@vantageos/cloud-identity 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -3,6 +3,55 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.13.0]
+
+**Additive: admission by membership of a stored list, by agent ID only
+(`./principal-by-id`).** A client roster used to be checked by comparing names.
+`assertPrincipalListed` is the single primitive that replaces it: the caller's
+agent ID must be byte-equal to an entry of a stored ID list. No existing
+function changes behaviour for an existing input.
+
+### Added
+
+- `assertPrincipalListed(principal, list, { door? })`: synchronous, returns
+  `{ ok: true }` or a typed `RBAC_DENIED` refusal naming the door. Refused by
+  default: an absent principal or one without an ID, a principal that is not
+  `kind: "agent"`, an absent list, a list without an organisation or stored
+  under another organisation, an empty or malformed `principalIds`, and an ID
+  not on the list. A name never matches and `"*"` is not a wildcard.
+- Types `PrincipalIdList`, `AssertPrincipalListedOptions`,
+  `AssertPrincipalListedResult`.
+- New `IdentityRefusalReason` values: `list-absent`, `list-empty`,
+  `principal-not-an-agent`, `principal-not-listed`.
+
+## [0.12.0]
+
+**Additive — the organisation-admin proof, decided by ID
+(`./principal-by-id`).** A door that requires "the caller is an ADMIN of its
+organisation" reads the verified role from the principal the package resolved,
+instead of re-reading the session in a local helper. No existing function
+changes behaviour for an existing input.
+
+### Added
+
+- `verifiedOrgRole` (optional, non-empty string) on the `kind: "person"`
+  credential of `resolveActingPrincipal`: the role the same verified token
+  carries in `verifiedOrgId` (Clerk: `org_role`). It is copied onto the
+  resolved principal as `orgRole`; a person credential without it resolves
+  exactly as in 0.11.0, with no `orgRole` key. The agent and service
+  credentials stay strict: a role on them is refused whole
+  (`credential-invalid`).
+- `assertOrgAdmin(principal, targetOrgId, { adminRoles, door? })`:
+  synchronous, returns `{ ok: true }` or a typed refusal. Only a person is an
+  organisation admin (an agent, a service account and the fleet principal are
+  refused); the target organisation must be present and byte-equal to the
+  principal's stored organisation; the role must be byte-equal to an entry of
+  the consumer's `adminRoles`. An absent role, an unknown role and an empty or
+  malformed `adminRoles` refuse. No lookup, no case folding, no default role.
+- Types `AssertOrgAdminOptions`, `AssertOrgAdminResult`; `orgRole?` on
+  `ActingPrincipal`.
+- New `IdentityRefusalReason` value: `principal-not-a-person`.
+
 ## [0.11.0]
 
 **Additive — the acting principal by ID, and the target checked by ID

package/README.md

@@ -594,7 +594,7 @@ resolved to `orgId: "org_a"`. The target check refuses it with
 
 Async. Returns `{ ok: true, principal }` or `{ ok: false, refusal }`
 (`ResolveActingPrincipalResult`). The `principal` (`ActingPrincipal`) is
-`{ principalId, orgId, kind, viaServiceAccountId? }`, where `kind` is
+`{ principalId, orgId, kind, viaServiceAccountId?, orgRole? }`, where `kind` is
 `"agent" | "person" | "service" | "fleet"` (`ActingPrincipalKind`).
 
 `credential` (`ActingCredential`, validated by `actingCredentialSchema`) is one
@@ -604,9 +604,12 @@ of three shapes, every identity field an ID:
   own bearer, already verified by you (for example with
   `validatePresentedBearer`). The agent row's stored `orgId` must equal
   `verifiedOrgId`.
-- `{ kind: "person", personId, verifiedOrgId }` — the human path: a person's
-  token, already verified by you. The person's row in that organisation is read
-  by `(personId, verifiedOrgId)`.
+- `{ kind: "person", personId, verifiedOrgId, verifiedOrgRole? }` — the human
+  path: a person's token, already verified by you. The person's row in that
+  organisation is read by `(personId, verifiedOrgId)`. `verifiedOrgRole`
+  (0.12.0, optional) is the role the SAME verified token carries in that
+  organisation (Clerk: `org_role`); it is copied onto the principal as
+  `orgRole` and read only by `assertOrgAdmin`.
 - `{ kind: "service", serviceAccountId, actingForAgentId? }` — the service
   account. Alone it acts as itself (`kind: "service"`, or `kind: "fleet"` if
   `orgKindOf` reports its organisation as `"operator"`). With `actingForAgentId` it acts for that
@@ -655,6 +658,68 @@ adapter as above, and is required (a missing or throwing adapter refuses with
 - An absent principal, or one with an empty ID, is refused
   (`credential-invalid`).
 
+**`assertOrgAdmin(principal, targetOrgId, opts)`** (`./principal-by-id`, 0.12.0)
+
+Synchronous. Returns `{ ok: true }` or `{ ok: false, refusal }`
+(`AssertOrgAdminResult`). `opts` (`AssertOrgAdminOptions`) is
+`{ adminRoles, door? }`: `adminRoles` is your list of admin role values exactly
+as the verified claim spells them (Clerk: `["org:admin"]`). Decided by ID, no
+lookup:
+
+- only a `kind: "person"` principal can be an organisation admin; an agent, a
+  service account and the fleet principal are refused
+  (`principal-not-a-person`);
+- `targetOrgId` must be present (`target-unstamped`) and byte-equal to the
+  principal's `orgId` (`target-other-organisation`): an admin of A is not an
+  admin of B;
+- the principal's `orgRole` must be byte-equal to an entry of `adminRoles`
+  (`role-not-admin`): an absent role, a member role, an empty or malformed
+  `adminRoles` all refuse. No case folding, no default role;
+- an absent principal, or one with an empty ID, is refused
+  (`credential-invalid`).
+
+```js
+const who = await resolveActingPrincipal(
+  { kind: "person", personId: claims.sub, verifiedOrgId: claims.org_id, verifiedOrgRole: claims.org_role },
+  lookups,
+  "owners:startBinding",
+);
+if (!who.ok) throw toHttpError(who.refusal);
+const admin = assertOrgAdmin(who.principal, who.principal.orgId, {
+  adminRoles: ["org:admin"],
+  door: "owners:startBinding",
+});
+if (!admin.ok) throw toHttpError(admin.refusal);
+```
+
+**`assertPrincipalListed(principal, list, opts)`** (`./principal-by-id`, 0.13.0)
+
+Synchronous. Returns `{ ok: true }` or `{ ok: false, refusal }`
+(`AssertPrincipalListedResult`). `list` is a `PrincipalIdList`,
+`{ orgId, principalIds }`, the stored roster of agent IDs; `opts`
+(`AssertPrincipalListedOptions`) is `{ door? }`. The single admission check
+for "is this caller on that stored list", decided by agent ID only, no lookup:
+
+- the principal's `principalId` must be byte-equal to an entry of
+  `principalIds` (`principal-not-listed`). No case folding, no trimming, no
+  prefix match, and no name matching anywhere: a name in the list never
+  matches, and a principal carrying only a name has no ID
+  (`credential-invalid`);
+- only a `kind: "agent"` principal is admitted (`principal-not-an-agent`),
+  an agent acting through a service account included, judged by its own ID;
+- `list.orgId` must be present (`target-unstamped`) and equal the principal's
+  `orgId` (`target-other-organisation`);
+- an absent list (`list-absent`) and an empty or malformed `principalIds`
+  (`list-empty`) refuse;
+- there is no wildcard: `"*"` is an ordinary string and admits nobody.
+
+```js
+const listed = assertPrincipalListed(who.principal, { orgId: row.orgId, principalIds: row.allowedAgentIds }, {
+  door: "tasks:complete",
+});
+if (!listed.ok) throw toHttpError(listed.refusal);
+```
+
 **The fleet is the operator organisation.** The fleet is not a reserved ID: it
 is the organisation your `orgKindOf` adapter reports as `"operator"` (for
 example the organisation whose mapping row carries `orgKind: "operator"`),

package/dist/identity-refusal.d.ts

@@ -1,7 +1,7 @@
 /**
  * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
- * org-admin proof, namespace write, secret comparison) and the 0.11.0
- * principal-by-id resolver and target check.
+ * org-admin proof, namespace write, secret comparison), the 0.11.0
+ * principal-by-id resolver and target check, the 0.12.0 org-admin check, and the 0.13.0 list-membership check.
  *
  * A refusal is a value carrying its own code, reason and door, so a caller
  * branches on content rather than on the mere presence of an exception, and an
@@ -13,7 +13,7 @@
  * closed vocabulary for the person path.
  */
 export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
-export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed";
 export type IdentityRefusal = {
     code: IdentityRefusalCode;
     reason: IdentityRefusalReason;

package/dist/identity-refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,CAAC;AAE5B,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js

@@ -1,7 +1,7 @@
 /**
  * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
- * org-admin proof, namespace write, secret comparison) and the 0.11.0
- * principal-by-id resolver and target check.
+ * org-admin proof, namespace write, secret comparison), the 0.11.0
+ * principal-by-id resolver and target check, the 0.12.0 org-admin check, and the 0.13.0 list-membership check.
  *
  * A refusal is a value carrying its own code, reason and door, so a caller
  * branches on content rather than on the mere presence of an exception, and an

package/dist/identity-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoDH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA2DH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -37,6 +37,6 @@ export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSche
 export type { MembershipRecord, ResolvedMembership, ResolveMembershipInput, ResolveMembershipResult, RequireOrgAdminInput, } from "./tenant-membership.js";
 export { assertNamespaceWrite } from "./namespace-write.js";
 export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
-export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, } from "./principal-by-id.js";
-export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, } from "./principal-by-id.js";
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, assertOrgAdmin, assertPrincipalListed, } from "./principal-by-id.js";
+export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, AssertOrgAdminOptions, AssertOrgAdminResult, PrincipalIdList, AssertPrincipalListedOptions, AssertPrincipalListedResult, } from "./principal-by-id.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -37,5 +37,6 @@ export { assertNamespaceWrite } from "./namespace-write.js";
 export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
 // 0.11.0 — The acting principal by ID and the target checked by ID. A name is
 // a display label: it never selects a row and never authorises one.
-export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, } from "./principal-by-id.js";
+// 0.12.0 — assertOrgAdmin: the org-admin proof on a principal resolved by ID.
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, assertOrgAdmin, assertPrincipalListed, } from "./principal-by-id.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}

package/dist/principal-by-id.d.ts

@@ -52,6 +52,9 @@ import { type IdentityRefusal } from "./identity-refusal.js";
  *     row is stamped with.
  *   - `person`: a person's token, verified by the consumer: the stored person
  *     ID (the verified subject) and the organisation the token is bound to.
+ *     Optionally (0.12.0) the role the SAME token carries in that organisation
+ *     (`verifiedOrgRole`, for example Clerk's `org_role`), read by
+ *     `assertOrgAdmin`. Only a verified claim belongs here, never an argument.
  *   - `service`: the service account, verified by the consumer. When it acts
  *     for an agent it names that agent BY ID (`actingForAgentId`); the agent
  *     is resolved within the service account's own organisation.
@@ -64,6 +67,7 @@ export declare const actingCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     kind: z.ZodLiteral<"person">;
     personId: z.ZodString;
     verifiedOrgId: z.ZodString;
+    verifiedOrgRole: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"service">;
     serviceAccountId: z.ZodString;
@@ -121,6 +125,11 @@ export type ActingPrincipal = {
     kind: ActingPrincipalKind;
     /** Set when a service account acts for an agent: the service account's ID. */
     viaServiceAccountId?: string;
+    /**
+     * `kind: "person"` only, and only when the credential carried
+     * `verifiedOrgRole`: the verified role in `orgId`. Read by `assertOrgAdmin`.
+     */
+    orgRole?: string;
 };
 export type ResolveActingPrincipalResult = {
     ok: true;
@@ -202,5 +211,84 @@ export declare function resolveActingPrincipal(credential: ActingCredential | nu
  *     absent owner is refused.
  */
 export declare function assertTargetBelongsTo(principal: ActingPrincipal | null | undefined, target: TargetIds | null | undefined, lookups: OrgKindLookups, opts?: AssertTargetOptions): Promise<AssertTargetResult>;
+export type AssertOrgAdminOptions = {
+    /**
+     * The role values that count as organisation admin, exactly as the verified
+     * claim spells them (for Clerk: `["org:admin"]`). Data supplied by the
+     * consumer; an empty or malformed list admits nobody.
+     */
+    adminRoles: readonly string[];
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+export type AssertOrgAdminResult = {
+    ok: true;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Admits a principal as ADMIN of the target organisation, deciding by ID only.
+ * The principal must come from `resolveActingPrincipal`; the role is the
+ * verified claim its person credential carried (`verifiedOrgRole`), so no host
+ * lookup is needed and none is read here.
+ *
+ *   - An absent principal, or one with an empty ID, is refused.
+ *   - Only a PERSON is an organisation admin. An agent, a service account and
+ *     the fleet principal are refused `principal-not-a-person`, whatever they
+ *     carry: the service account keeps its own rules and never becomes an
+ *     admin through this check.
+ *   - The target organisation must be present and byte-equal to the
+ *     principal's stored organisation: an admin of A is not an admin of B.
+ *   - The role must be byte-equal to one entry of `adminRoles`. An absent
+ *     role, an unknown role, and an empty or malformed `adminRoles` refuse.
+ *     No case folding, no prefix stripping, no default role.
+ */
+export declare function assertOrgAdmin(principal: ActingPrincipal | null | undefined, targetOrgId: string | null | undefined, opts: AssertOrgAdminOptions): AssertOrgAdminResult;
+/**
+ * A stored list of principal IDs scoped to one organisation, for example a
+ * client's roster of agents. Every entry is an ID; a name is never an entry.
+ */
+export type PrincipalIdList = {
+    /** The organisation the list is stored under. */
+    orgId: string;
+    /** Stored principal (agent) IDs, compared byte for byte. */
+    principalIds: readonly string[];
+};
+export type AssertPrincipalListedOptions = {
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+export type AssertPrincipalListedResult = {
+    ok: true;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Admits a principal only when its AGENT ID is an entry of a stored list that
+ * belongs to its own organisation. The principal must come from
+ * `resolveActingPrincipal`; synchronous, no lookup, no name read anywhere.
+ *
+ * Refusal by default. Each of these refuses with a typed `RBAC_DENIED`
+ * carrying the door (default `"assertPrincipalListed"`):
+ *
+ *   - an absent principal, or one with an empty ID or organisation
+ *     (`credential-invalid`). A principal carrying only a name has no ID.
+ *   - a principal that is not `kind: "agent"` (`principal-not-an-agent`): the
+ *     list holds agent IDs, so a person, a service account and the fleet
+ *     principal are not admitted by it. An agent acting through a service
+ *     account is `kind: "agent"` and is judged by its own ID.
+ *   - an absent list (`list-absent`).
+ *   - a list with a missing or empty `orgId` (`target-unstamped`), or one
+ *     stored under another organisation (`target-other-organisation`).
+ *   - an empty or malformed `principalIds` (`list-empty`).
+ *   - an ID that is not byte-equal to an entry (`principal-not-listed`). No
+ *     case folding, no trimming, no prefix match.
+ *
+ * There is no wildcard: a `"*"` entry is an ordinary string, never "everyone".
+ * The fleet sentinel is out of scope here.
+ */
+export declare function assertPrincipalListed(principal: ActingPrincipal | null | undefined, list: PrincipalIdList | null | undefined, opts?: AssertPrincipalListedOptions): AssertPrincipalListedResult;
 export {};
 //# sourceMappingURL=principal-by-id.d.ts.map

package/dist/principal-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;4BAgBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CAsGvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B"}
+{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;4BAiBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA8GvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAMD,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CAmCtB;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,CAAC,EAAE,4BAA4B,GAClC,2BAA2B,CAsC7B"}

package/dist/principal-by-id.js

@@ -55,6 +55,9 @@ import { refusal } from "./identity-refusal.js";
  *     row is stamped with.
  *   - `person`: a person's token, verified by the consumer: the stored person
  *     ID (the verified subject) and the organisation the token is bound to.
+ *     Optionally (0.12.0) the role the SAME token carries in that organisation
+ *     (`verifiedOrgRole`, for example Clerk's `org_role`), read by
+ *     `assertOrgAdmin`. Only a verified claim belongs here, never an argument.
  *   - `service`: the service account, verified by the consumer. When it acts
  *     for an agent it names that agent BY ID (`actingForAgentId`); the agent
  *     is resolved within the service account's own organisation.
@@ -69,6 +72,7 @@ export const actingCredentialSchema = z.discriminatedUnion("kind", [
         kind: z.literal("person"),
         personId: z.string().min(1),
         verifiedOrgId: z.string().min(1),
+        verifiedOrgRole: z.string().min(1).optional(),
     }),
     z.strictObject({
         kind: z.literal("service"),
@@ -223,6 +227,14 @@ export async function resolveActingPrincipal(credential, lookups, door = "resolv
         const orgRefusal = await checkOrganisation(rowOrg, look, door);
         if (orgRefusal !== null)
             return orgRefusal;
+        if (cred.kind === "person" && cred.verifiedOrgRole !== undefined) {
+            return served({
+                principalId: loaded.row.id,
+                orgId: rowOrg,
+                kind: cred.kind,
+                orgRole: cred.verifiedOrgRole,
+            });
+        }
         return served({ principalId: loaded.row.id, orgId: rowOrg, kind: cred.kind });
     }
     // service account
@@ -331,4 +343,99 @@ export async function assertTargetBelongsTo(principal, target, lookups, opts = {
     }
     return { ok: true };
 }
+/**
+ * Admits a principal as ADMIN of the target organisation, deciding by ID only.
+ * The principal must come from `resolveActingPrincipal`; the role is the
+ * verified claim its person credential carried (`verifiedOrgRole`), so no host
+ * lookup is needed and none is read here.
+ *
+ *   - An absent principal, or one with an empty ID, is refused.
+ *   - Only a PERSON is an organisation admin. An agent, a service account and
+ *     the fleet principal are refused `principal-not-a-person`, whatever they
+ *     carry: the service account keeps its own rules and never becomes an
+ *     admin through this check.
+ *   - The target organisation must be present and byte-equal to the
+ *     principal's stored organisation: an admin of A is not an admin of B.
+ *   - The role must be byte-equal to one entry of `adminRoles`. An absent
+ *     role, an unknown role, and an empty or malformed `adminRoles` refuse.
+ *     No case folding, no prefix stripping, no default role.
+ */
+export function assertOrgAdmin(principal, targetOrgId, opts) {
+    const door = opts?.door ?? "assertOrgAdmin";
+    if (principal === null ||
+        typeof principal !== "object" ||
+        !nonEmpty(principal.principalId) ||
+        !nonEmpty(principal.orgId)) {
+        return denied("credential-invalid", door, "No resolved principal stands behind this call.");
+    }
+    if (principal.kind !== "person") {
+        return denied("principal-not-a-person", door, "Only a person is an organisation admin; this principal is not a person.");
+    }
+    if (!nonEmpty(targetOrgId)) {
+        return denied("target-unstamped", door, "No target organisation was named, so none is administered.");
+    }
+    if (targetOrgId !== principal.orgId) {
+        return denied("target-other-organisation", door, "The target organisation is not the principal's organisation.");
+    }
+    const adminRoles = opts?.adminRoles;
+    const rolesValid = Array.isArray(adminRoles) && adminRoles.length > 0 && adminRoles.every((r) => nonEmpty(r));
+    const role = principal.orgRole;
+    if (!rolesValid || !nonEmpty(role) || !adminRoles.includes(role)) {
+        return denied("role-not-admin", door, "The principal's role is not an organisation-admin role.");
+    }
+    return { ok: true };
+}
+/**
+ * Admits a principal only when its AGENT ID is an entry of a stored list that
+ * belongs to its own organisation. The principal must come from
+ * `resolveActingPrincipal`; synchronous, no lookup, no name read anywhere.
+ *
+ * Refusal by default. Each of these refuses with a typed `RBAC_DENIED`
+ * carrying the door (default `"assertPrincipalListed"`):
+ *
+ *   - an absent principal, or one with an empty ID or organisation
+ *     (`credential-invalid`). A principal carrying only a name has no ID.
+ *   - a principal that is not `kind: "agent"` (`principal-not-an-agent`): the
+ *     list holds agent IDs, so a person, a service account and the fleet
+ *     principal are not admitted by it. An agent acting through a service
+ *     account is `kind: "agent"` and is judged by its own ID.
+ *   - an absent list (`list-absent`).
+ *   - a list with a missing or empty `orgId` (`target-unstamped`), or one
+ *     stored under another organisation (`target-other-organisation`).
+ *   - an empty or malformed `principalIds` (`list-empty`).
+ *   - an ID that is not byte-equal to an entry (`principal-not-listed`). No
+ *     case folding, no trimming, no prefix match.
+ *
+ * There is no wildcard: a `"*"` entry is an ordinary string, never "everyone".
+ * The fleet sentinel is out of scope here.
+ */
+export function assertPrincipalListed(principal, list, opts) {
+    const door = opts?.door ?? "assertPrincipalListed";
+    if (principal === null ||
+        typeof principal !== "object" ||
+        !nonEmpty(principal.principalId) ||
+        !nonEmpty(principal.orgId)) {
+        return denied("credential-invalid", door, "No resolved principal stands behind this call.");
+    }
+    if (principal.kind !== "agent") {
+        return denied("principal-not-an-agent", door, "The list holds agent IDs; this principal is not an agent.");
+    }
+    if (list === null || list === undefined || typeof list !== "object") {
+        return denied("list-absent", door, "No list was supplied, so nobody is listed.");
+    }
+    if (!nonEmpty(list.orgId)) {
+        return denied("target-unstamped", door, "The list carries no organisation, so it admits nobody.");
+    }
+    if (list.orgId !== principal.orgId) {
+        return denied("target-other-organisation", door, "The list belongs to another organisation than the principal.");
+    }
+    const ids = list.principalIds;
+    if (!Array.isArray(ids) || ids.length === 0) {
+        return denied("list-empty", door, "The list holds no principal IDs, so nobody is listed.");
+    }
+    if (!ids.some((id) => id === principal.principalId)) {
+        return denied("principal-not-listed", door, "The principal's ID is not on the list.");
+    }
+    return { ok: true };
+}
 //# sourceMappingURL=principal-by-id.js.map

package/dist/principal-by-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAoFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAyFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,eAAe;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,WAAsC,EACtC,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC5C,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6C,EAC7C,IAAwC,EACxC,IAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",