@vantageos/cloud-identity 0.12.0 → 0.15.0

package/CHANGELOG.md

@@ -3,6 +3,119 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- `verifyMcpAccessToken` now validates `audience` as an absolute URL with no
+  fragment (RFC 8707 section 2), with the same validator as the `resource` of
+  `buildProtectedResourceMetadata`. A whitespace-only, non-URL or
+  fragment-bearing audience throws the config error instead of being accepted.
+
+## [0.15.0]
+
+**Additive: resource-server primitives (`./resource-server`).** No existing
+function changes behaviour for an existing input. This is the identity layer an
+MCP server needs as an OAuth 2.1 protected resource, so a separate
+resource-server package is no longer needed.
+
+### Added
+
+- `buildProtectedResourceMetadata(config)`: the RFC 9728 document served at
+  `/.well-known/oauth-protected-resource` (`resource`, `authorization_servers`,
+  `bearer_methods_supported`, optional `scopes_supported`, `resource_name`,
+  `resource_documentation`). Throws on a relative or fragment-bearing resource,
+  an empty or relative authorization server list, or empty bearer methods.
+- `unauthorizedChallenge(config)`: the `401` status and a `WWW-Authenticate:
+  Bearer` value that always carries `resource_metadata` (RFC 9728 section 5.1),
+  with optional `error`, `error_description` and `scope` (RFC 6750). Values are
+  quoted and escaped; a line break throws.
+- `deriveClerkDiscoveryUrls(issuer)`: the OIDC discovery and JWKS URLs of an
+  `https` issuer.
+- `verifyMcpAccessToken(authorization, config, nowMs?)`: reads the `Authorization`
+  header and verifies the token for this resource by delegating to
+  `verifyClerkSessionToken` (RS256 only; signature, `iss`, `aud`, `exp`, `nbf`),
+  with the audience mandatory. Returns the verified session, or a typed
+  `CREDENTIAL_REFUSED` refusal with the `401` envelope (`bearer-missing` and
+  `bearer-malformed` answer `invalid_request`; `token-invalid` answers
+  `invalid_token`), or `503` with no challenge when the key set is unreachable
+  (`jwks-unavailable`). A missing issuer or audience throws.
+- Types `ProtectedResourceMetadataConfig`, `ProtectedResourceMetadata`,
+  `UnauthorizedChallengeConfig`, `UnauthorizedChallenge`, `ClerkDiscoveryUrls`,
+  `McpResourceServerConfig`, `VerifyMcpAccessTokenResult`.
+- `IdentityRefusalReason` gains `bearer-missing`, `bearer-malformed`,
+  `token-invalid`, `jwks-unavailable`.
+
+## [0.14.0]
+
+**Additive: who may address whom, which rows a caller may see, and a caller's
+standing, decided by agent ID only (`./principal-by-id`).** No existing function changes behaviour for an existing
+input.
+
+### Added
+
+- `assertRecipientAddressable(sender, recipient, lookups, { door? })` (CI-2):
+  decides, by agent ID only, whether a sender may address a recipient,
+  across organisations included. Admits same organisation; client to operator
+  when the recipient's ID is on the sender organisation's roster; operator to
+  client when the sender's ID is on the recipient organisation's roster.
+  `lookups` is `{ orgKindOf, rosterOf }`. Everything else refuses with a typed
+  `RBAC_DENIED` naming the door: client to client, a missing sender or
+  recipient, a sender that is not an agent, an unresolvable roster. The roster
+  check reuses `assertPrincipalListed`. Types `RecipientIds`,
+  `RecipientLookups`, `AssertRecipientAddressableOptions`,
+  `AssertRecipientAddressableResult`.
+- `resolveCallerStanding(credential, lookups, { adminRoles, door? })` (CI-4):
+  names a caller's standing as `anonymous` (with the typed refusal), `pre-org`
+  (a verified session with no organisation, via the new
+  `{ kind: "person-no-org", personId }` credential), `member`, `admin` or
+  `fleet`. Built on `resolveActingPrincipal` and `assertOrgAdmin`; the only
+  case the existing primitives could not say was `pre-org`, which they refuse
+  like a garbled credential. Types `CallerCredential`,
+  `AssertCallerStandingOptions`, `CallerStanding`.
+- `filterTargetsBelongingTo(principal, rows, lookups, opts?)` (CI-3): the
+  ID-keyed row filter that replaces the name-keyed `scopeFilterList`. Async;
+  returns `{ ok: true, rows }` or `{ ok: false, refusal }`. Each row is kept
+  exactly when `assertTargetBelongsTo` admits it (same `lookups` and options,
+  including `door`, `ownerOnly`, `fleetCrossOrg`); that function is reused, not
+  re-derived. The principal is proved first: an absent or unresolved principal
+  is a refusal naming the door, even for an empty list, never an empty
+  success. A resolved principal whose rows all belong elsewhere gets
+  `{ ok: true, rows: [] }`. Rows of other organisations, unstamped rows and a
+  same-NAME row of another organisation are dropped. A lookup failure on any
+  row refuses the whole call, never a silent drop. `fleetCrossOrg: true` from a
+  principal that is not `kind: "fleet"` is refused `reserved-fleet-scope` for
+  any list. Input order is kept. Type
+  `FilterTargetsResult`.
+
+### Deprecated
+
+- `scopeFilterList`, `scopeFilterGet`, `passesScopeFilter` and the name-keyed
+  `OAuthCtx.fromAllowList` field now point to `filterTargetsBelongingTo` in
+  their TSDoc. Behaviour is unchanged; they are removed when the consumer
+  migrates.
+
+## [0.13.0]
+
+**Additive: admission by membership of a stored list, by agent ID only
+(`./principal-by-id`).** A client roster used to be checked by comparing names.
+`assertPrincipalListed` is the single primitive that replaces it: the caller's
+agent ID must be byte-equal to an entry of a stored ID list. No existing
+function changes behaviour for an existing input.
+
+### Added
+
+- `assertPrincipalListed(principal, list, { door? })`: synchronous, returns
+  `{ ok: true }` or a typed `RBAC_DENIED` refusal naming the door. Refused by
+  default: an absent principal or one without an ID, a principal that is not
+  `kind: "agent"`, an absent list, a list without an organisation or stored
+  under another organisation, an empty or malformed `principalIds`, and an ID
+  not on the list. A name never matches and `"*"` is not a wildcard.
+- Types `PrincipalIdList`, `AssertPrincipalListedOptions`,
+  `AssertPrincipalListedResult`.
+- New `IdentityRefusalReason` values: `list-absent`, `list-empty`,
+  `principal-not-an-agent`, `principal-not-listed`.
+
 ## [0.12.0]
 
 **Additive — the organisation-admin proof, decided by ID

package/README.md

@@ -183,7 +183,7 @@ await resolveTenant({ session: null }); // throws Error("Unauthenticated: no ses
   unrestricted access. Useful for skipping filtering you know is pointless;
   never as a substitute for it.
 
-**Deprecated since 0.11.0: `passesScopeFilter`, `scopeFilterGet` and
+**Deprecated since 0.11.0 (pointing to `filterTargetsBelongingTo` since 0.14.0): `passesScopeFilter`, `scopeFilterGet` and
 `scopeFilterList`.** All three (the last two through the first) admit a row
 when its `createdBy` NAME appears in the caller's `fromAllowList`, so a name
 selects the row, which backend standard R-53 clause 1 forbids. For a target
@@ -692,6 +692,80 @@ const admin = assertOrgAdmin(who.principal, who.principal.orgId, {
 if (!admin.ok) throw toHttpError(admin.refusal);
 ```
 
+**`assertPrincipalListed(principal, list, opts)`** (`./principal-by-id`, 0.13.0)
+
+Synchronous. Returns `{ ok: true }` or `{ ok: false, refusal }`
+(`AssertPrincipalListedResult`). `list` is a `PrincipalIdList`,
+`{ orgId, principalIds }`, the stored roster of agent IDs; `opts`
+(`AssertPrincipalListedOptions`) is `{ door? }`. The single admission check
+for "is this caller on that stored list", decided by agent ID only, no lookup:
+
+- the principal's `principalId` must be byte-equal to an entry of
+  `principalIds` (`principal-not-listed`). No case folding, no trimming, no
+  prefix match, and no name matching anywhere: a name in the list never
+  matches, and a principal carrying only a name has no ID
+  (`credential-invalid`);
+- only a `kind: "agent"` principal is admitted (`principal-not-an-agent`),
+  an agent acting through a service account included, judged by its own ID;
+- `list.orgId` must be present (`target-unstamped`) and equal the principal's
+  `orgId` (`target-other-organisation`);
+- an absent list (`list-absent`) and an empty or malformed `principalIds`
+  (`list-empty`) refuse;
+- there is no wildcard: `"*"` is an ordinary string and admits nobody.
+
+```js
+const listed = assertPrincipalListed(who.principal, { orgId: row.orgId, principalIds: row.allowedAgentIds }, {
+  door: "tasks:complete",
+});
+if (!listed.ok) throw toHttpError(listed.refusal);
+```
+
+**`assertRecipientAddressable(sender, recipient, lookups, opts)`** (`./principal-by-id`, 0.14.0)
+
+Async. Returns `{ ok: true }` or `{ ok: false, refusal }`. `recipient` is
+`{ agentId, orgId }`; `lookups` is `{ orgKindOf, rosterOf }` where
+`rosterOf(orgId)` returns the stored `{ orgId, principalIds }` roster of that
+client organisation; `opts` is `{ door? }`. Decided by agent ID only:
+
+- same organisation: admitted;
+- client sender to operator recipient: the recipient's ID must be on the
+  SENDER organisation's roster;
+- operator sender to client recipient: the sender's ID must be on the
+  RECIPIENT organisation's roster;
+- client to client across organisations, a missing sender or recipient, a
+  sender that is not an agent, an unknown organisation kind and an
+  unresolvable roster all refuse. A name never matches. Types: `RecipientIds`,
+`RecipientLookups`, `AssertRecipientAddressableOptions`,
+`AssertRecipientAddressableResult`.
+
+```js
+const may = await assertRecipientAddressable(who.principal, { agentId: to.id, orgId: to.orgId }, {
+  orgKindOf, rosterOf,
+}, { door: "send_message" });
+if (!may.ok) throw toHttpError(may.refusal);
+```
+
+**`filterTargetsBelongingTo(principal, rows, lookups, opts)`** (`./principal-by-id`, 0.14.0)
+
+Async. The ID-keyed replacement for `scopeFilterList`. Returns
+`{ ok: true, rows }` (the rows `assertTargetBelongsTo` admits, in input order)
+or `{ ok: false, refusal }`. `lookups` and `opts` are those of
+`assertTargetBelongsTo`. Type: `FilterTargetsResult`.
+
+- an absent or unresolved principal is a refusal naming the door, even for an
+  empty list; it is never `{ ok: true, rows: [] }`;
+- a resolved principal whose rows all belong elsewhere gets
+  `{ ok: true, rows: [] }`, so a refusal is distinguishable from an absence;
+- rows of other organisations, unstamped rows and a same-NAME row of another
+  organisation are dropped; a name never decides;
+- a lookup failure is a refusal of the whole call, never a silent drop.
+
+```js
+const out = await filterTargetsBelongingTo(who.principal, rows, { orgKindOf }, { door: "tasks:list" });
+if (!out.ok) throw toHttpError(out.refusal);
+return out.rows;
+```
+
 **The fleet is the operator organisation.** The fleet is not a reserved ID: it
 is the organisation your `orgKindOf` adapter reports as `"operator"` (for
 example the organisation whose mapping row carries `orgKind: "operator"`),
@@ -740,6 +814,87 @@ left in the tables the door reads, then switch the door.
 takes a name as an identity input, and a test reads the exported signatures to
 keep it that way.
 
+### A caller's standing (0.14.0)
+
+`resolveCallerStanding(credential, lookups, { adminRoles, door? })` names which
+of the four callers is asking. It is built on `resolveActingPrincipal` and
+`assertOrgAdmin`; it is not a second path.
+
+| Credential (verified by you) | Standing |
+|---|---|
+| none, garbled, unknown or inactive principal | `anonymous`, with the typed `refusal` |
+| `{ kind: "person-no-org", personId }` | `pre-org` (signed in, no organisation) |
+| person or agent, or a non-operator service account, without the admin role | `member`, with `principal` |
+| person whose `verifiedOrgRole` is in `adminRoles` | `admin`, with `principal` |
+| service account of the operator organisation (`orgKindOf` is `"operator"`) | `fleet`, with `principal` |
+
+Types: `CallerCredential`, `AssertCallerStandingOptions`, `CallerStanding`.
+
+- A master token reaches `fleet` by your mapping it to the operator service
+  account: `validateMasterBearer` proves the secret, then you pass
+  `{ kind: "service", serviceAccountId }`. The package never mints a fleet
+  credential from a bearer.
+- A Clerk session reaches the function through `verifyClerkSessionToken`: with
+  an `org_id` claim, pass a `person` credential carrying `verifiedOrgId` and
+  `verifiedOrgRole`; without one, pass `person-no-org`. A person credential
+  that merely lacks `verifiedOrgId` is garbled and is `anonymous`, never `pre-org`.
+- Branch on `standing`, never on the absence of a field. `pre-org` is not
+  `anonymous`: refuse it where an organisation is needed, but answer it as a
+  signed-in caller (see the refusal rules of your read doors).
+
+## Protecting an MCP server as an OAuth resource (`/resource-server`)
+
+An MCP server that requires a bearer token is an OAuth 2.1 protected resource.
+These primitives are the whole resource side; they fetch nothing and call no
+network.
+
+```ts
+import {
+  buildProtectedResourceMetadata,
+  unauthorizedChallenge,
+  deriveClerkDiscoveryUrls,
+  verifyMcpAccessToken,
+} from "@vantageos/cloud-identity/resource-server";
+
+// GET /.well-known/oauth-protected-resource  (RFC 9728)
+const metadata = buildProtectedResourceMetadata({
+  resource: "https://mcp.example.com/mcp",
+  authorizationServers: ["https://clerk.example.com"],
+  scopesSupported: ["mcp:read", "mcp:write"],
+});
+
+// On every MCP request
+const r = await verifyMcpAccessToken(req.headers.authorization, {
+  realm: "mcp",
+  resourceMetadataUrl: "https://mcp.example.com/.well-known/oauth-protected-resource",
+  issuer: "https://clerk.example.com",
+  audience: "https://mcp.example.com/mcp", // this resource: required
+  jwks: () => fetchJwks(deriveClerkDiscoveryUrls("https://clerk.example.com").jwksUrl),
+});
+if (!r.ok) return respond(r.status, "headers" in r ? r.headers : {});
+// r.session.userId, r.session.claims
+```
+
+- `buildProtectedResourceMetadata` returns the RFC 9728 document
+  (`ProtectedResourceMetadataConfig` in, `ProtectedResourceMetadata` out).
+- `unauthorizedChallenge` returns `{ status: 401, headers }` whose
+  `WWW-Authenticate` always carries `resource_metadata`, plus `error`,
+  `error_description` and `scope` when given (`UnauthorizedChallengeConfig`,
+  `UnauthorizedChallenge`). Values are escaped; a line break throws.
+- `deriveClerkDiscoveryUrls` returns `ClerkDiscoveryUrls`
+  (`discoveryUrl`, `jwksUrl`) for an `https` issuer.
+- `verifyMcpAccessToken` reuses `verifyClerkSessionToken` (RS256 only) and
+  requires the token's `aud` to contain `audience`. It returns the verified
+  session, or a `CREDENTIAL_REFUSED` refusal with the `401` envelope
+  (`McpResourceServerConfig`, `VerifyMcpAccessTokenResult`):
+  `bearer-missing` and `bearer-malformed` answer `invalid_request`,
+  `token-invalid` answers `invalid_token` (wrong signature, issuer, audience,
+  expiry or not-before are one answer), and an unreachable key set is `503`
+  with no challenge (`jwks-unavailable`). A missing issuer or audience throws.
+- Limits, stated: the token needs a `sub` and a `kid` (the Clerk session shape);
+  the consumer fetches and caches the key set; no scope check is made on the
+  token (read `r.session.claims`).
+
 ## What this package does not do
 
 Worth reading before you rely on it.

package/dist/identity-refusal.d.ts

@@ -1,7 +1,7 @@
 /**
  * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
  * org-admin proof, namespace write, secret comparison), the 0.11.0
- * principal-by-id resolver and target check, and the 0.12.0 org-admin check.
+ * principal-by-id resolver and target check, the 0.12.0 org-admin check, and the 0.13.0 list-membership check.
  *
  * A refusal is a value carrying its own code, reason and door, so a caller
  * branches on content rather than on the mere presence of an exception, and an
@@ -13,7 +13,7 @@
  * closed vocabulary for the person path.
  */
 export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
-export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed" | "bearer-missing" | "bearer-malformed" | "token-invalid" | "jwks-unavailable";
 export type IdentityRefusal = {
     code: IdentityRefusalCode;
     reason: IdentityRefusalReason;

package/dist/identity-refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,GAEtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js

@@ -1,7 +1,7 @@
 /**
  * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
  * org-admin proof, namespace write, secret comparison), the 0.11.0
- * principal-by-id resolver and target check, and the 0.12.0 org-admin check.
+ * principal-by-id resolver and target check, the 0.12.0 org-admin check, and the 0.13.0 list-membership check.
  *
  * A refusal is a value carrying its own code, reason and door, so a caller
  * branches on content rather than on the mere presence of an exception, and an

package/dist/identity-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsDH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAgEH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -37,6 +37,8 @@ export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSche
 export type { MembershipRecord, ResolvedMembership, ResolveMembershipInput, ResolveMembershipResult, RequireOrgAdminInput, } from "./tenant-membership.js";
 export { assertNamespaceWrite } from "./namespace-write.js";
 export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
-export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, assertOrgAdmin, } from "./principal-by-id.js";
-export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, AssertOrgAdminOptions, AssertOrgAdminResult, } from "./principal-by-id.js";
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, filterTargetsBelongingTo, assertOrgAdmin, assertPrincipalListed, assertRecipientAddressable, resolveCallerStanding, } from "./principal-by-id.js";
+export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, FilterTargetsResult, AssertOrgAdminOptions, AssertOrgAdminResult, PrincipalIdList, AssertPrincipalListedOptions, AssertPrincipalListedResult, RecipientIds, RecipientLookups, AssertRecipientAddressableOptions, AssertRecipientAddressableResult, CallerCredential, AssertCallerStandingOptions, CallerStanding, } from "./principal-by-id.js";
+export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDiscoveryUrls, verifyMcpAccessToken, } from "./resource-server.js";
+export type { ProtectedResourceMetadataConfig, ProtectedResourceMetadata, UnauthorizedChallengeConfig, UnauthorizedChallenge, ClerkDiscoveryUrls, McpResourceServerConfig, VerifyMcpAccessTokenResult, } from "./resource-server.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -38,5 +38,10 @@ export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js"
 // 0.11.0 — The acting principal by ID and the target checked by ID. A name is
 // a display label: it never selects a row and never authorises one.
 // 0.12.0 — assertOrgAdmin: the org-admin proof on a principal resolved by ID.
-export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, assertOrgAdmin, } from "./principal-by-id.js";
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, filterTargetsBelongingTo, assertOrgAdmin, assertPrincipalListed, assertRecipientAddressable, resolveCallerStanding, } from "./principal-by-id.js";
+// 0.15.0 — Resource-server primitives: RFC 9728 protected resource metadata,
+// the RFC 6750 401 challenge, issuer discovery URLs and MCP access-token
+// verification bound to this resource. Replaces the standalone resource-server
+// package; one identity layer.
+export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDiscoveryUrls, verifyMcpAccessToken, } from "./resource-server.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}

package/dist/principal-by-id.d.ts

@@ -211,6 +211,40 @@ export declare function resolveActingPrincipal(credential: ActingCredential | nu
  *     absent owner is refused.
  */
 export declare function assertTargetBelongsTo(principal: ActingPrincipal | null | undefined, target: TargetIds | null | undefined, lookups: OrgKindLookups, opts?: AssertTargetOptions): Promise<AssertTargetResult>;
+export type FilterTargetsResult<T> = {
+    ok: true;
+    rows: T[];
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Keeps the rows that belong to the principal, deciding by STORED ID only.
+ * The ID-keyed replacement for the name-keyed `scopeFilterList`.
+ *
+ * Each row is judged by `assertTargetBelongsTo` (never re-derived here), so
+ * the same organisation, operator-org, unstamped, `ownerOnly` and
+ * `fleetCrossOrg` rules apply.
+ *
+ *   - The principal is proved FIRST, before any row is read. An absent or
+ *     unresolved principal, or a failed organisation-kind lookup for it,
+ *     returns `{ ok: false, refusal }` naming the door, even for an empty
+ *     list: a refusal is never an `ok: true` with no rows.
+ *   - `fleetCrossOrg: true` from a principal that is not `kind: "fleet"` is a
+ *     misconfigured door and is refused `reserved-fleet-scope` up front, for
+ *     any list. Per row, `reserved-fleet-scope` therefore only means "this row
+ *     is in the operator scope" and the row is dropped.
+ *   - A resolved principal whose rows all belong elsewhere gets
+ *     `{ ok: true, rows: [] }`: an absence, distinguishable from a refusal.
+ *   - A row that does not belong (other organisation, operator-org row,
+ *     unstamped, owner mismatch) is dropped. A same-NAME row of another
+ *     organisation is dropped: no name field is read.
+ *   - A lookup failure on any row refuses the whole call. It is never a
+ *     silent drop and never a pass; any refusal reason not known to mean
+ *     "this row is not yours" refuses too.
+ *   - The order of the kept rows is the order of the input.
+ */
+export declare function filterTargetsBelongingTo<T extends TargetIds>(principal: ActingPrincipal | null | undefined, rows: readonly T[], lookups: OrgKindLookups, opts?: AssertTargetOptions): Promise<FilterTargetsResult<T>>;
 export type AssertOrgAdminOptions = {
     /**
      * The role values that count as organisation admin, exactly as the verified
@@ -245,5 +279,154 @@ export type AssertOrgAdminResult = {
  *     No case folding, no prefix stripping, no default role.
  */
 export declare function assertOrgAdmin(principal: ActingPrincipal | null | undefined, targetOrgId: string | null | undefined, opts: AssertOrgAdminOptions): AssertOrgAdminResult;
+/**
+ * A stored list of principal IDs scoped to one organisation, for example a
+ * client's roster of agents. Every entry is an ID; a name is never an entry.
+ */
+export type PrincipalIdList = {
+    /** The organisation the list is stored under. */
+    orgId: string;
+    /** Stored principal (agent) IDs, compared byte for byte. */
+    principalIds: readonly string[];
+};
+export type AssertPrincipalListedOptions = {
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+export type AssertPrincipalListedResult = {
+    ok: true;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Admits a principal only when its AGENT ID is an entry of a stored list that
+ * belongs to its own organisation. The principal must come from
+ * `resolveActingPrincipal`; synchronous, no lookup, no name read anywhere.
+ *
+ * Refusal by default. Each of these refuses with a typed `RBAC_DENIED`
+ * carrying the door (default `"assertPrincipalListed"`):
+ *
+ *   - an absent principal, or one with an empty ID or organisation
+ *     (`credential-invalid`). A principal carrying only a name has no ID.
+ *   - a principal that is not `kind: "agent"` (`principal-not-an-agent`): the
+ *     list holds agent IDs, so a person, a service account and the fleet
+ *     principal are not admitted by it. An agent acting through a service
+ *     account is `kind: "agent"` and is judged by its own ID.
+ *   - an absent list (`list-absent`).
+ *   - a list with a missing or empty `orgId` (`target-unstamped`), or one
+ *     stored under another organisation (`target-other-organisation`).
+ *   - an empty or malformed `principalIds` (`list-empty`).
+ *   - an ID that is not byte-equal to an entry (`principal-not-listed`). No
+ *     case folding, no trimming, no prefix match.
+ *
+ * There is no wildcard: a `"*"` entry is an ordinary string, never "everyone".
+ * The fleet sentinel is out of scope here.
+ */
+export declare function assertPrincipalListed(principal: ActingPrincipal | null | undefined, list: PrincipalIdList | null | undefined, opts?: AssertPrincipalListedOptions): AssertPrincipalListedResult;
+/** The recipient of a message, named by its stored agent ID and organisation ID. */
+export type RecipientIds = {
+    /** The recipient agent's stored ID. */
+    agentId: string;
+    /** The recipient agent's stored organisation ID. */
+    orgId: string;
+};
+/**
+ * The lookups `assertRecipientAddressable` reads: the organisation kind, and
+ * the stored roster of agent IDs of one organisation (a client's list of the
+ * fleet agents it may reach). `null`, a miss or a throw is an unresolvable
+ * roster and refuses.
+ */
+export type RecipientLookups = OrgKindLookups & {
+    rosterOf?: Lookup<[orgId: string], PrincipalIdList>;
+};
+export type AssertRecipientAddressableOptions = {
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+export type AssertRecipientAddressableResult = {
+    ok: true;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Decides whether a sender may address a recipient, across organisations
+ * included, by AGENT ID only. The sender must come from
+ * `resolveActingPrincipal`. No name is read anywhere; a name never matches.
+ *
+ * Admitted iff one of these holds:
+ *   (a) same organisation: the sender's `orgId` equals the recipient's;
+ *   (b) client to operator: the sender is in a client organisation, the
+ *       recipient is in the operator organisation, and the RECIPIENT's ID is
+ *       on the SENDER organisation's roster;
+ *   (c) operator to client: the sender is in the operator organisation, the
+ *       recipient is in a client organisation, and the SENDER's ID is on the
+ *       RECIPIENT organisation's roster.
+ *
+ * Everything else is refused with a typed `RBAC_DENIED` carrying the door
+ * (default `"assertRecipientAddressable"`): an absent sender or one without an
+ * ID (`credential-invalid`), a sender that is not `kind: "agent"`
+ * (`principal-not-an-agent`), an absent recipient or one without an agent ID
+ * or organisation (`target-unstamped`), client to client across organisations
+ * and an organisation kind that is neither operator nor client
+ * (`target-other-organisation`), a missing or throwing `orgKindOf` /
+ * `rosterOf` (`principal-lookup-failed`), an absent roster (`list-absent`), and
+ * a roster that is empty, stored under the wrong organisation or does not list
+ * the ID (the refusals of {@link assertPrincipalListed}, which is reused for
+ * that check).
+ */
+export declare function assertRecipientAddressable(sender: ActingPrincipal | null | undefined, recipient: RecipientIds | null | undefined, lookups: RecipientLookups, opts?: AssertRecipientAddressableOptions): Promise<AssertRecipientAddressableResult>;
+/**
+ * A verified session that carries a person but NO organisation (a signed-in
+ * user who has not joined one). `resolveActingPrincipal` cannot express this:
+ * a person credential requires `verifiedOrgId`, so a no-organisation session
+ * is refused there exactly as a garbled credential is. This kind exists so
+ * the consumer can say "verified, and no organisation" on purpose; an absent
+ * `verifiedOrgId` on a `person` credential stays a garbled credential.
+ */
+declare const preOrgCredentialSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"person-no-org">;
+    personId: z.ZodString;
+}, z.core.$strict>;
+export type CallerCredential = ActingCredential | z.input<typeof preOrgCredentialSchema>;
+export type AssertCallerStandingOptions = {
+    /** Role values that make a person an organisation admin; see `assertOrgAdmin`. */
+    adminRoles: readonly string[];
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+/**
+ * The four callers, said apart. `anonymous` means no caller could be
+ * resolved (no credential, a garbled one, a miss, an inactive row) and carries
+ * the typed refusal; it is never what a signed-in session without an
+ * organisation becomes.
+ */
+export type CallerStanding = {
+    standing: "anonymous";
+    refusal: IdentityRefusal;
+} | {
+    standing: "pre-org";
+    personId: string;
+} | {
+    standing: "member";
+    principal: ActingPrincipal;
+} | {
+    standing: "admin";
+    principal: ActingPrincipal;
+} | {
+    standing: "fleet";
+    principal: ActingPrincipal;
+};
+/**
+ * Derives a caller's STANDING from a verified credential. It adds one case to
+ * the existing primitives, the signed-in session with no organisation, and
+ * reuses them for everything else: `resolveActingPrincipal` decides who the
+ * caller is (and `fleet`), `assertOrgAdmin` decides `admin` against the
+ * principal's own organisation. Any other resolved principal (a person
+ * without the admin role, an agent, a non-operator service account) is a
+ * `member`; read `principal.kind` to tell them apart.
+ */
+export declare function resolveCallerStanding(credential: CallerCredential | null | undefined, lookups: PrincipalLookups, opts: AssertCallerStandingOptions): Promise<CallerStanding>;
 export {};
 //# sourceMappingURL=principal-by-id.d.ts.map

package/dist/principal-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;4BAiBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA8GvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAMD,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CAmCtB"}
+{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;4BAiBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA8GvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAMD,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,EAAE,CAAA;CAAE,GACvB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAU5C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,SAAS,SAAS,EAChE,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAkCjC;AAMD,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CAmCtB;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,CAAC,EAAE,4BAA4B,GAClC,2BAA2B,CAsC7B;AAMD,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG;IACzB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC1C,SAAS,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAC1C,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iCAAiC,GACvC,OAAO,CAAC,gCAAgC,CAAC,CAuD3C;AAMD;;;;;;;GAOG;AACH,QAAA,MAAM,sBAAsB;;;kBAG1B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3C,MAAM,MAAM,2BAA2B,GAAG;IACxC,kFAAkF;IAClF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACnD;IAAE,QAAQ,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAClD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACjD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,cAAc,CAAC,CAWzB"}