@vantageos/cloud-identity 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -3,6 +3,98 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- `verifyMcpAccessToken` now validates `audience` as an absolute URL with no
+  fragment (RFC 8707 section 2), with the same validator as the `resource` of
+  `buildProtectedResourceMetadata`. A whitespace-only, non-URL or
+  fragment-bearing audience throws the config error instead of being accepted.
+
+## [0.15.0]
+
+**Additive: resource-server primitives (`./resource-server`).** No existing
+function changes behaviour for an existing input. This is the identity layer an
+MCP server needs as an OAuth 2.1 protected resource, so a separate
+resource-server package is no longer needed.
+
+### Added
+
+- `buildProtectedResourceMetadata(config)`: the RFC 9728 document served at
+  `/.well-known/oauth-protected-resource` (`resource`, `authorization_servers`,
+  `bearer_methods_supported`, optional `scopes_supported`, `resource_name`,
+  `resource_documentation`). Throws on a relative or fragment-bearing resource,
+  an empty or relative authorization server list, or empty bearer methods.
+- `unauthorizedChallenge(config)`: the `401` status and a `WWW-Authenticate:
+  Bearer` value that always carries `resource_metadata` (RFC 9728 section 5.1),
+  with optional `error`, `error_description` and `scope` (RFC 6750). Values are
+  quoted and escaped; a line break throws.
+- `deriveClerkDiscoveryUrls(issuer)`: the OIDC discovery and JWKS URLs of an
+  `https` issuer.
+- `verifyMcpAccessToken(authorization, config, nowMs?)`: reads the `Authorization`
+  header and verifies the token for this resource by delegating to
+  `verifyClerkSessionToken` (RS256 only; signature, `iss`, `aud`, `exp`, `nbf`),
+  with the audience mandatory. Returns the verified session, or a typed
+  `CREDENTIAL_REFUSED` refusal with the `401` envelope (`bearer-missing` and
+  `bearer-malformed` answer `invalid_request`; `token-invalid` answers
+  `invalid_token`), or `503` with no challenge when the key set is unreachable
+  (`jwks-unavailable`). A missing issuer or audience throws.
+- Types `ProtectedResourceMetadataConfig`, `ProtectedResourceMetadata`,
+  `UnauthorizedChallengeConfig`, `UnauthorizedChallenge`, `ClerkDiscoveryUrls`,
+  `McpResourceServerConfig`, `VerifyMcpAccessTokenResult`.
+- `IdentityRefusalReason` gains `bearer-missing`, `bearer-malformed`,
+  `token-invalid`, `jwks-unavailable`.
+
+## [0.14.0]
+
+**Additive: who may address whom, which rows a caller may see, and a caller's
+standing, decided by agent ID only (`./principal-by-id`).** No existing function changes behaviour for an existing
+input.
+
+### Added
+
+- `assertRecipientAddressable(sender, recipient, lookups, { door? })` (CI-2):
+  decides, by agent ID only, whether a sender may address a recipient,
+  across organisations included. Admits same organisation; client to operator
+  when the recipient's ID is on the sender organisation's roster; operator to
+  client when the sender's ID is on the recipient organisation's roster.
+  `lookups` is `{ orgKindOf, rosterOf }`. Everything else refuses with a typed
+  `RBAC_DENIED` naming the door: client to client, a missing sender or
+  recipient, a sender that is not an agent, an unresolvable roster. The roster
+  check reuses `assertPrincipalListed`. Types `RecipientIds`,
+  `RecipientLookups`, `AssertRecipientAddressableOptions`,
+  `AssertRecipientAddressableResult`.
+- `resolveCallerStanding(credential, lookups, { adminRoles, door? })` (CI-4):
+  names a caller's standing as `anonymous` (with the typed refusal), `pre-org`
+  (a verified session with no organisation, via the new
+  `{ kind: "person-no-org", personId }` credential), `member`, `admin` or
+  `fleet`. Built on `resolveActingPrincipal` and `assertOrgAdmin`; the only
+  case the existing primitives could not say was `pre-org`, which they refuse
+  like a garbled credential. Types `CallerCredential`,
+  `AssertCallerStandingOptions`, `CallerStanding`.
+- `filterTargetsBelongingTo(principal, rows, lookups, opts?)` (CI-3): the
+  ID-keyed row filter that replaces the name-keyed `scopeFilterList`. Async;
+  returns `{ ok: true, rows }` or `{ ok: false, refusal }`. Each row is kept
+  exactly when `assertTargetBelongsTo` admits it (same `lookups` and options,
+  including `door`, `ownerOnly`, `fleetCrossOrg`); that function is reused, not
+  re-derived. The principal is proved first: an absent or unresolved principal
+  is a refusal naming the door, even for an empty list, never an empty
+  success. A resolved principal whose rows all belong elsewhere gets
+  `{ ok: true, rows: [] }`. Rows of other organisations, unstamped rows and a
+  same-NAME row of another organisation are dropped. A lookup failure on any
+  row refuses the whole call, never a silent drop. `fleetCrossOrg: true` from a
+  principal that is not `kind: "fleet"` is refused `reserved-fleet-scope` for
+  any list. Input order is kept. Type
+  `FilterTargetsResult`.
+
+### Deprecated
+
+- `scopeFilterList`, `scopeFilterGet`, `passesScopeFilter` and the name-keyed
+  `OAuthCtx.fromAllowList` field now point to `filterTargetsBelongingTo` in
+  their TSDoc. Behaviour is unchanged; they are removed when the consumer
+  migrates.
+
 ## [0.13.0]
 
 **Additive: admission by membership of a stored list, by agent ID only

package/README.md

@@ -183,7 +183,7 @@ await resolveTenant({ session: null }); // throws Error("Unauthenticated: no ses
   unrestricted access. Useful for skipping filtering you know is pointless;
   never as a substitute for it.
 
-**Deprecated since 0.11.0: `passesScopeFilter`, `scopeFilterGet` and
+**Deprecated since 0.11.0 (pointing to `filterTargetsBelongingTo` since 0.14.0): `passesScopeFilter`, `scopeFilterGet` and
 `scopeFilterList`.** All three (the last two through the first) admit a row
 when its `createdBy` NAME appears in the caller's `fromAllowList`, so a name
 selects the row, which backend standard R-53 clause 1 forbids. For a target
@@ -720,6 +720,52 @@ const listed = assertPrincipalListed(who.principal, { orgId: row.orgId, principa
 if (!listed.ok) throw toHttpError(listed.refusal);
 ```
 
+**`assertRecipientAddressable(sender, recipient, lookups, opts)`** (`./principal-by-id`, 0.14.0)
+
+Async. Returns `{ ok: true }` or `{ ok: false, refusal }`. `recipient` is
+`{ agentId, orgId }`; `lookups` is `{ orgKindOf, rosterOf }` where
+`rosterOf(orgId)` returns the stored `{ orgId, principalIds }` roster of that
+client organisation; `opts` is `{ door? }`. Decided by agent ID only:
+
+- same organisation: admitted;
+- client sender to operator recipient: the recipient's ID must be on the
+  SENDER organisation's roster;
+- operator sender to client recipient: the sender's ID must be on the
+  RECIPIENT organisation's roster;
+- client to client across organisations, a missing sender or recipient, a
+  sender that is not an agent, an unknown organisation kind and an
+  unresolvable roster all refuse. A name never matches. Types: `RecipientIds`,
+`RecipientLookups`, `AssertRecipientAddressableOptions`,
+`AssertRecipientAddressableResult`.
+
+```js
+const may = await assertRecipientAddressable(who.principal, { agentId: to.id, orgId: to.orgId }, {
+  orgKindOf, rosterOf,
+}, { door: "send_message" });
+if (!may.ok) throw toHttpError(may.refusal);
+```
+
+**`filterTargetsBelongingTo(principal, rows, lookups, opts)`** (`./principal-by-id`, 0.14.0)
+
+Async. The ID-keyed replacement for `scopeFilterList`. Returns
+`{ ok: true, rows }` (the rows `assertTargetBelongsTo` admits, in input order)
+or `{ ok: false, refusal }`. `lookups` and `opts` are those of
+`assertTargetBelongsTo`. Type: `FilterTargetsResult`.
+
+- an absent or unresolved principal is a refusal naming the door, even for an
+  empty list; it is never `{ ok: true, rows: [] }`;
+- a resolved principal whose rows all belong elsewhere gets
+  `{ ok: true, rows: [] }`, so a refusal is distinguishable from an absence;
+- rows of other organisations, unstamped rows and a same-NAME row of another
+  organisation are dropped; a name never decides;
+- a lookup failure is a refusal of the whole call, never a silent drop.
+
+```js
+const out = await filterTargetsBelongingTo(who.principal, rows, { orgKindOf }, { door: "tasks:list" });
+if (!out.ok) throw toHttpError(out.refusal);
+return out.rows;
+```
+
 **The fleet is the operator organisation.** The fleet is not a reserved ID: it
 is the organisation your `orgKindOf` adapter reports as `"operator"` (for
 example the organisation whose mapping row carries `orgKind: "operator"`),
@@ -768,6 +814,87 @@ left in the tables the door reads, then switch the door.
 takes a name as an identity input, and a test reads the exported signatures to
 keep it that way.
 
+### A caller's standing (0.14.0)
+
+`resolveCallerStanding(credential, lookups, { adminRoles, door? })` names which
+of the four callers is asking. It is built on `resolveActingPrincipal` and
+`assertOrgAdmin`; it is not a second path.
+
+| Credential (verified by you) | Standing |
+|---|---|
+| none, garbled, unknown or inactive principal | `anonymous`, with the typed `refusal` |
+| `{ kind: "person-no-org", personId }` | `pre-org` (signed in, no organisation) |
+| person or agent, or a non-operator service account, without the admin role | `member`, with `principal` |
+| person whose `verifiedOrgRole` is in `adminRoles` | `admin`, with `principal` |
+| service account of the operator organisation (`orgKindOf` is `"operator"`) | `fleet`, with `principal` |
+
+Types: `CallerCredential`, `AssertCallerStandingOptions`, `CallerStanding`.
+
+- A master token reaches `fleet` by your mapping it to the operator service
+  account: `validateMasterBearer` proves the secret, then you pass
+  `{ kind: "service", serviceAccountId }`. The package never mints a fleet
+  credential from a bearer.
+- A Clerk session reaches the function through `verifyClerkSessionToken`: with
+  an `org_id` claim, pass a `person` credential carrying `verifiedOrgId` and
+  `verifiedOrgRole`; without one, pass `person-no-org`. A person credential
+  that merely lacks `verifiedOrgId` is garbled and is `anonymous`, never `pre-org`.
+- Branch on `standing`, never on the absence of a field. `pre-org` is not
+  `anonymous`: refuse it where an organisation is needed, but answer it as a
+  signed-in caller (see the refusal rules of your read doors).
+
+## Protecting an MCP server as an OAuth resource (`/resource-server`)
+
+An MCP server that requires a bearer token is an OAuth 2.1 protected resource.
+These primitives are the whole resource side; they fetch nothing and call no
+network.
+
+```ts
+import {
+  buildProtectedResourceMetadata,
+  unauthorizedChallenge,
+  deriveClerkDiscoveryUrls,
+  verifyMcpAccessToken,
+} from "@vantageos/cloud-identity/resource-server";
+
+// GET /.well-known/oauth-protected-resource  (RFC 9728)
+const metadata = buildProtectedResourceMetadata({
+  resource: "https://mcp.example.com/mcp",
+  authorizationServers: ["https://clerk.example.com"],
+  scopesSupported: ["mcp:read", "mcp:write"],
+});
+
+// On every MCP request
+const r = await verifyMcpAccessToken(req.headers.authorization, {
+  realm: "mcp",
+  resourceMetadataUrl: "https://mcp.example.com/.well-known/oauth-protected-resource",
+  issuer: "https://clerk.example.com",
+  audience: "https://mcp.example.com/mcp", // this resource: required
+  jwks: () => fetchJwks(deriveClerkDiscoveryUrls("https://clerk.example.com").jwksUrl),
+});
+if (!r.ok) return respond(r.status, "headers" in r ? r.headers : {});
+// r.session.userId, r.session.claims
+```
+
+- `buildProtectedResourceMetadata` returns the RFC 9728 document
+  (`ProtectedResourceMetadataConfig` in, `ProtectedResourceMetadata` out).
+- `unauthorizedChallenge` returns `{ status: 401, headers }` whose
+  `WWW-Authenticate` always carries `resource_metadata`, plus `error`,
+  `error_description` and `scope` when given (`UnauthorizedChallengeConfig`,
+  `UnauthorizedChallenge`). Values are escaped; a line break throws.
+- `deriveClerkDiscoveryUrls` returns `ClerkDiscoveryUrls`
+  (`discoveryUrl`, `jwksUrl`) for an `https` issuer.
+- `verifyMcpAccessToken` reuses `verifyClerkSessionToken` (RS256 only) and
+  requires the token's `aud` to contain `audience`. It returns the verified
+  session, or a `CREDENTIAL_REFUSED` refusal with the `401` envelope
+  (`McpResourceServerConfig`, `VerifyMcpAccessTokenResult`):
+  `bearer-missing` and `bearer-malformed` answer `invalid_request`,
+  `token-invalid` answers `invalid_token` (wrong signature, issuer, audience,
+  expiry or not-before are one answer), and an unreachable key set is `503`
+  with no challenge (`jwks-unavailable`). A missing issuer or audience throws.
+- Limits, stated: the token needs a `sub` and a `kid` (the Clerk session shape);
+  the consumer fetches and caches the key set; no scope check is made on the
+  token (read `r.session.claims`).
+
 ## What this package does not do
 
 Worth reading before you rely on it.

package/dist/identity-refusal.d.ts

@@ -13,7 +13,7 @@
  * closed vocabulary for the person path.
  */
 export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
-export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed" | "bearer-missing" | "bearer-malformed" | "token-invalid" | "jwks-unavailable";
 export type IdentityRefusal = {
     code: IdentityRefusalCode;
     reason: IdentityRefusalReason;

package/dist/identity-refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,GAEtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA2DH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAgEH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -37,6 +37,8 @@ export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSche
 export type { MembershipRecord, ResolvedMembership, ResolveMembershipInput, ResolveMembershipResult, RequireOrgAdminInput, } from "./tenant-membership.js";
 export { assertNamespaceWrite } from "./namespace-write.js";
 export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
-export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, assertOrgAdmin, assertPrincipalListed, } from "./principal-by-id.js";
-export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, AssertOrgAdminOptions, AssertOrgAdminResult, PrincipalIdList, AssertPrincipalListedOptions, AssertPrincipalListedResult, } from "./principal-by-id.js";
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, filterTargetsBelongingTo, assertOrgAdmin, assertPrincipalListed, assertRecipientAddressable, resolveCallerStanding, } from "./principal-by-id.js";
+export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, FilterTargetsResult, AssertOrgAdminOptions, AssertOrgAdminResult, PrincipalIdList, AssertPrincipalListedOptions, AssertPrincipalListedResult, RecipientIds, RecipientLookups, AssertRecipientAddressableOptions, AssertRecipientAddressableResult, CallerCredential, AssertCallerStandingOptions, CallerStanding, } from "./principal-by-id.js";
+export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDiscoveryUrls, verifyMcpAccessToken, } from "./resource-server.js";
+export type { ProtectedResourceMetadataConfig, ProtectedResourceMetadata, UnauthorizedChallengeConfig, UnauthorizedChallenge, ClerkDiscoveryUrls, McpResourceServerConfig, VerifyMcpAccessTokenResult, } from "./resource-server.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -38,5 +38,10 @@ export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js"
 // 0.11.0 — The acting principal by ID and the target checked by ID. A name is
 // a display label: it never selects a row and never authorises one.
 // 0.12.0 — assertOrgAdmin: the org-admin proof on a principal resolved by ID.
-export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, assertOrgAdmin, assertPrincipalListed, } from "./principal-by-id.js";
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, filterTargetsBelongingTo, assertOrgAdmin, assertPrincipalListed, assertRecipientAddressable, resolveCallerStanding, } from "./principal-by-id.js";
+// 0.15.0 — Resource-server primitives: RFC 9728 protected resource metadata,
+// the RFC 6750 401 challenge, issuer discovery URLs and MCP access-token
+// verification bound to this resource. Replaces the standalone resource-server
+// package; one identity layer.
+export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDiscoveryUrls, verifyMcpAccessToken, } from "./resource-server.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}

package/dist/principal-by-id.d.ts

@@ -211,6 +211,40 @@ export declare function resolveActingPrincipal(credential: ActingCredential | nu
  *     absent owner is refused.
  */
 export declare function assertTargetBelongsTo(principal: ActingPrincipal | null | undefined, target: TargetIds | null | undefined, lookups: OrgKindLookups, opts?: AssertTargetOptions): Promise<AssertTargetResult>;
+export type FilterTargetsResult<T> = {
+    ok: true;
+    rows: T[];
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Keeps the rows that belong to the principal, deciding by STORED ID only.
+ * The ID-keyed replacement for the name-keyed `scopeFilterList`.
+ *
+ * Each row is judged by `assertTargetBelongsTo` (never re-derived here), so
+ * the same organisation, operator-org, unstamped, `ownerOnly` and
+ * `fleetCrossOrg` rules apply.
+ *
+ *   - The principal is proved FIRST, before any row is read. An absent or
+ *     unresolved principal, or a failed organisation-kind lookup for it,
+ *     returns `{ ok: false, refusal }` naming the door, even for an empty
+ *     list: a refusal is never an `ok: true` with no rows.
+ *   - `fleetCrossOrg: true` from a principal that is not `kind: "fleet"` is a
+ *     misconfigured door and is refused `reserved-fleet-scope` up front, for
+ *     any list. Per row, `reserved-fleet-scope` therefore only means "this row
+ *     is in the operator scope" and the row is dropped.
+ *   - A resolved principal whose rows all belong elsewhere gets
+ *     `{ ok: true, rows: [] }`: an absence, distinguishable from a refusal.
+ *   - A row that does not belong (other organisation, operator-org row,
+ *     unstamped, owner mismatch) is dropped. A same-NAME row of another
+ *     organisation is dropped: no name field is read.
+ *   - A lookup failure on any row refuses the whole call. It is never a
+ *     silent drop and never a pass; any refusal reason not known to mean
+ *     "this row is not yours" refuses too.
+ *   - The order of the kept rows is the order of the input.
+ */
+export declare function filterTargetsBelongingTo<T extends TargetIds>(principal: ActingPrincipal | null | undefined, rows: readonly T[], lookups: OrgKindLookups, opts?: AssertTargetOptions): Promise<FilterTargetsResult<T>>;
 export type AssertOrgAdminOptions = {
     /**
      * The role values that count as organisation admin, exactly as the verified
@@ -290,5 +324,109 @@ export type AssertPrincipalListedResult = {
  * The fleet sentinel is out of scope here.
  */
 export declare function assertPrincipalListed(principal: ActingPrincipal | null | undefined, list: PrincipalIdList | null | undefined, opts?: AssertPrincipalListedOptions): AssertPrincipalListedResult;
+/** The recipient of a message, named by its stored agent ID and organisation ID. */
+export type RecipientIds = {
+    /** The recipient agent's stored ID. */
+    agentId: string;
+    /** The recipient agent's stored organisation ID. */
+    orgId: string;
+};
+/**
+ * The lookups `assertRecipientAddressable` reads: the organisation kind, and
+ * the stored roster of agent IDs of one organisation (a client's list of the
+ * fleet agents it may reach). `null`, a miss or a throw is an unresolvable
+ * roster and refuses.
+ */
+export type RecipientLookups = OrgKindLookups & {
+    rosterOf?: Lookup<[orgId: string], PrincipalIdList>;
+};
+export type AssertRecipientAddressableOptions = {
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+export type AssertRecipientAddressableResult = {
+    ok: true;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Decides whether a sender may address a recipient, across organisations
+ * included, by AGENT ID only. The sender must come from
+ * `resolveActingPrincipal`. No name is read anywhere; a name never matches.
+ *
+ * Admitted iff one of these holds:
+ *   (a) same organisation: the sender's `orgId` equals the recipient's;
+ *   (b) client to operator: the sender is in a client organisation, the
+ *       recipient is in the operator organisation, and the RECIPIENT's ID is
+ *       on the SENDER organisation's roster;
+ *   (c) operator to client: the sender is in the operator organisation, the
+ *       recipient is in a client organisation, and the SENDER's ID is on the
+ *       RECIPIENT organisation's roster.
+ *
+ * Everything else is refused with a typed `RBAC_DENIED` carrying the door
+ * (default `"assertRecipientAddressable"`): an absent sender or one without an
+ * ID (`credential-invalid`), a sender that is not `kind: "agent"`
+ * (`principal-not-an-agent`), an absent recipient or one without an agent ID
+ * or organisation (`target-unstamped`), client to client across organisations
+ * and an organisation kind that is neither operator nor client
+ * (`target-other-organisation`), a missing or throwing `orgKindOf` /
+ * `rosterOf` (`principal-lookup-failed`), an absent roster (`list-absent`), and
+ * a roster that is empty, stored under the wrong organisation or does not list
+ * the ID (the refusals of {@link assertPrincipalListed}, which is reused for
+ * that check).
+ */
+export declare function assertRecipientAddressable(sender: ActingPrincipal | null | undefined, recipient: RecipientIds | null | undefined, lookups: RecipientLookups, opts?: AssertRecipientAddressableOptions): Promise<AssertRecipientAddressableResult>;
+/**
+ * A verified session that carries a person but NO organisation (a signed-in
+ * user who has not joined one). `resolveActingPrincipal` cannot express this:
+ * a person credential requires `verifiedOrgId`, so a no-organisation session
+ * is refused there exactly as a garbled credential is. This kind exists so
+ * the consumer can say "verified, and no organisation" on purpose; an absent
+ * `verifiedOrgId` on a `person` credential stays a garbled credential.
+ */
+declare const preOrgCredentialSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"person-no-org">;
+    personId: z.ZodString;
+}, z.core.$strict>;
+export type CallerCredential = ActingCredential | z.input<typeof preOrgCredentialSchema>;
+export type AssertCallerStandingOptions = {
+    /** Role values that make a person an organisation admin; see `assertOrgAdmin`. */
+    adminRoles: readonly string[];
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+/**
+ * The four callers, said apart. `anonymous` means no caller could be
+ * resolved (no credential, a garbled one, a miss, an inactive row) and carries
+ * the typed refusal; it is never what a signed-in session without an
+ * organisation becomes.
+ */
+export type CallerStanding = {
+    standing: "anonymous";
+    refusal: IdentityRefusal;
+} | {
+    standing: "pre-org";
+    personId: string;
+} | {
+    standing: "member";
+    principal: ActingPrincipal;
+} | {
+    standing: "admin";
+    principal: ActingPrincipal;
+} | {
+    standing: "fleet";
+    principal: ActingPrincipal;
+};
+/**
+ * Derives a caller's STANDING from a verified credential. It adds one case to
+ * the existing primitives, the signed-in session with no organisation, and
+ * reuses them for everything else: `resolveActingPrincipal` decides who the
+ * caller is (and `fleet`), `assertOrgAdmin` decides `admin` against the
+ * principal's own organisation. Any other resolved principal (a person
+ * without the admin role, an agent, a non-operator service account) is a
+ * `member`; read `principal.kind` to tell them apart.
+ */
+export declare function resolveCallerStanding(credential: CallerCredential | null | undefined, lookups: PrincipalLookups, opts: AssertCallerStandingOptions): Promise<CallerStanding>;
 export {};
 //# sourceMappingURL=principal-by-id.d.ts.map

package/dist/principal-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;4BAiBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA8GvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAMD,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CAmCtB;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,CAAC,EAAE,4BAA4B,GAClC,2BAA2B,CAsC7B"}
+{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;4BAiBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA8GvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAMD,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,EAAE,CAAA;CAAE,GACvB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAU5C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,SAAS,SAAS,EAChE,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAkCjC;AAMD,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CAmCtB;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,CAAC,EAAE,4BAA4B,GAClC,2BAA2B,CAsC7B;AAMD,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG;IACzB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC1C,SAAS,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAC1C,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iCAAiC,GACvC,OAAO,CAAC,gCAAgC,CAAC,CAuD3C;AAMD;;;;;;;GAOG;AACH,QAAA,MAAM,sBAAsB;;;kBAG1B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3C,MAAM,MAAM,2BAA2B,GAAG;IACxC,kFAAkF;IAClF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACnD;IAAE,QAAQ,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAClD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACjD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,cAAc,CAAC,CAWzB"}

package/dist/principal-by-id.js

@@ -343,6 +343,64 @@ export async function assertTargetBelongsTo(principal, target, lookups, opts = {
     }
     return { ok: true };
 }
+/** Refusal reasons that say only "this ROW is not the principal's". */
+const ROW_NOT_OURS = new Set([
+    "target-unstamped",
+    "target-other-organisation",
+    "target-owner-mismatch",
+    "reserved-fleet-scope",
+]);
+/**
+ * Keeps the rows that belong to the principal, deciding by STORED ID only.
+ * The ID-keyed replacement for the name-keyed `scopeFilterList`.
+ *
+ * Each row is judged by `assertTargetBelongsTo` (never re-derived here), so
+ * the same organisation, operator-org, unstamped, `ownerOnly` and
+ * `fleetCrossOrg` rules apply.
+ *
+ *   - The principal is proved FIRST, before any row is read. An absent or
+ *     unresolved principal, or a failed organisation-kind lookup for it,
+ *     returns `{ ok: false, refusal }` naming the door, even for an empty
+ *     list: a refusal is never an `ok: true` with no rows.
+ *   - `fleetCrossOrg: true` from a principal that is not `kind: "fleet"` is a
+ *     misconfigured door and is refused `reserved-fleet-scope` up front, for
+ *     any list. Per row, `reserved-fleet-scope` therefore only means "this row
+ *     is in the operator scope" and the row is dropped.
+ *   - A resolved principal whose rows all belong elsewhere gets
+ *     `{ ok: true, rows: [] }`: an absence, distinguishable from a refusal.
+ *   - A row that does not belong (other organisation, operator-org row,
+ *     unstamped, owner mismatch) is dropped. A same-NAME row of another
+ *     organisation is dropped: no name field is read.
+ *   - A lookup failure on any row refuses the whole call. It is never a
+ *     silent drop and never a pass; any refusal reason not known to mean
+ *     "this row is not yours" refuses too.
+ *   - The order of the kept rows is the order of the input.
+ */
+export async function filterTargetsBelongingTo(principal, rows, lookups, opts = {}) {
+    const door = opts.door ?? "filterTargetsBelongingTo";
+    const doorOpts = { ...opts, door };
+    // A door asking for cross-organisation reach that the principal does not
+    // hold is a misconfigured door: refused, never an absence of rows.
+    if (opts.fleetCrossOrg === true && principal != null && principal.kind !== "fleet") {
+        return denied("reserved-fleet-scope", door, "Cross-organisation reach is held only by the operator organisation's service account.");
+    }
+    // Prove the principal on a target that is its own organisation's, owner
+    // check off: only a principal-level fault can refuse this.
+    const proof = await assertTargetBelongsTo(principal, { orgId: principal?.orgId }, lookups, { ...doorOpts, ownerOnly: false, fleetCrossOrg: false });
+    if (!proof.ok)
+        return proof;
+    const kept = [];
+    for (const row of rows) {
+        const verdict = await assertTargetBelongsTo(principal, row, lookups, doorOpts);
+        if (verdict.ok) {
+            kept.push(row);
+        }
+        else if (!ROW_NOT_OURS.has(verdict.refusal.reason)) {
+            return verdict;
+        }
+    }
+    return { ok: true, rows: kept };
+}
 /**
  * Admits a principal as ADMIN of the target organisation, deciding by ID only.
  * The principal must come from `resolveActingPrincipal`; the role is the
@@ -438,4 +496,119 @@ export function assertPrincipalListed(principal, list, opts) {
     }
     return { ok: true };
 }
+/**
+ * Decides whether a sender may address a recipient, across organisations
+ * included, by AGENT ID only. The sender must come from
+ * `resolveActingPrincipal`. No name is read anywhere; a name never matches.
+ *
+ * Admitted iff one of these holds:
+ *   (a) same organisation: the sender's `orgId` equals the recipient's;
+ *   (b) client to operator: the sender is in a client organisation, the
+ *       recipient is in the operator organisation, and the RECIPIENT's ID is
+ *       on the SENDER organisation's roster;
+ *   (c) operator to client: the sender is in the operator organisation, the
+ *       recipient is in a client organisation, and the SENDER's ID is on the
+ *       RECIPIENT organisation's roster.
+ *
+ * Everything else is refused with a typed `RBAC_DENIED` carrying the door
+ * (default `"assertRecipientAddressable"`): an absent sender or one without an
+ * ID (`credential-invalid`), a sender that is not `kind: "agent"`
+ * (`principal-not-an-agent`), an absent recipient or one without an agent ID
+ * or organisation (`target-unstamped`), client to client across organisations
+ * and an organisation kind that is neither operator nor client
+ * (`target-other-organisation`), a missing or throwing `orgKindOf` /
+ * `rosterOf` (`principal-lookup-failed`), an absent roster (`list-absent`), and
+ * a roster that is empty, stored under the wrong organisation or does not list
+ * the ID (the refusals of {@link assertPrincipalListed}, which is reused for
+ * that check).
+ */
+export async function assertRecipientAddressable(sender, recipient, lookups, opts) {
+    const door = opts?.door ?? "assertRecipientAddressable";
+    if (sender === null ||
+        typeof sender !== "object" ||
+        !nonEmpty(sender.principalId) ||
+        !nonEmpty(sender.orgId)) {
+        return denied("credential-invalid", door, "No resolved sender stands behind this call.");
+    }
+    if (sender.kind !== "agent") {
+        return denied("principal-not-an-agent", door, "Only an agent addresses a recipient; the sender is not an agent.");
+    }
+    if (recipient === null ||
+        typeof recipient !== "object" ||
+        !nonEmpty(recipient.agentId) ||
+        !nonEmpty(recipient.orgId)) {
+        return denied("target-unstamped", door, "The recipient carries no agent ID and organisation.");
+    }
+    if (recipient.orgId === sender.orgId)
+        return { ok: true };
+    const senderKind = await loadOrgKind(lookups, sender.orgId, door);
+    if (!senderKind.ok)
+        return senderKind;
+    const recipientKind = await loadOrgKind(lookups, recipient.orgId, door);
+    if (!recipientKind.ok)
+        return recipientKind;
+    let clientOrgId;
+    let listed;
+    if (senderKind.kind === "client" && recipientKind.kind === "operator") {
+        clientOrgId = sender.orgId;
+        listed = { principalId: recipient.agentId };
+    }
+    else if (senderKind.kind === "operator" && recipientKind.kind === "client") {
+        clientOrgId = recipient.orgId;
+        listed = { principalId: sender.principalId };
+    }
+    else {
+        return denied("target-other-organisation", door, "The recipient belongs to another organisation that this sender may not reach.");
+    }
+    const rosterOf = lookups?.rosterOf;
+    if (typeof rosterOf !== "function") {
+        return denied("principal-lookup-failed", door, "No lookup was supplied for the roster.");
+    }
+    let roster;
+    try {
+        roster = await rosterOf(clientOrgId);
+    }
+    catch {
+        return denied("principal-lookup-failed", door, "The roster could not be read, so none is resolved.");
+    }
+    return assertPrincipalListed({ ...listed, orgId: clientOrgId, kind: "agent" }, roster, { door });
+}
+// ---------------------------------------------------------------------------
+// resolveCallerStanding (0.14.0)
+// ---------------------------------------------------------------------------
+/**
+ * A verified session that carries a person but NO organisation (a signed-in
+ * user who has not joined one). `resolveActingPrincipal` cannot express this:
+ * a person credential requires `verifiedOrgId`, so a no-organisation session
+ * is refused there exactly as a garbled credential is. This kind exists so
+ * the consumer can say "verified, and no organisation" on purpose; an absent
+ * `verifiedOrgId` on a `person` credential stays a garbled credential.
+ */
+const preOrgCredentialSchema = z.strictObject({
+    kind: z.literal("person-no-org"),
+    personId: z.string().min(1),
+});
+/**
+ * Derives a caller's STANDING from a verified credential. It adds one case to
+ * the existing primitives, the signed-in session with no organisation, and
+ * reuses them for everything else: `resolveActingPrincipal` decides who the
+ * caller is (and `fleet`), `assertOrgAdmin` decides `admin` against the
+ * principal's own organisation. Any other resolved principal (a person
+ * without the admin role, an agent, a non-operator service account) is a
+ * `member`; read `principal.kind` to tell them apart.
+ */
+export async function resolveCallerStanding(credential, lookups, opts) {
+    const door = opts?.door ?? "resolveCallerStanding";
+    const preOrg = preOrgCredentialSchema.safeParse(credential);
+    if (preOrg.success)
+        return { standing: "pre-org", personId: preOrg.data.personId };
+    const resolved = await resolveActingPrincipal(credential, lookups, door);
+    if (!resolved.ok)
+        return { standing: "anonymous", refusal: resolved.refusal };
+    const { principal } = resolved;
+    if (principal.kind === "fleet")
+        return { standing: "fleet", principal };
+    const admin = assertOrgAdmin(principal, principal.orgId, { adminRoles: opts?.adminRoles, door });
+    return { standing: admin.ok ? "admin" : "member", principal };
+}
 //# sourceMappingURL=principal-by-id.js.map

package/dist/principal-by-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAyFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,eAAe;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,WAAsC,EACtC,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC5C,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6C,EAC7C,IAAwC,EACxC,IAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAyFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,eAAe;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAUD,uEAAuE;AACvE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IAChD,kBAAkB;IAClB,2BAA2B;IAC3B,uBAAuB;IACvB,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAA6C,EAC7C,IAAkB,EAClB,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,0BAA0B,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAExD,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnF,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,SAAS,EACT,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAC3B,OAAO,EACP,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CACxD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,WAAsC,EACtC,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC5C,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6C,EAC7C,IAAwC,EACxC,IAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA0C,EAC1C,SAA0C,EAC1C,OAAyB,EACzB,IAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,4BAA4B,CAAC;IACxD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,wBAAwB,EAAE,IAAI,EAAE,kEAAkE,CAAC,CAAC;IACpH,CAAC;IACD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IACtC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAE5C,IAAI,WAAmB,CAAC;IACxB,IAAI,MAA+B,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtE,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,MAAM,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7E,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9B,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,oDAAoD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,qBAAqB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AA0BH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAA+C,EAC/C,OAAyB,EACzB,IAAiC;IAEjC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,UAAiD,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IAC/B,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC"}

package/dist/resource-server.d.ts

@@ -0,0 +1,108 @@
+import type { ClerkJwks } from "./clerk-session.js";
+import type { VerifiedClerkSession } from "./clerk-session.js";
+import { type IdentityRefusal } from "./identity-refusal.js";
+export interface ProtectedResourceMetadataConfig {
+    /** Canonical identifier of this resource (the MCP server URL). Absolute URL, no fragment. */
+    resource: string;
+    /** Issuer URL(s) of the authorization server(s). At least one. */
+    authorizationServers: readonly string[];
+    /** Bearer transports accepted. Default `["header"]`. */
+    bearerMethodsSupported?: readonly string[];
+    /** Scopes this resource understands. */
+    scopesSupported?: readonly string[];
+    /** Human-readable label of the resource, emitted as RFC 9728 `resource_name`. A display string, never an identity: the package rule bans name-like inputs. */
+    resourceLabel?: string;
+    /** URL of developer documentation for the resource. */
+    resourceDocumentation?: string;
+}
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    bearer_methods_supported: string[];
+    scopes_supported?: string[];
+    resource_name?: string;
+    resource_documentation?: string;
+}
+/**
+ * Builds the RFC 9728 document served at `/.well-known/oauth-protected-resource`.
+ * A config that cannot produce a valid document throws: a document without a
+ * resource or an authorization server leaves a client unable to discover where
+ * to authenticate.
+ */
+export declare function buildProtectedResourceMetadata(config: ProtectedResourceMetadataConfig): ProtectedResourceMetadata;
+export interface UnauthorizedChallengeConfig {
+    /** Protection realm, for example `"mcp"`. */
+    realm: string;
+    /** Absolute URL of this resource's RFC 9728 metadata document. */
+    resourceMetadataUrl: string;
+    /** RFC 6750 `error`; omit when no token was presented. */
+    error?: "invalid_request" | "invalid_token" | "insufficient_scope";
+    /** RFC 6750 `error_description`. */
+    errorDescription?: string;
+    /** RFC 6750 `scope`: scopes needed, space separated. */
+    scope?: string;
+}
+export interface UnauthorizedChallenge {
+    status: 401;
+    headers: {
+        "WWW-Authenticate": string;
+    };
+}
+/**
+ * Builds the `401` envelope: status and a `WWW-Authenticate: Bearer` value that
+ * always carries `resource_metadata`, so a client can complete discovery. Every
+ * value is quoted and escaped; a value cannot inject a parameter or a header.
+ */
+export declare function unauthorizedChallenge(config: UnauthorizedChallengeConfig): UnauthorizedChallenge;
+export interface ClerkDiscoveryUrls {
+    discoveryUrl: string;
+    jwksUrl: string;
+}
+/**
+ * Derives the OIDC discovery and JWKS URLs of a Clerk issuer. The issuer must
+ * be an absolute `https` URL; anything else throws rather than producing a
+ * URL the client fails against later.
+ */
+export declare function deriveClerkDiscoveryUrls(issuer: string): ClerkDiscoveryUrls;
+export interface McpResourceServerConfig {
+    /** Realm of the challenge. */
+    realm: string;
+    /** Absolute URL of this resource's RFC 9728 metadata document. */
+    resourceMetadataUrl: string;
+    /** Exact `iss` the token must carry. */
+    issuer: string;
+    /** This resource's identifier: the token's `aud` must contain it. Required, never optional. */
+    audience: string;
+    /** The key set, or a function returning it (the consumer owns fetching and caching). */
+    jwks: ClerkJwks | (() => Promise<ClerkJwks>);
+    /** Clock tolerance in seconds for `exp` / `nbf`. Default 5. */
+    clockToleranceSeconds?: number;
+    /** The consumer's name for the entry point, carried in every refusal. */
+    door?: string;
+}
+export type VerifyMcpAccessTokenResult = {
+    ok: true;
+    session: VerifiedClerkSession;
+} | ({
+    ok: false;
+    refusal: IdentityRefusal;
+} & UnauthorizedChallenge) | {
+    ok: false;
+    refusal: IdentityRefusal;
+    status: 503;
+};
+/**
+ * Verifies the `Authorization` header of an MCP request against this resource.
+ *
+ * - no header: `401`, `invalid_request`, reason `bearer-missing`
+ * - not a non-empty `Bearer` credential: `401`, `invalid_request`, `bearer-malformed`
+ * - signature, issuer, audience, expiry or not-before wrong: `401`,
+ *   `invalid_token`, `token-invalid` (one answer, so the cause is not an oracle)
+ * - key set unreachable: `503`, no challenge, `jwks-unavailable` (an outage is
+ *   never reported as a bad credential)
+ *
+ * A missing issuer, or a missing or non-URL audience, in the config throws: the check is never skipped.
+ * `nowMs` is injectable for tests. The token never appears in a result.
+ */
+export declare function verifyMcpAccessToken(authorization: string | undefined, config: McpResourceServerConfig, nowMs?: number): Promise<VerifyMcpAccessTokenResult>;
+//# sourceMappingURL=resource-server.d.ts.map

package/dist/resource-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-server.d.ts","sourceRoot":"","sources":["../src/resource-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAgDtE,MAAM,WAAW,+BAA+B;IAC9C,6FAA6F;IAC7F,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,wDAAwD;IACxD,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,wCAAwC;IACxC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,8JAA8J;IAC9J,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,+BAA+B,GACtC,yBAAyB,CAuB3B;AAMD,MAAM,WAAW,2BAA2B;IAC1C,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,KAAK,CAAC,EAAE,iBAAiB,GAAG,eAAe,GAAG,oBAAoB,CAAC;IACnE,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,GAAG,CAAC;IACZ,OAAO,EAAE;QAAE,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AASD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,qBAAqB,CAchG;AAMD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAW3E;AAMD,MAAM,WAAW,uBAAuB;IACtC,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,IAAI,EAAE,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAC3C,CAAC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAAG,qBAAqB,CAAC,GACjE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,MAAM,EAAE,uBAAuB,EAC/B,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,0BAA0B,CAAC,CAuDrC"}

package/dist/resource-server.js

@@ -0,0 +1,171 @@
+import { verifyClerkSessionToken } from "./clerk-session.js";
+import { refusal } from "./identity-refusal.js";
+/**
+ * Resource-server primitives for an MCP server that is an OAuth 2.1 protected
+ * resource: the discovery document (RFC 9728), the `401` challenge (RFC 6750,
+ * RFC 9728 section 5.1), the issuer discovery URLs, and the verification of an
+ * inbound access token bound to this resource (RFC 8707 audience, RFC 9207
+ * issuer).
+ *
+ * Token verification is NOT a second verifier: it delegates signature, `iss`,
+ * `aud`, `exp` and `nbf` to `verifyClerkSessionToken` (RS256 only) and adds the
+ * `Authorization` header handling, the mandatory audience, and the HTTP
+ * envelope. Nothing here fetches a key set or calls the network.
+ */
+const DEFAULT_DOOR = "mcp-resource-server";
+function requireNonEmpty(fn, name, value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new Error(`cloud-identity: ${fn} requires a non-empty ${name}`);
+    }
+}
+function requireAbsoluteUrl(fn, name, value) {
+    requireNonEmpty(fn, name, value);
+    try {
+        return new URL(value);
+    }
+    catch {
+        throw new Error(`cloud-identity: ${fn}: ${name} must be an absolute URL`);
+    }
+}
+/**
+ * A resource identifier (RFC 8707 section 2, RFC 9728): an absolute URL with no
+ * fragment. The one validator for the metadata `resource` and the token audience.
+ */
+function requireResourceIdentifier(fn, name, value) {
+    const url = requireAbsoluteUrl(fn, name, value);
+    if (url.hash !== "" || value.includes("#")) {
+        throw new Error(`cloud-identity: ${fn}: ${name} must not carry a fragment`);
+    }
+    return url;
+}
+/**
+ * Builds the RFC 9728 document served at `/.well-known/oauth-protected-resource`.
+ * A config that cannot produce a valid document throws: a document without a
+ * resource or an authorization server leaves a client unable to discover where
+ * to authenticate.
+ */
+export function buildProtectedResourceMetadata(config) {
+    const fn = "buildProtectedResourceMetadata";
+    requireResourceIdentifier(fn, "resource", config.resource);
+    if (!Array.isArray(config.authorizationServers) || config.authorizationServers.length === 0) {
+        throw new Error(`cloud-identity: ${fn} requires at least one authorizationServer`);
+    }
+    for (const as of config.authorizationServers) {
+        requireAbsoluteUrl(fn, "authorizationServer", as);
+    }
+    const methods = config.bearerMethodsSupported ?? ["header"];
+    if (methods.length === 0) {
+        throw new Error(`cloud-identity: ${fn}: bearerMethodsSupported must not be empty`);
+    }
+    const doc = {
+        resource: config.resource,
+        authorization_servers: [...config.authorizationServers],
+        bearer_methods_supported: [...methods],
+    };
+    if (config.scopesSupported)
+        doc.scopes_supported = [...config.scopesSupported];
+    if (config.resourceLabel)
+        doc.resource_name = config.resourceLabel;
+    if (config.resourceDocumentation)
+        doc.resource_documentation = config.resourceDocumentation;
+    return doc;
+}
+function quoted(fn, name, value) {
+    if (/[\r\n]/.test(value)) {
+        throw new Error(`cloud-identity: ${fn}: ${name} must not contain a line break`);
+    }
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+/**
+ * Builds the `401` envelope: status and a `WWW-Authenticate: Bearer` value that
+ * always carries `resource_metadata`, so a client can complete discovery. Every
+ * value is quoted and escaped; a value cannot inject a parameter or a header.
+ */
+export function unauthorizedChallenge(config) {
+    const fn = "unauthorizedChallenge";
+    requireNonEmpty(fn, "realm", config.realm);
+    requireAbsoluteUrl(fn, "resourceMetadataUrl", config.resourceMetadataUrl);
+    const parts = [
+        `Bearer realm=${quoted(fn, "realm", config.realm)}`,
+        `resource_metadata=${quoted(fn, "resourceMetadataUrl", config.resourceMetadataUrl)}`,
+    ];
+    if (config.error)
+        parts.push(`error=${quoted(fn, "error", config.error)}`);
+    if (config.errorDescription) {
+        parts.push(`error_description=${quoted(fn, "errorDescription", config.errorDescription)}`);
+    }
+    if (config.scope)
+        parts.push(`scope=${quoted(fn, "scope", config.scope)}`);
+    return { status: 401, headers: { "WWW-Authenticate": parts.join(", ") } };
+}
+/**
+ * Derives the OIDC discovery and JWKS URLs of a Clerk issuer. The issuer must
+ * be an absolute `https` URL; anything else throws rather than producing a
+ * URL the client fails against later.
+ */
+export function deriveClerkDiscoveryUrls(issuer) {
+    const fn = "deriveClerkDiscoveryUrls";
+    const url = requireAbsoluteUrl(fn, "issuer", issuer);
+    if (url.protocol !== "https:") {
+        throw new Error(`cloud-identity: ${fn}: issuer must use https`);
+    }
+    const base = issuer.endsWith("/") ? issuer.slice(0, -1) : issuer;
+    return {
+        discoveryUrl: `${base}/.well-known/openid-configuration`,
+        jwksUrl: `${base}/.well-known/jwks.json`,
+    };
+}
+/**
+ * Verifies the `Authorization` header of an MCP request against this resource.
+ *
+ * - no header: `401`, `invalid_request`, reason `bearer-missing`
+ * - not a non-empty `Bearer` credential: `401`, `invalid_request`, `bearer-malformed`
+ * - signature, issuer, audience, expiry or not-before wrong: `401`,
+ *   `invalid_token`, `token-invalid` (one answer, so the cause is not an oracle)
+ * - key set unreachable: `503`, no challenge, `jwks-unavailable` (an outage is
+ *   never reported as a bad credential)
+ *
+ * A missing issuer, or a missing or non-URL audience, in the config throws: the check is never skipped.
+ * `nowMs` is injectable for tests. The token never appears in a result.
+ */
+export async function verifyMcpAccessToken(authorization, config, nowMs = Date.now()) {
+    const fn = "verifyMcpAccessToken";
+    requireNonEmpty(fn, "issuer", config.issuer);
+    requireResourceIdentifier(fn, "audience", config.audience);
+    requireNonEmpty(fn, "realm", config.realm);
+    requireAbsoluteUrl(fn, "resourceMetadataUrl", config.resourceMetadataUrl);
+    const door = config.door ?? DEFAULT_DOOR;
+    const deny = (reason, error, detail) => ({
+        ok: false,
+        refusal: refusal("CREDENTIAL_REFUSED", reason, door, detail),
+        ...unauthorizedChallenge({
+            realm: config.realm,
+            resourceMetadataUrl: config.resourceMetadataUrl,
+            error,
+        }),
+    });
+    if (authorization === undefined || authorization === null || authorization === "") {
+        return deny("bearer-missing", "invalid_request", "No Authorization header was presented.");
+    }
+    const match = /^bearer[ \t]+(\S+)[ \t]*$/i.exec(authorization);
+    if (!match || !match[1]) {
+        return deny("bearer-malformed", "invalid_request", "The Authorization header is not a Bearer credential.");
+    }
+    const verified = await verifyClerkSessionToken(match[1], {
+        issuer: config.issuer,
+        jwks: config.jwks,
+        audience: config.audience,
+        clockToleranceSeconds: config.clockToleranceSeconds,
+    }, nowMs);
+    if (verified.ok)
+        return { ok: true, session: verified.session };
+    if (verified.refusal.reason === "jwks-unavailable") {
+        return {
+            ok: false,
+            status: 503,
+            refusal: refusal("CREDENTIAL_REFUSED", "jwks-unavailable", door, "The signing keys could not be retrieved; retry later."),
+        };
+    }
+    return deny("token-invalid", "invalid_token", "The access token was refused.");
+}
+//# sourceMappingURL=resource-server.js.map

package/dist/resource-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-server.js","sourceRoot":"","sources":["../src/resource-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAE,OAAO,EAAwB,MAAM,uBAAuB,CAAC;AAEtE;;;;;;;;;;;GAWG;AAEH,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C,SAAS,eAAe,CAAC,EAAU,EAAE,IAAY,EAAE,KAAc;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU,EAAE,IAAY,EAAE,KAAc;IAClE,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,KAAK,IAAI,0BAA0B,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,EAAU,EAAE,IAAY,EAAE,KAAc;IACzE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAK,KAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,KAAK,IAAI,4BAA4B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA8BD;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAuC;IAEvC,MAAM,EAAE,GAAG,gCAAgC,CAAC;IAC5C,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC7C,kBAAkB,CAAC,EAAE,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,GAAG,GAA8B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,qBAAqB,EAAE,CAAC,GAAG,MAAM,CAAC,oBAAoB,CAAC;QACvD,wBAAwB,EAAE,CAAC,GAAG,OAAO,CAAC;KACvC,CAAC;IACF,IAAI,MAAM,CAAC,eAAe;QAAE,GAAG,CAAC,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,aAAa;QAAE,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IACnE,IAAI,MAAM,CAAC,qBAAqB;QAAE,GAAG,CAAC,sBAAsB,GAAG,MAAM,CAAC,qBAAqB,CAAC;IAC5F,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD,SAAS,MAAM,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;IACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,KAAK,IAAI,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAmC;IACvE,MAAM,EAAE,GAAG,uBAAuB,CAAC;IACnC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,gBAAgB,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QACnD,qBAAqB,MAAM,CAAC,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE;KACrF,CAAC;IACF,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAC5E,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,EAAE,GAAG,0BAA0B,CAAC;IACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,OAAO;QACL,YAAY,EAAE,GAAG,IAAI,mCAAmC;QACxD,OAAO,EAAE,GAAG,IAAI,wBAAwB;KACzC,CAAC;AACJ,CAAC;AA4BD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAiC,EACjC,MAA+B,EAC/B,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,EAAE,GAAG,sBAAsB,CAAC;IAClC,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,kBAAkB,CAAC,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;IAEzC,MAAM,IAAI,GAAG,CACX,MAA+D,EAC/D,KAA0C,EAC1C,MAAc,EACc,EAAE,CAAC,CAAC;QAChC,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;QAC5D,GAAG,qBAAqB,CAAC;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,KAAK;SACN,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,sDAAsD,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,CAAC,CAAC,EACR;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,EACD,KAAK,CACN,CAAC;IACF,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAEhE,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,OAAO,CACd,oBAAoB,EACpB,kBAAkB,EAClB,IAAI,EACJ,uDAAuD,CACxD;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,eAAe,EAAE,eAAe,EAAE,+BAA+B,CAAC,CAAC;AACjF,CAAC"}

package/dist/scope-filter.d.ts

@@ -123,9 +123,10 @@ export type GrantFieldDeclaration = readonly string[];
  * @deprecated Since 0.11.0. A `createdBy` name matched against
  * `fromAllowList` selects the row, which backend standard R-53 clause 1
  * forbids: a name never selects or authorises a row. Use
- * `resolveActingPrincipal` and `assertTargetBelongsTo`, which compare stored
- * IDs. Behaviour unchanged; it stays exported until consumers migrate off it,
- * and is removed in a major release.
+ * `resolveActingPrincipal` and `assertTargetBelongsTo` (one row) or
+ * `filterTargetsBelongingTo` (a list), which compare stored IDs. Behaviour
+ * unchanged; it stays exported until consumers migrate off it, and is removed
+ * in a major release.
  */
 export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T, grantFields?: GrantFieldDeclaration): boolean;
 /**
@@ -136,9 +137,10 @@ export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: O
  *
  * @deprecated Since 0.11.0. It selects rows through `passesScopeFilter`,
  * where a `createdBy` name selects the row, which backend standard R-53
- * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
- * which compare stored IDs. Behaviour unchanged; it stays exported until
- * consumers migrate off it, and is removed in a major release.
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`
+ * (one row) or `filterTargetsBelongingTo` (a list), which compare stored IDs.
+ * Behaviour unchanged; it stays exported until consumers migrate off it, and
+ * is removed in a major release.
  */
 export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[], grantFields?: GrantFieldDeclaration): T[];
 /**
@@ -151,9 +153,10 @@ export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAu
  *
  * @deprecated Since 0.11.0. It admits the row through `passesScopeFilter`,
  * where a `createdBy` name selects the row, which backend standard R-53
- * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
- * which compare stored IDs. Behaviour unchanged; it stays exported until
- * consumers migrate off it, and is removed in a major release.
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`
+ * (one row) or `filterTargetsBelongingTo` (a list), which compare stored IDs.
+ * Behaviour unchanged; it stays exported until consumers migrate off it, and
+ * is removed in a major release.
  */
 export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined, grantFields?: GrantFieldDeclaration): T | null;
 /**

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -129,9 +129,10 @@ function grantFieldMatches(value, fromAllowList) {
  * @deprecated Since 0.11.0. A `createdBy` name matched against
  * `fromAllowList` selects the row, which backend standard R-53 clause 1
  * forbids: a name never selects or authorises a row. Use
- * `resolveActingPrincipal` and `assertTargetBelongsTo`, which compare stored
- * IDs. Behaviour unchanged; it stays exported until consumers migrate off it,
- * and is removed in a major release.
+ * `resolveActingPrincipal` and `assertTargetBelongsTo` (one row) or
+ * `filterTargetsBelongingTo` (a list), which compare stored IDs. Behaviour
+ * unchanged; it stays exported until consumers migrate off it, and is removed
+ * in a major release.
  */
 export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
@@ -161,9 +162,10 @@ export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS)
  *
  * @deprecated Since 0.11.0. It selects rows through `passesScopeFilter`,
  * where a `createdBy` name selects the row, which backend standard R-53
- * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
- * which compare stored IDs. Behaviour unchanged; it stays exported until
- * consumers migrate off it, and is removed in a major release.
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`
+ * (one row) or `filterTargetsBelongingTo` (a list), which compare stored IDs.
+ * Behaviour unchanged; it stays exported until consumers migrate off it, and
+ * is removed in a major release.
  */
 export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
@@ -179,9 +181,10 @@ export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
  *
  * @deprecated Since 0.11.0. It admits the row through `passesScopeFilter`,
  * where a `createdBy` name selects the row, which backend standard R-53
- * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`,
- * which compare stored IDs. Behaviour unchanged; it stays exported until
- * consumers migrate off it, and is removed in a major release.
+ * clause 1 forbids. Use `resolveActingPrincipal` and `assertTargetBelongsTo`
+ * (one row) or `filterTargetsBelongingTo` (a list), which compare stored IDs.
+ * Behaviour unchanged; it stays exported until consumers migrate off it, and
+ * is removed in a major release.
  */
 export function scopeFilterGet(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IACtE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACpE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IACtE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACpE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/types.d.ts

@@ -28,6 +28,13 @@ export type FromAllowListEntry = string;
  * - `scope`: optional scope profile name. `"master"` triggers wildcard pass.
  */
 export type OAuthCtx = {
+    /**
+     * Names a non-master caller may see rows of (`row.createdBy`).
+     *
+     * @deprecated Since 0.14.0. A list of NAMES selects rows, and a name must
+     * never select or authorise one. Use `filterTargetsBelongingTo`, which
+     * compares stored IDs. Behaviour unchanged; removed when consumers migrate.
+     */
     fromAllowList: FromAllowListEntry[];
     namespaceReadPrefixes: NamespacePrefix[];
     namespaceWritePrefixes: NamespacePrefix[];

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAExC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,qBAAqB,EAAE,eAAe,EAAE,CAAC;IACzC,sBAAsB,EAAE,eAAe,EAAE,CAAC;IAC1C,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAA;CAAE,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAExC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;;;OAMG;IACH,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,qBAAqB,EAAE,eAAe,EAAE,CAAC;IACzC,sBAAsB,EAAE,eAAe,EAAE,CAAC;IAC1C,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAA;CAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -81,6 +81,10 @@
     "./principal-by-id": {
       "types": "./dist/principal-by-id.d.ts",
       "import": "./dist/principal-by-id.js"
+    },
+    "./resource-server": {
+      "types": "./dist/resource-server.d.ts",
+      "import": "./dist/resource-server.js"
     }
   },
   "files": [