@agenticprimitives/vault-authority 0.0.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agentic Trust Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,80 @@
+# @agenticprimitives/vault-authority
+
+Pure helpers for authority over vault-resident subjects.
+
+This package bridges three existing primitives:
+
+- `RoleAssignment` from `@agenticprimitives/organization`
+- `VaultRecordScopeGrant` from `@agenticprimitives/delegation`
+- owner-vault resource naming from `@agenticprimitives/vault`
+
+It does not persist, sign, read chain state, call MCP/A2A, or verify entitlements. Callers pass already
+verified facts into deterministic helpers.
+
+## What It Owns
+
+- subject refs: the thing a vault role is about
+- role definitions: capabilities plus vault-record-scope grant templates
+- grant compilation: role definition + subject -> `VaultRecordScopeGrant[]`
+- projection: role assignment + definition -> app-readable grant view
+- authorization: active assignment + materializing authority + record scope -> allow/deny
+
+## Core Rule
+
+RoleAssignment manages domain-subject responsibility. Delegation/caveats execute authority. Entitlements
+prove access.
+
+A role with no valid materializing authority authorizes nothing.
+
+## Minimal Example
+
+```ts
+import {
+  authorizeVaultSubjectOperation,
+  compileVaultRecordScopeGrants,
+  type VaultAuthorityRoleDefinition,
+} from '@agenticprimitives/vault-authority';
+
+const definition: VaultAuthorityRoleDefinition = {
+  roleDefinitionId: 'roledef:example.manager@1',
+  name: 'manager',
+  version: '1',
+  allowedScopes: ['resource'],
+  capabilities: ['example.manage'],
+  grantTemplates: [
+    {
+      server: 'example-vault',
+      resources: ['vault:example.subject:{scopeRef}:*'],
+      ops: ['read', 'write'],
+    },
+  ],
+};
+
+const subject = {
+  vaultOwner: '0x0000000000000000000000000000000000000001',
+  scope: 'resource' as const,
+  scopeRef: 'subject:123',
+};
+
+const recordScopes = compileVaultRecordScopeGrants({ definition, subject });
+
+const decision = authorizeVaultSubjectOperation({
+  assignment,
+  definition,
+  subject,
+  hasMaterializingAuthority: true,
+  recordScopes,
+  request: {
+    server: 'example-vault',
+    resource: 'vault:example.subject:subject:123:title',
+    op: 'write',
+  },
+});
+```
+
+## Privacy
+
+The package never creates a public registry of who manages which subject. Assignments, wires, and
+entitlements live off-chain in vault/Home/runtime stores. Chain state remains hash/signature/revocation
+verification.
+

package/dist/authority.d.ts

@@ -0,0 +1,9 @@
+import type { RoleAssignmentBody } from '@agenticprimitives/organization';
+import type { AuthorizeVaultSubjectOperationInput, ProjectVaultSubjectRolePartsInput, ProjectVaultSubjectRoleInput, VaultAuthorityRoleDefinition, VaultSubjectAuthorityDecision, VaultSubjectRef, VaultSubjectRoleGrant } from './types.js';
+export declare function isActiveVaultSubjectRole(assignment: RoleAssignmentBody | null, at?: string): boolean;
+export declare function assignmentMatchesDefinition(assignment: RoleAssignmentBody, definition: VaultAuthorityRoleDefinition): boolean;
+export declare function assignmentMatchesSubject(assignment: RoleAssignmentBody, subject: VaultSubjectRef): boolean;
+export declare function projectVaultSubjectRoleGrant(input: ProjectVaultSubjectRoleInput): VaultSubjectRoleGrant;
+export declare function projectVaultSubjectRoleGrantFromParts(input: ProjectVaultSubjectRolePartsInput): VaultSubjectRoleGrant;
+export declare function authorizeVaultSubjectOperation(input: AuthorizeVaultSubjectOperationInput): VaultSubjectAuthorityDecision;
+//# sourceMappingURL=authority.d.ts.map

package/dist/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,KAAK,EACV,mCAAmC,EACnC,iCAAiC,EACjC,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,eAAe,EACf,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI,EAAE,EAAE,SAA2B,GAAG,OAAO,CAOtH;AAED,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,kBAAkB,EAC9B,UAAU,EAAE,4BAA4B,GACvC,OAAO,CAET;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAK1G;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,4BAA4B,GAAG,qBAAqB,CAYvG;AAED,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,iCAAiC,GAAG,qBAAqB,CAYrH;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,mCAAmC,GAAG,6BAA6B,CAkBxH"}

package/dist/authority.js

@@ -0,0 +1,68 @@
+import { vaultRecordScopeAllows } from '@agenticprimitives/delegation';
+export function isActiveVaultSubjectRole(assignment, at = new Date().toISOString()) {
+    if (!assignment)
+        return false;
+    return (assignment.status === 'active' &&
+        assignment.validFrom <= at &&
+        (assignment.validUntil == null || at < assignment.validUntil));
+}
+export function assignmentMatchesDefinition(assignment, definition) {
+    return assignment.roleDefinitionId === definition.roleDefinitionId;
+}
+export function assignmentMatchesSubject(assignment, subject) {
+    if (assignment.scope !== subject.scope)
+        return false;
+    const assignmentRef = assignment.scopeRef ?? null;
+    if (assignment.scope === 'organization')
+        return assignmentRef == null && subject.scopeRef == null;
+    return assignmentRef != null && assignmentRef === subject.scopeRef;
+}
+export function projectVaultSubjectRoleGrant(input) {
+    return projectVaultSubjectRoleGrantFromParts({
+        assignee: input.assignee,
+        roleDefinitionId: input.definition.roleDefinitionId,
+        roleName: input.definition.name,
+        scope: input.assignment.scope,
+        scopeRef: input.assignment.scopeRef ?? null,
+        status: input.assignment.status,
+        capabilities: [...input.definition.capabilities],
+        authorityRefs: [...(input.assignment.authorityRefs ?? [])],
+        entitlementRefs: [...(input.assignment.entitlementRefs ?? [])],
+    });
+}
+export function projectVaultSubjectRoleGrantFromParts(input) {
+    return {
+        subject: input.assignee,
+        roleDefinitionId: input.roleDefinitionId,
+        roleName: input.roleName,
+        scope: input.scope,
+        scopeRef: input.scopeRef,
+        status: input.status,
+        capabilities: [...input.capabilities],
+        authorityRefs: [...(input.authorityRefs ?? [])],
+        entitlementRefs: [...(input.entitlementRefs ?? [])],
+    };
+}
+export function authorizeVaultSubjectOperation(input) {
+    const assignment = input.assignment;
+    if (!assignment)
+        return { decision: 'deny', reason: 'missing-assignment' };
+    if (!isActiveVaultSubjectRole(assignment, input.at))
+        return { decision: 'deny', reason: 'inactive-assignment' };
+    if (!assignmentMatchesDefinition(assignment, input.definition)) {
+        return { decision: 'deny', reason: 'role-definition-mismatch' };
+    }
+    if (!input.definition.allowedScopes.includes(input.subject.scope)) {
+        return { decision: 'deny', reason: 'scope-not-allowed' };
+    }
+    if (!assignmentMatchesSubject(assignment, input.subject))
+        return { decision: 'deny', reason: 'subject-mismatch' };
+    if (!input.hasMaterializingAuthority) {
+        return { decision: 'deny', reason: 'missing-materializing-authority' };
+    }
+    if (!vaultRecordScopeAllows(input.recordScopes ? [...input.recordScopes] : undefined, input.request)) {
+        return { decision: 'deny', reason: 'record-scope-denied' };
+    }
+    return { decision: 'allow' };
+}
+//# sourceMappingURL=authority.js.map

package/dist/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAavE,MAAM,UAAU,wBAAwB,CAAC,UAAqC,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAC3G,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,QAAQ;QAC9B,UAAU,CAAC,SAAS,IAAI,EAAE;QAC1B,CAAC,UAAU,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,UAA8B,EAC9B,UAAwC;IAExC,OAAO,UAAU,CAAC,gBAAgB,KAAK,UAAU,CAAC,gBAAgB,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,UAA8B,EAAE,OAAwB;IAC/F,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC;IAClD,IAAI,UAAU,CAAC,KAAK,KAAK,cAAc;QAAE,OAAO,aAAa,IAAI,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAClG,OAAO,aAAa,IAAI,IAAI,IAAI,aAAa,KAAK,OAAO,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAmC;IAC9E,OAAO,qCAAqC,CAAC;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;QACnD,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI;QAC/B,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK;QAC7B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI;QAC3C,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;QAC/B,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAChD,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC1D,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,KAAwC;IAC5F,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ;QACvB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC/C,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAA0C;IACvF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC3E,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChH,IAAI,CAAC,2BAA2B,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAClH,IAAI,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACrG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export declare const PACKAGE_NAME = "@agenticprimitives/vault-authority";
+export declare const PACKAGE_STATUS: "w1-subject-authority";
+export declare const SPEC_REF = "specs/343-vault-subject-authority.md";
+export type { AuthorizeVaultSubjectOperationInput, CompileVaultRecordScopeInput, ProjectVaultSubjectRolePartsInput, ProjectVaultSubjectRoleInput, RoleAssignmentStatus, RoleScopeKind, VaultAuthorityOperation, VaultAuthorityRoleDefinition, VaultRecordScopeTemplate, VaultSubjectAuthorityDecision, VaultSubjectAuthorityDenyReason, VaultSubjectOperationRequest, VaultSubjectRef, VaultSubjectRoleGrant, } from './types.js';
+export { compileVaultRecordScopeGrants } from './templates.js';
+export { assignmentMatchesDefinition, assignmentMatchesSubject, authorizeVaultSubjectOperation, isActiveVaultSubjectRole, projectVaultSubjectRoleGrantFromParts, projectVaultSubjectRoleGrant, } from './authority.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,uCAAuC,CAAC;AACjE,eAAO,MAAM,cAAc,EAAG,sBAA+B,CAAC;AAC9D,eAAO,MAAM,QAAQ,yCAAyC,CAAC;AAE/D,YAAY,EACV,mCAAmC,EACnC,4BAA4B,EAC5B,iCAAiC,EACjC,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,4BAA4B,EAC5B,eAAe,EACf,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// @agenticprimitives/vault-authority — role-gated authority over vault-resident subjects.
+export const PACKAGE_NAME = '@agenticprimitives/vault-authority';
+export const PACKAGE_STATUS = 'w1-subject-authority';
+export const SPEC_REF = 'specs/343-vault-subject-authority.md';
+export { compileVaultRecordScopeGrants } from './templates.js';
+export { assignmentMatchesDefinition, assignmentMatchesSubject, authorizeVaultSubjectOperation, isActiveVaultSubjectRole, projectVaultSubjectRoleGrantFromParts, projectVaultSubjectRoleGrant, } from './authority.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAE1F,MAAM,CAAC,MAAM,YAAY,GAAG,oCAAoC,CAAC;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,sBAA+B,CAAC;AAC9D,MAAM,CAAC,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAmB/D,OAAO,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,8BAA8B,EAC9B,wBAAwB,EACxB,qCAAqC,EACrC,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC"}

package/dist/templates.d.ts

@@ -0,0 +1,4 @@
+import type { VaultRecordScopeGrant } from '@agenticprimitives/delegation';
+import type { CompileVaultRecordScopeInput } from './types.js';
+export declare function compileVaultRecordScopeGrants(input: CompileVaultRecordScopeInput): VaultRecordScopeGrant[];
+//# sourceMappingURL=templates.d.ts.map

package/dist/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAoC/D,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,4BAA4B,GAAG,qBAAqB,EAAE,CAmB1G"}

package/dist/templates.js

@@ -0,0 +1,56 @@
+const PLACEHOLDER = /\{([A-Za-z0-9_]+)\}/g;
+const HAS_PLACEHOLDER = /\{[A-Za-z0-9_]+\}/;
+function values(input) {
+    return {
+        vaultOwner: input.subject.vaultOwner,
+        scope: input.subject.scope,
+        scopeRef: input.subject.scopeRef ?? '',
+        roleDefinitionId: input.definition.roleDefinitionId,
+    };
+}
+function expand(template, input) {
+    const v = values(input);
+    return template.replace(PLACEHOLDER, (_match, key) => {
+        const value = v[key];
+        if (value === undefined)
+            throw new Error(`unknown vault-authority template placeholder {${key}}`);
+        if (!value)
+            throw new Error(`empty vault-authority template placeholder {${key}}`);
+        return value;
+    });
+}
+function assertSafeResource(resource) {
+    if (!resource.startsWith('vault:')) {
+        throw new Error(`vault authority resource "${resource}" must be vault:-prefixed`);
+    }
+    if (resource === 'vault:' || resource === 'vault:*') {
+        throw new Error(`vault authority resource "${resource}" is too broad`);
+    }
+    if (HAS_PLACEHOLDER.test(resource)) {
+        throw new Error(`vault authority resource "${resource}" still contains a placeholder`);
+    }
+}
+export function compileVaultRecordScopeGrants(input) {
+    if (!input.definition.allowedScopes.includes(input.subject.scope)) {
+        throw new Error(`role ${input.definition.roleDefinitionId} is not assignable at ${input.subject.scope} scope`);
+    }
+    return input.definition.grantTemplates.map((template) => {
+        if (!template.server)
+            throw new Error('vault authority grant template requires server');
+        if (template.resources.length === 0)
+            throw new Error('vault authority grant template requires resources');
+        if (template.ops.length === 0)
+            throw new Error('vault authority grant template requires ops');
+        const resources = template.resources.map((r) => {
+            const resource = expand(r, input);
+            assertSafeResource(resource);
+            return resource;
+        });
+        return {
+            server: template.server,
+            resources,
+            ops: [...template.ops],
+        };
+    });
+}
+//# sourceMappingURL=templates.js.map

package/dist/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,SAAS,MAAM,CAAC,KAAmC;IACjD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK;QAC1B,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;QACtC,gBAAgB,EAAE,KAAK,CAAC,UAAU,CAAC,gBAAgB;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,KAAmC;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,GAAW,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,GAAG,CAAC,CAAC;QAClG,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,GAAG,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,2BAA2B,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,gBAAgB,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,gCAAgC,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAmC;IAC/E,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,UAAU,CAAC,gBAAgB,yBAAyB,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtD,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxF,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1G,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC9F,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS;YACT,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,96 @@
+import type { VaultRecordScopeGrant } from '@agenticprimitives/delegation';
+import type { RoleAssignmentBody, RoleAssignmentStatus, RoleScopeKind } from '@agenticprimitives/organization';
+import type { Address } from '@agenticprimitives/types';
+export type { RoleAssignmentStatus, RoleScopeKind };
+export type VaultAuthorityOperation = 'read' | 'write' | 'delete';
+/**
+ * A vault-resident subject. The subject is not an agent and never delegates; it is the thing a
+ * RoleAssignment is about.
+ */
+export interface VaultSubjectRef {
+    readonly vaultOwner: Address;
+    readonly scope: RoleScopeKind;
+    readonly scopeRef: string | null;
+    readonly subjectType?: string;
+}
+/**
+ * A `VaultRecordScopeGrant` template. Resources are `vault:`-prefixed strings with a small, fixed
+ * placeholder vocabulary expanded by `compileVaultRecordScopeGrants`.
+ */
+export interface VaultRecordScopeTemplate {
+    readonly server: string;
+    readonly resources: readonly string[];
+    readonly ops: readonly VaultAuthorityOperation[];
+}
+/**
+ * Generic role definition for authority over vault-resident subjects.
+ *
+ * `capabilities` are projection labels for product UX. The executable authority is materialized by
+ * expanding `grantTemplates` into delegation caveats.
+ */
+export interface VaultAuthorityRoleDefinition {
+    readonly roleDefinitionId: string;
+    readonly name: string;
+    readonly version: string;
+    readonly allowedScopes: readonly RoleScopeKind[];
+    readonly capabilities: readonly string[];
+    readonly grantTemplates: readonly VaultRecordScopeTemplate[];
+    readonly entitlementTemplateRefs?: readonly string[];
+}
+export interface VaultSubjectRoleGrant {
+    readonly subject: Address;
+    readonly roleDefinitionId: string;
+    readonly roleName: string;
+    readonly scope: RoleScopeKind;
+    readonly scopeRef: string | null;
+    readonly status: RoleAssignmentStatus;
+    readonly capabilities: readonly string[];
+    readonly authorityRefs: readonly string[];
+    readonly entitlementRefs: readonly string[];
+}
+export interface CompileVaultRecordScopeInput {
+    readonly definition: VaultAuthorityRoleDefinition;
+    readonly subject: VaultSubjectRef;
+}
+export interface ProjectVaultSubjectRoleInput {
+    readonly assignment: RoleAssignmentBody;
+    readonly assignee: Address;
+    readonly definition: VaultAuthorityRoleDefinition;
+}
+export interface ProjectVaultSubjectRolePartsInput {
+    readonly assignee: Address;
+    readonly roleDefinitionId: string;
+    readonly roleName: string;
+    readonly scope: RoleScopeKind;
+    readonly scopeRef: string | null;
+    readonly status: RoleAssignmentStatus;
+    readonly capabilities: readonly string[];
+    readonly authorityRefs?: readonly string[];
+    readonly entitlementRefs?: readonly string[];
+}
+export interface VaultSubjectOperationRequest {
+    readonly server: string;
+    readonly resource: string;
+    readonly op: VaultAuthorityOperation;
+}
+export interface AuthorizeVaultSubjectOperationInput {
+    readonly assignment: RoleAssignmentBody | null;
+    readonly definition: VaultAuthorityRoleDefinition;
+    readonly subject: VaultSubjectRef;
+    /**
+     * True only after the caller has verified the assignment's materializing delegation/entitlement.
+     * This package never verifies signatures or chain state.
+     */
+    readonly hasMaterializingAuthority: boolean;
+    readonly recordScopes?: readonly VaultRecordScopeGrant[];
+    readonly request: VaultSubjectOperationRequest;
+    readonly at?: string;
+}
+export type VaultSubjectAuthorityDenyReason = 'missing-assignment' | 'inactive-assignment' | 'role-definition-mismatch' | 'scope-not-allowed' | 'subject-mismatch' | 'missing-materializing-authority' | 'record-scope-denied';
+export type VaultSubjectAuthorityDecision = {
+    readonly decision: 'allow';
+} | {
+    readonly decision: 'deny';
+    readonly reason: VaultSubjectAuthorityDenyReason;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAC/G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC;AAEpD,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAClD;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,aAAa,EAAE,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7D,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;CACnD;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,uBAAuB,CAAC;CACtC;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;IAC/C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,+BAA+B,GACvC,oBAAoB,GACpB,qBAAqB,GACrB,0BAA0B,GAC1B,mBAAmB,GACnB,kBAAkB,GAClB,iCAAiC,GACjC,qBAAqB,CAAC;AAE1B,MAAM,MAAM,6BAA6B,GACrC;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAA;CAAE,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@agenticprimitives/vault-authority",
+  "version": "0.0.0-alpha.1",
+  "description": "Vault subject authority primitives: role assignments scoped to vault-resident subjects, vault-record-scope grant compilation, and pure runtime decisions.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
+    "directory": "packages/vault-authority"
+  },
+  "homepage": "https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/vault-authority",
+  "bugs": {
+    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "LICENSE",
+    "dist",
+    "spec.md",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@agenticprimitives/delegation": "1.0.0-alpha.21",
+    "@agenticprimitives/types": "1.0.0-alpha.21",
+    "@agenticprimitives/organization": "0.0.0-alpha.5"
+  },
+  "devDependencies": {
+    "vitest": "^4.1.8"
+  },
+  "keywords": [
+    "agentic",
+    "vault",
+    "authority",
+    "roles",
+    "delegation"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:unit": "vitest run test/unit --passWithNoTests",
+    "clean": "rm -rf dist"
+  }
+}

package/spec.md

@@ -0,0 +1 @@
+See [spec 343](../../specs/343-vault-subject-authority.md).