@vantageos/cloud-identity 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -3,6 +3,93 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.0]
+
+**Additive — the acting principal by ID, and the target checked by ID
+(`./principal-by-id`).** An actor and a target are identified by their stored
+IDs; a name is a display label and never selects or authorises a row. Motivating
+incident: an agent of one organisation, calling by name through the service
+account, landed on another organisation's same-named agent's task at ten task
+doors, because admission compared names. No existing function changes behaviour.
+
+### Added
+
+- `resolveActingPrincipal(credential, lookups, door?)`: a verified credential
+  (agent bearer, person token, or the service account acting as itself or for
+  an agent named BY ID within its own organisation) to `{ principalId, orgId,
+  kind, viaServiceAccountId? }` read from stored rows, or a typed refusal.
+  Strict credential schemas: a credential carrying a name field is refused
+  whole. Missing or throwing lookups, misses, malformed, inactive, unstamped
+  and wrong-organisation rows, and inactive organisations all refuse.
+- `assertTargetBelongsTo(principal, target, lookups, opts?)` (async):
+  compares the target's stored `orgId` (and `ownerId` with `ownerOnly`) with
+  the resolved IDs. An unstamped target is refused to every principal, the
+  fleet principal included: no right is inferred from an absence, and a fleet
+  row carries the operator organisation's ID explicitly.
+- The fleet is the OPERATOR ORGANISATION, decided from data by the adapter
+  method `orgKindOf(orgId) => "operator" | "client" | null` on
+  `PrincipalLookups` (and `OrgKindLookups` for `assertTargetBelongsTo`). `null`,
+  a miss or any other answer is not the fleet; a missing or throwing adapter
+  refuses. An operator-organisation row is refused to every client; the
+  fleet principal reaches a client organisation's row only with
+  `fleetCrossOrg: true` and only when the adapter reports it as `"client"`.
+- RULING 5: membership of the operator organisation is ordinary membership.
+  Its agents and persons resolve as `kind: "agent"` / `"person"` of that
+  organisation and reach its rows only; cross-organisation reach (`kind:
+  "fleet"` + `fleetCrossOrg`) belongs to its service account alone, and
+  `reserved-fleet-scope` refuses a claim of that scope (a `kind: "fleet"`
+  credential, or `fleetCrossOrg` used by any other principal), never plain
+  membership.
+  The operator organisation is checked by `organisationById` like any other.
+- `FLEET_SCOPE_ORG_ID` (a reserved `"vantageos:fleet"` constant, merged on
+  `main` but never published) is REMOVED before release, with no alias (RULING
+  4). A row stamped with that literal is an unknown organisation and is refused
+  to every caller.
+- `actingCredentialSchema`, `principalRowSchema`, `organisationRowSchema` and
+  the types `ActingCredential`, `PrincipalRow`, `OrganisationRow`,
+  `PrincipalLookups`, `OrgKind`, `OrgKindLookups`, `ActingPrincipalKind`,
+  `ActingPrincipal`,
+  `ResolveActingPrincipalResult`, `TargetIds`, `AssertTargetOptions`,
+  `AssertTargetResult`.
+- New `IdentityRefusalReason` values: `credential-invalid`,
+  `principal-lookup-failed`, `principal-not-found`, `principal-record-invalid`,
+  `principal-inactive`, `organisation-not-active`, `reserved-fleet-scope`,
+  `acting-agent-other-organisation`, `target-unstamped`,
+  `target-other-organisation`, `target-owner-mismatch`.
+- New subpath export `./principal-by-id`.
+- A test that reads the exported signatures with the TypeScript checker and
+  fails if any identity input of this module is spelled like a name.
+
+### Deprecated
+
+- `resolvePersonActingName` (0.9.0). It takes names (`claimedName`,
+  `agentCredential.agentName`) as identity input; backend standard R-53
+  clause 4 makes it non-conforming for any new door. Use
+  `resolveActingPrincipal` and `assertTargetBelongsTo`. Behaviour unchanged;
+  removal is a major change, made only after consumers migrate off it.
+- `passesScopeFilter`, `scopeFilterGet` and `scopeFilterList` (the last two
+  through the first). A `createdBy` name matched against `fromAllowList`
+  selects the row; backend standard R-53 clause 1 forbids it. Use
+  `resolveActingPrincipal` and `assertTargetBelongsTo`. Behaviour unchanged;
+  they stay exported until consumers migrate off them.
+- The name-input test now covers every callable export of the package root: a
+  new export taking a name-like identity input fails. The deprecated legacy
+  exceptions are exactly `resolvePersonActingName`, `passesScopeFilter`,
+  `scopeFilterGet` and `scopeFilterList`, and the test fails if any of them
+  loses its `@deprecated Since 0.11.0` tag. The scan reads a generic input
+  through its constraint, so a name field behind `T extends ScopeFilterable`
+  is seen. Two 0.10.0 exports that carry a name-like field without selecting a
+  row by it (`isPersonActorName`: `name`; `checkPersonCallShape`:
+  `actingName`, accepted only to be refused) are pinned in a frozen map that
+  can only shrink.
+
+### Migration (required consumer step)
+
+- Before switching a door to `assertTargetBelongsTo`, stamp every existing row
+  that has no `orgId` with its real organisation ID or with the operator
+  organisation's ID, and supply `orgKindOf` reading the stored `orgKind`. Unstamped rows are refused to every caller, so a door
+  switched before the backfill stops serving them.
+
 ## [0.10.0]
 
 **Additive — identity gaps a consumer had are now in the package.** Every

package/README.md

@@ -174,13 +174,24 @@ await resolveTenant({ session: null }); // throws Error("Unauthenticated: no ses
 **Row filtering**
 
 - `passesScopeFilter(ctx, row)` — true when this row is visible to this
-  caller.
+  caller. **Deprecated since 0.11.0** (see below).
 - `scopeFilterList(ctx, rows)` — the subset of rows the caller may see.
+  **Deprecated since 0.11.0** (see below).
 - `scopeFilterGet(ctx, row)` — the row, or `null` if the caller may not see it.
+  **Deprecated since 0.11.0** (see below).
 - `isMasterScope(ctx)` / `isWildcardScope(ctx)` — true when the caller holds
   unrestricted access. Useful for skipping filtering you know is pointless;
   never as a substitute for it.
 
+**Deprecated since 0.11.0: `passesScopeFilter`, `scopeFilterGet` and
+`scopeFilterList`.** All three (the last two through the first) admit a row
+when its `createdBy` NAME appears in the caller's `fromAllowList`, so a name
+selects the row, which backend standard R-53 clause 1 forbids. For a target
+that carries an organisation or owner ID, use `resolveActingPrincipal` and
+`assertTargetBelongsTo`, which compare stored IDs (see "The acting principal
+by ID, and the target checked by ID"). Their behaviour is unchanged; they stay
+exported until consumers migrate off them, and are removed in a major release.
+
 Visibility is granted two ways: the row's `createdBy` appears in the caller's
 `fromAllowList`, or the row's `namespace` sits under one of the caller's
 `namespaceReadPrefixes`. Prefixes match on a path boundary, so a caller allowed
@@ -410,6 +421,7 @@ const who = await resolvePersonPrincipal(
 if (!who.ok) return deny(who.refusal);
 
 // 2. Under what name: the token's, never the argument's.
+//    Deprecated since 0.11.0: a new door uses resolveActingPrincipal instead.
 const name = resolvePersonActingName({
   principal: who.principal, claimedName: args.createdBy,
   agentCredential: presentedAgent, door: "my-tool",
@@ -427,6 +439,12 @@ const mayWrite = resolveWriterRole({
 - `resolvePersonPrincipal(token, deps, door)` refuses a token that is expired,
   revoked, not a person's, bound to no organisation, or bound to an inactive or
   unmapped one. It looks up only the token's own organisation.
+- **Deprecated since 0.11.0:** `resolvePersonActingName`. It takes names
+  (`claimedName`, `agentCredential.agentName`) as identity input, which backend
+  standard R-53 clause 4 makes non-conforming for any new door. Use
+  `resolveActingPrincipal` and `assertTargetBelongsTo` (see "The acting
+  principal by ID, and the target checked by ID"). Its behaviour is unchanged;
+  it will be removed in a major release once consumers have migrated off it.
 - `resolvePersonActingName` returns `{ ok: true, actingAs: "person", actor }`
   for no name or the person's own (`user:<subject>`), and refuses another
   user's name (`PERSON_ACTS_AS_ITSELF`) and an agent's name without that
@@ -521,6 +539,170 @@ refuses accepts an optional `door` so the refusal names your own entry point.
   empty) matches nothing, so a missing configuration never opens a door. The
   refusal carries neither value.
 
+## The acting principal by ID, and the target checked by ID (0.11.0)
+
+**Why this exists.** Two organisations each had an agent displayed as `eta`.
+An organisation A agent, calling through the shared service account and naming
+itself `eta`, completed, updated and deleted organisation B's `eta` task at ten
+different task doors. Every door admitted the call by comparing the typed name
+with a name stored on the task. The names were equal; the two agents were not.
+Nothing compared an ID.
+
+The rule this module carries: **an actor and a target are identified by their
+stored IDs. A name is a display label; it never selects a row and never
+authorises one.** Resolving the principal and checking the target both happen
+here, so a product never writes its own identity layer.
+
+```js
+import {
+  resolveActingPrincipal,
+  assertTargetBelongsTo,
+} from "@vantageos/cloud-identity";
+
+// The operator org is DATA: the org whose mapping row says orgKind "operator".
+const orgKindOf = async (id) => (await db.orgs.get(id))?.orgKind ?? null;
+
+// 1. Who is acting? IDs from the VERIFIED credential, rows read by ID.
+const who = await resolveActingPrincipal(
+  { kind: "service", serviceAccountId: "svc_a", actingForAgentId: "agent_a_eta" },
+  {
+    agentById: (id) => db.agents.get(id),          // -> { id, orgId, active }
+    serviceAccountById: (id) => db.services.get(id),
+    organisationById: (id) => db.orgs.get(id),     // -> { id, active }
+    orgKindOf,                                     // -> "operator" | "client" | null
+  },
+  "tasks:complete",
+);
+if (!who.ok) throw toHttpError(who.refusal);       // RBAC_DENIED, typed reason
+
+// 2. Does the target belong to them? Stored IDs against resolved IDs.
+const task = await db.tasks.get(taskId);
+const may = await assertTargetBelongsTo(
+  who.principal,
+  { orgId: task.orgId, ownerId: task.ownerId },
+  { orgKindOf },
+  { ownerOnly: true, door: "tasks:complete" },
+);
+if (!may.ok) throw toHttpError(may.refusal);
+```
+
+Organisation B's `eta` task carries `orgId: "org_b"`; the principal above
+resolved to `orgId: "org_a"`. The target check refuses it with
+`target-other-organisation`, whatever either agent is called.
+
+**`resolveActingPrincipal(credential, lookups, door?)`** (`./principal-by-id`)
+
+Async. Returns `{ ok: true, principal }` or `{ ok: false, refusal }`
+(`ResolveActingPrincipalResult`). The `principal` (`ActingPrincipal`) is
+`{ principalId, orgId, kind, viaServiceAccountId? }`, where `kind` is
+`"agent" | "person" | "service" | "fleet"` (`ActingPrincipalKind`).
+
+`credential` (`ActingCredential`, validated by `actingCredentialSchema`) is one
+of three shapes, every identity field an ID:
+
+- `{ kind: "agent", agentId, verifiedOrgId }` — the machine path: an agent's
+  own bearer, already verified by you (for example with
+  `validatePresentedBearer`). The agent row's stored `orgId` must equal
+  `verifiedOrgId`.
+- `{ kind: "person", personId, verifiedOrgId }` — the human path: a person's
+  token, already verified by you. The person's row in that organisation is read
+  by `(personId, verifiedOrgId)`.
+- `{ kind: "service", serviceAccountId, actingForAgentId? }` — the service
+  account. Alone it acts as itself (`kind: "service"`, or `kind: "fleet"` if
+  `orgKindOf` reports its organisation as `"operator"`). With `actingForAgentId` it acts for that
+  agent, named BY ID and resolved within the service account's OWN
+  organisation; the principal is the agent, and `viaServiceAccountId` records
+  the carrier.
+
+The schemas are strict: a credential carrying any other key (`agentName`,
+`callerOrchestrator`, `name`, `assignedTo`) is refused whole with
+`credential-invalid`, before any lookup runs.
+
+`lookups` (`PrincipalLookups`) are your indexed reads by ID: `agentById(id)`,
+`personById(id, orgId)`, `serviceAccountById(id)` returning a `PrincipalRow`
+(`{ id, orgId?, active }`, schema `principalRowSchema`), and
+`organisationById(id)` returning an `OrganisationRow` (`{ id, active }`, schema
+`organisationRowSchema`), and `orgKindOf(orgId)` returning an `OrgKind`
+(`"operator" | "client"`) or `null`. Only the lookups of the presented path
+are called; `orgKindOf` is called on every path.
+Each row must repeat the ID that was asked for, and `active` is required and
+must be `true`.
+
+Refused, each with a typed `IdentityRefusal` reason: a credential that does not
+parse; a missing or throwing lookup (its error text is never surfaced); a miss;
+a malformed, inactive or unstamped row; a row of another organisation than its
+credential; an unmapped or inactive organisation; a service account acting for
+an agent of another organisation. Nothing falls back to a default or master
+principal.
+
+**`assertTargetBelongsTo(principal, target, lookups, opts?)`** (`./principal-by-id`)
+
+Async. Returns `{ ok: true }` or `{ ok: false, refusal }`
+(`AssertTargetResult`). `target` (`TargetIds`) is `{ orgId?, ownerId? }` read
+from the STORED row; `lookups` (`OrgKindLookups`) is `{ orgKindOf }`, the same
+adapter as above, and is required (a missing or throwing adapter refuses with
+`principal-lookup-failed`); `opts` (`AssertTargetOptions`) is
+`{ door?, ownerOnly?, fleetCrossOrg? }`. IDs are compared byte for byte.
+
+- The target's `orgId` must equal the principal's `orgId`
+  (`target-other-organisation` otherwise).
+- `ownerOnly: true` also requires `ownerId` to equal `principalId`; a target
+  with no owner is refused (`target-owner-mismatch`).
+- A target with no `orgId` is refused (`target-unstamped`) to EVERY
+  principal, the fleet principal included, with or without `fleetCrossOrg`.
+  No right is inferred from an absence: a row with no organisation is never
+  treated as a master row.
+- An absent principal, or one with an empty ID, is refused
+  (`credential-invalid`).
+
+**The fleet is the operator organisation.** The fleet is not a reserved ID: it
+is the organisation your `orgKindOf` adapter reports as `"operator"` (for
+example the organisation whose mapping row carries `orgKind: "operator"`),
+read from your data at run time. The package spells no organisation ID. An
+adapter answering `null`, a miss, or anything other than exactly
+`"operator"` means "not the fleet"; a missing or throwing adapter refuses.
+
+**RULING 5: membership of the operator organisation is ordinary membership.**
+Its agents and persons resolve as `kind: "agent"` / `"person"` of that
+organisation and reach its rows only; cross-organisation reach (`kind: "fleet"`
+with `fleetCrossOrg`) belongs to the operator organisation's service account
+alone, and `reserved-fleet-scope` refuses a CLAIM of that scope, never plain
+membership:
+
+- an agent or person credential verified for the operator organisation
+  resolves as an ordinary principal of it, with no cross-organisation reach;
+  only a service account stamped with it resolves to `kind: "fleet"`;
+- a credential carrying `kind: "fleet"` is refused (`reserved-fleet-scope`),
+  whoever presents it;
+- any non-fleet principal reaching another organisation's row under
+  `fleetCrossOrg: true` is refused (`reserved-fleet-scope`); without it,
+  `target-other-organisation`;
+- an operator-organisation row is refused to every client principal, with or
+  without `fleetCrossOrg` (`reserved-fleet-scope`);
+- a `kind: "fleet"` principal whose organisation the adapter does not report
+  as `"operator"` is refused, and so is a `kind: "service"` principal in the
+  operator organisation (its service account is the fleet);
+- the fleet principal reaches a CLIENT organisation's row only when the door
+  passes `fleetCrossOrg: true` (a master export) AND the adapter reports that
+  organisation as `"client"`. An unknown organisation is refused;
+- the operator organisation is an ordinary stored organisation:
+  `organisationById` must return it mapped and active, like any other;
+- a fleet row is a row stamped with the operator organisation's ID explicitly.
+  A row with no `orgId` is not a fleet row and is refused to the fleet
+  principal too.
+
+**Migration (required consumer step).** Before a product switches any door to
+`assertTargetBelongsTo`, it must stamp every existing row that has no `orgId`:
+with its real organisation ID, or with the operator organisation's ID if it
+belongs to the operator's own scope. An unstamped row is refused to every caller,
+including the fleet principal, so a door switched before the backfill stops
+serving those rows. Run the backfill first, confirm that no unstamped row is
+left in the tables the door reads, then switch the door.
+
+`viaServiceAccountId` and `door` are not identity; no function in this module
+takes a name as an identity input, and a test reads the exported signatures to
+keep it that way.
+
 ## What this package does not do
 
 Worth reading before you rely on it.

package/dist/identity-refusal.d.ts

@@ -1,6 +1,7 @@
 /**
  * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
- * org-admin proof, namespace write, secret comparison).
+ * org-admin proof, namespace write, secret comparison) and the 0.11.0
+ * principal-by-id resolver and target check.
  *
  * A refusal is a value carrying its own code, reason and door, so a caller
  * branches on content rather than on the mere presence of an exception, and an
@@ -12,7 +13,7 @@
  * closed vocabulary for the person path.
  */
 export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
-export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch";
 export type IdentityRefusal = {
     code: IdentityRefusalCode;
     reason: IdentityRefusalReason;

package/dist/identity-refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,CAAC;AAE5B,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js

@@ -1,6 +1,7 @@
 /**
  * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
- * org-admin proof, namespace write, secret comparison).
+ * org-admin proof, namespace write, secret comparison) and the 0.11.0
+ * principal-by-id resolver and target check.
  *
  * A refusal is a value carrying its own code, reason and door, so a caller
  * branches on content rather than on the mere presence of an exception, and an

package/dist/identity-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwCH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoDH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -37,4 +37,6 @@ export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSche
 export type { MembershipRecord, ResolvedMembership, ResolveMembershipInput, ResolveMembershipResult, RequireOrgAdminInput, } from "./tenant-membership.js";
 export { assertNamespaceWrite } from "./namespace-write.js";
 export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, } from "./principal-by-id.js";
+export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, } from "./principal-by-id.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -35,4 +35,7 @@ export { resolveMinRole, assertMinRole, mapRoleClaim } from "./role-policy.js";
 export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSchema, } from "./tenant-membership.js";
 export { assertNamespaceWrite } from "./namespace-write.js";
 export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
+// 0.11.0 — The acting principal by ID and the target checked by ID. A name is
+// a display label: it never selects a row and never authorises one.
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, } from "./principal-by-id.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}

package/dist/person-principal.d.ts

@@ -136,6 +136,13 @@ export type PersonActingNameResult = {
  *                                           resolved by the consumer): none ->
  *                                           AGENT_CREDENTIAL_REQUIRED, a
  *                                           different agent -> AGENT_IDENTITY_MISMATCH.
+ *
+ * @deprecated Since 0.11.0. Use `resolveActingPrincipal` (and
+ * `assertTargetBelongsTo` for the target), which resolve the actor by stored
+ * ID. This function takes names (`claimedName`, `agentCredential.agentName`)
+ * as identity input, which backend standard R-53 clause 4 makes
+ * non-conforming for any new door. Behaviour is unchanged; it will be removed
+ * in a major release once consumers have migrated off it.
  */
 export declare function resolvePersonActingName(input: {
     /** Only the actor name is read: the rule needs no organisation. */

package/dist/person-principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"person-principal.d.ts","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,qBAAqB,GACrB,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,yBAAyB,GACzB,oBAAoB,GACpB,iBAAiB,CAAC;AAEtB,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,yEAAyE;AACzE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBACpB,OAAO,EAAE,aAAa;CAKnC;AAgBD,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAO3C,4CAA4C;AAC5C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAOlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,iBAAiB,IAAI;IAC7D,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,iBAAiB,IACzD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,CAAC,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,SAAS,iBAAiB,EACtE,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC3C,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CA6CnC;AAMD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,mEAAmE;IACnE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8EAA8E;IAC9E,eAAe,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,sBAAsB,CAgDzB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,aAAa,GAAG,IAAI,CAmBvB;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEtF;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,kBAAkB,CAerB;AAMD,KAAK,eAAe,GAAG;IACrB,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,oFAAoF;IACpF,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAc5E;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAG9D"}
+{"version":3,"file":"person-principal.d.ts","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,qBAAqB,GACrB,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,yBAAyB,GACzB,oBAAoB,GACpB,iBAAiB,CAAC;AAEtB,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,yEAAyE;AACzE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBACpB,OAAO,EAAE,aAAa;CAKnC;AAgBD,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAO3C,4CAA4C;AAC5C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAOlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,iBAAiB,IAAI;IAC7D,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,iBAAiB,IACzD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,CAAC,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,SAAS,iBAAiB,EACtE,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC3C,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CA6CnC;AAMD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,mEAAmE;IACnE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8EAA8E;IAC9E,eAAe,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,sBAAsB,CAgDzB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,aAAa,GAAG,IAAI,CAmBvB;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEtF;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,kBAAkB,CAerB;AAMD,KAAK,eAAe,GAAG;IACrB,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,oFAAoF;IACpF,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAc5E;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAG9D"}

package/dist/person-principal.js

@@ -131,6 +131,13 @@ export async function resolvePersonPrincipal(token, deps, door) {
  *                                           resolved by the consumer): none ->
  *                                           AGENT_CREDENTIAL_REQUIRED, a
  *                                           different agent -> AGENT_IDENTITY_MISMATCH.
+ *
+ * @deprecated Since 0.11.0. Use `resolveActingPrincipal` (and
+ * `assertTargetBelongsTo` for the target), which resolve the actor by stored
+ * ID. This function takes names (`claimedName`, `agentCredential.agentName`)
+ * as identity input, which backend standard R-53 clause 4 makes
+ * non-conforming for any new door. Behaviour is unchanged; it will be removed
+ * in a major release once consumers have migrated off it.
  */
 export function resolvePersonActingName(input) {
     const { principal, door } = input;

package/dist/person-principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"person-principal.js","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB,yEAAyE;AACzE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,OAAO,CAAgB;IAChC,YAAY,OAAsB;QAChC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,SAAS,MAAM,CACb,IAAuB,EACvB,MAA2B,EAC3B,IAAY,EACZ,MAAc,EACd,QAA+E,EAAE;IAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,mEAAmE;AACnE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,GAAG,mBAAmB,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2C,EAC3C,IAA4B,EAC5B,IAAY;IAEZ,MAAM,IAAI,GAAG,CACX,MAA2B,EAC3B,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IACE,CAAC,MAAM,CAAC,OAAO;QACf,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;QACnC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAChC,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,IAAI,CACT,oBAAoB,EACpB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,IAAI,CACT,gBAAgB,EAChB,QAAQ,OAAO,yCAAyC,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY;QACZ,SAAS,EAAE;YACT,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO;YACP,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;SACpC;KACF,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAOvC;IACC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,uBAAuB,EACvB,uBAAuB,EACvB,IAAI,EACJ,wDAAwD,OAAO,GAAG,EAClE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,2BAA2B,EAC3B,2BAA2B,EAC3B,IAAI,EACJ,oBAAoB,OAAO,2CAA2C,EACtE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,yBAAyB,EACzB,yBAAyB,EACzB,IAAI,EACJ,oBAAoB,OAAO,yDAAyD,EACpF,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CACX,aAAa,EACb,4BAA4B,EAC5B,KAAK,CAAC,IAAI,EACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,CAAC,IAAI,EACV,6DAA6D,KAAK,CAAC,UAAU,GAAG,EAChF,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,gEAAgE,EAChE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAC/B;KACF,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,iBAAiB,EACjB,KAAK,CAAC,IAAI,EACV,kCAAkC,EAClC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,CACzC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"person-principal.js","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB,yEAAyE;AACzE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,OAAO,CAAgB;IAChC,YAAY,OAAsB;QAChC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,SAAS,MAAM,CACb,IAAuB,EACvB,MAA2B,EAC3B,IAAY,EACZ,MAAc,EACd,QAA+E,EAAE;IAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,mEAAmE;AACnE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,GAAG,mBAAmB,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2C,EAC3C,IAA4B,EAC5B,IAAY;IAEZ,MAAM,IAAI,GAAG,CACX,MAA2B,EAC3B,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IACE,CAAC,MAAM,CAAC,OAAO;QACf,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;QACnC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAChC,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,IAAI,CACT,oBAAoB,EACpB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,IAAI,CACT,gBAAgB,EAChB,QAAQ,OAAO,yCAAyC,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY;QACZ,SAAS,EAAE;YACT,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO;YACP,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;SACpC;KACF,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAOvC;IACC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,uBAAuB,EACvB,uBAAuB,EACvB,IAAI,EACJ,wDAAwD,OAAO,GAAG,EAClE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,2BAA2B,EAC3B,2BAA2B,EAC3B,IAAI,EACJ,oBAAoB,OAAO,2CAA2C,EACtE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,yBAAyB,EACzB,yBAAyB,EACzB,IAAI,EACJ,oBAAoB,OAAO,yDAAyD,EACpF,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CACX,aAAa,EACb,4BAA4B,EAC5B,KAAK,CAAC,IAAI,EACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,CAAC,IAAI,EACV,6DAA6D,KAAK,CAAC,UAAU,GAAG,EAChF,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,gEAAgE,EAChE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAC/B;KACF,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,iBAAiB,EACjB,KAAK,CAAC,IAAI,EACV,kCAAkC,EAClC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,CACzC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC"}

package/dist/principal-by-id.d.ts

@@ -0,0 +1,206 @@
+/**
+ * The acting principal by ID, and the target checked by ID.
+ *
+ * An actor and a target are identified by their stored IDs, never by a name.
+ * A name is a display label: it never selects a row and never authorises one.
+ *
+ * Motivating incident: an agent of organisation A named "eta", calling by name
+ * through a service account, completed, updated and deleted the task of
+ * organisation B's agent also named "eta" at ten task doors, because every door
+ * admitted the caller by comparing names. Two different agents shared a label;
+ * nothing compared their IDs.
+ *
+ * Two functions close that class:
+ *
+ *   - `resolveActingPrincipal(credential, lookups)` turns a VERIFIED credential
+ *     into `{ principalId, orgId, kind }` read from stored rows, or refuses.
+ *   - `assertTargetBelongsTo(principal, target, lookups, opts)` admits a target
+ *     only when its stored organisation ID (and owner ID, where the door is
+ *     owner-only) equals the principal's resolved IDs.
+ *
+ * The fleet is the OPERATOR ORGANISATION: the organisation the consumer's
+ * `orgKindOf` adapter reports as `"operator"`, read from stored data at run
+ * time. No organisation ID is reserved or spelled in this package; an
+ * adapter that answers anything else, or nothing, means "not the fleet".
+ *
+ * RULING 5: membership of the operator org is ORDINARY membership. Its agents
+ * and persons resolve as `kind: "agent"` / `"person"` of that org and reach its
+ * rows only. Cross-org reach (`kind: "fleet"` + `fleetCrossOrg`) belongs to the
+ * operator org's SERVICE ACCOUNT alone; `reserved-fleet-scope` refuses a claim
+ * of that scope by any other credential, never plain membership.
+ *
+ * Pure functions over injected lookups: no database, no framework, no network.
+ * The consumer performs each indexed read by ID and passes the function in;
+ * every failure (throwing lookup, miss, malformed row, inactive row, wrong
+ * organisation) is a typed `IdentityRefusal`, never a default principal.
+ *
+ * @security This module verifies NOTHING about the credential itself. The IDs
+ * in a credential must come from the consumer's verification of what the
+ * caller presented (a bearer row, a person's token, the service secret). A
+ * client-supplied argument passed as a credential becomes the principal.
+ */
+import { z } from "zod";
+import { type IdentityRefusal } from "./identity-refusal.js";
+/**
+ * A verified credential, in the package's vocabulary. Every identity field is
+ * an ID. The schemas are STRICT: a credential carrying any other key (an
+ * `agentName`, a `callerOrchestrator`, a `name`) is refused whole, so a name
+ * cannot be smuggled in beside an ID.
+ *
+ *   - `agent`: an agent's own bearer, verified by the consumer (for example by
+ *     `validatePresentedBearer`): the agent ID and the organisation the bearer
+ *     row is stamped with.
+ *   - `person`: a person's token, verified by the consumer: the stored person
+ *     ID (the verified subject) and the organisation the token is bound to.
+ *   - `service`: the service account, verified by the consumer. When it acts
+ *     for an agent it names that agent BY ID (`actingForAgentId`); the agent
+ *     is resolved within the service account's own organisation.
+ */
+export declare const actingCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"agent">;
+    agentId: z.ZodString;
+    verifiedOrgId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"person">;
+    personId: z.ZodString;
+    verifiedOrgId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"service">;
+    serviceAccountId: z.ZodString;
+    actingForAgentId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "kind">;
+export type ActingCredential = z.input<typeof actingCredentialSchema>;
+/**
+ * Each row repeats its own ID, so a loose lookup (prefix match, wrong index)
+ * returning another row cannot become a principal. `active` is REQUIRED and
+ * must be `true`: an absent flag grants nothing. Extra fields (a display name)
+ * are allowed and ignored.
+ */
+export declare const principalRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    orgId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    active: z.ZodBoolean;
+}, z.core.$strip>;
+export type PrincipalRow = z.input<typeof principalRowSchema>;
+export declare const organisationRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    active: z.ZodBoolean;
+}, z.core.$strip>;
+export type OrganisationRow = z.input<typeof organisationRowSchema>;
+/**
+ * The kind of a stored organisation, as the consumer's mapping row records it.
+ * `"operator"` is the fleet: the operator's own organisation, whose rows are
+ * the master scope. Any other answer, `null` included, is not the fleet.
+ */
+export type OrgKind = "operator" | "client";
+type Lookup<A extends unknown[], R> = (...args: A) => Promise<R | null | undefined> | R | null | undefined;
+/** Indexed reads BY ID. Only the lookups of the presented path are called. */
+export type PrincipalLookups = {
+    agentById?: Lookup<[agentId: string], PrincipalRow>;
+    /** A person's row IN one organisation (their membership there). */
+    personById?: Lookup<[personId: string, orgId: string], PrincipalRow>;
+    serviceAccountById?: Lookup<[serviceAccountId: string], PrincipalRow>;
+    /** The organisation row; the operator organisation is checked like any other. */
+    organisationById?: Lookup<[orgId: string], OrganisationRow>;
+    /**
+     * The stored kind of an organisation (for example `orgKind` on its mapping
+     * row). Decides, from data, whether an organisation is the operator org,
+     * that is the fleet. `null`, a miss, or any value other than exactly
+     * `"operator"` is NOT the fleet. A missing or throwing adapter refuses.
+     */
+    orgKindOf?: Lookup<[orgId: string], OrgKind>;
+};
+/** The one lookup `assertTargetBelongsTo` reads. */
+export type OrgKindLookups = Pick<PrincipalLookups, "orgKindOf">;
+export type ActingPrincipalKind = "agent" | "person" | "service" | "fleet";
+export type ActingPrincipal = {
+    /** The stored ID of the actor: agent ID, person ID or service-account ID. */
+    principalId: string;
+    /** The stored organisation ID. The operator org's ID for `fleet`. */
+    orgId: string;
+    kind: ActingPrincipalKind;
+    /** Set when a service account acts for an agent: the service account's ID. */
+    viaServiceAccountId?: string;
+};
+export type ResolveActingPrincipalResult = {
+    ok: true;
+    principal: ActingPrincipal;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+export type TargetIds = {
+    /** The target row's stored organisation ID. Absent: unstamped. */
+    orgId?: string | null;
+    /** The target row's stored owner ID (agent, person or service account). */
+    ownerId?: string | null;
+};
+export type AssertTargetOptions = {
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+    /** Owner-only door: the target's `ownerId` must equal `principalId`. */
+    ownerOnly?: boolean;
+    /**
+     * A fleet principal may reach a row of a CLIENT organisation only when the
+     * door declares it (a master export), and only when `orgKindOf` reports that
+     * organisation as `"client"`. Default `false`: refused.
+     */
+    fleetCrossOrg?: boolean;
+};
+export type AssertTargetResult = {
+    ok: true;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Resolves the acting principal from a VERIFIED credential to stored IDs, or
+ * refuses. Refusal by default: a credential claiming the fleet kind
+ * (`reserved-fleet-scope`), a credential that does not parse (including one
+ * carrying any name field), a missing or throwing lookup, a miss, a malformed
+ * or inactive row, an unstamped row and an inactive organisation are all
+ * refused. Nothing is ever resolved by a name, and nothing falls back to a
+ * master principal.
+ *
+ *   - agent: the agent row by `agentId`; its stored org must equal the org
+ *     the credential was verified for. An agent of the operator org resolves
+ *     as an ordinary `kind: "agent"` of that org (RULING 5).
+ *   - person: the person row by (`personId`, `verifiedOrgId`); it must be
+ *     stamped with that org. A person of the operator org resolves as an
+ *     ordinary `kind: "person"` of that org (RULING 5).
+ *   - service: the service-account row by `serviceAccountId`. Alone, it acts
+ *     as itself (`kind: "service"`, or `kind: "fleet"` when `orgKindOf` reports
+ *     its stored org as `"operator"`). With `actingForAgentId`, the agent row is read by
+ *     ID and must be stamped with the service account's own org; the principal
+ *     is that agent, with `viaServiceAccountId` recording the carrier.
+ */
+export declare function resolveActingPrincipal(credential: ActingCredential | null | undefined, lookups: PrincipalLookups, door?: string): Promise<ResolveActingPrincipalResult>;
+/**
+ * Admits a target only by comparing its STORED IDs with the principal's
+ * resolved IDs, byte for byte. No name field is read; there is none to read.
+ *
+ * Whether an organisation is the operator org (the fleet) is read from
+ * `lookups.orgKindOf`; a missing or throwing adapter refuses.
+ *
+ *   - An absent principal, or one with an empty ID, is refused.
+ *   - A `kind: "fleet"` principal outside the operator org is refused, and so
+ *     is a `kind: "service"` principal inside it (the operator org's service
+ *     account is the fleet). An agent or person of the operator org is an
+ *     ordinary member of it (RULING 5).
+ *   - An unstamped target (no `orgId`) is refused to EVERY principal, the
+ *     fleet principal included. No right is inferred from an absence: a fleet
+ *     row carries the operator org's ID explicitly, and a row with no
+ *     organisation is never treated as a master row.
+ *   - An operator-org row is refused to every client principal.
+ *   - Otherwise the target's `orgId` must equal the principal's. A fleet
+ *     principal reaches a client organisation's row only when the door sets
+ *     `fleetCrossOrg` (a master export) AND `orgKindOf` reports that
+ *     organisation as `"client"`; an unknown organisation is refused. Any
+ *     other principal reaching across organisations under `fleetCrossOrg`
+ *     claims the fleet scope and is refused `reserved-fleet-scope`.
+ *   - `ownerOnly`: the target's `ownerId` must also equal `principalId`; an
+ *     absent owner is refused.
+ */
+export declare function assertTargetBelongsTo(principal: ActingPrincipal | null | undefined, target: TargetIds | null | undefined, lookups: OrgKindLookups, opts?: AssertTargetOptions): Promise<AssertTargetResult>;
+export {};
+//# sourceMappingURL=principal-by-id.d.ts.map

package/dist/principal-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;4BAgBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CAsGvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B"}

package/dist/principal-by-id.js

@@ -0,0 +1,334 @@
+/**
+ * The acting principal by ID, and the target checked by ID.
+ *
+ * An actor and a target are identified by their stored IDs, never by a name.
+ * A name is a display label: it never selects a row and never authorises one.
+ *
+ * Motivating incident: an agent of organisation A named "eta", calling by name
+ * through a service account, completed, updated and deleted the task of
+ * organisation B's agent also named "eta" at ten task doors, because every door
+ * admitted the caller by comparing names. Two different agents shared a label;
+ * nothing compared their IDs.
+ *
+ * Two functions close that class:
+ *
+ *   - `resolveActingPrincipal(credential, lookups)` turns a VERIFIED credential
+ *     into `{ principalId, orgId, kind }` read from stored rows, or refuses.
+ *   - `assertTargetBelongsTo(principal, target, lookups, opts)` admits a target
+ *     only when its stored organisation ID (and owner ID, where the door is
+ *     owner-only) equals the principal's resolved IDs.
+ *
+ * The fleet is the OPERATOR ORGANISATION: the organisation the consumer's
+ * `orgKindOf` adapter reports as `"operator"`, read from stored data at run
+ * time. No organisation ID is reserved or spelled in this package; an
+ * adapter that answers anything else, or nothing, means "not the fleet".
+ *
+ * RULING 5: membership of the operator org is ORDINARY membership. Its agents
+ * and persons resolve as `kind: "agent"` / `"person"` of that org and reach its
+ * rows only. Cross-org reach (`kind: "fleet"` + `fleetCrossOrg`) belongs to the
+ * operator org's SERVICE ACCOUNT alone; `reserved-fleet-scope` refuses a claim
+ * of that scope by any other credential, never plain membership.
+ *
+ * Pure functions over injected lookups: no database, no framework, no network.
+ * The consumer performs each indexed read by ID and passes the function in;
+ * every failure (throwing lookup, miss, malformed row, inactive row, wrong
+ * organisation) is a typed `IdentityRefusal`, never a default principal.
+ *
+ * @security This module verifies NOTHING about the credential itself. The IDs
+ * in a credential must come from the consumer's verification of what the
+ * caller presented (a bearer row, a person's token, the service secret). A
+ * client-supplied argument passed as a credential becomes the principal.
+ */
+import { z } from "zod";
+import { refusal } from "./identity-refusal.js";
+// ---------------------------------------------------------------------------
+// The credential: verified IDs only, no name field anywhere
+// ---------------------------------------------------------------------------
+/**
+ * A verified credential, in the package's vocabulary. Every identity field is
+ * an ID. The schemas are STRICT: a credential carrying any other key (an
+ * `agentName`, a `callerOrchestrator`, a `name`) is refused whole, so a name
+ * cannot be smuggled in beside an ID.
+ *
+ *   - `agent`: an agent's own bearer, verified by the consumer (for example by
+ *     `validatePresentedBearer`): the agent ID and the organisation the bearer
+ *     row is stamped with.
+ *   - `person`: a person's token, verified by the consumer: the stored person
+ *     ID (the verified subject) and the organisation the token is bound to.
+ *   - `service`: the service account, verified by the consumer. When it acts
+ *     for an agent it names that agent BY ID (`actingForAgentId`); the agent
+ *     is resolved within the service account's own organisation.
+ */
+export const actingCredentialSchema = z.discriminatedUnion("kind", [
+    z.strictObject({
+        kind: z.literal("agent"),
+        agentId: z.string().min(1),
+        verifiedOrgId: z.string().min(1),
+    }),
+    z.strictObject({
+        kind: z.literal("person"),
+        personId: z.string().min(1),
+        verifiedOrgId: z.string().min(1),
+    }),
+    z.strictObject({
+        kind: z.literal("service"),
+        serviceAccountId: z.string().min(1),
+        actingForAgentId: z.string().min(1).optional(),
+    }),
+]);
+// ---------------------------------------------------------------------------
+// The stored rows the consumer's lookups return
+// ---------------------------------------------------------------------------
+/**
+ * Each row repeats its own ID, so a loose lookup (prefix match, wrong index)
+ * returning another row cannot become a principal. `active` is REQUIRED and
+ * must be `true`: an absent flag grants nothing. Extra fields (a display name)
+ * are allowed and ignored.
+ */
+export const principalRowSchema = z.object({
+    id: z.string().min(1),
+    orgId: z.string().min(1).nullish(),
+    active: z.boolean(),
+});
+export const organisationRowSchema = z.object({
+    id: z.string().min(1),
+    active: z.boolean(),
+});
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function denied(reason, door, detail) {
+    return { ok: false, refusal: refusal("RBAC_DENIED", reason, door, detail) };
+}
+/**
+ * Reads one principal row BY ID and checks it: the lookup is supplied and does
+ * not throw, the row exists, is well formed, repeats the ID asked for, and is
+ * active. The lookup's own error text is never surfaced.
+ */
+async function loadPrincipalRow(lookup, args, expectedId, what, door) {
+    if (typeof lookup !== "function") {
+        return denied("principal-lookup-failed", door, `No lookup was supplied for the ${what}.`);
+    }
+    let raw;
+    try {
+        raw = await lookup(...args);
+    }
+    catch {
+        return denied("principal-lookup-failed", door, `The ${what} could not be read, so none is resolved.`);
+    }
+    if (raw === null || raw === undefined) {
+        return denied("principal-not-found", door, `No ${what} has this ID.`);
+    }
+    const parsed = principalRowSchema.safeParse(raw);
+    if (!parsed.success || parsed.data.id !== expectedId) {
+        return denied("principal-record-invalid", door, `The ${what} record is not well formed.`);
+    }
+    if (parsed.data.active !== true) {
+        return denied("principal-inactive", door, `The ${what} is not active.`);
+    }
+    return { ok: true, row: parsed.data };
+}
+/**
+ * Reads the stored kind of an organisation. Refusal by default: a missing or
+ * throwing adapter refuses; a miss or any answer other than exactly
+ * `"operator"` / `"client"` is `null`, which is never the fleet.
+ */
+async function loadOrgKind(lookups, orgId, door) {
+    const lookup = lookups?.orgKindOf;
+    if (typeof lookup !== "function") {
+        return denied("principal-lookup-failed", door, "No lookup was supplied for the organisation kind.");
+    }
+    let raw;
+    try {
+        raw = await lookup(orgId);
+    }
+    catch {
+        return denied("principal-lookup-failed", door, "The organisation kind could not be read, so none is resolved.");
+    }
+    return { ok: true, kind: raw === "operator" || raw === "client" ? raw : null };
+}
+/** Every organisation, the operator org included, must exist and be active. */
+async function checkOrganisation(orgId, lookups, door) {
+    const lookup = lookups.organisationById;
+    if (typeof lookup !== "function") {
+        return denied("principal-lookup-failed", door, "No lookup was supplied for the organisation.");
+    }
+    let raw;
+    try {
+        raw = await lookup(orgId);
+    }
+    catch {
+        return denied("principal-lookup-failed", door, "The organisation could not be read, so none is resolved.");
+    }
+    const parsed = organisationRowSchema.safeParse(raw);
+    if (!parsed.success || parsed.data.id !== orgId || parsed.data.active !== true) {
+        return denied("organisation-not-active", door, "The organisation is not mapped or not active.");
+    }
+    return null;
+}
+function served(principal) {
+    return { ok: true, principal };
+}
+/**
+ * Resolves the acting principal from a VERIFIED credential to stored IDs, or
+ * refuses. Refusal by default: a credential claiming the fleet kind
+ * (`reserved-fleet-scope`), a credential that does not parse (including one
+ * carrying any name field), a missing or throwing lookup, a miss, a malformed
+ * or inactive row, an unstamped row and an inactive organisation are all
+ * refused. Nothing is ever resolved by a name, and nothing falls back to a
+ * master principal.
+ *
+ *   - agent: the agent row by `agentId`; its stored org must equal the org
+ *     the credential was verified for. An agent of the operator org resolves
+ *     as an ordinary `kind: "agent"` of that org (RULING 5).
+ *   - person: the person row by (`personId`, `verifiedOrgId`); it must be
+ *     stamped with that org. A person of the operator org resolves as an
+ *     ordinary `kind: "person"` of that org (RULING 5).
+ *   - service: the service-account row by `serviceAccountId`. Alone, it acts
+ *     as itself (`kind: "service"`, or `kind: "fleet"` when `orgKindOf` reports
+ *     its stored org as `"operator"`). With `actingForAgentId`, the agent row is read by
+ *     ID and must be stamped with the service account's own org; the principal
+ *     is that agent, with `viaServiceAccountId` recording the carrier.
+ */
+export async function resolveActingPrincipal(credential, lookups, door = "resolveActingPrincipal") {
+    if (credential !== null &&
+        typeof credential === "object" &&
+        credential.kind === "fleet") {
+        return denied("reserved-fleet-scope", door, "The fleet scope is held only by the operator organisation's service account; no credential claims it.");
+    }
+    const parsed = actingCredentialSchema.safeParse(credential);
+    if (!parsed.success) {
+        return denied("credential-invalid", door, "The credential does not identify a principal by ID.");
+    }
+    const cred = parsed.data;
+    const look = lookups ?? {};
+    if (cred.kind === "agent" || cred.kind === "person") {
+        // The org's kind is read so a missing or throwing adapter refuses here as
+        // on every path; an operator-org member is NOT refused (RULING 5).
+        const credKind = await loadOrgKind(look, cred.verifiedOrgId, door);
+        if (!credKind.ok)
+            return credKind;
+        const loaded = cred.kind === "agent"
+            ? await loadPrincipalRow(look.agentById, [cred.agentId], cred.agentId, "agent", door)
+            : await loadPrincipalRow(look.personById, [cred.personId, cred.verifiedOrgId], cred.personId, "person", door);
+        if (!loaded.ok)
+            return loaded;
+        const rowOrg = loaded.row.orgId;
+        if (!nonEmpty(rowOrg)) {
+            return denied("no-verified-organisation", door, `The ${cred.kind} is stamped with no organisation.`);
+        }
+        if (rowOrg !== cred.verifiedOrgId) {
+            return denied("other-organisation", door, `The ${cred.kind} belongs to another organisation than its credential.`);
+        }
+        const orgRefusal = await checkOrganisation(rowOrg, look, door);
+        if (orgRefusal !== null)
+            return orgRefusal;
+        return served({ principalId: loaded.row.id, orgId: rowOrg, kind: cred.kind });
+    }
+    // service account
+    const svc = await loadPrincipalRow(look.serviceAccountById, [cred.serviceAccountId], cred.serviceAccountId, "service account", door);
+    if (!svc.ok)
+        return svc;
+    const svcOrg = svc.row.orgId;
+    if (!nonEmpty(svcOrg)) {
+        return denied("no-verified-organisation", door, "The service account is stamped with no organisation.");
+    }
+    const svcKind = await loadOrgKind(look, svcOrg, door);
+    if (!svcKind.ok)
+        return svcKind;
+    const orgRefusal = await checkOrganisation(svcOrg, look, door);
+    if (orgRefusal !== null)
+        return orgRefusal;
+    if (cred.actingForAgentId === undefined) {
+        return served({
+            principalId: svc.row.id,
+            orgId: svcOrg,
+            kind: svcKind.kind === "operator" ? "fleet" : "service",
+        });
+    }
+    const agent = await loadPrincipalRow(look.agentById, [cred.actingForAgentId], cred.actingForAgentId, "agent", door);
+    if (!agent.ok)
+        return agent;
+    if (agent.row.orgId !== svcOrg) {
+        return denied("acting-agent-other-organisation", door, "The service account may act only for an agent of its own organisation.");
+    }
+    return served({
+        principalId: agent.row.id,
+        orgId: svcOrg,
+        kind: "agent",
+        viaServiceAccountId: svc.row.id,
+    });
+}
+// ---------------------------------------------------------------------------
+// assertTargetBelongsTo
+// ---------------------------------------------------------------------------
+/**
+ * Admits a target only by comparing its STORED IDs with the principal's
+ * resolved IDs, byte for byte. No name field is read; there is none to read.
+ *
+ * Whether an organisation is the operator org (the fleet) is read from
+ * `lookups.orgKindOf`; a missing or throwing adapter refuses.
+ *
+ *   - An absent principal, or one with an empty ID, is refused.
+ *   - A `kind: "fleet"` principal outside the operator org is refused, and so
+ *     is a `kind: "service"` principal inside it (the operator org's service
+ *     account is the fleet). An agent or person of the operator org is an
+ *     ordinary member of it (RULING 5).
+ *   - An unstamped target (no `orgId`) is refused to EVERY principal, the
+ *     fleet principal included. No right is inferred from an absence: a fleet
+ *     row carries the operator org's ID explicitly, and a row with no
+ *     organisation is never treated as a master row.
+ *   - An operator-org row is refused to every client principal.
+ *   - Otherwise the target's `orgId` must equal the principal's. A fleet
+ *     principal reaches a client organisation's row only when the door sets
+ *     `fleetCrossOrg` (a master export) AND `orgKindOf` reports that
+ *     organisation as `"client"`; an unknown organisation is refused. Any
+ *     other principal reaching across organisations under `fleetCrossOrg`
+ *     claims the fleet scope and is refused `reserved-fleet-scope`.
+ *   - `ownerOnly`: the target's `ownerId` must also equal `principalId`; an
+ *     absent owner is refused.
+ */
+export async function assertTargetBelongsTo(principal, target, lookups, opts = {}) {
+    const door = opts.door ?? "assertTargetBelongsTo";
+    if (principal === null ||
+        typeof principal !== "object" ||
+        !nonEmpty(principal.principalId) ||
+        !nonEmpty(principal.orgId)) {
+        return denied("credential-invalid", door, "No resolved principal stands behind this call.");
+    }
+    const principalKind = await loadOrgKind(lookups, principal.orgId, door);
+    if (!principalKind.ok)
+        return principalKind;
+    const inFleet = principalKind.kind === "operator";
+    const isFleet = principal.kind === "fleet";
+    if ((isFleet && !inFleet) || (inFleet && principal.kind === "service")) {
+        return denied("reserved-fleet-scope", door, "The principal does not hold the fleet scope.");
+    }
+    const targetOrg = target?.orgId;
+    if (!nonEmpty(targetOrg)) {
+        return denied("target-unstamped", door, "The target carries no organisation, so it is not reachable.");
+    }
+    if (targetOrg !== principal.orgId) {
+        const targetKind = await loadOrgKind(lookups, targetOrg, door);
+        if (!targetKind.ok)
+            return targetKind;
+        if (targetKind.kind === "operator") {
+            return denied("reserved-fleet-scope", door, "The target is in the fleet scope.");
+        }
+        if (!isFleet && opts.fleetCrossOrg === true) {
+            return denied("reserved-fleet-scope", door, "Cross-organisation reach is held only by the operator organisation's service account.");
+        }
+        const masterExport = isFleet && opts.fleetCrossOrg === true && targetKind.kind === "client";
+        if (!masterExport) {
+            return denied("target-other-organisation", door, "The target belongs to another organisation.");
+        }
+    }
+    if (opts.ownerOnly === true) {
+        const owner = target?.ownerId;
+        if (!nonEmpty(owner) || owner !== principal.principalId) {
+            return denied("target-owner-mismatch", door, "Only the target's owner may act on it.");
+        }
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=principal-by-id.js.map

package/dist/principal-by-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAoFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/scope-filter.d.ts

@@ -119,6 +119,13 @@ export type GrantFieldDeclaration = readonly string[];
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
+ *
+ * @deprecated Since 0.11.0. A `createdBy` name matched against
+ * `fromAllowList` selects the row, which backend standard R-53 clause 1
+ * forbids: a name never selects or authorises a row. Use
+ * `resolveActingPrincipal` and `assertTargetBelongsTo`, which compare stored
+ * IDs. Behaviour unchanged; it stays exported until consumers migrate off it,
+ * and is removed in a major release.
  */
 export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T, grantFields?: GrantFieldDeclaration): boolean;
 /**
@@ -126,6 +133,12 @@ export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: O
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It selects rows through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[], grantFields?: GrantFieldDeclaration): T[];
 /**
@@ -135,6 +148,12 @@ export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAu
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It admits the row through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined, grantFields?: GrantFieldDeclaration): T | null;
 /**

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -125,6 +125,13 @@ function grantFieldMatches(value, fromAllowList) {
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
+ *
+ * @deprecated Since 0.11.0. A `createdBy` name matched against
+ * `fromAllowList` selects the row, which backend standard R-53 clause 1
+ * forbids: a name never selects or authorises a row. Use
+ * `resolveActingPrincipal` and `assertTargetBelongsTo`, which compare stored
+ * IDs. Behaviour unchanged; it stays exported until consumers migrate off it,
+ * and is removed in a major release.
  */
 export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
@@ -151,6 +158,12 @@ export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS)
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It selects rows through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
@@ -163,6 +176,12 @@ export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
  *
  * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
  * behaviour).
+ *
+ * @deprecated Since 0.11.0. It admits the row through `passesScopeFilter`,
+ * where a `createdBy` name selects the row, which backend standard R-53
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
+ * which compare stored IDs. Behaviour unchanged; it stays exported until
+ * consumers migrate off it, and is removed in a major release.
  */
 export function scopeFilterGet(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IACtE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACpE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IACtE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACpE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -77,6 +77,10 @@
     "./secret-compare-sync": {
       "types": "./dist/secret-compare-sync.d.ts",
       "import": "./dist/secret-compare-sync.js"
+    },
+    "./principal-by-id": {
+      "types": "./dist/principal-by-id.d.ts",
+      "import": "./dist/principal-by-id.js"
     }
   },
   "files": [