@vantageos/cloud-identity 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -12,6 +12,43 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
   `buildProtectedResourceMetadata`. A whitespace-only, non-URL or
   fragment-bearing audience throws the config error instead of being accepted.
 
+## [0.16.0]
+
+**Additive: an organisation is its permanent ID (`./org-by-id`).** A consumer
+used to keep its own copy of "which org is this credential", "are these two
+rows one org", "which org is the operator" and "what is this slug's org ID".
+Those decisions are now the package's, keyed on IDs, refusing by default. No
+existing function changes behaviour for an existing input.
+
+### Added
+
+- `resolveOrgFromClaim(claims, lookups, { door? })`: a verified
+  credential's `org_id` claim to the org's mapping row (roster, scopes, kind).
+- `sameOrg`, `isFleetStamp`, `sameTenantStamp`: comparisons over `OrgRef`
+  (`{ id?, label? }`). Unstamped is never a match.
+- `findOperatorOrg(lookups, { cap? })`: `one | none | many | overCap | unreadable`.
+- `resolveOrgIdForLabelBackfillOnly(label, lookups)`: label to permanent ID,
+  or a typed `ORG_ID_ABSENT` absence. For the one-off backfill only; it must
+  never be called on a request path, and the name says so. (Developed as
+  `resolveOrgIdForLabel`; that name was never published.)
+- `orgMappingRowSchema` and the types `OrgRef`, `OrgMappingRow`,
+  `OrgMappingLookups`, `ResolvedOrg`, `ResolveOrgFromClaimOptions`,
+  `ResolveOrgFromClaimResult`, `OrgIdAbsence`, `OrgIdAbsenceReason`,
+  `OrgIdResolution`, `OperatorOrgLookups`, `FindOperatorOrgOptions`,
+  `OperatorOrgResult`.
+- New `IdentityRefusalReason` values: `org-mapping-lookup-failed`,
+  `org-mapping-not-found`, `org-mapping-record-invalid`.
+
+### No label resolution
+
+An organisation is never resolved from its label on a request path, and no
+option turns that on. A transitional `labelFallback` option was developed and
+removed before publication: `sameOrg`, `isFleetStamp`, `sameTenantStamp` and
+`resolveOrgFromClaim` compare and select by org ID only, a label-only input
+refuses, and the `org-id-contradicts-label` reason and the `source` field of
+`ResolvedOrg` went with it. The label adapter is read only by
+`resolveOrgIdForLabelBackfillOnly`.
+
 ## [0.15.0]
 
 **Additive: resource-server primitives (`./resource-server`).** No existing

package/README.md

@@ -895,6 +895,64 @@ if (!r.ok) return respond(r.status, "headers" in r ? r.headers : {});
   the consumer fetches and caches the key set; no scope check is made on the
   token (read `r.session.claims`).
 
+## An organisation is its permanent ID (0.16.0)
+
+A label (the slug an org can be renamed to) is display text. These functions
+decide "which organisation" from the permanent org ID, with the store supplied
+as adapters, and refuse by default. All are in `./org-by-id` and the root.
+
+**`resolveOrgFromClaim(claims, lookups, opts)`** takes the claim record of a
+VERIFIED credential (never a request field) and returns
+`{ ok: true, org: { id, label, allowedOrchestrators, scopes, orgKind } }`
+or a typed `RBAC_DENIED` refusal. The `org_id` claim (also read from
+`organizationId` and `orgId`, only when shaped like a Clerk org ID) selects the
+mapping row through `lookups.orgById`; a stale label in the token is ignored,
+so a rename never changes who the caller is. Refused: no claim, an ID no
+mapping holds, an inactive org, a row that does not repeat the ID asked for, a
+malformed row, a missing or throwing adapter.
+
+```ts
+const r = await resolveOrgFromClaim(identity, {
+  orgById: (id) => db.mappingByClerkOrgId(id),
+}, { door: "tasks:list" });
+if (!r.ok) throw new IdentityRefusalError(r.refusal);
+```
+
+**`sameOrg(a, b, opts)`**, **`isFleetStamp(stamp, operator, opts)`** and
+**`sameTenantStamp(a, b, operator, opts)`** compare `OrgRef` values
+(`{ id?, label? }`). Two IDs are equal or they are not; unstamped is never
+a match; `isFleetStamp` is true for an unstamped stamp or the operator's, and
+`sameTenantStamp` is true for the same org or when both are the fleet's.
+
+**`findOperatorOrg(lookups, opts)`** finds the operator organisation from
+`lookups.activeOrganisations(limit)`: `one`, `none`, `many`, `overCap`
+(`cap` defaults to 1000, the read is `cap + 1`) or `unreadable`. Only `one` is
+an operator; pass `undefined` as `operator` otherwise and only unstamped rows
+are the fleet's.
+
+**`resolveOrgIdForLabelBackfillOnly(label, lookups)`** derives the permanent
+ID of the org a label names, for a ONE-OFF BACKFILL that stamps rows written
+before IDs existed. It must never be called on a request path: a request
+decides its organisation from the verified `org_id` claim
+(`resolveOrgFromClaim`), and a miss there is a refusal, never a retry by label.
+It returns `{ present: true, orgId }` or a typed `ORG_ID_ABSENT` absence
+(`no-label`, `lookup-failed`, `not-mapped`, `record-invalid`, `id-not-filled`).
+It never invents an ID.
+
+**`orgMappingRowSchema`** is the Zod shape of a mapping row an adapter returns
+(`id`, `label`, `active`, `allowedOrchestrators`, `scopes`, `orgKind`).
+
+Types: `OrgRef`, `OrgMappingRow`, `OrgMappingLookups`,
+`ResolvedOrg`, `ResolveOrgFromClaimOptions`, `ResolveOrgFromClaimResult`,
+`OrgIdAbsence`, `OrgIdAbsenceReason`, `OrgIdResolution`, `OperatorOrgLookups`,
+`FindOperatorOrgOptions`, `OperatorOrgResult`.
+
+**No label resolution.** No function above compares or selects by label, and
+no option turns that on: a reference or credential without an org ID names no
+organisation and is refused. A store that has not filled every ID is filled
+once, with `resolveOrgIdForLabelBackfillOnly`, before the consumer relies on
+these functions.
+
 ## What this package does not do
 
 Worth reading before you rely on it.

package/dist/identity-refusal.d.ts

@@ -13,7 +13,7 @@
  * closed vocabulary for the person path.
  */
 export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
-export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed" | "bearer-missing" | "bearer-malformed" | "token-invalid" | "jwks-unavailable";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed" | "bearer-missing" | "bearer-malformed" | "token-invalid" | "jwks-unavailable" | "org-mapping-lookup-failed" | "org-mapping-not-found" | "org-mapping-record-invalid";
 export type IdentityRefusal = {
     code: IdentityRefusalCode;
     reason: IdentityRefusalReason;

package/dist/identity-refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,GAEtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,GAEtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAElB,2BAA2B,GAC3B,uBAAuB,GACvB,4BAA4B,CAAC;AAEjC,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAgEH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoEH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -41,4 +41,6 @@ export { actingCredentialSchema, principalRowSchema, organisationRowSchema, reso
 export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, FilterTargetsResult, AssertOrgAdminOptions, AssertOrgAdminResult, PrincipalIdList, AssertPrincipalListedOptions, AssertPrincipalListedResult, RecipientIds, RecipientLookups, AssertRecipientAddressableOptions, AssertRecipientAddressableResult, CallerCredential, AssertCallerStandingOptions, CallerStanding, } from "./principal-by-id.js";
 export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDiscoveryUrls, verifyMcpAccessToken, } from "./resource-server.js";
 export type { ProtectedResourceMetadataConfig, ProtectedResourceMetadata, UnauthorizedChallengeConfig, UnauthorizedChallenge, ClerkDiscoveryUrls, McpResourceServerConfig, VerifyMcpAccessTokenResult, } from "./resource-server.js";
+export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
+export type { OrgRef, OrgMappingRow, OrgMappingLookups, ResolvedOrg, ResolveOrgFromClaimOptions, ResolveOrgFromClaimResult, OrgIdAbsence, OrgIdAbsenceReason, OrgIdResolution, OperatorOrgLookups, FindOperatorOrgOptions, OperatorOrgResult, } from "./org-by-id.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,0BAA0B,EAC1B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -44,4 +44,10 @@ export { actingCredentialSchema, principalRowSchema, organisationRowSchema, reso
 // verification bound to this resource. Replaces the standalone resource-server
 // package; one identity layer.
 export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDiscoveryUrls, verifyMcpAccessToken, } from "./resource-server.js";
+// 0.16.0 — An organisation is its permanent ID: the credential's org_id claim to
+// the org's mapping row, the ID comparisons and the operator org. Labels
+// (slugs) never select or prove an org; no option turns that on. The
+// label-to-ID derivation is exported only as
+// `resolveOrgIdForLabelBackfillOnly`, for a one-off backfill.
+export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,iFAAiF;AACjF,yEAAyE;AACzE,qEAAqE;AACrE,6CAA6C;AAC7C,8DAA8D;AAC9D,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC"}

package/dist/org-by-id.d.ts

@@ -0,0 +1,170 @@
+/**
+ * @vantageos/cloud-identity — an organisation is its permanent ID.
+ *
+ * Everything here decides "which organisation" from the permanent org ID a
+ * verified credential or a stored row carries. A label (the slug an org can be
+ * renamed to) is display text: it never selects an org and never proves two
+ * references are one org.
+ *
+ * Refusal, always. There is no option that compares or resolves by label: a
+ * reference or credential without an org ID names no organisation, and a
+ * mapping is reached only by an ID.
+ *
+ * The store is the consumer's: every read is an adapter it supplies, called
+ * with the key as presented, byte for byte. A missing, throwing or malformed
+ * adapter refuses. An adapter's error text is never surfaced.
+ */
+import { z } from "zod";
+import { type IdentityRefusal } from "./identity-refusal.js";
+import type { OrgKind } from "./principal-by-id.js";
+/**
+ * An organisation as a row or a caller names it: the permanent ID and the
+ * label. Either may be absent. Both absent is "unstamped", which names no
+ * organisation.
+ */
+export type OrgRef = {
+    /** The permanent org ID. */
+    id?: string | null;
+    /** The renamable label (slug). Display text; never compared. */
+    label?: string | null;
+};
+/**
+ * Do two references name the same organisation? Only by ID, when both carry
+ * one. A label never matches, and absence is not a match: two unstamped
+ * references are NOT the same organisation here.
+ */
+export declare function sameOrg(a: OrgRef | null | undefined, b: OrgRef | null | undefined): boolean;
+/**
+ * Is a stamp the fleet's: unstamped, or the operator organisation's? The
+ * operator is read from stored data by the caller (see `findOperatorOrg`);
+ * pass `undefined` when there is not exactly one, and only an unstamped stamp
+ * is the fleet's. An empty-string stamp is neither unstamped nor the operator.
+ */
+export declare function isFleetStamp(stamp: OrgRef | null | undefined, operator: OrgRef | null | undefined): boolean;
+/**
+ * Do two stamps name the same tenant: the same organisation, or both the
+ * fleet's? Two IDs that differ are two tenants even under one label.
+ */
+export declare function sameTenantStamp(a: OrgRef | null | undefined, b: OrgRef | null | undefined, operator: OrgRef | null | undefined): boolean;
+/**
+ * The consumer's organisation mapping row, as an adapter returns it. `id` is
+ * the permanent org ID and may be absent while the store is being filled;
+ * `label` is the slug. Extra fields are allowed and ignored.
+ */
+export declare const orgMappingRowSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    label: z.ZodString;
+    active: z.ZodBoolean;
+    allowedOrchestrators: z.ZodArray<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString>;
+    orgKind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type OrgMappingRow = z.input<typeof orgMappingRowSchema>;
+type Lookup<A extends unknown[], R> = (...args: A) => Promise<R | null | undefined> | R | null | undefined;
+/** Indexed reads of the mapping store. Only the lookups of the path taken are called. */
+export type OrgMappingLookups = {
+    /** The mapping row whose permanent ID is exactly the one asked for. */
+    orgById?: Lookup<[orgId: string], OrgMappingRow>;
+    /** The mapping row whose label is exactly the one asked for. Read only by `resolveOrgIdForLabelBackfillOnly`. */
+    orgByLabel?: Lookup<[label: string], OrgMappingRow>;
+};
+/** The org a credential resolves to, with the roster and scopes of its mapping row. */
+export type ResolvedOrg = {
+    /** The permanent org ID: the one the credential carried and the mapping holds. */
+    id: string;
+    /** The org's CURRENT label. Display text. */
+    label: string;
+    allowedOrchestrators: string[];
+    scopes: string[];
+    orgKind: OrgKind | null;
+};
+export type ResolveOrgFromClaimOptions = {
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+export type ResolveOrgFromClaimResult = {
+    ok: true;
+    org: ResolvedOrg;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Resolves a VERIFIED credential's claims to the stored mapping row of its
+ * organisation, or refuses. The claim's org ID selects the row; nothing the
+ * request supplies does.
+ *
+ * A credential carrying no usable org ID is refused
+ * (`no-verified-organisation`) and an ID no mapping holds is refused
+ * (`org-mapping-not-found`). A label claim (a slug) is never read: it neither
+ * selects a mapping nor rescues a missing ID.
+ *
+ * `claims` is the verified identity's own claim record, never a request field.
+ */
+export declare function resolveOrgFromClaim(claims: Record<string, unknown> | null | undefined, lookups: OrgMappingLookups | null | undefined, options?: ResolveOrgFromClaimOptions): Promise<ResolveOrgFromClaimResult>;
+export type OrgIdAbsenceReason = "no-label" | "lookup-failed" | "not-mapped" | "record-invalid" | "id-not-filled";
+/** The typed absence of an ID. A non-empty object: never mistaken for an ID or for nothing. */
+export type OrgIdAbsence = {
+    code: "ORG_ID_ABSENT";
+    reason: OrgIdAbsenceReason;
+};
+export type OrgIdResolution = {
+    present: true;
+    orgId: string;
+} | {
+    present: false;
+    absence: OrgIdAbsence;
+};
+/**
+ * BACKFILL ONLY. Derives the permanent org ID of the organisation a label
+ * names, from the consumer's stored mapping, so a one-off migration can stamp
+ * rows written before IDs existed.
+ *
+ * MUST NEVER be called on a request path. A request decides its organisation
+ * from the verified credential's `org_id` claim (`resolveOrgFromClaim`); a miss
+ * there is a refusal, never a retry by label. A label is renamable display
+ * text: resolving an org from it on a request is the name-to-ID defect this
+ * module exists to close, and the export name carries that restriction so a
+ * reviewer sees it at every call site.
+ *
+ * A derivation and not an authorization: it answers for an inactive mapping
+ * too. It never invents an ID: a mapping with none filled is `id-not-filled`.
+ */
+export declare function resolveOrgIdForLabelBackfillOnly(label: string | null | undefined, lookups: OrgMappingLookups | null | undefined): Promise<OrgIdResolution>;
+export type OperatorOrgLookups = {
+    /**
+     * The ACTIVE organisation mapping rows, at most `limit` of them. Called with
+     * `cap + 1` so a filled read is recognisable as over the cap.
+     */
+    activeOrganisations?: (limit: number) => unknown;
+};
+export type FindOperatorOrgOptions = {
+    /** Read bound. Default 1000. A read over the cap is never decided from. */
+    cap?: number;
+};
+export type OperatorOrgResult = {
+    kind: "one";
+    org: {
+        id: string | undefined;
+        label: string;
+    };
+} | {
+    kind: "none";
+} | {
+    kind: "many";
+    count: number;
+} | {
+    kind: "overCap";
+} | {
+    kind: "unreadable";
+};
+/**
+ * Finds the operator organisation (the fleet) from stored mapping rows: the
+ * single ACTIVE row whose kind is exactly `"operator"`. None, several, an
+ * over-cap read, an unreadable store and a malformed row are each a typed
+ * non-answer, so the caller can only treat the fleet as "no single operator"
+ * (fail closed) and never widen from a guess.
+ */
+export declare function findOperatorOrg(lookups: OperatorOrgLookups | null | undefined, options?: FindOperatorOrgOptions): Promise<OperatorOrgResult>;
+export {};
+//# sourceMappingURL=org-by-id.d.ts.map

package/dist/org-by-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-by-id.d.ts","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMpD;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,4BAA4B;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAmBF;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC3B,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjD,iHAAiH;IACjH,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;CACrD,CAAC;AA2BF,uFAAuF;AACvF,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAgB5C;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC7C,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,CAAC,CA6CpC;AAMD,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,eAAe,CAAC;AAEpB,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEjF,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC5C,OAAO,CAAC,eAAe,CAAC,CAa1B;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAI3B;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}

package/dist/org-by-id.js

@@ -0,0 +1,232 @@
+/**
+ * @vantageos/cloud-identity — an organisation is its permanent ID.
+ *
+ * Everything here decides "which organisation" from the permanent org ID a
+ * verified credential or a stored row carries. A label (the slug an org can be
+ * renamed to) is display text: it never selects an org and never proves two
+ * references are one org.
+ *
+ * Refusal, always. There is no option that compares or resolves by label: a
+ * reference or credential without an org ID names no organisation, and a
+ * mapping is reached only by an ID.
+ *
+ * The store is the consumer's: every read is an adapter it supplies, called
+ * with the key as presented, byte for byte. A missing, throwing or malformed
+ * adapter refuses. An adapter's error text is never surfaced.
+ */
+import { z } from "zod";
+import { refusal } from "./identity-refusal.js";
+import { resolveTenantIdOrAbsent } from "./org-guard.js";
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function isUnstamped(ref) {
+    return (ref === null ||
+        ref === undefined ||
+        ((ref.id === null || ref.id === undefined) &&
+            (ref.label === null || ref.label === undefined)));
+}
+// ---------------------------------------------------------------------------
+// sameOrg / isFleetStamp / sameTenantStamp
+// ---------------------------------------------------------------------------
+/**
+ * Do two references name the same organisation? Only by ID, when both carry
+ * one. A label never matches, and absence is not a match: two unstamped
+ * references are NOT the same organisation here.
+ */
+export function sameOrg(a, b) {
+    if (!a || !b)
+        return false;
+    return nonEmpty(a.id) && nonEmpty(b.id) && a.id === b.id;
+}
+/**
+ * Is a stamp the fleet's: unstamped, or the operator organisation's? The
+ * operator is read from stored data by the caller (see `findOperatorOrg`);
+ * pass `undefined` when there is not exactly one, and only an unstamped stamp
+ * is the fleet's. An empty-string stamp is neither unstamped nor the operator.
+ */
+export function isFleetStamp(stamp, operator) {
+    if (isUnstamped(stamp))
+        return true;
+    return operator !== null && operator !== undefined && sameOrg(stamp, operator);
+}
+/**
+ * Do two stamps name the same tenant: the same organisation, or both the
+ * fleet's? Two IDs that differ are two tenants even under one label.
+ */
+export function sameTenantStamp(a, b, operator) {
+    if (isFleetStamp(a, operator) && isFleetStamp(b, operator))
+        return true;
+    return sameOrg(a, b);
+}
+// ---------------------------------------------------------------------------
+// The stored mapping row
+// ---------------------------------------------------------------------------
+/**
+ * The consumer's organisation mapping row, as an adapter returns it. `id` is
+ * the permanent org ID and may be absent while the store is being filled;
+ * `label` is the slug. Extra fields are allowed and ignored.
+ */
+export const orgMappingRowSchema = z.object({
+    id: z.string().min(1).nullish(),
+    label: z.string().min(1),
+    active: z.boolean(),
+    allowedOrchestrators: z.array(z.string()),
+    scopes: z.array(z.string()),
+    orgKind: z.string().nullish(),
+});
+function kindOf(raw) {
+    return raw === "operator" || raw === "client" ? raw : null;
+}
+/** Calls an adapter; a missing or throwing one is `called: false`. */
+async function call(lookup, ...args) {
+    if (typeof lookup !== "function")
+        return { called: false };
+    try {
+        const raw = await lookup(...args);
+        return { called: true, row: raw ?? null };
+    }
+    catch {
+        return { called: false };
+    }
+}
+const CLERK_ORG_ID_SHAPE = /^org_[A-Za-z0-9]+$/;
+const ID_CLAIMS = ["org_id", "organizationId", "orgId"];
+/** The first claim that is shaped like a Clerk org ID and resolves as a tenant. */
+function claimedOrgId(claims) {
+    for (const name of ID_CLAIMS) {
+        const value = claims[name];
+        if (typeof value !== "string" || !CLERK_ORG_ID_SHAPE.test(value))
+            continue;
+        const resolved = resolveTenantIdOrAbsent({ kind: "session", identity: { orgId: value } });
+        if (resolved.present)
+            return resolved.tenantId;
+    }
+    return undefined;
+}
+/**
+ * Resolves a VERIFIED credential's claims to the stored mapping row of its
+ * organisation, or refuses. The claim's org ID selects the row; nothing the
+ * request supplies does.
+ *
+ * A credential carrying no usable org ID is refused
+ * (`no-verified-organisation`) and an ID no mapping holds is refused
+ * (`org-mapping-not-found`). A label claim (a slug) is never read: it neither
+ * selects a mapping nor rescues a missing ID.
+ *
+ * `claims` is the verified identity's own claim record, never a request field.
+ */
+export async function resolveOrgFromClaim(claims, lookups, options) {
+    const door = options?.door ?? "resolveOrgFromClaim";
+    const deny = (reason, detail) => ({
+        ok: false,
+        refusal: refusal("RBAC_DENIED", reason, door, detail),
+    });
+    const record = claims && typeof claims === "object" ? claims : {};
+    const orgId = claimedOrgId(record);
+    if (orgId === undefined) {
+        return deny("no-verified-organisation", "The credential carries no verified organisation.");
+    }
+    const served = (row, id) => {
+        if (row.active !== true) {
+            return deny("organisation-not-active", "The organisation is not mapped or not active.");
+        }
+        return {
+            ok: true,
+            org: {
+                id,
+                label: row.label,
+                allowedOrchestrators: row.allowedOrchestrators,
+                scopes: row.scopes,
+                orgKind: kindOf(row.orgKind),
+            },
+        };
+    };
+    const invalid = deny("org-mapping-record-invalid", "The organisation mapping record is not well formed.");
+    const unreadable = deny("org-mapping-lookup-failed", "The organisation mapping could not be read, so none is resolved.");
+    const found = await call(lookups?.orgById, orgId);
+    if (!found.called)
+        return unreadable;
+    if (found.row === null) {
+        return deny("org-mapping-not-found", "No organisation mapping holds the credential's organisation ID.");
+    }
+    const parsed = orgMappingRowSchema.safeParse(found.row);
+    if (!parsed.success || parsed.data.id !== orgId)
+        return invalid;
+    return served(parsed.data, orgId);
+}
+/**
+ * BACKFILL ONLY. Derives the permanent org ID of the organisation a label
+ * names, from the consumer's stored mapping, so a one-off migration can stamp
+ * rows written before IDs existed.
+ *
+ * MUST NEVER be called on a request path. A request decides its organisation
+ * from the verified credential's `org_id` claim (`resolveOrgFromClaim`); a miss
+ * there is a refusal, never a retry by label. A label is renamable display
+ * text: resolving an org from it on a request is the name-to-ID defect this
+ * module exists to close, and the export name carries that restriction so a
+ * reviewer sees it at every call site.
+ *
+ * A derivation and not an authorization: it answers for an inactive mapping
+ * too. It never invents an ID: a mapping with none filled is `id-not-filled`.
+ */
+export async function resolveOrgIdForLabelBackfillOnly(label, lookups) {
+    const absent = (reason) => ({
+        present: false,
+        absence: { code: "ORG_ID_ABSENT", reason },
+    });
+    if (!nonEmpty(label))
+        return absent("no-label");
+    const found = await call(lookups?.orgByLabel, label);
+    if (!found.called)
+        return absent("lookup-failed");
+    if (found.row === null)
+        return absent("not-mapped");
+    const parsed = orgMappingRowSchema.safeParse(found.row);
+    if (!parsed.success || parsed.data.label !== label)
+        return absent("record-invalid");
+    if (parsed.data.id === undefined || parsed.data.id === null)
+        return absent("id-not-filled");
+    return { present: true, orgId: parsed.data.id };
+}
+const DEFAULT_OPERATOR_READ_CAP = 1000;
+/**
+ * Finds the operator organisation (the fleet) from stored mapping rows: the
+ * single ACTIVE row whose kind is exactly `"operator"`. None, several, an
+ * over-cap read, an unreadable store and a malformed row are each a typed
+ * non-answer, so the caller can only treat the fleet as "no single operator"
+ * (fail closed) and never widen from a guess.
+ */
+export async function findOperatorOrg(lookups, options) {
+    const cap = options?.cap ?? DEFAULT_OPERATOR_READ_CAP;
+    const read = lookups?.activeOrganisations;
+    if (typeof read !== "function")
+        return { kind: "unreadable" };
+    let raw;
+    try {
+        raw = await read(cap + 1);
+    }
+    catch {
+        return { kind: "unreadable" };
+    }
+    if (!Array.isArray(raw))
+        return { kind: "unreadable" };
+    if (raw.length > cap)
+        return { kind: "overCap" };
+    const operators = [];
+    for (const item of raw) {
+        const parsed = orgMappingRowSchema.safeParse(item);
+        if (!parsed.success)
+            return { kind: "unreadable" };
+        if (parsed.data.active === true && parsed.data.orgKind === "operator") {
+            operators.push(parsed.data);
+        }
+    }
+    if (operators.length === 0)
+        return { kind: "none" };
+    if (operators.length > 1)
+        return { kind: "many", count: operators.length };
+    const [only] = operators;
+    return { kind: "one", org: { id: only.id ?? undefined, label: only.label } };
+}
+//# sourceMappingURL=org-by-id.js.map

package/dist/org-by-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-by-id.js","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAmBzD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,GAA8B;IACjD,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,KAAK,SAAS;QACjB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC;YACxC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,OAAO,CACrB,CAA4B,EAC5B,CAA4B;IAE5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAgC,EAChC,QAAmC;IAEnC,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,CAA4B,EAC5B,CAA4B,EAC5B,QAAmC;IAEnC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AAeH,SAAS,MAAM,CAAC,GAA8B;IAC5C,OAAO,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAKD,sEAAsE;AACtE,KAAK,UAAU,IAAI,CACjB,MAAgC,EAChC,GAAG,IAAO;IAEV,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AA0BD,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAU,CAAC;AAEjE,mFAAmF;AACnF,SAAS,YAAY,CAAC,MAA+B;IACnD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkD,EAClD,OAA6C,EAC7C,OAAoC;IAEpC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,qBAAqB,CAAC;IACpD,MAAM,IAAI,GAAG,CACX,MAAqC,EACrC,MAAc,EACa,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACtD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,0BAA0B,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAc,EAAE,EAAU,EAA6B,EAAE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE;gBACH,EAAE;gBACF,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;aAC7B;SACF,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,EAAE,qDAAqD,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,IAAI,CACrB,2BAA2B,EAC3B,kEAAkE,CACnE,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,EAAE,iEAAiE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAoBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAgC,EAChC,OAA6C;IAE7C,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAmB,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAClD,CAAC;AA0BD,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA8C,EAC9C,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,yBAAyB,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,EAAE,mBAAmB,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjD,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACtE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/E,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -85,6 +85,10 @@
     "./resource-server": {
       "types": "./dist/resource-server.d.ts",
       "import": "./dist/resource-server.js"
+    },
+    "./org-by-id": {
+      "types": "./dist/org-by-id.d.ts",
+      "import": "./dist/org-by-id.js"
     }
   },
   "files": [