`.\`cross_tenant_grant\` ctg
-  LEFT JOIN \`${APP}\`.\`companies\` owner_co ON owner_co.c_uuid = ctg.ctg_owning_tenant_uuid
-  LEFT JOIN \`${APP}\`.\`companies\` grantee_co ON grantee_co.c_uuid = ctg.ctg_grantee_tenant_uuid
-  LEFT JOIN \`${APP}\`.\`users\` gu ON ctg.ctg_grantee_kind = 'user' AND gu.u_uuid = ctg.ctg_grantee_uuid
-  LEFT JOIN \`${APP}\`.\`roles\` gr ON ctg.ctg_grantee_kind = 'role' AND gr.r_uuid = ctg.ctg_grantee_uuid
-  LEFT JOIN \`${APP}\`.\`users\` offerer ON offerer.u_uuid = ctg.ctg_offered_by
+/** The FROM/JOIN block every read shares, over the resolved framework names. */
+const joinsFor = ({ app, authz }) => `
+  FROM \`${authz}\`.\`cross_tenant_grant\` ctg
+  LEFT JOIN \`${app}\`.\`companies\` owner_co ON owner_co.c_uuid = ctg.ctg_owning_tenant_uuid
+  LEFT JOIN \`${app}\`.\`companies\` grantee_co ON grantee_co.c_uuid = ctg.ctg_grantee_tenant_uuid
+  LEFT JOIN \`${app}\`.\`users\` gu ON ctg.ctg_grantee_kind = 'user' AND gu.u_uuid = ctg.ctg_grantee_uuid
+  LEFT JOIN \`${app}\`.\`roles\` gr ON ctg.ctg_grantee_kind = 'role' AND gr.r_uuid = ctg.ctg_grantee_uuid
+  LEFT JOIN \`${app}\`.\`users\` offerer ON offerer.u_uuid = ctg.ctg_offered_by
 `;
 let CrossTenantGrantReadService = class CrossTenantGrantReadService {
     pool;
@@ -127,10 +127,14 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
      *   `cross_tenant_grant` -> share/accept/revoke) — the single source every
      *   action-vocabulary consumer uses, so a per-type set can never drift between callers.
      */
-    constructor(pool, offerableTypeInputs, actionsByType) {
+    /** The shared FROM/JOIN block, built once from the resolved names. */
+    joins;
+    /** (`schemas`: resolved framework names; absent ⇒ resolved from the namespace, once, here.) */
+    constructor(pool, offerableTypeInputs, actionsByType, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.offerableTypeInputs = offerableTypeInputs;
         this.actionsByType = actionsByType;
+        this.joins = joinsFor(schemas);
     }
     /**
      * Pending offers sitting in the CALLER's tenant inbox: `ctg_grantee_tenant_uuid =
@@ -142,7 +146,7 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
         if (!tenantId)
             return [];
         const rows = (await this.pool.query(`SELECT ${SELECT_COLUMNS}
-       ${JOINS}
+       ${this.joins}
        WHERE ctg.ctg_grantee_tenant_uuid = ?
          AND ctg.ctg_status = 'offered'
          AND ctg.ctg_expires_at_ms > ?
@@ -170,7 +174,7 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
         if (!tenantId)
             return [];
         const rows = (await this.pool.query(`SELECT ${SELECT_COLUMNS}
-       ${JOINS}
+       ${this.joins}
        WHERE ctg.ctg_owning_tenant_uuid = ?
        ORDER BY ctg.ctg_created_at DESC`, [tenantId]));
         return rows.map((row) => ({
@@ -199,7 +203,7 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
         if (!tenantId)
             return [];
         const rows = (await this.pool.query(`SELECT ${SELECT_COLUMNS}
-       ${JOINS}
+       ${this.joins}
        WHERE ctg.ctg_grantee_tenant_uuid = ?
          AND ctg.ctg_status = 'accepted'
        ORDER BY ctg.ctg_expires_at_ms ASC`, [tenantId]));
@@ -273,5 +277,5 @@ let CrossTenantGrantReadService = class CrossTenantGrantReadService {
 exports.CrossTenantGrantReadService = CrossTenantGrantReadService;
 exports.CrossTenantGrantReadService = CrossTenantGrantReadService = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [Object, Array, Function])
+    __metadata("design:paramtypes", [Object, Array, Function, Object])
 ], CrossTenantGrantReadService);

package/dist/features/framework-schemas.token.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The framework database names `IdentityFeatureModule.forRoot` resolved (configurable-framework-db,
+ * ADR-0037), for identity services Nest constructs (e.g. `UserService`'s email-change audit sink),
+ * so they use the SAME set as every store forRoot builds, not a second env read. Internal to
+ * identity; guard's `FRAMEWORK_SCHEMAS` is checked equal at boot.
+ */
+export declare const IDENTITY_FRAMEWORK_SCHEMAS: unique symbol;
+//# sourceMappingURL=framework-schemas.token.d.ts.map

package/dist/features/framework-schemas.token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-schemas.token.d.ts","sourceRoot":"","sources":["../../src/features/framework-schemas.token.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}

package/dist/features/framework-schemas.token.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_FRAMEWORK_SCHEMAS = void 0;
+/**
+ * The framework database names `IdentityFeatureModule.forRoot` resolved (configurable-framework-db,
+ * ADR-0037), for identity services Nest constructs (e.g. `UserService`'s email-change audit sink),
+ * so they use the SAME set as every store forRoot builds, not a second env read. Internal to
+ * identity; guard's `FRAMEWORK_SCHEMAS` is checked equal at boot.
+ */
+exports.IDENTITY_FRAMEWORK_SCHEMAS = Symbol('IDENTITY_FRAMEWORK_SCHEMAS');

package/dist/features/identity-feature.module.d.ts

@@ -1,5 +1,6 @@
 import { type DynamicModule } from '@nestjs/common';
-import { type ObjectTypeInput } from '@astram/engine';
+import { type FrameworkSchemas } from '@astram/core';
+import { type EngineDbConfig, type ObjectTypeInput } from '@astram/engine';
 /**
  * The boot check behind {@link IDENTITY_DECISION_AUTHORITY_CHECK}: with this module wired, the
  * request path must decide with the authority guard built from this module's inputs. A missing
@@ -8,6 +9,33 @@ import { type ObjectTypeInput } from '@astram/engine';
  * different registry. (Another source next to this one is refused by `ShieldModule` itself.)
  */
 export declare function assertRequestPathUsesIdentityAuthorization(authority: unknown): true;
+/**
+ * The boot check behind {@link IDENTITY_FRAMEWORK_SCHEMAS_CHECK} (configurable-framework-db,
+ * ADR-0037; reviewer R2): the names `IdentityFeatureModule.forRoot` resolved — and handed to the
+ * engine, the audit sinks, the reader and every identity store — must equal guard's
+ * `FRAMEWORK_SCHEMAS`, or engine/guard/identity would split across databases. A guard that
+ * provides no `FRAMEWORK_SCHEMAS` (older than this seam) may only run on the default names.
+ * Throws (fail closed) with the namespaces and names only.
+ */
+export declare function assertFrameworkSchemasAgree(identity: FrameworkSchemas, guard: FrameworkSchemas | null | undefined): true;
+/**
+ * The boot check behind {@link IDENTITY_FRAMEWORK_DATABASE_CHECK} (G-007 QA P2-5): the runtime
+ * database identity's engine and authz pool connect to (derived from `forRoot({ schemas })`)
+ * must equal guard's `APP_CONFIG.db.database`, or unqualified queries of guard and identity would
+ * land in different databases. No guard `APP_CONFIG` visible ⇒ nothing to compare. Throws (fail
+ * closed) with database names only.
+ */
+export declare function assertFrameworkDatabaseAgrees(identityDatabase: string, guardConfig: {
+    readonly db?: {
+        readonly database?: string;
+    };
+} | null | undefined): true;
+/**
+ * Map guard's DbConfig → the engine's EngineDbConfig (adds the pool cap the engine needs). The
+ * database and default user follow `schemas` (the names `forRoot` resolved or was given); an
+ * explicit `APP_DB_USER` / `APP_DB_NAME` still wins (QA P2-5).
+ */
+export declare function engineDbFromEnv(schemas: FrameworkSchemas, env?: NodeJS.ProcessEnv): EngineDbConfig;
 /**
  * IdentityFeatureModule — the framework-owned identity FEATURE surface (company/user/role CRUD;
  * more in later phases) as thin controllers over the engine's RecordsService. The CONSUMER imports
@@ -34,10 +62,16 @@ export declare class IdentityFeatureModule {
      *   cross-tenant / policy authority, grant ceiling, guided rule-builder schema and owner-share
      *   resolver. Without them a consumer type is unregistered everywhere (denied), not policy-
      *   authorable and not shareable ("type '…' is not registered — cannot share").
+     * @param schemas the resolved framework database names (configurable-framework-db, ADR-0037).
+     *   Absent ⇒ resolved ONCE here from `SHIELD_DB_NAMESPACE` (unset ⇒ `shield_*`; invalid ⇒
+     *   throws). The one set is handed to the engine (registrations + its audit sink), the seven
+     *   audit sinks, the audit reader and every identity store; a boot check refuses names that
+     *   differ from guard's `FRAMEWORK_SCHEMAS`. Never read per request.
      */
-    static forRoot({ rootIds, extraObjects, }?: {
+    static forRoot({ rootIds, extraObjects, schemas: givenSchemas, }?: {
         rootIds?: readonly string[];
         extraObjects?: readonly ObjectTypeInput[];
+        schemas?: FrameworkSchemas;
     }): DynamicModule;
 }
 //# sourceMappingURL=identity-feature.module.d.ts.map

package/dist/features/identity-feature.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAcL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAiGxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAoBD;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,GAClB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;KACtC,GAAG,aAAa;CAigBvB"}
+{"version":3,"file":"identity-feature.module.d.ts","sourceRoot":"","sources":["../../src/features/identity-feature.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAYL,KAAK,cAAc,EAGnB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AA2GxB;;;;;;GAMG;AACH,wBAAgB,0CAA0C,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAUnF;AAKD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,IAAI,CAwBN;AAKD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC/E,IAAI,CAQN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,gBAAgB,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAqBhB;AAED;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAChC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,OAAO,CAAC,EACb,OAAO,EACP,YAAiB,EACjB,OAAO,EAAE,YAAY,GACtB,GAAE;QACD,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,gBAAgB,CAAC;KACvB,GAAG,aAAa;CA2jBvB"}