@medicine-wheel/community-identity 0.14.0

package/README.md

@@ -0,0 +1,20 @@
+# @medicine-wheel/community-identity
+
+Who is in the circle. A person is a `human` node on the wheel with `metadata.kind = 'person'` and a `role`; a circle is a `circle` node; membership is a `member_of` edge; ceremonies held in a circle carry `circle_id`. Tokens and invitation codes are kept by the consumer (hashed, jsonl or your own store), never on the wheel.
+
+Roles and the permission map are copied from STPB (`lib/types/roles.ts`): `participant → emerging_guide → ceremony_facilitator → firekeeper → admin`, with `story_keeper` parallel to firekeeper, plus `companion_ai` and `integration_ai`.
+
+```ts
+import { personNode, circleNode, membershipEdge, hasPermission, JsonlCredentialStore, JsonlInvitationStore } from '@medicine-wheel/community-identity';
+
+const node = personNode({ name: 'Guillaume', role: 'admin' });           // POST to /api/nodes
+const circle = circleNode({ name: 'Ep349 circle', intention: '…', facilitator_id: node.id });
+const edge = membershipEdge(node.id, circle.id, 'facilitator');          // POST to /api/edges
+hasPermission('ceremony_facilitator', 'invite_members');                 // true
+
+const creds = new JsonlCredentialStore('/srv/miadi/identity/credentials.jsonl');
+const { token } = await creds.issue(node.id, 'laptop');                  // shown once
+const record = await creds.verify(token);                                // who is calling
+```
+
+Added in 0.14.0 for jgwill/Miadi#647 (episode 349). Spec: `rispecs/community-identity.spec.md`.

package/dist/circles.d.ts

@@ -0,0 +1,100 @@
+/**
+ * A circle is a node on the wheel of type `circle`; membership is a relation.
+ *
+ * Copied in shape from STPB's `StoryCircle` (`lib/community/types.ts`:
+ * facilitator, participants, invited, capacity, sacred-container config) and
+ * mapped onto the wheel: the circle is a node, each member is an edge
+ * `member_of` from the person to the circle, the facilitator is the edge whose
+ * obligations name `facilitate`. Ceremonies held in the circle carry its id
+ * in `circle_id` (ontology-core 0.14.0).
+ */
+import type { DirectionName, RelationalEdge, RelationalNode } from '@medicine-wheel/ontology-core';
+import { z } from 'zod';
+export declare const CIRCLE_KIND: "circle";
+export declare const MEMBER_OF: "member_of";
+/** What protects the space. A subset of STPB's SacredContainerConfig, the part a wheel can honour. */
+export interface CircleContainer {
+    /** New ceremonies and beats in this circle are private to its members until shared. */
+    private_by_default: boolean;
+    /** Sharing outside the circle needs the speaker's explicit consent. */
+    explicit_sharing_consent: boolean;
+    /** No counts, no rankings shown to members. */
+    hide_engagement_metrics: boolean;
+}
+export declare const DEFAULT_CONTAINER: CircleContainer;
+export interface Circle {
+    /** The node id on the wheel. */
+    id: string;
+    name: string;
+    intention: string;
+    facilitator_id: string;
+    direction?: DirectionName;
+    capacity?: number;
+    container: CircleContainer;
+    created_at: string;
+    updated_at: string;
+}
+export declare const NewCircleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    intention: z.ZodString;
+    facilitator_id: z.ZodString;
+    direction: z.ZodOptional<z.ZodEnum<["east", "south", "west", "north"]>>;
+    capacity: z.ZodOptional<z.ZodNumber>;
+    container: z.ZodOptional<z.ZodObject<{
+        private_by_default: z.ZodOptional<z.ZodBoolean>;
+        explicit_sharing_consent: z.ZodOptional<z.ZodBoolean>;
+        hide_engagement_metrics: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        private_by_default?: boolean | undefined;
+        explicit_sharing_consent?: boolean | undefined;
+        hide_engagement_metrics?: boolean | undefined;
+    }, {
+        private_by_default?: boolean | undefined;
+        explicit_sharing_consent?: boolean | undefined;
+        hide_engagement_metrics?: boolean | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    intention: string;
+    facilitator_id: string;
+    id?: string | undefined;
+    direction?: "east" | "south" | "west" | "north" | undefined;
+    capacity?: number | undefined;
+    container?: {
+        private_by_default?: boolean | undefined;
+        explicit_sharing_consent?: boolean | undefined;
+        hide_engagement_metrics?: boolean | undefined;
+    } | undefined;
+}, {
+    name: string;
+    intention: string;
+    facilitator_id: string;
+    id?: string | undefined;
+    direction?: "east" | "south" | "west" | "north" | undefined;
+    capacity?: number | undefined;
+    container?: {
+        private_by_default?: boolean | undefined;
+        explicit_sharing_consent?: boolean | undefined;
+        hide_engagement_metrics?: boolean | undefined;
+    } | undefined;
+}>;
+export type NewCircle = z.infer<typeof NewCircleSchema>;
+export declare function circleNodeId(): string;
+export declare function circleNode(input: NewCircle, now?: string): RelationalNode;
+export declare function circleFromNode(node: RelationalNode | null | undefined): Circle | null;
+export type CircleRole = 'member' | 'facilitator';
+export interface Membership {
+    person_id: string;
+    circle_id: string;
+    role: CircleRole;
+    since: string;
+}
+/** The edge to weave on the wheel when a person joins a circle. */
+export declare function membershipEdge(person_id: string, circle_id: string, role?: CircleRole, now?: string): Omit<RelationalEdge, 'id'>;
+export declare function membershipFromEdge(edge: RelationalEdge | Omit<RelationalEdge, 'id'>): Membership | null;
+/** Members of one circle, from the edges that point at it. */
+export declare function membersOf(circle_id: string, edges: readonly (RelationalEdge | Omit<RelationalEdge, 'id'>)[]): Membership[];
+/** Circles one person belongs to, from the edges that leave them. */
+export declare function circlesOf(person_id: string, edges: readonly (RelationalEdge | Omit<RelationalEdge, 'id'>)[]): Membership[];
+//# sourceMappingURL=circles.d.ts.map

package/dist/circles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"circles.d.ts","sourceRoot":"","sources":["../src/circles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,WAAW,EAAG,QAAiB,CAAC;AAC7C,eAAO,MAAM,SAAS,EAAG,WAAoB,CAAC;AAE9C,sGAAsG;AACtG,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uEAAuE;IACvE,wBAAwB,EAAE,OAAO,CAAC;IAClC,+CAA+C;IAC/C,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,eAAO,MAAM,iBAAiB,EAAE,eAI/B,CAAC;AAEF,MAAM,WAAW,MAAM;IACrB,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,SAA2B,GAAG,cAAc,CAgB3F;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAgBrF;AAED,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC;AAElD,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,UAAqB,EAAE,GAAG,SAA2B,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAU5J;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,UAAU,GAAG,IAAI,CAQvG;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAK1H;AAED,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,CAK1H"}

package/dist/circles.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * A circle is a node on the wheel of type `circle`; membership is a relation.
+ *
+ * Copied in shape from STPB's `StoryCircle` (`lib/community/types.ts`:
+ * facilitator, participants, invited, capacity, sacred-container config) and
+ * mapped onto the wheel: the circle is a node, each member is an edge
+ * `member_of` from the person to the circle, the facilitator is the edge whose
+ * obligations name `facilitate`. Ceremonies held in the circle carry its id
+ * in `circle_id` (ontology-core 0.14.0).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NewCircleSchema = exports.DEFAULT_CONTAINER = exports.MEMBER_OF = exports.CIRCLE_KIND = void 0;
+exports.circleNodeId = circleNodeId;
+exports.circleNode = circleNode;
+exports.circleFromNode = circleFromNode;
+exports.membershipEdge = membershipEdge;
+exports.membershipFromEdge = membershipFromEdge;
+exports.membersOf = membersOf;
+exports.circlesOf = circlesOf;
+const zod_1 = require("zod");
+exports.CIRCLE_KIND = 'circle';
+exports.MEMBER_OF = 'member_of';
+exports.DEFAULT_CONTAINER = {
+    private_by_default: true,
+    explicit_sharing_consent: true,
+    hide_engagement_metrics: true,
+};
+exports.NewCircleSchema = zod_1.z.object({
+    id: zod_1.z.string().trim().min(1).optional(),
+    name: zod_1.z.string().trim().min(1),
+    intention: zod_1.z.string().trim().min(1),
+    facilitator_id: zod_1.z.string().trim().min(1),
+    direction: zod_1.z.enum(['east', 'south', 'west', 'north']).optional(),
+    capacity: zod_1.z.number().int().positive().optional(),
+    container: zod_1.z
+        .object({
+        private_by_default: zod_1.z.boolean().optional(),
+        explicit_sharing_consent: zod_1.z.boolean().optional(),
+        hide_engagement_metrics: zod_1.z.boolean().optional(),
+    })
+        .optional(),
+});
+function circleNodeId() {
+    return `circle:${Date.now()}:${Math.random().toString(36).slice(2, 8)}`;
+}
+function circleNode(input, now = new Date().toISOString()) {
+    return {
+        id: input.id ?? circleNodeId(),
+        name: input.name,
+        type: 'circle',
+        ...(input.direction ? { direction: input.direction } : {}),
+        metadata: {
+            kind: exports.CIRCLE_KIND,
+            intention: input.intention,
+            facilitator_id: input.facilitator_id,
+            ...(input.capacity !== undefined ? { capacity: input.capacity } : {}),
+            container: { ...exports.DEFAULT_CONTAINER, ...(input.container ?? {}) },
+        },
+        created_at: now,
+        updated_at: now,
+    };
+}
+function circleFromNode(node) {
+    if (!node || node.type !== 'circle')
+        return null;
+    const meta = node.metadata ?? {};
+    if (typeof meta.facilitator_id !== 'string')
+        return null;
+    const container = (meta.container && typeof meta.container === 'object' ? meta.container : {});
+    return {
+        id: node.id,
+        name: node.name,
+        intention: typeof meta.intention === 'string' ? meta.intention : '',
+        facilitator_id: meta.facilitator_id,
+        ...(node.direction ? { direction: node.direction } : {}),
+        ...(typeof meta.capacity === 'number' ? { capacity: meta.capacity } : {}),
+        container: { ...exports.DEFAULT_CONTAINER, ...container },
+        created_at: node.created_at,
+        updated_at: node.updated_at,
+    };
+}
+/** The edge to weave on the wheel when a person joins a circle. */
+function membershipEdge(person_id, circle_id, role = 'member', now = new Date().toISOString()) {
+    return {
+        from_id: person_id,
+        to_id: circle_id,
+        relationship_type: exports.MEMBER_OF,
+        strength: 1,
+        ceremony_honored: false,
+        obligations: role === 'facilitator' ? ['facilitate', 'hold the space'] : ['show up', 'listen'],
+        created_at: now,
+    };
+}
+function membershipFromEdge(edge) {
+    if (edge.relationship_type !== exports.MEMBER_OF)
+        return null;
+    return {
+        person_id: edge.from_id,
+        circle_id: edge.to_id,
+        role: edge.obligations?.includes('facilitate') ? 'facilitator' : 'member',
+        since: edge.created_at,
+    };
+}
+/** Members of one circle, from the edges that point at it. */
+function membersOf(circle_id, edges) {
+    return edges
+        .filter((e) => e.to_id === circle_id)
+        .map(membershipFromEdge)
+        .filter((m) => m !== null);
+}
+/** Circles one person belongs to, from the edges that leave them. */
+function circlesOf(person_id, edges) {
+    return edges
+        .filter((e) => e.from_id === person_id)
+        .map(membershipFromEdge)
+        .filter((m) => m !== null);
+}
+//# sourceMappingURL=circles.js.map

package/dist/circles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circles.js","sourceRoot":"","sources":["../src/circles.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAuDH,oCAEC;AAED,gCAgBC;AAED,wCAgBC;AAYD,wCAUC;AAED,gDAQC;AAGD,8BAKC;AAGD,8BAKC;AA1ID,6BAAwB;AAEX,QAAA,WAAW,GAAG,QAAiB,CAAC;AAChC,QAAA,SAAS,GAAG,WAAoB,CAAC;AAYjC,QAAA,iBAAiB,GAAoB;IAChD,kBAAkB,EAAE,IAAI;IACxB,wBAAwB,EAAE,IAAI;IAC9B,uBAAuB,EAAE,IAAI;CAC9B,CAAC;AAeW,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,SAAS,EAAE,OAAC;SACT,MAAM,CAAC;QACN,kBAAkB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC1C,wBAAwB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChD,uBAAuB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,SAAgB,YAAY;IAC1B,OAAO,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAgB,UAAU,CAAC,KAAgB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACzE,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,YAAY,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,QAAQ,EAAE;YACR,IAAI,EAAE,mBAAW;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,EAAE,GAAG,yBAAiB,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE;SAChE;QACD,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAAC,IAAuC;IACpE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAA6B,CAAC;IAC3H,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACnE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,SAAS,EAAE,EAAE,GAAG,yBAAiB,EAAE,GAAG,SAAS,EAAE;QACjD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAWD,mEAAmE;AACnE,SAAgB,cAAc,CAAC,SAAiB,EAAE,SAAiB,EAAE,OAAmB,QAAQ,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAC9H,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,SAAS;QAChB,iBAAiB,EAAE,iBAAS;QAC5B,QAAQ,EAAE,CAAC;QACX,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC9F,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAiD;IAClF,IAAI,IAAI,CAAC,iBAAiB,KAAK,iBAAS;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;QACzE,KAAK,EAAE,IAAI,CAAC,UAAU;KACvB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,SAAS,CAAC,SAAiB,EAAE,KAA+D;IAC1G,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;SACpC,GAAG,CAAC,kBAAkB,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,qEAAqE;AACrE,SAAgB,SAAS,CAAC,SAAiB,EAAE,KAA+D;IAC1G,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;SACtC,GAAG,CAAC,kBAAkB,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAChD,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Credentials: the secret that proves a person is who the wheel says.
+ *
+ * Never stored on the wheel. The wheel holds the relational truth (who, in
+ * which circle, with which role); the consumer that lets people sign in holds
+ * the secrets, hashed. A person issues their own tokens (STPB's
+ * `api/user/tokens`), an admin issues the first one for a newcomer.
+ *
+ * The store is an interface so a community can keep credentials where it
+ * chooses. `JsonlCredentialStore` is the file-backed one Miadi uses.
+ */
+export declare const TOKEN_PREFIX = "mwt_";
+export interface CredentialRecord {
+    id: string;
+    person_id: string;
+    label: string;
+    /** sha256 hex of the token. The token itself is shown once, at issue. */
+    token_hash: string;
+    created_at: string;
+    last_used_at?: string;
+    revoked_at?: string;
+}
+export interface IssuedCredential {
+    /** The bearer token, shown once. */
+    token: string;
+    record: CredentialRecord;
+}
+export interface CredentialStore {
+    issue(person_id: string, label: string): Promise<IssuedCredential>;
+    /** The live record for a token, or null when unknown or revoked. Touches `last_used_at`. */
+    verify(token: string): Promise<CredentialRecord | null>;
+    list(person_id: string): Promise<CredentialRecord[]>;
+    /** Revoke by record id. Returns false when unknown. */
+    revoke(id: string, person_id?: string): Promise<boolean>;
+}
+export declare function mintToken(): string;
+export declare function hashToken(token: string): string;
+/**
+ * One append-only jsonl file: issues append, revocations and last-use rewrite
+ * the record in place. Small by design; a community with thousands of people
+ * puts the same interface over a database.
+ */
+export declare class JsonlCredentialStore implements CredentialStore {
+    private readonly file;
+    constructor(file: string);
+    private readAll;
+    private writeAll;
+    issue(person_id: string, label: string): Promise<IssuedCredential>;
+    verify(token: string): Promise<CredentialRecord | null>;
+    list(person_id: string): Promise<CredentialRecord[]>;
+    revoke(id: string, person_id?: string): Promise<boolean>;
+}
+/** Public view of a credential: never the hash. */
+export declare function publicCredential(record: CredentialRecord): Omit<CredentialRecord, 'token_hash'>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,eAAO,MAAM,YAAY,SAAS,CAAC;AAEnC,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACnE,4FAA4F;IAC5F,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrD,uDAAuD;IACvD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAYD;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,eAAe;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEzC,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,QAAQ;IAKV,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAelE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAWvD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAU/D;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAG/F"}

package/dist/credentials.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * Credentials: the secret that proves a person is who the wheel says.
+ *
+ * Never stored on the wheel. The wheel holds the relational truth (who, in
+ * which circle, with which role); the consumer that lets people sign in holds
+ * the secrets, hashed. A person issues their own tokens (STPB's
+ * `api/user/tokens`), an admin issues the first one for a newcomer.
+ *
+ * The store is an interface so a community can keep credentials where it
+ * chooses. `JsonlCredentialStore` is the file-backed one Miadi uses.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JsonlCredentialStore = exports.TOKEN_PREFIX = void 0;
+exports.mintToken = mintToken;
+exports.hashToken = hashToken;
+exports.publicCredential = publicCredential;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+exports.TOKEN_PREFIX = 'mwt_';
+function mintToken() {
+    return exports.TOKEN_PREFIX + (0, node_crypto_1.randomBytes)(32).toString('base64url');
+}
+function hashToken(token) {
+    return (0, node_crypto_1.createHash)('sha256').update(token, 'utf8').digest('hex');
+}
+function sameHash(a, b) {
+    const ba = Buffer.from(a, 'hex');
+    const bb = Buffer.from(b, 'hex');
+    return ba.length === bb.length && (0, node_crypto_1.timingSafeEqual)(ba, bb);
+}
+function credentialId() {
+    return `cred:${Date.now()}:${(0, node_crypto_1.randomBytes)(3).toString('hex')}`;
+}
+/**
+ * One append-only jsonl file: issues append, revocations and last-use rewrite
+ * the record in place. Small by design; a community with thousands of people
+ * puts the same interface over a database.
+ */
+class JsonlCredentialStore {
+    file;
+    constructor(file) {
+        this.file = file;
+    }
+    readAll() {
+        if (!(0, node_fs_1.existsSync)(this.file))
+            return [];
+        return (0, node_fs_1.readFileSync)(this.file, 'utf8')
+            .split('\n')
+            .filter((line) => line.trim())
+            .map((line) => JSON.parse(line));
+    }
+    writeAll(records) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(this.file), { recursive: true });
+        (0, node_fs_1.writeFileSync)(this.file, records.map((r) => JSON.stringify(r)).join('\n') + (records.length ? '\n' : ''), { mode: 0o600 });
+    }
+    async issue(person_id, label) {
+        const token = mintToken();
+        const record = {
+            id: credentialId(),
+            person_id,
+            label: label.trim() || 'token',
+            token_hash: hashToken(token),
+            created_at: new Date().toISOString(),
+        };
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(this.file), { recursive: true });
+        if (!(0, node_fs_1.existsSync)(this.file))
+            (0, node_fs_1.writeFileSync)(this.file, '', { mode: 0o600 });
+        (0, node_fs_1.appendFileSync)(this.file, JSON.stringify(record) + '\n');
+        return { token, record };
+    }
+    async verify(token) {
+        if (!token || !token.startsWith(exports.TOKEN_PREFIX))
+            return null;
+        const hash = hashToken(token);
+        const records = this.readAll();
+        const index = records.findIndex((r) => !r.revoked_at && sameHash(r.token_hash, hash));
+        if (index < 0)
+            return null;
+        records[index] = { ...records[index], last_used_at: new Date().toISOString() };
+        this.writeAll(records);
+        return records[index];
+    }
+    async list(person_id) {
+        return this.readAll().filter((r) => r.person_id === person_id);
+    }
+    async revoke(id, person_id) {
+        const records = this.readAll();
+        const index = records.findIndex((r) => r.id === id && (person_id === undefined || r.person_id === person_id));
+        if (index < 0)
+            return false;
+        if (!records[index].revoked_at) {
+            records[index] = { ...records[index], revoked_at: new Date().toISOString() };
+            this.writeAll(records);
+        }
+        return true;
+    }
+}
+exports.JsonlCredentialStore = JsonlCredentialStore;
+/** Public view of a credential: never the hash. */
+function publicCredential(record) {
+    const { token_hash: _hash, ...rest } = record;
+    return rest;
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAkCH,8BAEC;AAED,8BAEC;AA4ED,4CAGC;AArHD,6CAAuE;AACvE,qCAA6F;AAC7F,yCAAoC;AAEvB,QAAA,YAAY,GAAG,MAAM,CAAC;AA4BnC,SAAgB,SAAS;IACvB,OAAO,oBAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAa,oBAAoB;IACF;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,OAAO;QACb,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;aACnC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC,CAAC;IACzD,CAAC;IAEO,QAAQ,CAAC,OAA2B;QAC1C,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7H,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,KAAa;QAC1C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAqB;YAC/B,EAAE,EAAE,YAAY,EAAE;YAClB,SAAS;YACT,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,OAAO;YAC9B,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YAC5B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QACF,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,IAAA,wBAAc,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACtF,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,SAAkB;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC;QAC9G,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxDD,oDAwDC;AAED,mDAAmD;AACnD,SAAgB,gBAAgB,CAAC,MAAwB;IACvD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @medicine-wheel/community-identity
+ *
+ * Measured 2026-09-03 (`rispecs/community-identity.spec.md`): neither the wheel
+ * nor Miadi could tell two people apart. This package is the smallest set of
+ * facts that lets them: a person is a `human` node with a role, a circle is a
+ * `circle` node, membership is a `member_of` relation, and the secrets
+ * (tokens, invitation codes) are kept by the consumer, hashed, never on the
+ * wheel. Roles and their permission map are copied from STPB.
+ *
+ * What this package does not decide (the spec's held question): whether a
+ * published, unpublishable-after-72h npm package can honour OCAP's right to
+ * withdraw. It carries no person's data; it carries the shape.
+ */
+export * from './roles.js';
+export * from './people.js';
+export * from './circles.js';
+export * from './credentials.js';
+export * from './invitations.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,36 @@
+"use strict";
+/**
+ * @medicine-wheel/community-identity
+ *
+ * Measured 2026-09-03 (`rispecs/community-identity.spec.md`): neither the wheel
+ * nor Miadi could tell two people apart. This package is the smallest set of
+ * facts that lets them: a person is a `human` node with a role, a circle is a
+ * `circle` node, membership is a `member_of` relation, and the secrets
+ * (tokens, invitation codes) are kept by the consumer, hashed, never on the
+ * wheel. Roles and their permission map are copied from STPB.
+ *
+ * What this package does not decide (the spec's held question): whether a
+ * published, unpublishable-after-72h npm package can honour OCAP's right to
+ * withdraw. It carries no person's data; it carries the shape.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./roles.js"), exports);
+__exportStar(require("./people.js"), exports);
+__exportStar(require("./circles.js"), exports);
+__exportStar(require("./credentials.js"), exports);
+__exportStar(require("./invitations.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;AAEH,6CAA2B;AAC3B,8CAA4B;AAC5B,+CAA6B;AAC7B,mDAAiC;AACjC,mDAAiC"}

package/dist/invitations.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Invitations: the door into a circle.
+ *
+ * STPB invites by circle (`circles/[id]/invite`) and admits by ceremony code
+ * (`admin/ceremony-codes`). Here one record does both: a code, minted by
+ * someone allowed to invite, bound to a circle, with a role for whoever
+ * accepts it. Codes are operational, not relational, so like credentials they
+ * stay with the consumer, not on the wheel; accepting one weaves the
+ * `member_of` edge, which is the relational fact.
+ */
+import type { CircleRole } from './circles.js';
+export interface InvitationRecord {
+    code: string;
+    circle_id: string;
+    invited_by: string;
+    role: CircleRole;
+    /** A name or email the invitation was meant for; informational. */
+    intended_for?: string;
+    created_at: string;
+    expires_at?: string;
+    max_uses: number;
+    accepted_by: string[];
+    revoked_at?: string;
+}
+export interface InvitationStore {
+    create(input: {
+        circle_id: string;
+        invited_by: string;
+        role?: CircleRole;
+        intended_for?: string;
+        expires_at?: string;
+        max_uses?: number;
+    }): Promise<InvitationRecord>;
+    get(code: string): Promise<InvitationRecord | null>;
+    listForCircle(circle_id: string): Promise<InvitationRecord[]>;
+    /** Record an acceptance. Returns the record, or a reason it could not be accepted. */
+    accept(code: string, person_id: string): Promise<{
+        ok: true;
+        record: InvitationRecord;
+    } | {
+        ok: false;
+        reason: 'unknown' | 'revoked' | 'expired' | 'exhausted' | 'already';
+    }>;
+    revoke(code: string): Promise<boolean>;
+}
+export declare function mintInvitationCode(length?: number): string;
+export declare function invitationState(record: InvitationRecord, now?: number): 'open' | 'revoked' | 'expired' | 'exhausted';
+export declare class JsonlInvitationStore implements InvitationStore {
+    private readonly file;
+    constructor(file: string);
+    private readAll;
+    private writeAll;
+    create(input: {
+        circle_id: string;
+        invited_by: string;
+        role?: CircleRole;
+        intended_for?: string;
+        expires_at?: string;
+        max_uses?: number;
+    }): Promise<InvitationRecord>;
+    get(code: string): Promise<InvitationRecord | null>;
+    listForCircle(circle_id: string): Promise<InvitationRecord[]>;
+    accept(code: string, person_id: string): Promise<{
+        ok: false;
+        reason: "unknown";
+        record?: undefined;
+    } | {
+        ok: false;
+        reason: "already";
+        record?: undefined;
+    } | {
+        ok: false;
+        reason: "revoked" | "expired" | "exhausted";
+        record?: undefined;
+    } | {
+        ok: true;
+        record: InvitationRecord;
+        reason?: undefined;
+    }>;
+    revoke(code: string): Promise<boolean>;
+}
+//# sourceMappingURL=invitations.d.ts.map

package/dist/invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../src/invitations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtK,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC9D,sFAAsF;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IAC9K,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxC;AAID,wBAAgB,kBAAkB,CAAC,MAAM,SAAI,GAAG,MAAM,CAKrD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAKxH;AAED,qBAAa,oBAAqB,YAAW,eAAe;IAC9C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAEzC,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,QAAQ;IAKV,MAAM,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBrK,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAInD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAI7D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;IAatC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAU7C"}

package/dist/invitations.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * Invitations: the door into a circle.
+ *
+ * STPB invites by circle (`circles/[id]/invite`) and admits by ceremony code
+ * (`admin/ceremony-codes`). Here one record does both: a code, minted by
+ * someone allowed to invite, bound to a circle, with a role for whoever
+ * accepts it. Codes are operational, not relational, so like credentials they
+ * stay with the consumer, not on the wheel; accepting one weaves the
+ * `member_of` edge, which is the relational fact.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JsonlInvitationStore = void 0;
+exports.mintInvitationCode = mintInvitationCode;
+exports.invitationState = invitationState;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+function mintInvitationCode(length = 8) {
+    const bytes = (0, node_crypto_1.randomBytes)(length);
+    let out = '';
+    for (let i = 0; i < length; i++)
+        out += ALPHABET[bytes[i] % ALPHABET.length];
+    return out;
+}
+function invitationState(record, now = Date.now()) {
+    if (record.revoked_at)
+        return 'revoked';
+    if (record.expires_at && Date.parse(record.expires_at) < now)
+        return 'expired';
+    if (record.accepted_by.length >= record.max_uses)
+        return 'exhausted';
+    return 'open';
+}
+class JsonlInvitationStore {
+    file;
+    constructor(file) {
+        this.file = file;
+    }
+    readAll() {
+        if (!(0, node_fs_1.existsSync)(this.file))
+            return [];
+        return (0, node_fs_1.readFileSync)(this.file, 'utf8')
+            .split('\n')
+            .filter((line) => line.trim())
+            .map((line) => JSON.parse(line));
+    }
+    writeAll(records) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(this.file), { recursive: true });
+        (0, node_fs_1.writeFileSync)(this.file, records.map((r) => JSON.stringify(r)).join('\n') + (records.length ? '\n' : ''));
+    }
+    async create(input) {
+        const record = {
+            code: mintInvitationCode(),
+            circle_id: input.circle_id,
+            invited_by: input.invited_by,
+            role: input.role ?? 'member',
+            ...(input.intended_for ? { intended_for: input.intended_for } : {}),
+            created_at: new Date().toISOString(),
+            ...(input.expires_at ? { expires_at: input.expires_at } : {}),
+            max_uses: input.max_uses && input.max_uses > 0 ? input.max_uses : 1,
+            accepted_by: [],
+        };
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(this.file), { recursive: true });
+        (0, node_fs_1.appendFileSync)(this.file, JSON.stringify(record) + '\n');
+        return record;
+    }
+    async get(code) {
+        return this.readAll().find((r) => r.code === code.trim().toUpperCase()) ?? null;
+    }
+    async listForCircle(circle_id) {
+        return this.readAll().filter((r) => r.circle_id === circle_id);
+    }
+    async accept(code, person_id) {
+        const records = this.readAll();
+        const index = records.findIndex((r) => r.code === code.trim().toUpperCase());
+        if (index < 0)
+            return { ok: false, reason: 'unknown' };
+        const record = records[index];
+        if (record.accepted_by.includes(person_id))
+            return { ok: false, reason: 'already' };
+        const state = invitationState(record);
+        if (state !== 'open')
+            return { ok: false, reason: state };
+        records[index] = { ...record, accepted_by: [...record.accepted_by, person_id] };
+        this.writeAll(records);
+        return { ok: true, record: records[index] };
+    }
+    async revoke(code) {
+        const records = this.readAll();
+        const index = records.findIndex((r) => r.code === code.trim().toUpperCase());
+        if (index < 0)
+            return false;
+        if (!records[index].revoked_at) {
+            records[index] = { ...records[index], revoked_at: new Date().toISOString() };
+            this.writeAll(records);
+        }
+        return true;
+    }
+}
+exports.JsonlInvitationStore = JsonlInvitationStore;
+//# sourceMappingURL=invitations.js.map

package/dist/invitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../src/invitations.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAgCH,gDAKC;AAED,0CAKC;AA1CD,6CAA0C;AAC1C,qCAA6F;AAC7F,yCAAoC;AA0BpC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEnD,SAAgB,kBAAkB,CAAC,MAAM,GAAG,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,MAAM,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,MAAwB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxE,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAa,oBAAoB;IACF;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,OAAO;QACb,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;aACnC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC,CAAC;IACzD,CAAC;IAEO,QAAQ,CAAC,OAA2B;QAC1C,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkI;QAC7I,MAAM,MAAM,GAAqB;YAC/B,IAAI,EAAE,kBAAkB,EAAE;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;YAC5B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnE,WAAW,EAAE,EAAE;SAChB,CAAC;QACF,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,IAAA,wBAAc,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,SAAiB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7E,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;QACtG,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7E,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAhED,oDAgEC"}

package/dist/people.d.ts

@@ -0,0 +1,52 @@
+/**
+ * A person is a node on the wheel of type `human` whose metadata says so.
+ *
+ * The wheel had `human` nodes long before this package (participants in
+ * ceremonies were written as `node:human:<ts>:<rand>`); what it could not do
+ * was tell two of them apart or say what either may do. `metadata.kind =
+ * 'person'` and `metadata.role` are the two facts this package adds. The
+ * secret that proves a person is who they say (a token) never goes on the
+ * wheel; see `credentials.ts`.
+ */
+import type { DirectionName, RelationalNode } from '@medicine-wheel/ontology-core';
+import { z } from 'zod';
+import { type Role } from './roles.js';
+export declare const PERSON_KIND: "person";
+export interface Person {
+    /** The node id on the wheel. */
+    id: string;
+    name: string;
+    role: Role;
+    email?: string;
+    direction?: DirectionName;
+    created_at: string;
+    updated_at: string;
+}
+export declare const NewPersonSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    role: z.ZodEffects<z.ZodString, "participant" | "emerging_guide" | "ceremony_facilitator" | "firekeeper" | "story_keeper" | "admin" | "companion_ai" | "integration_ai", string>;
+    email: z.ZodOptional<z.ZodString>;
+    direction: z.ZodOptional<z.ZodEnum<["east", "south", "west", "north"]>>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    role: "participant" | "emerging_guide" | "ceremony_facilitator" | "firekeeper" | "story_keeper" | "admin" | "companion_ai" | "integration_ai";
+    id?: string | undefined;
+    direction?: "east" | "south" | "west" | "north" | undefined;
+    email?: string | undefined;
+}, {
+    name: string;
+    role: string;
+    id?: string | undefined;
+    direction?: "east" | "south" | "west" | "north" | undefined;
+    email?: string | undefined;
+}>;
+export type NewPerson = z.infer<typeof NewPersonSchema>;
+export declare function personNodeId(): string;
+/** The node to create on the wheel for a new person. */
+export declare function personNode(input: NewPerson, now?: string): RelationalNode;
+/** Read a person back from a node; null when the node is a human that this package does not govern. */
+export declare function personFromNode(node: RelationalNode | null | undefined): Person | null;
+/** The metadata patch that grants (or changes) a person's role. */
+export declare function roleGrant(role: Role, current?: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=people.d.ts.map

package/dist/people.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"people.d.ts","sourceRoot":"","sources":["../src/people.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAU,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AAE/C,eAAO,MAAM,WAAW,EAAG,QAAiB,CAAC;AAE7C,MAAM,WAAW,MAAM;IACrB,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;EAM1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,SAA2B,GAAG,cAAc,CAc3F;AAED,uGAAuG;AACvG,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAarF;AAED,mEAAmE;AACnE,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEpG"}

package/dist/people.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * A person is a node on the wheel of type `human` whose metadata says so.
+ *
+ * The wheel had `human` nodes long before this package (participants in
+ * ceremonies were written as `node:human:<ts>:<rand>`); what it could not do
+ * was tell two of them apart or say what either may do. `metadata.kind =
+ * 'person'` and `metadata.role` are the two facts this package adds. The
+ * secret that proves a person is who they say (a token) never goes on the
+ * wheel; see `credentials.ts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NewPersonSchema = exports.PERSON_KIND = void 0;
+exports.personNodeId = personNodeId;
+exports.personNode = personNode;
+exports.personFromNode = personFromNode;
+exports.roleGrant = roleGrant;
+const zod_1 = require("zod");
+const roles_js_1 = require("./roles.js");
+exports.PERSON_KIND = 'person';
+exports.NewPersonSchema = zod_1.z.object({
+    id: zod_1.z.string().trim().min(1).optional(),
+    name: zod_1.z.string().trim().min(1),
+    role: zod_1.z.string().refine(roles_js_1.isRole, 'unknown role'),
+    email: zod_1.z.string().trim().email().optional(),
+    direction: zod_1.z.enum(['east', 'south', 'west', 'north']).optional(),
+});
+function personNodeId() {
+    return `node:human:${Date.now()}:${Math.random().toString(36).slice(2, 8)}`;
+}
+/** The node to create on the wheel for a new person. */
+function personNode(input, now = new Date().toISOString()) {
+    return {
+        id: input.id ?? personNodeId(),
+        name: input.name,
+        type: 'human',
+        ...(input.direction ? { direction: input.direction } : {}),
+        metadata: {
+            kind: exports.PERSON_KIND,
+            role: input.role,
+            ...(input.email ? { email: input.email } : {}),
+        },
+        created_at: now,
+        updated_at: now,
+    };
+}
+/** Read a person back from a node; null when the node is a human that this package does not govern. */
+function personFromNode(node) {
+    if (!node || node.type !== 'human')
+        return null;
+    const meta = node.metadata ?? {};
+    if (meta.kind !== exports.PERSON_KIND || !(0, roles_js_1.isRole)(meta.role))
+        return null;
+    return {
+        id: node.id,
+        name: node.name,
+        role: meta.role,
+        ...(typeof meta.email === 'string' ? { email: meta.email } : {}),
+        ...(node.direction ? { direction: node.direction } : {}),
+        created_at: node.created_at,
+        updated_at: node.updated_at,
+    };
+}
+/** The metadata patch that grants (or changes) a person's role. */
+function roleGrant(role, current = {}) {
+    return { ...current, kind: exports.PERSON_KIND, role };
+}
+//# sourceMappingURL=people.js.map

package/dist/people.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"people.js","sourceRoot":"","sources":["../src/people.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA6BH,oCAEC;AAGD,gCAcC;AAGD,wCAaC;AAGD,8BAEC;AAlED,6BAAwB;AACxB,yCAA+C;AAElC,QAAA,WAAW,GAAG,QAAiB,CAAC;AAahC,QAAA,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAM,EAAE,cAAc,CAAC;IAC/C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAIH,SAAgB,YAAY;IAC1B,OAAO,cAAc,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,wDAAwD;AACxD,SAAgB,UAAU,CAAC,KAAgB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IACzE,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,YAAY,EAAE;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,QAAQ,EAAE;YACR,IAAI,EAAE,mBAAW;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;QACD,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,SAAgB,cAAc,CAAC,IAAuC;IACpE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAW,IAAI,CAAC,IAAA,iBAAM,EAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAgB,SAAS,CAAC,IAAU,EAAE,UAAmC,EAAE;IACzE,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,mBAAW,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC"}

package/dist/roles.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Roles and what each may do.
+ *
+ * Copied from STPB (`jgwill/StorytellingPlatformBlueprint2510`, `lib/types/roles.ts`)
+ * on 2026-09-18 and renamed where the name was a brand: `lighthouse_admin` is
+ * `admin`, `eva_ai` is `companion_ai`. The progression is the same one:
+ *
+ *   participant → emerging_guide → ceremony_facilitator → firekeeper → admin
+ *                                                        ↘ story_keeper (parallel)
+ */
+export declare const ROLES: readonly ["participant", "emerging_guide", "ceremony_facilitator", "firekeeper", "story_keeper", "admin", "companion_ai", "integration_ai"];
+export type Role = (typeof ROLES)[number];
+export declare const PERMISSIONS: readonly ["create_beats", "join_circles", "witness", "view_own_arc", "create_circles", "invite_members", "facilitate_ceremony", "moderate", "view_community_patterns", "view_historical_arcs", "create_wisdom", "propose_themes", "read_personal_data", "analyze_narrative", "read_public_api", "manage_people"];
+export type Permission = (typeof PERMISSIONS)[number];
+/** Story keeper is parallel to firekeeper, not above it. */
+export declare const ROLE_HIERARCHY: Record<Role, number>;
+export declare const ROLE_LABELS: Record<Role, string>;
+export declare const ROLE_PERMISSIONS: Record<Role, readonly (Permission | '*')[]>;
+export declare function isRole(value: unknown): value is Role;
+export declare function hasPermission(role: Role, permission: Permission): boolean;
+export declare function hasRoleLevel(role: Role, required: Role): boolean;
+export declare function rolesAtOrAbove(role: Role): Role[];
+//# sourceMappingURL=roles.d.ts.map

package/dist/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,KAAK,6IASR,CAAC;AAEX,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1C,eAAO,MAAM,WAAW,kTAiBd,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAS/C,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAS5C,CAAC;AAKF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,GAAG,GAAG,CAAC,EAAE,CASxE,CAAC;AAEF,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEpD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAGzE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,OAAO,CAEhE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,CAGjD"}

package/dist/roles.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Roles and what each may do.
+ *
+ * Copied from STPB (`jgwill/StorytellingPlatformBlueprint2510`, `lib/types/roles.ts`)
+ * on 2026-09-18 and renamed where the name was a brand: `lighthouse_admin` is
+ * `admin`, `eva_ai` is `companion_ai`. The progression is the same one:
+ *
+ *   participant → emerging_guide → ceremony_facilitator → firekeeper → admin
+ *                                                        ↘ story_keeper (parallel)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROLE_PERMISSIONS = exports.ROLE_LABELS = exports.ROLE_HIERARCHY = exports.PERMISSIONS = exports.ROLES = void 0;
+exports.isRole = isRole;
+exports.hasPermission = hasPermission;
+exports.hasRoleLevel = hasRoleLevel;
+exports.rolesAtOrAbove = rolesAtOrAbove;
+exports.ROLES = [
+    'participant',
+    'emerging_guide',
+    'ceremony_facilitator',
+    'firekeeper',
+    'story_keeper',
+    'admin',
+    'companion_ai',
+    'integration_ai',
+];
+exports.PERMISSIONS = [
+    'create_beats',
+    'join_circles',
+    'witness',
+    'view_own_arc',
+    'create_circles',
+    'invite_members',
+    'facilitate_ceremony',
+    'moderate',
+    'view_community_patterns',
+    'view_historical_arcs',
+    'create_wisdom',
+    'propose_themes',
+    'read_personal_data',
+    'analyze_narrative',
+    'read_public_api',
+    'manage_people',
+];
+/** Story keeper is parallel to firekeeper, not above it. */
+exports.ROLE_HIERARCHY = {
+    participant: 0,
+    emerging_guide: 1,
+    ceremony_facilitator: 2,
+    firekeeper: 3,
+    story_keeper: 3,
+    admin: 4,
+    companion_ai: 0,
+    integration_ai: 0,
+};
+exports.ROLE_LABELS = {
+    participant: 'Participant',
+    emerging_guide: 'Emerging Guide',
+    ceremony_facilitator: 'Ceremony Facilitator',
+    firekeeper: 'Firekeeper',
+    story_keeper: 'Story Keeper',
+    admin: 'Admin',
+    companion_ai: 'Companion AI',
+    integration_ai: 'Integration AI',
+};
+const BASE = ['create_beats', 'join_circles'];
+const GUIDE = [...BASE, 'witness', 'view_own_arc'];
+exports.ROLE_PERMISSIONS = {
+    participant: BASE,
+    emerging_guide: GUIDE,
+    ceremony_facilitator: [...GUIDE, 'create_circles', 'invite_members', 'facilitate_ceremony'],
+    firekeeper: [...GUIDE, 'create_circles', 'invite_members', 'moderate', 'view_community_patterns'],
+    story_keeper: [...GUIDE, 'view_community_patterns', 'view_historical_arcs', 'create_wisdom', 'propose_themes'],
+    admin: ['*'],
+    companion_ai: ['read_personal_data', 'analyze_narrative'],
+    integration_ai: ['read_public_api'],
+};
+function isRole(value) {
+    return typeof value === 'string' && exports.ROLES.includes(value);
+}
+function hasPermission(role, permission) {
+    const perms = exports.ROLE_PERMISSIONS[role];
+    return perms.includes('*') || perms.includes(permission);
+}
+function hasRoleLevel(role, required) {
+    return exports.ROLE_HIERARCHY[role] >= exports.ROLE_HIERARCHY[required];
+}
+function rolesAtOrAbove(role) {
+    const level = exports.ROLE_HIERARCHY[role];
+    return exports.ROLES.filter((r) => exports.ROLE_HIERARCHY[r] >= level);
+}
+//# sourceMappingURL=roles.js.map

package/dist/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAyEH,wBAEC;AAED,sCAGC;AAED,oCAEC;AAED,wCAGC;AAvFY,QAAA,KAAK,GAAG;IACnB,aAAa;IACb,gBAAgB;IAChB,sBAAsB;IACtB,YAAY;IACZ,cAAc;IACd,OAAO;IACP,cAAc;IACd,gBAAgB;CACR,CAAC;AAIE,QAAA,WAAW,GAAG;IACzB,cAAc;IACd,cAAc;IACd,SAAS;IACT,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,UAAU;IACV,yBAAyB;IACzB,sBAAsB;IACtB,eAAe;IACf,gBAAgB;IAChB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;CACP,CAAC;AAIX,4DAA4D;AAC/C,QAAA,cAAc,GAAyB;IAClD,WAAW,EAAE,CAAC;IACd,cAAc,EAAE,CAAC;IACjB,oBAAoB,EAAE,CAAC;IACvB,UAAU,EAAE,CAAC;IACb,YAAY,EAAE,CAAC;IACf,KAAK,EAAE,CAAC;IACR,YAAY,EAAE,CAAC;IACf,cAAc,EAAE,CAAC;CAClB,CAAC;AAEW,QAAA,WAAW,GAAyB;IAC/C,WAAW,EAAE,aAAa;IAC1B,cAAc,EAAE,gBAAgB;IAChC,oBAAoB,EAAE,sBAAsB;IAC5C,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;CACjC,CAAC;AAEF,MAAM,IAAI,GAAiB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;AAC5D,MAAM,KAAK,GAAiB,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAEpD,QAAA,gBAAgB,GAAgD;IAC3E,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,KAAK;IACrB,oBAAoB,EAAE,CAAC,GAAG,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;IAC3F,UAAU,EAAE,CAAC,GAAG,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,yBAAyB,CAAC;IACjG,YAAY,EAAE,CAAC,GAAG,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,CAAC;IAC9G,KAAK,EAAE,CAAC,GAAG,CAAC;IACZ,YAAY,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;IACzD,cAAc,EAAE,CAAC,iBAAiB,CAAC;CACpC,CAAC;AAEF,SAAgB,MAAM,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,SAAgB,aAAa,CAAC,IAAU,EAAE,UAAsB;IAC9D,MAAM,KAAK,GAAG,wBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED,SAAgB,YAAY,CAAC,IAAU,EAAE,QAAc;IACrD,OAAO,sBAAc,CAAC,IAAI,CAAC,IAAI,sBAAc,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc,CAAC,IAAU;IACvC,MAAM,KAAK,GAAG,sBAAc,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,aAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAc,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@medicine-wheel/community-identity",
+  "version": "0.14.0",
+  "description": "Who is in the circle: people as wheel nodes, roles with a permission map, circles and memberships as relations, invitations and self-issued credentials kept by the consumer — so a Medicine Wheel can tell two people apart.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "lint": "tsc --noEmit",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "keywords": [
+    "medicine-wheel",
+    "identity",
+    "roles",
+    "circles",
+    "talking-circle",
+    "invitations",
+    "relational-accountability"
+  ],
+  "author": "IAIP Collaborative - Shawinigan, QC",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jgwill/medicine-wheel.git",
+    "directory": "src/community-identity"
+  },
+  "dependencies": {
+    "@medicine-wheel/ontology-core": "^0.14.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.10.0",
+    "typescript": "^5.3.0"
+  }
+}