@astram/identity 0.11.0 → 0.13.0

package/dist/features/scope/scope-closure.service.js

@@ -40,10 +40,7 @@ exports.quarantineCycles = quarantineCycles;
  */
 const core_1 = require("@astram/core");
 const guard_1 = require("@astram/guard");
-/** Schema the node tree (`companies`) lives in. */
-const APP = 'shield_app';
-/** Schema the closure table lives in (ADR-0011 / Task 1.1). */
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /** The named lock every hierarchy writer holds (security review F3). */
 const TREE_LOCK = 'shield_scope_closure';
 /** Seconds to wait for it before failing closed. */
@@ -51,9 +48,16 @@ const TREE_LOCK_TIMEOUT_S = 10;
 class ScopeClosureService {
     pool;
     bumper;
-    constructor(pool, bumper) {
+    schemas;
+    /**
+     * @param schemas resolved framework names: the node tree (`companies`) lives in `schemas.app`,
+     *   the closure table in `schemas.authz` (ADR-0011 / Task 1.1). Absent ⇒ resolved from the
+     *   namespace, once, here.
+     */
+    constructor(pool, bumper, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
         this.bumper = bumper;
+        this.schemas = schemas;
     }
     /**
      * Rebuild `scope_closure` from the current `companies.c_parent_uuid` edges. Idempotent
@@ -183,7 +187,7 @@ class ScopeClosureService {
             if (newParentUuid !== null) {
                 // Cycle guard: the new parent must NOT be at/under the moved node. A closure hit means
                 // newParent is a descendant of node → re-parenting node under it would form a cycle.
-                const cyclic = (await conn.query(`SELECT 1 FROM \`${AUTHZ}\`.\`scope_closure\`
+                const cyclic = (await conn.query(`SELECT 1 FROM \`${this.schemas.authz}\`.\`scope_closure\`
           WHERE ancestor_uuid = ? AND descendant_uuid = ? LIMIT 1`, [nodeUuid, newParentUuid]));
                 if (cyclic.length > 0) {
                     throw new guard_1.ScopeCycleError(nodeUuid);
@@ -191,14 +195,14 @@ class ScopeClosureService {
             }
             // The moved subtree — the nodes whose ancestry changes (node + all descendants). Read
             // BEFORE the update (the move doesn't change the subtree's internal membership).
-            const subtreeRows = (await conn.query(`SELECT descendant_uuid FROM \`${AUTHZ}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeUuid]));
+            const subtreeRows = (await conn.query(`SELECT descendant_uuid FROM \`${this.schemas.authz}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeUuid]));
             // The FORMER-PARENT ANCESTRY — the nodes ABOVE `node` in the OLD tree (its ancestors,
             // excluding self). They just LOST `node`'s subtree from their reach, so their admins' cached
             // session subtrees are now stale (they'd otherwise keep reaching the moved-away tenant — the
             // HIGH stale-subtree-after-move leak). Read BEFORE the update (the pre-move closure has the
             // old ancestry). Bump these too so those sessions re-derive their (now-smaller) subtree at
             // their next refresh (ADR-0011 bound — no forced re-login).
-            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
+            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${this.schemas.authz}\`.\`scope_closure\`
         WHERE descendant_uuid = ? AND ancestor_uuid <> ?`, [nodeUuid, nodeUuid]));
             // Fall back to the node itself if the closure has no self-row yet (pre-first-reconcile).
             const movedSubtree = subtreeRows.length > 0 ? subtreeRows.map((r) => r.descendant_uuid) : [nodeUuid];
@@ -209,10 +213,7 @@ class ScopeClosureService {
             ];
             {
                 // 1) Re-parent the edge.
-                await conn.query(`UPDATE \`${APP}\`.\`companies\` SET c_parent_uuid = ? WHERE c_uuid = ?`, [
-                    newParentUuid,
-                    nodeUuid,
-                ]);
+                await conn.query(`UPDATE \`${this.schemas.app}\`.\`companies\` SET c_parent_uuid = ? WHERE c_uuid = ?`, [newParentUuid, nodeUuid]);
                 // 2) Rebuild the whole closure from the now-updated edges (full rebuild — safe + simple;
                 //    a targeted subtree rebuild is a later optimization). Re-reads edges over the SAME tx
                 //    connection so it sees the UPDATE. Fail-loud propagates → the whole move rolls back.
@@ -267,20 +268,22 @@ class ScopeClosureService {
         // Under the tree lock (review F3): a concurrent move cannot hang a child under this node
         // between the children check and the delete.
         await this.inTreeLock(async (conn) => {
-            const children = (await conn.query(`SELECT 1 FROM \`${APP}\`.\`companies\` WHERE c_parent_uuid = ? LIMIT 1`, [nodeUuid]));
+            const children = (await conn.query(`SELECT 1 FROM \`${this.schemas.app}\`.\`companies\` WHERE c_parent_uuid = ? LIMIT 1`, [nodeUuid]));
             if (children.length > 0) {
                 throw new NodeHasChildrenError(nodeUuid);
             }
             const touched = (beforeDelete ? await beforeDelete(conn) : undefined) ?? [];
             // The former-parent ancestry — the deleted node's ancestors (excluding self). They lose the
             // node from their reach → bump so their sessions re-derive. Read BEFORE the delete.
-            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${AUTHZ}\`.\`scope_closure\`
+            const formerAncestryRows = (await conn.query(`SELECT ancestor_uuid FROM \`${this.schemas.authz}\`.\`scope_closure\`
           WHERE descendant_uuid = ? AND ancestor_uuid <> ?`, [nodeUuid, nodeUuid]));
             // Remove the node's closure rows (self-row + any it appears in as ancestor/descendant).
-            await conn.query(`DELETE FROM \`${AUTHZ}\`.\`scope_closure\`
+            await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`scope_closure\`
           WHERE ancestor_uuid = ? OR descendant_uuid = ?`, [nodeUuid, nodeUuid]);
             // Remove the company row itself.
-            await conn.query(`DELETE FROM \`${APP}\`.\`companies\` WHERE c_uuid = ?`, [nodeUuid]);
+            await conn.query(`DELETE FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid = ?`, [
+                nodeUuid,
+            ]);
             // Bump the former-parent ancestry so their cached subtrees re-derive at next refresh, and the
             // deleted node's OWN tenant (Phase 8 #3): its memberships and postings cascade away, so
             // sessions cached in it must reload (and find nothing). A leaf has no descendants to bump.
@@ -299,7 +302,7 @@ class ScopeClosureService {
     }
     /** Read the node forest's parent edges (`c_uuid` → `c_parent_uuid`) as `ScopeEdge[]`. */
     async readEdges(q) {
-        const rows = (await q.query(`SELECT c_uuid, c_parent_uuid FROM \`${APP}\`.\`companies\``));
+        const rows = (await q.query(`SELECT c_uuid, c_parent_uuid FROM \`${this.schemas.app}\`.\`companies\``));
         return rows.map((r) => ({ node: r.c_uuid, parent: r.c_parent_uuid ?? null }));
     }
     /**
@@ -308,7 +311,7 @@ class ScopeClosureService {
      * idempotent (a re-run writes the identical target set) and correct for a full rebuild.
      */
     async rewriteClosure(conn, rows) {
-        await conn.query(`DELETE FROM \`${AUTHZ}\`.\`scope_closure\``);
+        await conn.query(`DELETE FROM \`${this.schemas.authz}\`.\`scope_closure\``);
         if (rows.length === 0)
             return;
         const placeholders = rows.map(() => '(?, ?, ?)').join(', ');
@@ -316,7 +319,7 @@ class ScopeClosureService {
         for (const r of rows) {
             params.push(r.ancestor, r.descendant, r.depth);
         }
-        await conn.query(`INSERT INTO \`${AUTHZ}\`.\`scope_closure\` (ancestor_uuid, descendant_uuid, depth)
+        await conn.query(`INSERT INTO \`${this.schemas.authz}\`.\`scope_closure\` (ancestor_uuid, descendant_uuid, depth)
          VALUES ${placeholders}`, params);
     }
 }

package/dist/features/scope/scope-subtree.resolver.d.ts

@@ -33,9 +33,15 @@
  * `shield_authz`; the shared authz pool reaches it.
  */
 import type { Pool } from 'mariadb';
+import { type IdentitySchemaNames } from '../../schema.js';
 export declare class DbScopeSubtreeResolver {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /**
+     * @param schemas resolved framework names; the closure table lives in `schemas.authz`
+     *   (Task 1.1 / ADR-0011). Absent ⇒ resolved from the namespace, once, here.
+     */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     /**
      * Resolve the active-scope subtree for `nodeId` — the node itself plus every
      * descendant — from `scope_closure`. Returns `[nodeId]` (self-node, non-widening)

package/dist/features/scope/scope-subtree.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-subtree.resolver.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-subtree.resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAKpC,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEvC;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;CAQjE"}
+{"version":3,"file":"scope-subtree.resolver.d.ts","sourceRoot":"","sources":["../../../src/features/scope/scope-subtree.resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B;;;OAGG;gBAEgB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAG3E;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;CAQjE"}

package/dist/features/scope/scope-subtree.resolver.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbScopeSubtreeResolver = void 0;
-/** Schema the closure table lives in (Task 1.1 / ADR-0011). */
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 class DbScopeSubtreeResolver {
     pool;
-    constructor(pool) {
+    schemas;
+    /**
+     * @param schemas resolved framework names; the closure table lives in `schemas.authz`
+     *   (Task 1.1 / ADR-0011). Absent ⇒ resolved from the namespace, once, here.
+     */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     /**
      * Resolve the active-scope subtree for `nodeId` — the node itself plus every
@@ -15,7 +20,7 @@ class DbScopeSubtreeResolver {
      * store outage (the login path swallows it → self-node fallback per request).
      */
     async resolveSubtree(nodeId) {
-        const rows = (await this.pool.query(`SELECT descendant_uuid FROM \`${AUTHZ}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeId]));
+        const rows = (await this.pool.query(`SELECT descendant_uuid FROM \`${this.schemas.authz}\`.\`scope_closure\` WHERE ancestor_uuid = ?`, [nodeId]));
         if (rows.length === 0)
             return [nodeId]; // pre-first-reconcile → self-node (non-widening).
         return rows.map((r) => r.descendant_uuid);

package/dist/features/service-account/lock-service-accounts.d.ts

@@ -18,12 +18,14 @@
  * `columns` and `where.sql` are fixed SQL written by the caller (never client input); every value
  * is `?`-bound.
  */
+import type { IdentitySchemaNames } from '../../schema.js';
 /** The connection surface: one transaction's `query`. */
 export interface LockConn {
     query(sql: string, params?: readonly unknown[]): Promise<unknown>;
 }
+/** @param schemas resolved framework names; `service_account` lives in `schemas.app`. */
 export declare function lockServiceAccountsWhere<T>(conn: LockConn, columns: string, where: {
     readonly sql: string;
     readonly params: readonly unknown[];
-}): Promise<T[]>;
+}, schemas: IdentitySchemaNames): Promise<T[]>;
 //# sourceMappingURL=lock-service-accounts.d.ts.map

package/dist/features/service-account/lock-service-accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lock-service-accounts.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/lock-service-accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,GACnE,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}
+{"version":3,"file":"lock-service-accounts.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/lock-service-accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,yFAAyF;AACzF,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;CAAE,EACpE,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,CAAC,EAAE,CAAC,CAed"}

package/dist/features/service-account/lock-service-accounts.js

@@ -21,14 +21,14 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lockServiceAccountsWhere = lockServiceAccountsWhere;
-const APP = 'shield_app';
-async function lockServiceAccountsWhere(conn, columns, where) {
-    const candidates = (await conn.query(`SELECT sa_id FROM \`${APP}\`.\`service_account\` WHERE ${where.sql}`, [...where.params]));
+/** @param schemas resolved framework names; `service_account` lives in `schemas.app`. */
+async function lockServiceAccountsWhere(conn, columns, where, schemas) {
+    const candidates = (await conn.query(`SELECT sa_id FROM \`${schemas.app}\`.\`service_account\` WHERE ${where.sql}`, [...where.params]));
     const ids = [...new Set(candidates.map((r) => r.sa_id))].sort();
     if (ids.length === 0)
         return [];
     return (await conn.query(`SELECT ${columns}
-       FROM \`${APP}\`.\`service_account\`
+       FROM \`${schemas.app}\`.\`service_account\`
       WHERE sa_id IN (${ids.map(() => '?').join(', ')}) AND (${where.sql})
       ORDER BY sa_id
       FOR UPDATE`, [...ids, ...where.params]));

package/dist/features/service-account/no-expiry-key-report.d.ts

@@ -7,8 +7,12 @@
  * lists each agent's CURRENT, unrevoked key with no expiry so an operator can rotate it with an
  * expiry. It prints labels and company names only: never a secret, a hash or a raw id.
  */
-/** Read-only: the current unrevoked key of each agent that has no expiry, with display names. */
-export declare const NO_EXPIRY_KEY_REPORT_SQL = "SELECT sa.sa_label AS label, c.c_name AS company,\n       sa.sa_status AS status, k.sak_version AS version, k.sak_created_at_ms AS issuedAtMs\n  FROM shield_authz.service_account_key k\n  LEFT JOIN shield_app.service_account sa ON sa.sa_id = k.sak_account_id\n  LEFT JOIN shield_app.companies c ON c.c_uuid = k.sak_tenant_id\n WHERE k.sak_expires_at_ms IS NULL\n   AND k.sak_revoked_at_ms IS NULL\n   AND k.sak_version = (SELECT MAX(v.sak_version)\n                          FROM shield_authz.service_account_key v\n                         WHERE v.sak_account_id = k.sak_account_id)\n ORDER BY k.sak_created_at_ms";
+import { type IdentitySchemaNames } from '../../schema.js';
+/**
+ * Read-only: the current unrevoked key of each agent that has no expiry, with display names, over
+ * the resolved framework names (validated identifiers, never input).
+ */
+export declare function noExpiryKeyReportSql({ app, authz }: IdentitySchemaNames): string;
 /** One non-expiring key, as printed (no ids, no secrets). */
 export interface NonExpiringKey {
     /** The agent's label; `null` when the agent row no longer exists. */
@@ -24,7 +28,7 @@ export interface ReportQueryable {
     query(sql: string, params?: unknown[]): Promise<unknown>;
 }
 /** Run the report query and map the rows. Read-only. */
-export declare function findNonExpiringKeys(db: ReportQueryable): Promise<NonExpiringKey[]>;
+export declare function findNonExpiringKeys(db: ReportQueryable, schemas: IdentitySchemaNames): Promise<NonExpiringKey[]>;
 /** Human-readable report text (one line per key, plus a summary line). */
 export declare function formatNonExpiringKeyReport(keys: readonly NonExpiringKey[]): string;
 /** The bin's behaviour, testable without a process: returns the exit code. */
@@ -35,5 +39,7 @@ export declare function runNonExpiringKeyReport(opts: {
     };
     readonly out: (text: string) => void;
     readonly err: (text: string) => void;
+    /** Resolved framework names; absent ⇒ resolved from `SHIELD_DB_NAMESPACE` once per run. */
+    readonly schemas?: IdentitySchemaNames;
 }): Promise<number>;
 //# sourceMappingURL=no-expiry-key-report.d.ts.map

package/dist/features/service-account/no-expiry-key-report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"no-expiry-key-report.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/no-expiry-key-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,2mBAUP,CAAC;AAE/B,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAMD,wDAAwD;AACxD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CASxF;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAalF;AAcD,8EAA8E;AAC9E,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,eAAe,GAAG;QAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB"}
+{"version":3,"file":"no-expiry-key-report.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/no-expiry-key-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,mBAAmB,GAAG,MAAM,CAYhF;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAMD,wDAAwD;AACxD,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,eAAe,EACnB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,cAAc,EAAE,CAAC,CAS3B;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAalF;AAcD,8EAA8E;AAC9E,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,eAAe,GAAG;QAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;CACxC,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBlB"}

package/dist/features/service-account/no-expiry-key-report.js

@@ -9,27 +9,33 @@
  * expiry. It prints labels and company names only: never a secret, a hash or a raw id.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NO_EXPIRY_KEY_REPORT_SQL = void 0;
+exports.noExpiryKeyReportSql = noExpiryKeyReportSql;
 exports.findNonExpiringKeys = findNonExpiringKeys;
 exports.formatNonExpiringKeyReport = formatNonExpiringKeyReport;
 exports.runNonExpiringKeyReport = runNonExpiringKeyReport;
-/** Read-only: the current unrevoked key of each agent that has no expiry, with display names. */
-exports.NO_EXPIRY_KEY_REPORT_SQL = `SELECT sa.sa_label AS label, c.c_name AS company,
+const schema_js_1 = require("../../schema.js");
+/**
+ * Read-only: the current unrevoked key of each agent that has no expiry, with display names, over
+ * the resolved framework names (validated identifiers, never input).
+ */
+function noExpiryKeyReportSql({ app, authz }) {
+    return `SELECT sa.sa_label AS label, c.c_name AS company,
        sa.sa_status AS status, k.sak_version AS version, k.sak_created_at_ms AS issuedAtMs
-  FROM shield_authz.service_account_key k
-  LEFT JOIN shield_app.service_account sa ON sa.sa_id = k.sak_account_id
-  LEFT JOIN shield_app.companies c ON c.c_uuid = k.sak_tenant_id
+  FROM ${authz}.service_account_key k
+  LEFT JOIN ${app}.service_account sa ON sa.sa_id = k.sak_account_id
+  LEFT JOIN ${app}.companies c ON c.c_uuid = k.sak_tenant_id
  WHERE k.sak_expires_at_ms IS NULL
    AND k.sak_revoked_at_ms IS NULL
    AND k.sak_version = (SELECT MAX(v.sak_version)
-                          FROM shield_authz.service_account_key v
+                          FROM ${authz}.service_account_key v
                          WHERE v.sak_account_id = k.sak_account_id)
  ORDER BY k.sak_created_at_ms`;
+}
 const str = (v) => (v === null || v === undefined ? null : String(v));
 const num = (v) => v === null || v === undefined || !Number.isFinite(Number(v)) ? null : Number(v);
 /** Run the report query and map the rows. Read-only. */
-async function findNonExpiringKeys(db) {
-    const rows = (await db.query(exports.NO_EXPIRY_KEY_REPORT_SQL));
+async function findNonExpiringKeys(db, schemas) {
+    const rows = (await db.query(noExpiryKeyReportSql(schemas)));
     return rows.map((r) => ({
         label: str(r.label),
         company: str(r.company),
@@ -75,8 +81,9 @@ async function runNonExpiringKeyReport(opts) {
     }
     let db;
     try {
+        const schemas = opts.schemas ?? (0, schema_js_1.frameworkSchemasFromEnv)();
         db = opts.openDb();
-        const keys = await findNonExpiringKeys(db);
+        const keys = await findNonExpiringKeys(db, schemas);
         opts.out(formatNonExpiringKeyReport(keys));
         return keys.length > 0 && opts.argv.includes('--fail-on-found') ? 1 : 0;
     }

package/dist/features/service-account/service-account.store.d.ts

@@ -12,6 +12,7 @@
  * stamped `sa_tenant_id` (from the session) on create — never client input.
  */
 import type { Pool } from 'mariadb';
+import { type IdentitySchemaNames } from '../../schema.js';
 /** The status of an account's current key (no hash, no secret). Epoch-ms; `null` = not set. */
 export interface ServiceAccountKeyRow {
     readonly accountId: string;
@@ -50,7 +51,13 @@ export interface ScopeNodeOption {
 }
 export declare class ServiceAccountStore {
     private readonly pool;
-    constructor(pool: Pool);
+    private readonly schemas;
+    /**
+     * @param schemas resolved framework names: accounts in `schemas.app`; guard's key table
+     *   (`1710000000017-CreateServiceAccountKey.cjs`, read-only here) in `schemas.authz`. Absent ⇒
+     *   resolved from the namespace, once, here.
+     */
+    constructor(pool: Pool, schemas?: IdentitySchemaNames);
     /** Roles by id (unknown ids are simply absent — the caller supplies a fallback label). */
     rolesByIds(ids: readonly string[]): Promise<RoleOption[]>;
     /** Every role in the catalog (ROOT's assignable set). */

package/dist/features/service-account/service-account.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAMpC,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAUD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAMvC,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBjF,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}
+{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAUD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B;;;;OAIG;gBAEgB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAO3E,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBjF,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}

package/dist/features/service-account/service-account.store.js

@@ -1,9 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceAccountStore = void 0;
-const APP = 'shield_app';
-/** Guard's key table lives here (`1710000000017-CreateServiceAccountKey.cjs`); read-only here. */
-const AUTHZ = 'shield_authz';
+const schema_js_1 = require("../../schema.js");
 /** Normalize a JSON-array column (driver returns array OR string) → string[]. Fail-safe to []. */
 function jsonArray(v) {
     const arr = Array.isArray(v)
@@ -53,8 +51,15 @@ function uniqueIds(ids) {
 }
 class ServiceAccountStore {
     pool;
-    constructor(pool) {
+    schemas;
+    /**
+     * @param schemas resolved framework names: accounts in `schemas.app`; guard's key table
+     *   (`1710000000017-CreateServiceAccountKey.cjs`, read-only here) in `schemas.authz`. Absent ⇒
+     *   resolved from the namespace, once, here.
+     */
+    constructor(pool, schemas = (0, schema_js_1.frameworkSchemasFromEnv)()) {
         this.pool = pool;
+        this.schemas = schemas;
     }
     // ── directory reads (names for the picker, the view labels and the ceiling messages) ─────
     // Read-only lookups over the global role catalog + the company tree (`shield_app.roles`,
@@ -64,12 +69,12 @@ class ServiceAccountStore {
         const u = uniqueIds(ids);
         if (u.length === 0)
             return [];
-        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${APP}\`.\`roles\` WHERE r_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY r_name`, u));
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY r_name`, u));
         return rows.map((r) => ({ id: r.id, name: r.name }));
     }
     /** Every role in the catalog (ROOT's assignable set). */
     async allRoles() {
-        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${APP}\`.\`roles\` ORDER BY r_name`, []));
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${this.schemas.app}\`.\`roles\` ORDER BY r_name`, []));
         return rows.map((r) => ({ id: r.id, name: r.name }));
     }
     /** Companies (scope nodes) by id, with their parent handle. Unknown ids are absent. */
@@ -77,12 +82,12 @@ class ServiceAccountStore {
         const u = uniqueIds(ids);
         if (u.length === 0)
             return [];
-        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` WHERE c_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY c_name`, u));
+        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${this.schemas.app}\`.\`companies\` WHERE c_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY c_name`, u));
         return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
     }
     /** Every company (ROOT's assignable scope — root reaches all). */
     async allNodes() {
-        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${APP}\`.\`companies\` ORDER BY c_name`, []));
+        const rows = (await this.pool.query(`SELECT c_uuid AS id, c_name AS name, c_parent_uuid AS parentId FROM \`${this.schemas.app}\`.\`companies\` ORDER BY c_name`, []));
         return rows.map((r) => ({ id: r.id, name: r.name, parentId: r.parentId ?? null }));
     }
     /**
@@ -97,9 +102,9 @@ class ServiceAccountStore {
             return [];
         const rows = (await this.pool.query(`SELECT k.sak_account_id, k.sak_version, k.sak_expires_at_ms, k.sak_revoked_at_ms,
               k.sak_created_at_ms
-         FROM \`${AUTHZ}\`.\`service_account_key\` k
+         FROM \`${this.schemas.authz}\`.\`service_account_key\` k
          JOIN (SELECT sak_account_id, MAX(sak_version) AS v
-                 FROM \`${AUTHZ}\`.\`service_account_key\`
+                 FROM \`${this.schemas.authz}\`.\`service_account_key\`
                 WHERE sak_account_id IN (${u.map(() => '?').join(', ')})
                 GROUP BY sak_account_id) m
            ON m.sak_account_id = k.sak_account_id AND m.v = k.sak_version`, u));
@@ -115,13 +120,13 @@ class ServiceAccountStore {
     /** List the caller's own-tenant accounts (newest first). Root sees all. */
     async list(scope) {
         const t = tenantScope(scope);
-        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${APP}\`.\`service_account\` WHERE 1=1${t.sql} ORDER BY sa_created_at_ms DESC`, t.params));
+        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${this.schemas.app}\`.\`service_account\` WHERE 1=1${t.sql} ORDER BY sa_created_at_ms DESC`, t.params));
         return rows.map(toRow);
     }
     /** Fetch one account BY id, scoped to the caller's subtree. Cross-tenant/unknown → null (404). */
     async getById(id, scope) {
         const t = tenantScope(scope);
-        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${APP}\`.\`service_account\` WHERE sa_id = ?${t.sql} LIMIT 1`, [id, ...t.params]));
+        const rows = (await this.pool.query(`SELECT ${COLS} FROM \`${this.schemas.app}\`.\`service_account\` WHERE sa_id = ?${t.sql} LIMIT 1`, [id, ...t.params]));
         return rows[0] ? toRow(rows[0]) : null;
     }
     /**
@@ -130,7 +135,7 @@ class ServiceAccountStore {
      * per create); the id is unique by construction.
      */
     async insert(input) {
-        await this.pool.query(`INSERT INTO \`${APP}\`.\`service_account\`
+        await this.pool.query(`INSERT INTO \`${this.schemas.app}\`.\`service_account\`
          (sa_id, sa_tenant_id, sa_label, sa_scope_subtree, sa_role_ids, sa_status,
           sa_created_by, sa_created_at_ms, sa_updated_at_ms)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`, [
@@ -180,7 +185,7 @@ class ServiceAccountStore {
         const t = tenantScope(scope);
         const guard = expectedUpdatedAtMs !== undefined ? ' AND sa_updated_at_ms <=> ?' : '';
         const guardParams = expectedUpdatedAtMs !== undefined ? [expectedUpdatedAtMs] : [];
-        const res = (await this.pool.query(`UPDATE \`${APP}\`.\`service_account\` SET ${sets.join(', ')} WHERE sa_id = ?${t.sql}${guard}`, [...params, id, ...t.params, ...guardParams]));
+        const res = (await this.pool.query(`UPDATE \`${this.schemas.app}\`.\`service_account\` SET ${sets.join(', ')} WHERE sa_id = ?${t.sql}${guard}`, [...params, id, ...t.params, ...guardParams]));
         return res.affectedRows ?? 0;
     }
 }

package/dist/features/user/user.service.d.ts

@@ -1,5 +1,5 @@
 import { RecordsService, type RecordId } from '@astram/engine';
-import type { Principal } from '@astram/core';
+import type { FrameworkSchemas, Principal } from '@astram/core';
 import { type EmailAddressChanger, type EmailSender, type ResetTokenStore, type SessionSweeper } from '@astram/guard';
 import { type PostingVersionBump } from '../membership/posting-version-bump.js';
 import { type ListParams } from '../shared/list-query.js';
@@ -38,9 +38,13 @@ export declare class UserService {
     private readonly versionBump?;
     private readonly emailAddresses?;
     private readonly logger;
-    /** The engine's audit sink, used on the email helper's transaction (no pool of its own). */
+    /**
+     * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
+     * audit database forRoot resolved (`IDENTITY_FRAMEWORK_SCHEMAS`); absent (a hand-built
+     * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
+     */
     private readonly emailAudit;
-    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined);
+    constructor(records: RecordsService, ceiling: GrantCeiling, resetTokens?: (ResetTokenStore | null) | undefined, emailSender?: (EmailSender | null) | undefined, sessions?: (SessionSweeper | null) | undefined, versionBump?: (PostingVersionBump | null) | undefined, emailAddresses?: (EmailAddressChanger | null) | undefined, schemas?: FrameworkSchemas | null);
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
      * ONE transaction — the onboarding path for a non-root admin, whose membership create is checked

package/dist/features/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,KAAK,EAAc,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAOL,KAAK,mBAAmB,EAExB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAqCzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAMpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAzBlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;gBAGpC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA;IAG9D;;;;;;;;;;OAUG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,QAAQ,CAAC;IAsBpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAyBzB,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,KAAK,EAAc,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAOL,KAAK,mBAAmB,EAExB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAsCzD,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IACY,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAK1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA7BlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;gBAG3B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EAGrB,WAAW,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACK,WAAW,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAMzE,QAAQ,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAKhC,WAAW,CAAC,GAAE,kBAAkB,GAAG,IAAI,aAAA,EAIvC,cAAc,CAAC,GAAE,mBAAmB,GAAG,IAAI,aAAA,EAI5D,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAKnC;;;;;;;;;;OAUG;IACG,UAAU,CACd,KAAK,EAAE,SAAS,EAChB,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACxF,OAAO,CAAC,QAAQ,CAAC;IAsBpB,uEAAuE;IACvE,SAAS,CAAC,MAAM,CAAC,EAAE,UAAU;IAI7B,0BAA0B;IAC1B,OAAO,CAAC,IAAI,EAAE,MAAM;IAIpB,mGAAmG;IAC7F,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjF;;;;;;OAMG;YACW,WAAW;IAyBzB,uFAAuF;IACvF,OAAO,CAAC,gBAAgB;IA8BxB;;;;;;;;;OASG;YACW,iBAAiB;IAY/B,uDAAuD;IACjD,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,6FAA6F;YAC/E,kBAAkB;CAkBjC"}

package/dist/features/user/user.service.js

@@ -22,6 +22,7 @@ const list_query_js_1 = require("../shared/list-query.js");
 const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
 const identity_errors_js_1 = require("../shared/identity-errors.js");
 const email_address_changer_token_js_1 = require("./email-address-changer.token.js");
+const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
 /**
  * KI #87: `users` has two unique keys besides the PK, `IDX_users_username` (migration 001) and
  * `uq_users_email` (021, `utf8mb4_unicode_ci`: folds case, accents, width, trailing spaces). The
@@ -77,9 +78,13 @@ let UserService = UserService_1 = class UserService {
     versionBump;
     emailAddresses;
     logger = new common_1.Logger(UserService_1.name);
-    /** The engine's audit sink, used on the email helper's transaction (no pool of its own). */
-    emailAudit = new engine_1.MariaDbAuditSink({});
-    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses) {
+    /**
+     * The engine's audit sink, used on the email helper's transaction (no pool of its own), on the
+     * audit database forRoot resolved (`IDENTITY_FRAMEWORK_SCHEMAS`); absent (a hand-built
+     * service) ⇒ the sink resolves `SHIELD_DB_NAMESPACE` itself.
+     */
+    emailAudit;
+    constructor(records, ceiling, resetTokens, emailSender, sessions, versionBump, emailAddresses, schemas) {
         this.records = records;
         this.ceiling = ceiling;
         this.resetTokens = resetTokens;
@@ -87,6 +92,7 @@ let UserService = UserService_1 = class UserService {
         this.sessions = sessions;
         this.versionBump = versionBump;
         this.emailAddresses = emailAddresses;
+        this.emailAudit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
     }
     /**
      * Create a user. With `companyUuid`, the user is created AND attached (one active membership) in
@@ -288,6 +294,8 @@ exports.UserService = UserService = UserService_1 = __decorate([
     __param(5, (0, common_1.Inject)(posting_version_bump_js_1.POSTING_VERSION_BUMP)),
     __param(6, (0, common_1.Optional)()),
     __param(6, (0, common_1.Inject)(email_address_changer_token_js_1.IDENTITY_EMAIL_ADDRESS_CHANGER)),
+    __param(7, (0, common_1.Optional)()),
+    __param(7, (0, common_1.Inject)(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS)),
     __metadata("design:paramtypes", [engine_1.RecordsService,
-        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object])
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object])
 ], UserService);

package/dist/record-share.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"record-share.object.d.ts","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBASa,WAAW;IAEtB,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,UAAU,EAAG,MAAM,CAAC;CACrB"}
+{"version":3,"file":"record-share.object.d.ts","sourceRoot":"","sources":["../src/record-share.object.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBASa,WAAW;IAEtB,IAAI,EAAG,MAAM,CAAC;IAGd,UAAU,EAAG,MAAM,CAAC;IAGpB,UAAU,EAAG,MAAM,CAAC;CACrB"}

package/dist/record-share.object.js

@@ -12,8 +12,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RecordShare = void 0;
 const engine_1 = require("@astram/engine");
 const guard_1 = require("@astram/guard");
-/** The physical schema `record_share` lives in (migration 1710000000014). */
-const SCHEMA = 'shield_authz';
+/** The authz-database token `record_share` lives in (migration 1710000000014); the engine
+ *  resolves it at registration (ADR-0037). */
+const SCHEMA = engine_1.FRAMEWORK_SCHEMA.authz;
 /**
  * `record_share` — an AUTHORITY-ONLY @ObjectType, never CRUD'd through the RecordEngine pipe
  * (list-scoping engine Phase 6, §9.2). Its sole purpose is to give `record_share` an entry in the

package/dist/schema.d.ts

@@ -1,3 +1,16 @@
-/** The physical schema every identity table lives in (single-source). */
-export declare const SCHEMA = "shield_app";
+import { type FrameworkSchemas } from '@astram/core';
+/**
+ * The schema every identity table declares (single-source): the app-database token, resolved by
+ * the engine at registration to `<namespace>_app` (configurable-framework-db, ADR-0037). It is
+ * never a database name: SQL built outside the engine uses {@link IdentitySchemaNames}.
+ */
+export declare const SCHEMA: "{{framework_schema:app}}";
+/** The resolved framework database names identity SQL needs (`FrameworkSchemas` fits). */
+export type IdentitySchemaNames = Pick<FrameworkSchemas, 'app' | 'authz'>;
+/**
+ * The framework database names from `SHIELD_DB_NAMESPACE` (unset ⇒ `shield_*`), for a class built
+ * without explicit names. Call at construction (boot) only, never per request; an invalid
+ * namespace throws (fail closed). `IdentityFeatureModule.forRoot` always passes its names.
+ */
+export declare function frameworkSchemasFromEnv(): FrameworkSchemas;
 //# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,MAAM,eAAe,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG9E;;;;GAIG;AACH,eAAO,MAAM,MAAM,4BAAuB,CAAC;AAE3C,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,gBAAgB,CAE1D"}

package/dist/schema.js

@@ -1,5 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SCHEMA = void 0;
-/** The physical schema every identity table lives in (single-source). */
-exports.SCHEMA = 'shield_app';
+exports.frameworkSchemasFromEnv = frameworkSchemasFromEnv;
+const core_1 = require("@astram/core");
+const engine_1 = require("@astram/engine");
+/**
+ * The schema every identity table declares (single-source): the app-database token, resolved by
+ * the engine at registration to `<namespace>_app` (configurable-framework-db, ADR-0037). It is
+ * never a database name: SQL built outside the engine uses {@link IdentitySchemaNames}.
+ */
+exports.SCHEMA = engine_1.FRAMEWORK_SCHEMA.app;
+/**
+ * The framework database names from `SHIELD_DB_NAMESPACE` (unset ⇒ `shield_*`), for a class built
+ * without explicit names. Call at construction (boot) only, never per request; an invalid
+ * namespace throws (fail closed). `IdentityFeatureModule.forRoot` always passes its names.
+ */
+function frameworkSchemasFromEnv() {
+    return (0, core_1.resolveFrameworkSchemas)(process.env);
+}