@vantageos/cloud-identity 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -3,6 +3,65 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased] - 0.3.0
+
+**BREAKING.** Closes two measured 0.2.0 defects — a right must never be
+granted by absence.
+
+### Changed (breaking)
+
+- `passesScopeFilter`, `scopeFilterList`, `scopeFilterGet`, `isMasterScope`,
+  `isWildcardScope`: `oauthCtx` is now **mandatory** (`OAuthCtx`, no longer
+  `OAuthCtx | undefined`). The 0.2.0 behaviour of an omitted `oauthCtx`
+  silently passing every row (wildcard, as if master-scoped) is removed.
+  Omitting the argument now breaks the caller's build; at runtime (for
+  callers that bypass TypeScript) it throws instead of granting access.
+  Callers that deliberately want the old legacy-bearer wildcard behaviour
+  must import and pass the new `LEGACY_WILDCARD_CTX` sentinel explicitly.
+
+### Added
+
+- `LEGACY_WILDCARD_CTX` — explicit, by-name opt-in for the pre-0.3.0
+  legacy-bearer wildcard behaviour (`src/scope-filter.ts`).
+- `requireTenantId(source: TenantSource): string` — organization/workspace
+  membership guard, unifying the human (session) and machine (bearer) entry
+  paths behind one contract. Refuses on missing session, missing/empty `orgId`, and
+  missing/empty bearer-resolved `workspaceId` (`src/org-guard.ts`).
+- `SessionIdentity`, `TenantSource` types.
+
+### Scope note
+
+The package now exposes, behind one contract, all four primitives an
+application needs and should never reimplement: tenant resolution
+(`getEffectiveTenantId`), membership requirement (`requireTenantId`), row
+filtering (`passesScopeFilter` / `scopeFilterList` / `scopeFilterGet`), and
+identifier validation (`validateMasterBearer`). Framework adapters (Convex,
+Hono, etc.) wrap these; they must not reimplement the checks.
+
+## [0.2.0] - 2026-06-13
+
+Additive release — domain-tenancy layer. No breaking changes. All 0.1.0 exports unchanged.
+
+### Added
+
+- `WorkspaceRole` literal union `"Admin" | "Editor" | "Viewer"` + `workspaceRoleSchema` (Zod).
+- `Workspace` type + `workspaceSchema` (Zod) — `{ id, name, createdAt, metadata? }`.
+- `WorkspaceMember` type + `workspaceMemberSchema` (Zod) — `{ userId, workspaceId, role, joinedAt }`.
+- `TenantContext` type + `tenantContextSchema` (Zod) — `{ workspaceId, userId, roles[] }`.
+- `ScopeViolationError` class — `code: "SCOPE_VIOLATION"`, payload `{ requestedTenantId, contextTenantId, reason }`. Canonical cross-tenant isolation signal — translate to 403 or MCP permission-denied.
+- `getEffectiveTenantId(ctx, args)` — multi-tenant isolation guard. Throws `ScopeViolationError` when `args.workspaceId !== ctx.workspaceId`; returns `ctx.workspaceId` on match.
+- `decodeUnverifiedBearer(token)` — async DECODER for `base64(JSON({ userId, workspaceId, roles[] }))` into `BearerPayload`. Validates SHAPE via Zod and throws on shape or decode failure. **⚠️ NOT authentication. NOT a trust boundary.** Performs NO signature verification, NO issuer check, NO expiry check. The decoded payload is attacker-controlled — see the "Security: bearer decoding" section of README. Use as a test fixture or as a decoder for a bearer already verified by an upstream signed-JWT / opaque-token middleware. The production trust boundary (signed JWT + verification) is planned for 0.3.0. Renamed from the original `resolveBearer` (0.2.0 pre-release) per Eta security review — the new name makes the lack of verification impossible to miss at the call-site.
+- `BearerPayload` type (inferred from Zod schema).
+- `ScopeViolationPayload` interface.
+- New subpath export: `@vantageos/cloud-identity/tenancy-domain`.
+- `zod` added as a production dependency (schema validation for domain types).
+
+### Notes
+
+- All new symbols are also re-exported from the main `@vantageos/cloud-identity` entry point.
+- `decodeUnverifiedBearer` uses base64-JSON as a lightweight format and is intentionally NOT an authentication primitive. Production callers MUST run a SIGNATURE-VERIFYING middleware (signed JWT / Clerk session / opaque-token lookup) before constructing the `TenantContext` passed to `getEffectiveTenantId`.
+- `getEffectiveTenantId` expects a `TenantContext` whose `workspaceId` came from a signature-verified source. Feeding it the output of `decodeUnverifiedBearer` directly is a security bug — see README "Security: bearer decoding".
+
 ## [0.1.0] - 2026-06-04
 
 Initial release.
@@ -14,5 +73,5 @@ Initial release.
 - Public type surface: `OAuthCtx`, `ScopeProfile`, `NamespacePrefix`, `FromAllowListEntry`, `ValidateMasterBearerResult`.
 
 ### Notes
-- `getEffectiveWorkspaceId` deferred to 0.2.0 (depends on `vantageos-crm` workspace helper, owned by Theta).
+- `getEffectiveWorkspaceId` deferred to 0.2.0.
 - No `provenance: true` in `publishConfig` — provenance only from CI per fleet friction lesson `npm-publish-provenance-only-from-ci-not-local-host`.

package/LICENSE

@@ -1,21 +1,110 @@
-MIT License
+Functional Source License, Version 1.1, Apache 2.0 Future License
 
-Copyright (c) 2026 VantagePeers Cloud
+Abbreviation
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+FSL-1.1-Apache-2.0
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+Notice
+
+Copyright 2026 VantageOS (ElPi Corp)
+
+Terms and Conditions
+
+Licensor:             VantageOS (ElPi Corp)
+
+Licensed Work:        VantagePeers
+                      The Licensed Work is (c) 2026 VantageOS (ElPi Corp)
+
+Additional Use Grant: You may make production use of the Licensed Work,
+                      provided Your use does not include offering the Licensed
+                      Work to third parties as a hosted or managed service
+                      where the service provides users with access to any
+                      substantial set of the features or functionality of the
+                      Licensed Work.
+
+Change Date:          2028-04-03 (two years from publication)
+
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact: contact@vantageos.com
+
+License text below is provided for informational purposes only.
+
+---
+
+Functional Source License, Version 1.1, Apache 2.0 Future License
+
+1. Purpose
+
+This license gives you broad permission to use, modify, and share this
+software, with one important condition: you may not use it to compete with us.
+
+2. Acceptance
+
+To use the software, you must agree to these terms. If you do not agree, you
+may not use the software.
+
+3. Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide, non-
+sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations below.
+
+4. Limitations
+
+You may not make the functionality of the software available to third parties
+as a service, or otherwise use the software to provide a service to third
+parties that competes with the licensor.
+
+5. Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license or becomes able to license, to make, have made, use, sell, offer for
+sale, import, and have imported the software, in each case subject to the
+limitations and conditions in this license.
+
+6. Fair Use
+
+This license is not intended to limit any rights you may have under applicable
+fair use or other laws.
+
+7. No Other Rights
+
+These terms do not grant any other rights. The licensor reserves all rights not
+expressly granted.
+
+8. Termination
+
+Your license is automatically terminated if you violate the terms. However, if
+you cure the violation within 30 days of discovering it, your license is
+reinstated retroactively.
+
+9. Disclaimer
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+IMPLIED.
+
+10. Limitation of Liability
+
+TO THE EXTENT PERMITTED BY LAW, THE LICENSOR IS NOT LIABLE FOR ANY DAMAGES
+ARISING FROM THE USE OF THE SOFTWARE.
+
+11. Change Date and License
+
+After the Change Date, the licensor grants you the rights under the Change
+License.
+
+12. Definitions
+
+"Compete" means providing a product or service that is substantially similar
+to, or a replacement for, all or a significant portion of the Licensed Work.
+
+---
+
+Apache License, Version 2.0
+
+After the Change Date (2028-04-03), this software will be available under the
+Apache License, Version 2.0. See https://www.apache.org/licenses/LICENSE-2.0
+for full text.

package/README.md

@@ -1,8 +1,16 @@
 # @vantageos/cloud-identity
 
-Framework-agnostic identity + scope-filter primitives for **VantagePeers Cloud** (multi-tenant MCP).
+Building blocks for multi-tenant authorization: decide which tenant a caller
+belongs to, and keep every other tenant's rows out of the response.
 
-Consumed by `vantage-peers-mcp` and `@vantageos/vantage-crm-mcp` — provides the small, testable building blocks that gate cross-tenant data access in the MCP transport layer.
+If your service holds data for several customers behind one deployment, you
+answer the same four questions on every request — who is calling, which tenant
+they belong to, which rows they may see, and whether their token is genuine.
+This package answers them once, in plain functions with no framework attached,
+so each service does not re-implement (and re-misimplement) its own version.
+
+It depends on no web framework, router or database, and runs anywhere
+JavaScript runs.
 
 ## Install
 
@@ -10,76 +18,198 @@ Consumed by `vantage-peers-mcp` and `@vantageos/vantage-crm-mcp` — provides th
 npm install @vantageos/cloud-identity
 ```
 
-## Modules
+Node 18 or later. ESM only.
+
+## Quick start
 
-| Module | Symbols | Purpose |
-| --- | --- | --- |
-| `@vantageos/cloud-identity/crypto` | `timingSafeEqual` | Constant-time byte comparison (no branch-timing leak). |
-| `@vantageos/cloud-identity/scope-filter` | `passesScopeFilter`, `scopeFilterList`, `scopeFilterGet` | Row-level visibility filter on `(createdBy, namespace)` using the caller's OAuth scope. |
-| `@vantageos/cloud-identity/bearer-validation` | `validateMasterBearer` | Bearer-token parsing + sha256 constant-time match against a configured master secret. |
-| `@vantageos/cloud-identity/types` | `OAuthCtx`, `ScopeProfile`, `NamespacePrefix`, `FromAllowListEntry`, `ValidateMasterBearerResult` | Public type surface. |
+```js
+import { requireTenantId, scopeFilterList } from "@vantageos/cloud-identity";
 
-## 0.1.0 scope
+// 1. Which tenant is this caller in? Throws if the answer is "none".
+const tenantId = requireTenantId({
+  kind: "session",
+  identity: { userId: "user_123", orgId: "org_abc" },
+});
 
-This release ships the **transport-agnostic** core:
+// 2. Which of these rows may they see?
+const ctx = {
+  fromAllowList: ["reports"],
+  namespaceReadPrefixes: ["team/finance"],
+  namespaceWritePrefixes: [],
+};
 
-- `crypto.timingSafeEqual`
-- `scope-filter.{passesScopeFilter, scopeFilterList, scopeFilterGet}`
-- `bearer-validation.validateMasterBearer`
-- types
+const rows = [
+  { createdBy: "reports", namespace: "team/finance" },    // kept
+  { createdBy: "someone-else", namespace: "team/legal" }, // dropped
+];
 
-## 0.2.0 roadmap
+console.log(tenantId);                    // "org_abc"
+console.log(scopeFilterList(ctx, rows));  // only the first row
+```
 
-- `getEffectiveWorkspaceId` (workspace resolution helper, sourced from `vantageos-crm`).
-- D1 ghost Clerk identity injection.
-- Co-designed in a Theta cycle.
+Every symbol is available from the package root. Subpath imports
+(`@vantageos/cloud-identity/scope-filter` and friends) also work if you prefer
+to be explicit about where something comes from.
 
-## Usage examples
+## Both caller paths, one contract
 
-### Constant-time byte comparison
+A right is never granted by an absent argument. `requireTenantId` refuses by
+default — a missing session, a missing organization, or a missing
+bearer-resolved workspace all throw; there is no branch that falls through to
+"full access" when tenant information is absent. The same function resolves
+both entry paths a VantagePeers Cloud request can arrive on:
 
 ```ts
-import { timingSafeEqual } from "@vantageos/cloud-identity/crypto";
-
-const a = new TextEncoder().encode(presentedHash);
-const b = new TextEncoder().encode(expectedHash);
-if (!(await timingSafeEqual(a, b))) {
-  return new Response("forbidden", { status: 403 });
+import {
+  requireTenantId,
+  decodeUnverifiedBearer,
+  type TenantSource,
+} from "@vantageos/cloud-identity";
+
+async function resolveTenant(req: {
+  session?: { orgId?: string | null } | null;
+  bearerToken?: string;
+}): Promise<string> {
+  const source: TenantSource = req.session
+    ? { kind: "session", identity: req.session }
+    : {
+        // decodeUnverifiedBearer only decodes the shape — verify the token's
+        // signature (or look it up against your own store) before trusting
+        // any field on the payload. See "What this package does not do".
+        kind: "bearer",
+        context: await decodeUnverifiedBearer(req.bearerToken!),
+      };
+
+  // Throws for BOTH paths if no tenant is attached — never returns a
+  // "default" tenant id when one is missing.
+  return requireTenantId(source);
 }
-```
 
-### Scope-aware row filtering
+// Human path: a signed-in user with an active organization.
+await resolveTenant({ session: { orgId: "org_abc" } }); // -> "org_abc"
 
-```ts
-import { scopeFilterList } from "@vantageos/cloud-identity/scope-filter";
-import type { OAuthCtx } from "@vantageos/cloud-identity/types";
+// Machine path: a caller presenting an already-resolved bearer token.
+await resolveTenant({ bearerToken: someBase64Token }); // -> the token's workspaceId
 
-const ctx: OAuthCtx = {
-  fromAllowList: ["alice"],
-  namespaceReadPrefixes: ["orchestrator/alpha"],
-  namespaceWritePrefixes: [],
-};
-const visible = scopeFilterList(ctx, rowsFromConvex);
+// Either path with nothing attached throws instead of granting access.
+await resolveTenant({ session: null }); // throws Error("Unauthenticated: no session.")
 ```
 
-### Master Bearer validation
-
-```ts
-import { validateMasterBearer } from "@vantageos/cloud-identity/bearer-validation";
-
-const res = await validateMasterBearer(
-  request.headers.get("authorization") ?? undefined,
-  process.env.BEARER_SECRET_MASTER ?? "",
-);
-if (!res.ok) {
-  return new Response(`unauthorized: ${res.error}`, { status: 401 });
-}
+## What each function does
+
+**Tenant resolution and membership**
+
+- `requireTenantId(source)` — returns the caller's tenant id, or throws if
+  there is none. It accepts both entry paths behind one contract:
+  `{ kind: "session", identity }` for a signed-in human, and
+  `{ kind: "bearer", context }` for a machine caller. A missing session, a
+  missing organization and an empty organization id are all refusals, never a
+  default.
+- `getEffectiveTenantId(ctx, args)` — resolves which tenant a request should
+  act on when a caller may legitimately act on more than one.
+
+**Row filtering**
+
+- `passesScopeFilter(ctx, row)` — true when this row is visible to this
+  caller.
+- `scopeFilterList(ctx, rows)` — the subset of rows the caller may see.
+- `scopeFilterGet(ctx, row)` — the row, or `null` if the caller may not see it.
+- `isMasterScope(ctx)` / `isWildcardScope(ctx)` — true when the caller holds
+  unrestricted access. Useful for skipping filtering you know is pointless;
+  never as a substitute for it.
+
+Visibility is granted two ways: the row's `createdBy` appears in the caller's
+`fromAllowList`, or the row's `namespace` sits under one of the caller's
+`namespaceReadPrefixes`. Prefixes match on a path boundary, so a caller allowed
+`team/finance` does not thereby see `team/finance-archive`.
+
+**Token validation**
+
+- `validateMasterBearer(header, secret)` — compares an `Authorization: Bearer`
+  header against a shared secret in constant time, and reports *why* it failed:
+  header absent, header malformed, or value mismatched.
+- `timingSafeEqual(a, b)` — constant-time byte comparison, if you need to build
+  your own check.
+
+**Shapes**
+
+Zod schemas and their inferred TypeScript types for workspaces, members,
+roles and tenant context: `workspaceSchema` (type `Workspace`),
+`workspaceMemberSchema` (type `WorkspaceMember`), `workspaceRoleSchema`
+(type `WorkspaceRole`), `tenantContextSchema` (type `TenantContext`) — plus
+`ScopeViolationError` (payload type `ScopeViolationPayload`), for refusals you
+want to catch by type, and `BearerPayload`, the type returned by
+`decodeUnverifiedBearer`.
+
+**Supporting types** (no runtime code — import with `import type`)
+
+- `OAuthCtx` — the context object every scope-filter function above requires:
+  `{ fromAllowList, namespaceReadPrefixes, namespaceWritePrefixes, scope? }`.
+- `ScopeProfile`, `NamespacePrefix`, `FromAllowListEntry` — the field types
+  that make up `OAuthCtx`.
+- `ValidateMasterBearerResult` — the return type of `validateMasterBearer`.
+- `ScopeFilterable` — the minimal row shape (`{ createdBy?, namespace? }`)
+  accepted by `passesScopeFilter` / `scopeFilterList` / `scopeFilterGet`.
+- `SessionIdentity` — the human-path shape `requireTenantId` accepts under
+  `{ kind: "session", identity }` (see "Both caller paths, one contract").
+- `TenantSource` — the discriminated union `requireTenantId` accepts:
+  `{ kind: "session", identity }` or `{ kind: "bearer", context }`.
+
+## What this package does not do
+
+Worth reading before you rely on it.
+
+- **`decodeUnverifiedBearer` decodes a token. It does not verify one.** The
+  name is literal. It reads the payload out of a bearer token and checks its
+  shape; it does not check a signature, so the contents are whatever the caller
+  chose to put there. Treating its output as trusted is a vulnerability, not a
+  shortcut. Verify the token — a signed JWT, or a lookup against your own store
+  — before you believe any field in it.
+- **This is not an authentication system.** There is no user store, no login,
+  no session issuance. It takes an identity you have already established and
+  tells you what that identity may reach.
+- **It does not talk to your database.** `scopeFilterList` filters rows you
+  have already fetched. If fetching them was itself expensive or unsafe, filter
+  earlier, in your query.
+
+## Upgrading to 0.3.0
+
+**This release changes a default, and it breaks compilation on purpose.**
+
+Before 0.3.0, calling a scope-filter function without an authorization context
+returned `true` — no context meant full access. A caller who simply forgot to
+pass the context received every row, and no warning. From 0.3.0 the context is
+required: omitting it is a type error, and passing `null` or `undefined`
+throws.
+
+The breakage is deliberate, and it is the point. A caller that stops compiling
+is a caller that has been told. A caller that still compiles and quietly
+returns different rows is an incident nobody attributes to the upgrade.
+
+What to do:
+
+- If the call site has a real authorization context, pass it. This is almost
+  always the right fix, and the context is usually already in scope.
+- If the call site genuinely means "unrestricted", pass the exported constant
+  `LEGACY_WILDCARD_CTX` by name. It reproduces the old behaviour exactly. It
+  has to be written out, because an intentional bypass belongs in a code review
+  and an accidental one should not be possible.
+
+```js
+import { scopeFilterList, LEGACY_WILDCARD_CTX } from "@vantageos/cloud-identity";
+
+scopeFilterList(LEGACY_WILDCARD_CTX, rows); // explicit, unrestricted
 ```
 
-## Security doctrine
+`requireTenantId` is also new in 0.3.0. Nothing existing calls it, so it breaks
+nothing.
 
-Canonical reference: `docs/cloud/security-multi-tenant.md` in the `vantage-peers` repo.
+Version history is in [CHANGELOG.md](./CHANGELOG.md).
 
 ## License
 
-MIT — VantagePeers Cloud, 2026.
+FSL-1.1-Apache-2.0. See [LICENSE](./LICENSE).
+
+## Issues
+
+https://github.com/vantageos-agency/cloud-identity/issues

package/dist/bearer-validation.d.ts

@@ -1,9 +1,8 @@
 /**
  * Master-token Bearer validation.
  *
- * Extracted from the master-gate logic in
- * `vantage-memory/mcp-server/server-http.ts` (`masterOnlyMiddleware`) and
- * HARDENED per @vantageos/cloud-identity 0.1.0 contract:
+ * Extracted from an earlier in-tree master-gate middleware and HARDENED per
+ * this package's contract:
  *   - SHA-256 hash both the presented token AND the configured master secret,
  *     then compare the two digests with `timingSafeEqual` (constant time).
  *   - The original middleware did a direct `token !== masterToken` string

package/dist/bearer-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-validation.d.ts","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAU7D;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAsBrC"}
+{"version":3,"file":"bearer-validation.d.ts","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAU7D;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAsBrC"}

package/dist/bearer-validation.js

@@ -1,9 +1,8 @@
 /**
  * Master-token Bearer validation.
  *
- * Extracted from the master-gate logic in
- * `vantage-memory/mcp-server/server-http.ts` (`masterOnlyMiddleware`) and
- * HARDENED per @vantageos/cloud-identity 0.1.0 contract:
+ * Extracted from an earlier in-tree master-gate middleware and HARDENED per
+ * this package's contract:
  *   - SHA-256 hash both the presented token AND the configured master secret,
  *     then compare the two digests with `timingSafeEqual` (constant time).
  *   - The original middleware did a direct `token !== masterToken` string

package/dist/bearer-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-validation.js","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC,KAAK,UAAU,WAAW,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAA8B,EAC9B,YAAoB;IAEpB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,sEAAsE;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,WAAW,CAAC,KAAK,CAAC;QAClB,WAAW,CAAC,YAAY,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"bearer-validation.js","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC,KAAK,UAAU,WAAW,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAA8B,EAC9B,YAAoB;IAEpB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,sEAAsE;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,WAAW,CAAC,KAAK,CAAC;QAClB,WAAW,CAAC,YAAY,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC"}

package/dist/crypto.d.ts

@@ -1,11 +1,9 @@
 /**
  * Constant-time byte-array comparison.
  *
- * Ported from `vantage-memory/mcp-server/src/crypto.ts` (Day 47 master-token
- * gate, Eta F1 MAJOR PR #621). Surface adapted from `(string, string)` to
- * `(Uint8Array, Uint8Array)` per @vantageos/cloud-identity 0.1.0 contract so
- * the helper is framework-agnostic and reusable by any caller (hash bytes,
- * raw token bytes, HMAC tags, etc.).
+ * Takes `(Uint8Array, Uint8Array)` rather than strings so the helper stays
+ * framework-agnostic and reusable by any caller: hash bytes, raw token
+ * bytes, HMAC tags.
  *
  * Algorithm (identical to source):
  *   1. Length mismatch → still run a dummy Web Crypto HMAC over equal-length

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,UAAU,EACb,CAAC,EAAE,UAAU,GACZ,OAAO,CAAC,OAAO,CAAC,CAoBlB"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,UAAU,EACb,CAAC,EAAE,UAAU,GACZ,OAAO,CAAC,OAAO,CAAC,CAoBlB"}

package/dist/crypto.js

@@ -1,11 +1,9 @@
 /**
  * Constant-time byte-array comparison.
  *
- * Ported from `vantage-memory/mcp-server/src/crypto.ts` (Day 47 master-token
- * gate, Eta F1 MAJOR PR #621). Surface adapted from `(string, string)` to
- * `(Uint8Array, Uint8Array)` per @vantageos/cloud-identity 0.1.0 contract so
- * the helper is framework-agnostic and reusable by any caller (hash bytes,
- * raw token bytes, HMAC tags, etc.).
+ * Takes `(Uint8Array, Uint8Array)` rather than strings so the helper stays
+ * framework-agnostic and reusable by any caller: hash bytes, raw token
+ * bytes, HMAC tags.
  *
  * Algorithm (identical to source):
  *   1. Length mismatch → still run a dummy Web Crypto HMAC over equal-length

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAa,EACb,CAAa;IAEb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAgC,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAa,EACb,CAAa;IAEb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAgC,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,16 @@
 /**
  * @vantageos/cloud-identity — public surface.
  *
- * Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud
- * (multi-tenant MCP). Consumed by `vantage-peers-mcp` and
- * `@vantageos/vantage-crm-mcp`.
+ * Framework-agnostic building blocks for multi-tenant authorization:
+ * tenant resolution, membership requirement, row filtering and bearer
+ * validation.
  */
 export { timingSafeEqual } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, type ScopeFilterable, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 export type { OAuthCtx, ScopeProfile, NamespacePrefix, FromAllowListEntry, ValidateMasterBearerResult, } from "./types.js";
+export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
+export type { Workspace, WorkspaceMember, WorkspaceRole, TenantContext, ScopeViolationPayload, BearerPayload, } from "./tenancy-domain.js";
+export { requireTenantId } from "./org-guard.js";
+export type { SessionIdentity, TenantSource } from "./org-guard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,11 +1,15 @@
 /**
  * @vantageos/cloud-identity — public surface.
  *
- * Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud
- * (multi-tenant MCP). Consumed by `vantage-peers-mcp` and
- * `@vantageos/vantage-crm-mcp`.
+ * Framework-agnostic building blocks for multi-tenant authorization:
+ * tenant resolution, membership requirement, row filtering and bearer
+ * validation.
  */
 export { timingSafeEqual } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
+// 0.2.0 — Domain-tenancy layer (additive)
+export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
+// Organization-membership guard (unified session + bearer contract)
+export { requireTenantId } from "./org-guard.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}