@vantageos/cloud-identity 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -3,6 +3,43 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.20.0]
+
+### Added
+
+- `./scope-standing`: `scopeStanding(scope)` reads a RESOLVED org scope (the shape
+  an org-scope resolver such as VantagePeers `withOrgScope` returns) as
+  `"fleet" | "operator-admin" | "member" | "refused"`; `requireStanding(scope, door, allowed)`
+  and `requireFleetStanding(scope, door)` throw `RBAC_DENIED` naming the door
+  (`scope-not-resolved` / `standing-not-allowed`); `hasFleetRead(scope)` is the
+  reading meaning of `isMaster`. Fail closed: `isMaster`, `fleetWide` and a known
+  `masterSource` must agree, otherwise `"refused"`. Types `ScopeStanding`,
+  `StandingScope`. New `IdentityRefusalReason` members `scope-not-resolved`,
+  `standing-not-allowed`.
+- `./caller-from-claims`: `resolveCallerFromClaims(claims, deps, { adminRoles, door })`,
+  the one call from a verified claim record to `{ subject, actorName, org, principal,
+  role, isOrgAdmin }` or a typed refusal with `claimsOrg`. It chains
+  `resolveOrgFromClaim` -> `resolveActingPrincipal` (person) -> `assertOrgAdmin`
+  and decides nothing new. Helpers `readOrgRoleClaim`, `claimsAnOrganisation`.
+- `resolveProvisioningLabel(label, lookups)` (`./org-by-id`): the one boundary
+  where a provisioning label is translated to the permanent org ID —
+  `mapped` / `unmapped` / `mapped-without-id` / `unreadable`; an unreadable
+  store is never `unmapped`.
+- `@callerResolver` JSDoc tag, kept in the published declarations, on the
+  caller resolvers (`resolveActingPrincipal`, `resolvePersonPrincipal`,
+  `resolveCallerFromClaims`): an analyser derives its accepted sinks for a
+  verified identity from the tag instead of a hand-typed list.
+
+## [0.19.1]
+
+### Fixed
+
+- `resolveClerkSessionFromRequest`: a `__clerk_handshake` that does not verify (not a JWT, or
+  signed by another key) resolves to `signed-out` with reason `handshake-invalid` and no headers.
+  The SDK threw on these forms, so a consumer callback answered 500. Any other SDK error still
+  propagates. Measured: a Clerk-signed handshake past its own `exp` is still answered by the SDK
+  (its cookies are Clerk-signed; the `__session` among them is verified on its own).
+
 ## [0.19.0]
 
 ### Added

package/README.md

@@ -957,6 +957,67 @@ if (!t.ok) return respond(t.status, "headers" in t ? t.headers : {}); // 401, 40
   `resolveTenantFromAccessToken`) and never the token.
 - Types: `ResolveTenantFromAccessTokenResult`, `TokenPrincipal`.
 
+### The standing of a resolved org scope (`/scope-standing`, 0.20.0)
+
+An org-scope resolver hands every door a scope object, and doors used to branch
+on its `isMaster` boolean. That boolean mixes "may read the whole fleet" with
+"is the fleet itself". `scopeStanding(scope)` is the one reading:
+
+| standing | the scope |
+|---|---|
+| `"fleet"` | master, `masterSource` `"service-account"` or `"internal"` |
+| `"operator-admin"` | master, `masterSource` `"operator-admin"`: reads the fleet, is not the fleet |
+| `"member"` | not master, bound to one organisation (`orgClerkId`, or `orgSlug` while ids are filled) |
+| `"refused"` | anything else |
+
+```ts
+import { requireStanding, requireFleetStanding, hasFleetRead } from "@vantageos/cloud-identity/scope-standing";
+
+requireFleetStanding(scope, "secrets.read");                     // the fleet's own service only
+requireStanding(scope, "tasks.list", ["fleet", "operator-admin", "member"]);
+if (hasFleetRead(scope)) { /* unfiltered read: fleet or operator-admin */ }
+```
+
+- Fail closed. A scope is `"fleet"` or `"operator-admin"` only when `isMaster`,
+  `fleetWide` and a known `masterSource` agree; an absent or malformed scope, the
+  `refused` flag, no organisation, or any disagreement is `"refused"` — never the
+  more powerful reading.
+- `requireStanding` / `requireFleetStanding` throw `IdentityRefusalError`
+  `RBAC_DENIED` naming the door: reason `scope-not-resolved` for a `"refused"`
+  scope, `standing-not-allowed` otherwise. An empty `allowed` list is a
+  `TypeError`, never a pass.
+- `hasFleetRead(scope)` is true for `"fleet"` and `"operator-admin"`: the reading
+  meaning of `isMaster`.
+- Types: `ScopeStanding`, `StandingScope`.
+
+### From verified claims to the caller (`/caller-from-claims`, 0.20.0)
+
+`resolveCallerFromClaims(claims, { orgLookups, principalLookups }, { adminRoles, door })`
+is the one call from a VERIFIED identity's claim record to the caller. It chains
+the existing primitives, deciding nothing new: `resolveOrgFromClaim` (the
+organisation by the verified `org_id`; a slug never selects one), then
+`resolveActingPrincipal` (the person as stored in that organisation), then
+`assertOrgAdmin` (is that person an admin there).
+
+```ts
+import { resolveCallerFromClaims } from "@vantageos/cloud-identity/caller-from-claims";
+
+const c = await resolveCallerFromClaims(identity, { orgLookups, principalLookups }, { adminRoles: ["org:admin"], door: "withOrgScope" });
+if (!c.ok) {
+  // c.refusal: typed RBAC_DENIED (no-verified-organisation, org-mapping-not-found, other-organisation, credential-invalid, ...)
+  // c.claimsOrg: the claims NAME an organisation they could not prove (refuse loudly), vs none at all
+} else {
+  // c.subject, c.actorName ("user:<sub>"), c.org { id, label, orgKind, ... }, c.principal, c.role, c.isOrgAdmin
+}
+```
+
+- The role claim is read as `orgRole`, `org_role` or `organizationRole`
+  (`readOrgRoleClaim`); none is `null`, and `null` is never an admin.
+- `claimsAnOrganisation(claims)` only chooses a refusal's shape; it never names
+  an organisation.
+- An empty `adminRoles` is a `TypeError`, never a silent non-admin.
+- Types: `CallerFromClaimsDeps`, `CallerFromClaimsOptions`, `CallerFromClaimsResult`.
+
 ## An organisation is its permanent ID (0.16.0)
 
 A label (the slug an org can be renamed to) is display text. These functions
@@ -1015,6 +1076,15 @@ organisation and is refused. A store that has not filled every ID is filled
 once, with `resolveOrgIdForLabelBackfillOnly`, before the consumer relies on
 these functions.
 
+**`resolveProvisioningLabel(label, lookups)`** (0.20.0) is the one boundary
+where an operator's provisioning input names an organisation by label. It
+returns `{ kind: "mapped", orgId, active }`, `{ kind: "unmapped" }` (the
+organisation does not exist yet), `{ kind: "mapped-without-id", active }` or
+`{ kind: "unreadable", reason }` (`no-label`, `lookup-failed`,
+`record-invalid`). Every decision after it is by `orgId`; an unreadable store
+is never "unmapped", so a failing read cannot authorise a creation. Type:
+`ProvisioningLabelResult`.
+
 ## What this package does not do
 
 Worth reading before you rely on it.

package/dist/caller-from-claims.d.ts

@@ -0,0 +1,70 @@
+/**
+ * One entry from a VERIFIED credential's claims to the caller (0.20.0).
+ *
+ * A consumer that holds a verified identity (a Clerk session's claim record)
+ * used to chain three package calls itself: `resolveOrgFromClaim` (which
+ * organisation, by the verified `org_id`), `resolveActingPrincipal` (the person
+ * stored in that organisation) and `assertOrgAdmin` (is that person an admin of
+ * it). The chain, the role-claim spellings and the "does the token claim an
+ * organisation at all" test were each re-read in the consumer. This function is
+ * that chain, once:
+ *
+ *   claims -> org (by org_id) -> person principal in that org -> role -> isOrgAdmin
+ *
+ * It decides nothing new: every decision is the existing primitive's, in the
+ * same order, with the same refusals. A label (slug) claim never selects an
+ * organisation.
+ */
+import { type IdentityRefusal } from "./identity-refusal.js";
+import { type OrgMappingLookups, type ResolvedOrg } from "./org-by-id.js";
+import { type ActingPrincipal, type PrincipalLookups } from "./principal-by-id.js";
+export type CallerFromClaimsDeps = {
+    /** The mapping store, read by `resolveOrgFromClaim` (only `orgById` is used). */
+    orgLookups: OrgMappingLookups;
+    /** The principal store, read by `resolveActingPrincipal` for a person. */
+    principalLookups: PrincipalLookups;
+};
+export type CallerFromClaimsOptions = {
+    /** The roles that make a person an admin of their organisation, byte-equal. Non-empty. */
+    adminRoles: readonly string[];
+    /** The consumer's name for the door; carried on every refusal. */
+    door?: string;
+};
+export type CallerFromClaimsResult = {
+    ok: true;
+    /** The verified subject. */
+    subject: string;
+    /** `user:<subject>`, the person's actor name. */
+    actorName: string;
+    /** The organisation, resolved by the verified `org_id`. */
+    org: ResolvedOrg;
+    /** The person, as stored in that organisation. */
+    principal: ActingPrincipal;
+    /** The verified role claim, or null when the credential carries none. */
+    role: string | null;
+    /** True when `role` is one of `adminRoles` in this organisation (`assertOrgAdmin`). */
+    isOrgAdmin: boolean;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+    /**
+     * True when the claims NAME an organisation (an id or a slug, in any
+     * spelling) that did not resolve. Lets a consumer tell "signed in with no
+     * organisation" from "claims an organisation it cannot prove"; it is
+     * never an organisation itself.
+     */
+    claimsOrg: boolean;
+};
+/** The verified org role claim, under any of its spellings, or null. */
+export declare function readOrgRoleClaim(claims: Record<string, unknown>): string | null;
+/** Whether the claims name any organisation (id or slug, any spelling). Chooses a refusal's shape, never an org. */
+export declare function claimsAnOrganisation(claims: Record<string, unknown>): boolean;
+/**
+ * Resolves the caller behind a verified claim record: organisation by `org_id`,
+ * the person stored in it, the role claim and whether that role is an admin
+ * role there; or a typed refusal with `claimsOrg`.
+ *
+ * @callerResolver — resolves a verified caller; consumers may derive their accepted sinks from this tag.
+ */
+export declare function resolveCallerFromClaims(claims: Record<string, unknown> | null | undefined, deps: CallerFromClaimsDeps, options: CallerFromClaimsOptions): Promise<CallerFromClaimsResult>;
+//# sourceMappingURL=caller-from-claims.d.ts.map

package/dist/caller-from-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-from-claims.d.ts","sourceRoot":"","sources":["../src/caller-from-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAuB,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAGtB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,oBAAoB,GAAG;IACjC,iFAAiF;IACjF,UAAU,EAAE,iBAAiB,CAAC;IAC9B,0EAA0E;IAC1E,gBAAgB,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,0FAA0F;IAC1F,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,GAAG,EAAE,WAAW,CAAC;IACjB,kDAAkD;IAClD,SAAS,EAAE,eAAe,CAAC;IAC3B,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,uFAAuF;IACvF,UAAU,EAAE,OAAO,CAAC;CACrB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AASN,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAK/E;AAED,oHAAoH;AACpH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,IAAI,EAAE,oBAAoB,EAC1B,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CA8CjC"}

package/dist/caller-from-claims.js

@@ -0,0 +1,86 @@
+/**
+ * One entry from a VERIFIED credential's claims to the caller (0.20.0).
+ *
+ * A consumer that holds a verified identity (a Clerk session's claim record)
+ * used to chain three package calls itself: `resolveOrgFromClaim` (which
+ * organisation, by the verified `org_id`), `resolveActingPrincipal` (the person
+ * stored in that organisation) and `assertOrgAdmin` (is that person an admin of
+ * it). The chain, the role-claim spellings and the "does the token claim an
+ * organisation at all" test were each re-read in the consumer. This function is
+ * that chain, once:
+ *
+ *   claims -> org (by org_id) -> person principal in that org -> role -> isOrgAdmin
+ *
+ * It decides nothing new: every decision is the existing primitive's, in the
+ * same order, with the same refusals. A label (slug) claim never selects an
+ * organisation.
+ */
+import { personActorName } from "./person-principal.js";
+import { refusal } from "./identity-refusal.js";
+import { resolveOrgFromClaim } from "./org-by-id.js";
+import { assertOrgAdmin, resolveActingPrincipal, } from "./principal-by-id.js";
+const ROLE_KEYS = ["orgRole", "org_role", "organizationRole"];
+const ORG_CLAIM_KEYS = ["organizationSlug", "org_slug", "organizationId", "org_id", "orgId"];
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0;
+}
+/** The verified org role claim, under any of its spellings, or null. */
+export function readOrgRoleClaim(claims) {
+    for (const key of ROLE_KEYS) {
+        if (nonEmpty(claims[key]))
+            return claims[key];
+    }
+    return null;
+}
+/** Whether the claims name any organisation (id or slug, any spelling). Chooses a refusal's shape, never an org. */
+export function claimsAnOrganisation(claims) {
+    return ORG_CLAIM_KEYS.some((key) => claims[key] !== undefined && claims[key] !== null);
+}
+/**
+ * Resolves the caller behind a verified claim record: organisation by `org_id`,
+ * the person stored in it, the role claim and whether that role is an admin
+ * role there; or a typed refusal with `claimsOrg`.
+ *
+ * @callerResolver — resolves a verified caller; consumers may derive their accepted sinks from this tag.
+ */
+export async function resolveCallerFromClaims(claims, deps, options) {
+    const adminRoles = options?.adminRoles;
+    if (!Array.isArray(adminRoles) || adminRoles.length === 0 || !adminRoles.every(nonEmpty)) {
+        throw new TypeError("resolveCallerFromClaims: `adminRoles` must name at least one role.");
+    }
+    const door = options.door ?? "resolveCallerFromClaims";
+    const record = claims !== null && typeof claims === "object" && !Array.isArray(claims) ? claims : {};
+    const claimsOrg = claimsAnOrganisation(record);
+    const subject = record.subject ?? record.sub;
+    if (!nonEmpty(subject)) {
+        return {
+            ok: false,
+            claimsOrg,
+            refusal: refusal("RBAC_DENIED", "credential-invalid", door, "The verified claims carry no subject."),
+        };
+    }
+    const resolved = await resolveOrgFromClaim(record, deps?.orgLookups, { door });
+    if (!resolved.ok)
+        return { ok: false, claimsOrg, refusal: resolved.refusal };
+    const org = resolved.org;
+    const role = readOrgRoleClaim(record);
+    const person = await resolveActingPrincipal({
+        kind: "person",
+        personId: subject,
+        verifiedOrgId: org.id,
+        ...(role !== null ? { verifiedOrgRole: role } : {}),
+    }, deps?.principalLookups, door);
+    if (!person.ok)
+        return { ok: false, claimsOrg, refusal: person.refusal };
+    const isOrgAdmin = assertOrgAdmin(person.principal, org.id, { adminRoles, door }).ok;
+    return {
+        ok: true,
+        subject,
+        actorName: personActorName(subject),
+        org,
+        principal: person.principal,
+        role,
+        isOrgAdmin,
+    };
+}
+//# sourceMappingURL=caller-from-claims.js.map

package/dist/caller-from-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-from-claims.js","sourceRoot":"","sources":["../src/caller-from-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAA4C,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAGL,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AA4C9B,MAAM,SAAS,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,CAAU,CAAC;AACvE,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEtG,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAW,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAClE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAkD,EAClD,IAA0B,EAC1B,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,SAAS,CAAC,oEAAoE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,yBAAyB,CAAC;IACvD,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,uCAAuC,CAAC;SACrG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAEzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO;QACjB,aAAa,EAAE,GAAG,CAAC,EAAE;QACrB,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,EACD,IAAI,EAAE,gBAAgB,EACtB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAEzE,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACrF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO;QACP,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;QACnC,GAAG;QACH,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI;QACJ,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/clerk-handshake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clerk-handshake.d.ts","sourceRoot":"","sources":["../src/clerk-handshake.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAEjB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;CAClB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;CAClB,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7D,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,uBAAuB,CAAC,CAiClC;AAED,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5D;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EACxC,KAAK,EAAE,8BAA8B,EACrC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,wBAAwB,CAAC,CAQnC"}
+{"version":3,"file":"clerk-handshake.d.ts","sourceRoot":"","sources":["../src/clerk-handshake.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAEjB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;CAClB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;CAClB,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE7D,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,uBAAuB,CAAC,CAiDlC;AAED,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5D;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EACxC,KAAK,EAAE,8BAA8B,EACrC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,wBAAwB,CAAC,CAQnC"}

package/dist/clerk-handshake.js

@@ -5,13 +5,32 @@ export async function resolveClerkSessionFromRequest(request, options) {
         secretKey: options.secretKey,
         publishableKey: options.publishableKey,
     });
-    const state = await client.authenticateRequest(request, {
-        publishableKey: options.publishableKey,
-        secretKey: options.secretKey,
-        ...(options.authorizedParties ? { authorizedParties: [...options.authorizedParties] } : {}),
-        ...(options.jwtKey ? { jwtKey: options.jwtKey } : {}),
-        acceptsToken: "session_token",
+    // A `__clerk_handshake` that does not verify (not a JWT, signed by another key) is no session.
+    // The SDK throws on some of these forms and answers signed-out on others; both become one
+    // outcome, and no header of the SDK's is kept: the cookies would come from an untrusted payload.
+    const carriesHandshake = new URL(request.url).searchParams.has("__clerk_handshake");
+    const invalidHandshake = () => ({
+        kind: "signed-out",
+        reason: "handshake-invalid",
+        headers: new Headers(),
     });
+    let state;
+    try {
+        state = await client.authenticateRequest(request, {
+            publishableKey: options.publishableKey,
+            secretKey: options.secretKey,
+            ...(options.authorizedParties ? { authorizedParties: [...options.authorizedParties] } : {}),
+            ...(options.jwtKey ? { jwtKey: options.jwtKey } : {}),
+            acceptsToken: "session_token",
+        });
+    }
+    catch (error) {
+        if (carriesHandshake)
+            return invalidHandshake();
+        throw error;
+    }
+    if (carriesHandshake && state.status === "signed-out")
+        return invalidHandshake();
     if (state.status === "handshake") {
         return { kind: "handshake", status: 307, headers: state.headers };
     }

package/dist/clerk-handshake.js.map

@@ -1 +1 @@
-{"version":3,"file":"clerk-handshake.js","sourceRoot":"","sources":["../src/clerk-handshake.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAKL,eAAe,GAChB,MAAM,qBAAqB,CAAC;AA2C7B,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,OAAuC;IAEvC,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE;QACtD,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,gDAAgD;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,KAAK,CAAC,KAAK;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACnG,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,KAAwC,EACxC,KAAqC,EACrC,GAAoB,EACpB,IAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACjD,OAAO,eAAe,CACpB,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,EAC3F,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"clerk-handshake.js","sourceRoot":"","sources":["../src/clerk-handshake.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAKL,eAAe,GAChB,MAAM,qBAAqB,CAAC;AA2C7B,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,OAAuC;IAEvC,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,+FAA+F;IAC/F,0FAA0F;IAC1F,iGAAiG;IACjG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpF,MAAM,gBAAgB,GAAG,GAA4B,EAAE,CAAC,CAAC;QACvD,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,IAAI,OAAO,EAAE;KACvB,CAAC,CAAC;IACH,IAAI,KAA6D,CAAC;IAClE,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE;YAChD,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,YAAY,EAAE,eAAe;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,gBAAgB,EAAE,CAAC;IACjF,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,gDAAgD;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,YAAY,EAAE,KAAK,CAAC,KAAK;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AACnG,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAgB,EAChB,KAAwC,EACxC,KAAqC,EACrC,GAAoB,EACpB,IAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,OAAO,CAAC;IACjD,OAAO,eAAe,CACpB,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,EAC3F,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/human-path.d.ts

@@ -21,9 +21,9 @@
 import { z } from "zod";
 export declare const humanAccountRoleSchema: z.ZodEnum<{
     client: "client";
-    owner: "owner";
-    admin: "admin";
     member: "member";
+    admin: "admin";
+    owner: "owner";
 }>;
 export type HumanAccountRole = z.infer<typeof humanAccountRoleSchema>;
 /**

package/dist/identity-refusal.d.ts

@@ -13,7 +13,7 @@
  * closed vocabulary for the person path.
  */
 export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
-export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed" | "bearer-missing" | "bearer-malformed" | "token-invalid" | "jwks-unavailable" | "org-mapping-lookup-failed" | "org-mapping-not-found" | "org-mapping-record-invalid";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch" | "principal-not-a-person" | "list-absent" | "list-empty" | "principal-not-an-agent" | "principal-not-listed" | "scope-not-resolved" | "standing-not-allowed" | "bearer-missing" | "bearer-malformed" | "token-invalid" | "jwks-unavailable" | "org-mapping-lookup-failed" | "org-mapping-not-found" | "org-mapping-record-invalid";
 export type IdentityRefusal = {
     code: IdentityRefusalCode;
     reason: IdentityRefusalReason;

package/dist/identity-refusal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,GAEtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAElB,2BAA2B,GAC3B,uBAAuB,GACvB,4BAA4B,CAAC;AAEjC,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,GAEvB,wBAAwB,GAExB,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,GAEtB,oBAAoB,GACpB,sBAAsB,GAEtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAElB,2BAA2B,GAC3B,uBAAuB,GACvB,4BAA4B,CAAC;AAEjC,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoEH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAuEH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -21,6 +21,10 @@ export { startAuthorize, resumeAuthorize, } from "./authorize-flow.js";
 export type { AuthorizeClient, ClerkOrgMembership, AuthorizationCodeRecord, AuthorizationCodeStore, ConsumeCodeResult, AuthorizeConfig, AuthorizeDeps, AuthorizeOutcome, OrgPickerModel, ResumeInput, } from "./authorize-flow.js";
 export { resolveClerkSessionFromRequest, resumeAuthorizeFromRequest, } from "./clerk-handshake.js";
 export type { ClerkSessionFromRequest, ClerkSessionFromRequestOptions, ResumeFromRequestOutcome, } from "./clerk-handshake.js";
+export { scopeStanding, hasFleetRead, requireStanding, requireFleetStanding, } from "./scope-standing.js";
+export type { ScopeStanding, StandingScope } from "./scope-standing.js";
+export { resolveCallerFromClaims, readOrgRoleClaim, claimsAnOrganisation, } from "./caller-from-claims.js";
+export type { CallerFromClaimsDeps, CallerFromClaimsOptions, CallerFromClaimsResult, } from "./caller-from-claims.js";
 export { exchangeAuthorizationCode } from "./token-exchange.js";
 export type { AuthorizedTokenClaims, ExchangeInput, ExchangeDeps, ExchangeResult, } from "./token-exchange.js";
 export { verifyClerkSessionToken } from "./clerk-session.js";
@@ -43,8 +47,8 @@ export { actingCredentialSchema, principalRowSchema, organisationRowSchema, reso
 export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, FilterTargetsResult, AssertOrgAdminOptions, AssertOrgAdminResult, PrincipalIdList, AssertPrincipalListedOptions, AssertPrincipalListedResult, RecipientIds, RecipientLookups, AssertRecipientAddressableOptions, AssertRecipientAddressableResult, CallerCredential, AssertCallerStandingOptions, CallerStanding, } from "./principal-by-id.js";
 export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDiscoveryUrls, verifyMcpAccessToken, } from "./resource-server.js";
 export type { ProtectedResourceMetadataConfig, ProtectedResourceMetadata, UnauthorizedChallengeConfig, UnauthorizedChallenge, ClerkDiscoveryUrls, McpResourceServerConfig, VerifyMcpAccessTokenResult, } from "./resource-server.js";
-export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
-export type { OrgRef, OrgMappingRow, OrgMappingLookups, ResolvedOrg, ResolveOrgFromClaimOptions, ResolveOrgFromClaimResult, OrgIdAbsence, OrgIdAbsenceReason, OrgIdResolution, OperatorOrgLookups, FindOperatorOrgOptions, OperatorOrgResult, } from "./org-by-id.js";
+export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, resolveProvisioningLabel, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
+export type { OrgRef, OrgMappingRow, OrgMappingLookups, ResolvedOrg, ResolveOrgFromClaimOptions, ResolveOrgFromClaimResult, OrgIdAbsence, OrgIdAbsenceReason, OrgIdResolution, ProvisioningLabelResult, OperatorOrgLookups, FindOperatorOrgOptions, OperatorOrgResult, } from "./org-by-id.js";
 export { resolveTenantFromAccessToken } from "./tenant-from-token.js";
 export type { TokenPrincipal, ResolveTenantFromAccessTokenResult, } from "./tenant-from-token.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAO9B,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,0BAA0B,EAC1B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,YAAY,EACV,cAAc,EACd,kCAAkC,GACnC,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGxE,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,EAC3B,YAAY,EACZ,gBAAgB,EAChB,iCAAiC,EACjC,gCAAgC,EAChC,gBAAgB,EAChB,2BAA2B,EAC3B,cAAc,GACf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAS9B,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,0BAA0B,EAC1B,yBAAyB,EACzB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,YAAY,EACV,cAAc,EACd,kCAAkC,GACnC,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -22,6 +22,10 @@ export { validatePresentedBearer, requireAgentScopedIdentity, storedBearerRowSch
 // bound to both; the exchange that redeems it; the OIDC documents.
 export { startAuthorize, resumeAuthorize, } from "./authorize-flow.js";
 export { resolveClerkSessionFromRequest, resumeAuthorizeFromRequest, } from "./clerk-handshake.js";
+// 0.20.0 — the standing of a resolved org scope: one reading of "isMaster".
+export { scopeStanding, hasFleetRead, requireStanding, requireFleetStanding, } from "./scope-standing.js";
+// 0.20.0 — one entry from verified claims to org + person + role + admin.
+export { resolveCallerFromClaims, readOrgRoleClaim, claimsAnOrganisation, } from "./caller-from-claims.js";
 export { exchangeAuthorizationCode } from "./token-exchange.js";
 export { verifyClerkSessionToken } from "./clerk-session.js";
 export { buildDiscoveryDocument, buildUserInfo } from "./oidc.js";
@@ -49,8 +53,10 @@ export { buildProtectedResourceMetadata, unauthorizedChallenge, deriveClerkDisco
 // the org's mapping row, the ID comparisons and the operator org. Labels
 // (slugs) never select or prove an org; no option turns that on. The
 // label-to-ID derivation is exported only as
-// `resolveOrgIdForLabelBackfillOnly`, for a one-off backfill.
-export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
+// `resolveOrgIdForLabelBackfillOnly`, for a one-off backfill, and as
+// `resolveProvisioningLabel` (0.20.0), the one boundary where an operator's
+// provisioning input names an organisation by label.
+export { sameOrg, isFleetStamp, sameTenantStamp, resolveOrgFromClaim, resolveOrgIdForLabelBackfillOnly, resolveProvisioningLabel, findOperatorOrg, orgMappingRowSchema, } from "./org-by-id.js";
 // 0.18.0 — Session to tenant: `{ principal, orgId }` from a verified access token,
 // built on `verifyMcpAccessToken`, or a typed refusal. A downstream server never
 // reads a raw claim.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAM9B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,iFAAiF;AACjF,yEAAyE;AACzE,qEAAqE;AACrE,6CAA6C;AAC7C,8DAA8D;AAC9D,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAgBxB,mFAAmF;AACnF,iFAAiF;AACjF,qBAAqB;AACrB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAO9B,4EAA4E;AAC5E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,0EAA0E;AAC1E,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAC9E,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AA6B9B,6EAA6E;AAC7E,yEAAyE;AACzE,+EAA+E;AAC/E,+BAA+B;AAC/B,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAW9B,iFAAiF;AACjF,yEAAyE;AACzE,qEAAqE;AACrE,6CAA6C;AAC7C,qEAAqE;AACrE,4EAA4E;AAC5E,qDAAqD;AACrD,OAAO,EACL,OAAO,EACP,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,gCAAgC,EAChC,wBAAwB,EACxB,eAAe,EACf,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAiBxB,mFAAmF;AACnF,iFAAiF;AACjF,qBAAqB;AACrB,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/org-by-id.d.ts

@@ -65,7 +65,7 @@ type Lookup<A extends unknown[], R> = (...args: A) => Promise<R | null | undefin
 export type OrgMappingLookups = {
     /** The mapping row whose permanent ID is exactly the one asked for. */
     orgById?: Lookup<[orgId: string], OrgMappingRow>;
-    /** The mapping row whose label is exactly the one asked for. Read only by `resolveOrgIdForLabelBackfillOnly`. */
+    /** The mapping row whose label is exactly the one asked for. Read only by `resolveOrgIdForLabelBackfillOnly` and `resolveProvisioningLabel`. */
     orgByLabel?: Lookup<[label: string], OrgMappingRow>;
 };
 /** The org a credential resolves to, with the roster and scopes of its mapping row. */
@@ -131,6 +131,38 @@ export type OrgIdResolution = {
  * too. It never invents an ID: a mapping with none filled is `id-not-filled`.
  */
 export declare function resolveOrgIdForLabelBackfillOnly(label: string | null | undefined, lookups: OrgMappingLookups | null | undefined): Promise<OrgIdResolution>;
+export type ProvisioningLabelResult = 
+/** No mapping holds this label: the organisation does not exist yet. */
+{
+    kind: "unmapped";
+}
+/** A mapping holds this label; every decision after this point is by `orgId`. */
+ | {
+    kind: "mapped";
+    orgId: string;
+    active: boolean;
+}
+/** A mapping holds this label but its permanent ID is not filled yet. */
+ | {
+    kind: "mapped-without-id";
+    active: boolean;
+}
+/** No answer could be read: never treated as "unmapped". */
+ | {
+    kind: "unreadable";
+    reason: "no-label" | "lookup-failed" | "record-invalid";
+};
+/**
+ * The ONE place a provisioning input (an operator typing an organisation's
+ * label to create or configure it) is translated to the organisation's
+ * permanent ID. A label is accepted here and nowhere after: the caller decides
+ * from `orgId`, and from `kind` whether the organisation already exists.
+ *
+ * Request paths decide their organisation from the verified credential
+ * (`resolveOrgFromClaim`), never from a label. An unreadable store is its own
+ * answer, never "unmapped", so a failing read can never authorise a creation.
+ */
+export declare function resolveProvisioningLabel(label: string | null | undefined, lookups: OrgMappingLookups | null | undefined): Promise<ProvisioningLabelResult>;
 export type OperatorOrgLookups = {
     /**
      * The ACTIVE organisation mapping rows, at most `limit` of them. Called with

package/dist/org-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-by-id.d.ts","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMpD;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,4BAA4B;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAmBF;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC3B,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjD,iHAAiH;IACjH,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;CACrD,CAAC;AA2BF,uFAAuF;AACvF,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC7C,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,CAAC,CA6CpC;AAMD,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,eAAe,CAAC;AAEpB,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEjF,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC5C,OAAO,CAAC,eAAe,CAAC,CAa1B;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAI3B;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}
+{"version":3,"file":"org-by-id.d.ts","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMpD;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG;IACnB,4BAA4B;IAC5B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAmBF;;;;GAIG;AACH,wBAAgB,OAAO,CACrB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC3B,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAGT;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjD,gJAAgJ;IAChJ,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;CACrD,CAAC;AA2BF,uFAAuF;AACvF,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,EAClD,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC7C,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,yBAAyB,CAAC,CA6CpC;AAMD,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,eAAe,GACf,YAAY,GACZ,gBAAgB,GAChB,eAAe,CAAC;AAEpB,+FAA+F;AAC/F,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEjF,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gCAAgC,CACpD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC5C,OAAO,CAAC,eAAe,CAAC,CAa1B;AAMD,MAAM,MAAM,uBAAuB;AACjC,wEAAwE;AACtE;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB,iFAAiF;GAC/E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE;AACpD,yEAAyE;GACvE;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE;AAChD,4DAA4D;GAC1D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,eAAe,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAC5C,OAAO,CAAC,uBAAuB,CAAC,CAWlC;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAI3B;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG,IAAI,GAAG,SAAS,EAC9C,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwB5B"}

package/dist/org-by-id.js

@@ -175,6 +175,32 @@ export async function resolveOrgIdForLabelBackfillOnly(label, lookups) {
         return absent("id-not-filled");
     return { present: true, orgId: parsed.data.id };
 }
+/**
+ * The ONE place a provisioning input (an operator typing an organisation's
+ * label to create or configure it) is translated to the organisation's
+ * permanent ID. A label is accepted here and nowhere after: the caller decides
+ * from `orgId`, and from `kind` whether the organisation already exists.
+ *
+ * Request paths decide their organisation from the verified credential
+ * (`resolveOrgFromClaim`), never from a label. An unreadable store is its own
+ * answer, never "unmapped", so a failing read can never authorise a creation.
+ */
+export async function resolveProvisioningLabel(label, lookups) {
+    if (!nonEmpty(label))
+        return { kind: "unreadable", reason: "no-label" };
+    const found = await call(lookups?.orgByLabel, label);
+    if (!found.called)
+        return { kind: "unreadable", reason: "lookup-failed" };
+    if (found.row === null)
+        return { kind: "unmapped" };
+    const parsed = orgMappingRowSchema.safeParse(found.row);
+    if (!parsed.success || parsed.data.label !== label)
+        return { kind: "unreadable", reason: "record-invalid" };
+    if (parsed.data.id === undefined || parsed.data.id === null) {
+        return { kind: "mapped-without-id", active: parsed.data.active };
+    }
+    return { kind: "mapped", orgId: parsed.data.id, active: parsed.data.active };
+}
 const DEFAULT_OPERATOR_READ_CAP = 1000;
 /**
  * Finds the operator organisation (the fleet) from stored mapping rows: the

package/dist/org-by-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-by-id.js","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAmBnD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,GAA8B;IACjD,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,KAAK,SAAS;QACjB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC;YACxC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,OAAO,CACrB,CAA4B,EAC5B,CAA4B;IAE5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAgC,EAChC,QAAmC;IAEnC,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,CAA4B,EAC5B,CAA4B,EAC5B,QAAmC;IAEnC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AAeH,SAAS,MAAM,CAAC,GAA8B;IAC5C,OAAO,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAKD,sEAAsE;AACtE,KAAK,UAAU,IAAI,CACjB,MAAgC,EAChC,GAAG,IAAO;IAEV,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AA0BD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkD,EAClD,OAA6C,EAC7C,OAAoC;IAEpC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,qBAAqB,CAAC;IACpD,MAAM,IAAI,GAAG,CACX,MAAqC,EACrC,MAAc,EACa,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACtD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,0BAA0B,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAc,EAAE,EAAU,EAA6B,EAAE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE;gBACH,EAAE;gBACF,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;aAC7B;SACF,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,EAAE,qDAAqD,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,IAAI,CACrB,2BAA2B,EAC3B,kEAAkE,CACnE,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,EAAE,iEAAiE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAoBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAgC,EAChC,OAA6C;IAE7C,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAmB,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAClD,CAAC;AA0BD,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA8C,EAC9C,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,yBAAyB,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,EAAE,mBAAmB,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjD,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACtE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"org-by-id.js","sourceRoot":"","sources":["../src/org-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAmBnD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,GAA8B;IACjD,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,KAAK,SAAS;QACjB,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC;YACxC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,OAAO,CACrB,CAA4B,EAC5B,CAA4B;IAE5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAgC,EAChC,QAAmC;IAEnC,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,CAA4B,EAC5B,CAA4B,EAC5B,QAAmC;IAEnC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AAeH,SAAS,MAAM,CAAC,GAA8B;IAC5C,OAAO,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAKD,sEAAsE;AACtE,KAAK,UAAU,IAAI,CACjB,MAAgC,EAChC,GAAG,IAAO;IAEV,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AA0BD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAkD,EAClD,OAA6C,EAC7C,OAAoC;IAEpC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,qBAAqB,CAAC;IACpD,MAAM,IAAI,GAAG,CACX,MAAqC,EACrC,MAAc,EACa,EAAE,CAAC,CAAC;QAC/B,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACtD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,0BAA0B,EAAE,kDAAkD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAc,EAAE,EAAU,EAA6B,EAAE;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,GAAG,EAAE;gBACH,EAAE;gBACF,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;aAC7B;SACF,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,4BAA4B,EAAE,qDAAqD,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,IAAI,CACrB,2BAA2B,EAC3B,kEAAkE,CACnE,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IACrC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,EAAE,iEAAiE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAoBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,KAAgC,EAChC,OAA6C;IAE7C,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAmB,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAClD,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAgC,EAChC,OAA6C;IAE7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1E,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5G,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;AAC/E,CAAC;AA0BD,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA8C,EAC9C,OAAgC;IAEhC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,yBAAyB,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,EAAE,mBAAmB,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC9D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjD,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACtE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC3E,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/E,CAAC"}

package/dist/person-principal.d.ts

@@ -111,6 +111,8 @@ export type PersonPrincipalResult<O extends OrganisationState> = {
  * the token is live (present, unrevoked, unexpired); it acts for a PERSON;
  * it is bound to an organisation; that organisation exists and is active.
  * The only organisation ever looked up is the token's own.
+ *
+ * @callerResolver — resolves a verified caller; consumers may derive their accepted sinks from this tag.
  */
 export declare function resolvePersonPrincipal<O extends OrganisationState>(token: PersonTokenRecord | null | undefined, deps: PersonPrincipalDeps<O>, door: string): Promise<PersonPrincipalResult<O>>;
 export type PersonActingNameResult = {

package/dist/person-principal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"person-principal.d.ts","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,qBAAqB,GACrB,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,yBAAyB,GACzB,oBAAoB,GACpB,iBAAiB,CAAC;AAEtB,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,yEAAyE;AACzE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBACpB,OAAO,EAAE,aAAa;CAKnC;AAgBD,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAO3C,4CAA4C;AAC5C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAOlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,iBAAiB,IAAI;IAC7D,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,iBAAiB,IACzD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,CAAC,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,SAAS,iBAAiB,EACtE,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC3C,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CA6CnC;AAMD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,mEAAmE;IACnE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8EAA8E;IAC9E,eAAe,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,sBAAsB,CAgDzB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,aAAa,GAAG,IAAI,CAmBvB;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEtF;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,kBAAkB,CAerB;AAMD,KAAK,eAAe,GAAG;IACrB,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,oFAAoF;IACpF,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAc5E;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAG9D"}
+{"version":3,"file":"person-principal.d.ts","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,oBAAoB,GACpB,qBAAqB,GACrB,gBAAgB,GAChB,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,yBAAyB,GACzB,oBAAoB,GACpB,iBAAiB,CAAC;AAEtB,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,yEAAyE;AACzE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;gBACpB,OAAO,EAAE,aAAa;CAKnC;AAgBD,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAO3C,4CAA4C;AAC5C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAMD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;;;;iBAOlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,iBAAiB,IAAI;IAC7D,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC5D,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,iBAAiB,IACzD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,CAAC,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,SAAS,iBAAiB,EACtE,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAC3C,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC5B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CA6CnC;AAMD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,mEAAmE;IACnE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,8EAA8E;IAC9E,eAAe,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,sBAAsB,CAgDzB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,aAAa,GAAG,IAAI,CAmBvB;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEtF;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,kBAAkB,CAerB;AAMD,KAAK,eAAe,GAAG;IACrB,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,oFAAoF;IACpF,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAc5E;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAG9D"}

package/dist/person-principal.js

@@ -85,6 +85,8 @@ export const personTokenRecordSchema = z.object({
  * the token is live (present, unrevoked, unexpired); it acts for a PERSON;
  * it is bound to an organisation; that organisation exists and is active.
  * The only organisation ever looked up is the token's own.
+ *
+ * @callerResolver — resolves a verified caller; consumers may derive their accepted sinks from this tag.
  */
 export async function resolvePersonPrincipal(token, deps, door) {
     const deny = (reason, detail) => ({

package/dist/person-principal.js.map

@@ -1 +1 @@
-{"version":3,"file":"person-principal.js","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB,yEAAyE;AACzE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,OAAO,CAAgB;IAChC,YAAY,OAAsB;QAChC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,SAAS,MAAM,CACb,IAAuB,EACvB,MAA2B,EAC3B,IAAY,EACZ,MAAc,EACd,QAA+E,EAAE;IAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,mEAAmE;AACnE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,GAAG,mBAAmB,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2C,EAC3C,IAA4B,EAC5B,IAAY;IAEZ,MAAM,IAAI,GAAG,CACX,MAA2B,EAC3B,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IACE,CAAC,MAAM,CAAC,OAAO;QACf,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;QACnC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAChC,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,IAAI,CACT,oBAAoB,EACpB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,IAAI,CACT,gBAAgB,EAChB,QAAQ,OAAO,yCAAyC,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY;QACZ,SAAS,EAAE;YACT,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO;YACP,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;SACpC;KACF,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAOvC;IACC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,uBAAuB,EACvB,uBAAuB,EACvB,IAAI,EACJ,wDAAwD,OAAO,GAAG,EAClE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,2BAA2B,EAC3B,2BAA2B,EAC3B,IAAI,EACJ,oBAAoB,OAAO,2CAA2C,EACtE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,yBAAyB,EACzB,yBAAyB,EACzB,IAAI,EACJ,oBAAoB,OAAO,yDAAyD,EACpF,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CACX,aAAa,EACb,4BAA4B,EAC5B,KAAK,CAAC,IAAI,EACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,CAAC,IAAI,EACV,6DAA6D,KAAK,CAAC,UAAU,GAAG,EAChF,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,gEAAgE,EAChE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAC/B;KACF,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,iBAAiB,EACjB,KAAK,CAAC,IAAI,EACV,kCAAkC,EAClC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,CACzC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"person-principal.js","sourceRoot":"","sources":["../src/person-principal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA0CxB,yEAAyE;AACzE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,OAAO,CAAgB;IAChC,YAAY,OAAsB;QAChC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,SAAS,MAAM,CACb,IAAuB,EACvB,MAA2B,EAC3B,IAAY,EACZ,MAAc,EACd,QAA+E,EAAE;IAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,mEAAmE;AACnE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,GAAG,mBAAmB,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AA2BH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2C,EAC3C,IAA4B,EAC5B,IAAY;IAEZ,MAAM,IAAI,GAAG,CACX,MAA2B,EAC3B,MAAc,EACyB,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IACE,CAAC,MAAM,CAAC,OAAO;QACf,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;QACnC,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAChC,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,IAAI,CACT,oBAAoB,EACpB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,IAAI,CACT,gBAAgB,EAChB,QAAQ,OAAO,yCAAyC,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,YAAY;QACZ,SAAS,EAAE;YACT,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO;YACP,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;SACpC;KACF,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAOvC;IACC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,uBAAuB,EACvB,uBAAuB,EACvB,IAAI,EACJ,wDAAwD,OAAO,GAAG,EAClE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,2BAA2B,EAC3B,2BAA2B,EAC3B,IAAI,EACJ,oBAAoB,OAAO,2CAA2C,EACtE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,MAAM,CACb,yBAAyB,EACzB,yBAAyB,EACzB,IAAI,EACJ,oBAAoB,OAAO,yDAAyD,EACpF,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,CACnC;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CACX,aAAa,EACb,4BAA4B,EAC5B,KAAK,CAAC,IAAI,EACV,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,CAAC,IAAI,EACV,6DAA6D,KAAK,CAAC,UAAU,GAAG,EAChF,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAIzC;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,gEAAgE,EAChE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAC/B;KACF,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,MAAM,CACb,aAAa,EACb,iBAAiB,EACjB,KAAK,CAAC,IAAI,EACV,kCAAkC,EAClC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,CACzC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC"}

package/dist/principal-by-id.d.ts

@@ -182,6 +182,8 @@ export type AssertTargetResult = {
  *     its stored org as `"operator"`). With `actingForAgentId`, the agent row is read by
  *     ID and must be stamped with the service account's own org; the principal
  *     is that agent, with `viaServiceAccountId` recording the carrier.
+ *
+ * @callerResolver — resolves a verified caller; consumers may derive their accepted sinks from this tag.
  */
 export declare function resolveActingPrincipal(credential: ActingCredential | null | undefined, lookups: PrincipalLookups, door?: string): Promise<ResolveActingPrincipalResult>;
 /**

package/dist/principal-by-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;4BAiBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA8GvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAMD,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,EAAE,CAAA;CAAE,GACvB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAU5C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,SAAS,SAAS,EAChE,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAkCjC;AAMD,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CAmCtB;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,CAAC,EAAE,4BAA4B,GAClC,2BAA2B,CAsC7B;AAMD,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG;IACzB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC1C,SAAS,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAC1C,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iCAAiC,GACvC,OAAO,CAAC,gCAAgC,CAAC,CAuD3C;AAMD;;;;;;;GAOG;AACH,QAAA,MAAM,sBAAsB;;;kBAG1B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3C,MAAM,MAAM,2BAA2B,GAAG;IACxC,kFAAkF;IAClF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACnD;IAAE,QAAQ,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAClD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACjD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,cAAc,CAAC,CAWzB"}
+{"version":3,"file":"principal-by-id.d.ts","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,eAAe,EAAW,MAAM,uBAAuB,CAAC;AAMtE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;4BAiBjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5C,KAAK,MAAM,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,IAAI,CACpC,GAAG,IAAI,EAAE,CAAC,KACP,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACpD,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;IACtE,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAMjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,SAAS,GAAG;IACtB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AA0GxF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,SAA2B,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CA8GvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAiD7B;AAMD,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,EAAE,CAAA;CAAE,GACvB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAU5C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,SAAS,SAAS,EAChE,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAkCjC;AAMD,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;OAIG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CAmCtB;AAMD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEjG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC7C,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,CAAC,EAAE,4BAA4B,GAClC,2BAA2B,CAsC7B;AAMD,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG;IACzB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC1C,SAAS,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,EAC1C,OAAO,EAAE,gBAAgB,EACzB,IAAI,CAAC,EAAE,iCAAiC,GACvC,OAAO,CAAC,gCAAgC,CAAC,CAuD3C;AAMD;;;;;;;GAOG;AACH,QAAA,MAAM,sBAAsB;;;kBAG1B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GACxB,gBAAgB,GAChB,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3C,MAAM,MAAM,2BAA2B,GAAG;IACxC,kFAAkF;IAClF,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACnD;IAAE,QAAQ,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GAClD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,GACjD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,cAAc,CAAC,CAWzB"}

package/dist/principal-by-id.js

@@ -193,6 +193,8 @@ function served(principal) {
  *     its stored org as `"operator"`). With `actingForAgentId`, the agent row is read by
  *     ID and must be stamped with the service account's own org; the principal
  *     is that agent, with `viaServiceAccountId` recording the carrier.
+ *
+ * @callerResolver — resolves a verified caller; consumers may derive their accepted sinks from this tag.
  */
 export async function resolveActingPrincipal(credential, lookups, door = "resolveActingPrincipal") {
     if (credential !== null &&

package/dist/principal-by-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAyFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,eAAe;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAUD,uEAAuE;AACvE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IAChD,kBAAkB;IAClB,2BAA2B;IAC3B,uBAAuB;IACvB,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAA6C,EAC7C,IAAkB,EAClB,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,0BAA0B,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAExD,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnF,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,SAAS,EACT,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAC3B,OAAO,EACP,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CACxD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,WAAsC,EACtC,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC5C,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6C,EAC7C,IAAwC,EACxC,IAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA0C,EAC1C,SAA0C,EAC1C,OAAyB,EACzB,IAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,4BAA4B,CAAC;IACxD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,wBAAwB,EAAE,IAAI,EAAE,kEAAkE,CAAC,CAAC;IACpH,CAAC;IACD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IACtC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAE5C,IAAI,WAAmB,CAAC;IACxB,IAAI,MAA+B,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtE,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,MAAM,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7E,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9B,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,oDAAoD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,qBAAqB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AA0BH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAA+C,EAC/C,OAAyB,EACzB,IAAiC;IAEjC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,UAAiD,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IAC/B,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"principal-by-id.js","sourceRoot":"","sources":["../src/principal-by-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAwB,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACH,CAAC,CAAC;AAIH,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAyFH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAA2C,EAC3C,IAAO,EACP,UAAkB,EAClB,IAAY,EACZ,IAAY;IAEZ,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,IAAI,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,MAAM,IAAI,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,6BAA6B,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,OAA0C,EAC1C,KAAa,EACb,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,EAAE,SAAS,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CACX,yBAAyB,EACzB,IAAI,EACJ,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,iBAAiB,CAC9B,KAAa,EACb,OAAyB,EACzB,IAAY;IAEZ,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,0DAA0D,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAA+C,EAC/C,OAAyB,EACzB,IAAI,GAAG,wBAAwB;IAE/B,IACE,UAAU,KAAK,IAAI;QACnB,OAAO,UAAU,KAAK,QAAQ;QAC7B,UAAiC,CAAC,IAAI,KAAK,OAAO,EACnD,CAAC;QACD,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAqB,OAAO,IAAI,EAAE,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpD,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,OAAO;YACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;YACrF,CAAC,CAAC,MAAM,gBAAgB,CACpB,IAAI,CAAC,UAAU,EACf,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,EACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,IAAI,CACL,CAAC;QACR,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,MAAM,CACX,oBAAoB,EACpB,IAAI,EACJ,OAAO,IAAI,CAAC,IAAI,uDAAuD,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,UAAU,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBAC1B,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,eAAe;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,kBAAkB;IAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,IAAI,CAAC,kBAAkB,EACvB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,iBAAiB,EACjB,IAAI,CACL,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,0BAA0B,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAE3C,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;YACvB,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,IAAI,CAAC,SAAS,EACd,CAAC,IAAI,CAAC,gBAAgB,CAAC,EACvB,IAAI,CAAC,gBAAgB,EACrB,OAAO,EACP,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,iCAAiC,EACjC,IAAI,EACJ,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;QACZ,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,OAAO;QACb,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA6C,EAC7C,MAAoC,EACpC,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAC;IAClD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,KAAK,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,CAAC;IAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,6DAA6D,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,uBAAuB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAUD,uEAAuE;AACvE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC;IAChD,kBAAkB;IAClB,2BAA2B;IAC3B,uBAAuB;IACvB,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAA6C,EAC7C,IAAkB,EAClB,OAAuB,EACvB,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,0BAA0B,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAExD,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACnF,OAAO,MAAM,CACX,sBAAsB,EACtB,IAAI,EACJ,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,SAAS,EACT,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAC3B,OAAO,EACP,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CACxD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,IAAI,GAAQ,EAAE,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,WAAsC,EACtC,IAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC;IAC5C,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,4DAA4D,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IACpC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,yDAAyD,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA6C,EAC7C,IAAwC,EACxC,IAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;QAChC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,wBAAwB,EACxB,IAAI,EACJ,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,wDAAwD,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,uDAAuD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,sBAAsB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA0C,EAC1C,SAA0C,EAC1C,OAAyB,EACzB,IAAwC;IAExC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,4BAA4B,CAAC;IACxD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,EAAE,6CAA6C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,wBAAwB,EAAE,IAAI,EAAE,kEAAkE,CAAC,CAAC;IACpH,CAAC;IACD,IACE,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAC5B,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC,kBAAkB,EAAE,IAAI,EAAE,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE1D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IACtC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,OAAO,aAAa,CAAC;IAE5C,IAAI,WAAmB,CAAC;IACxB,IAAI,MAA+B,CAAC;IACpC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtE,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,MAAM,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7E,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9B,MAAM,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,OAAO,MAAM,CACX,2BAA2B,EAC3B,IAAI,EACJ,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACnC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,wCAAwC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,yBAAyB,EAAE,IAAI,EAAE,oDAAoD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,qBAAqB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AA0BH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAA+C,EAC/C,OAAyB,EACzB,IAAiC;IAEjC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,uBAAuB,CAAC;IACnD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,UAAiD,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IAC/B,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC"}

package/dist/scope-standing.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Standing of a RESOLVED org scope (0.20.0).
+ *
+ * A consumer's org-scope resolver (VantagePeers `withOrgScope`) returns a scope
+ * object; doors then branch on `scope.isMaster` locally. That boolean answers
+ * two different questions (may this caller read the whole fleet, and is it the
+ * fleet's own service), so each door re-derived its own reading. This module is
+ * the one reading:
+ *
+ *   - "fleet"           a master scope granted to the fleet itself
+ *                       (`masterSource` "service-account" or "internal").
+ *   - "operator-admin"  a master scope granted to the operator's org:admin
+ *                       human: it reads the fleet, it is not the fleet.
+ *   - "member"          a non-master scope bound to one organisation
+ *                       (`orgClerkId`, or `orgSlug` while ids are being filled).
+ *   - "refused"         everything else: absent, malformed, flagged `refused`,
+ *                       no organisation, or self-contradicting.
+ *
+ * Fail closed: a scope is "fleet" or "operator-admin" only when `isMaster`,
+ * `fleetWide` and `masterSource` all agree; any disagreement is "refused",
+ * never the more powerful reading.
+ */
+export type ScopeStanding = "fleet" | "operator-admin" | "member" | "refused";
+/** The fields of a resolved scope this module reads. Other fields are ignored. */
+export interface StandingScope {
+    isMaster: boolean;
+    fleetWide: boolean;
+    masterSource?: string;
+    orgSlug?: string | null;
+    orgClerkId?: string;
+    refused?: boolean;
+}
+/** The standing of `scope`; "refused" for anything that is not a well-formed scope. */
+export declare function scopeStanding(scope: unknown): ScopeStanding;
+/** True when the scope may read the whole fleet: "fleet" or "operator-admin". */
+export declare function hasFleetRead(scope: unknown): boolean;
+/**
+ * Returns the scope's standing when it is in `allowed`; otherwise throws
+ * `IdentityRefusalError` RBAC_DENIED naming `door`:
+ *   - "scope-not-resolved"   the scope is "refused";
+ *   - "standing-not-allowed" the standing exists but is not in `allowed`.
+ * An empty `allowed` is a programming error (TypeError), never a pass.
+ */
+export declare function requireStanding(scope: unknown, door: string, allowed: readonly Exclude<ScopeStanding, "refused">[]): Exclude<ScopeStanding, "refused">;
+/** `requireStanding(scope, door, ["fleet"])`: the fleet's own service only. */
+export declare function requireFleetStanding(scope: unknown, door: string): "fleet";
+//# sourceMappingURL=scope-standing.d.ts.map

package/dist/scope-standing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-standing.d.ts","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9E,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAiB3D;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGpD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,GACpD,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAqBnC;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1E"}

package/dist/scope-standing.js

@@ -0,0 +1,83 @@
+/**
+ * Standing of a RESOLVED org scope (0.20.0).
+ *
+ * A consumer's org-scope resolver (VantagePeers `withOrgScope`) returns a scope
+ * object; doors then branch on `scope.isMaster` locally. That boolean answers
+ * two different questions (may this caller read the whole fleet, and is it the
+ * fleet's own service), so each door re-derived its own reading. This module is
+ * the one reading:
+ *
+ *   - "fleet"           a master scope granted to the fleet itself
+ *                       (`masterSource` "service-account" or "internal").
+ *   - "operator-admin"  a master scope granted to the operator's org:admin
+ *                       human: it reads the fleet, it is not the fleet.
+ *   - "member"          a non-master scope bound to one organisation
+ *                       (`orgClerkId`, or `orgSlug` while ids are being filled).
+ *   - "refused"         everything else: absent, malformed, flagged `refused`,
+ *                       no organisation, or self-contradicting.
+ *
+ * Fail closed: a scope is "fleet" or "operator-admin" only when `isMaster`,
+ * `fleetWide` and `masterSource` all agree; any disagreement is "refused",
+ * never the more powerful reading.
+ */
+import { IdentityRefusalError, refusal } from "./identity-refusal.js";
+const FLEET_SOURCES = new Set(["service-account", "internal"]);
+function nonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+/** The standing of `scope`; "refused" for anything that is not a well-formed scope. */
+export function scopeStanding(scope) {
+    if (scope === null || typeof scope !== "object" || Array.isArray(scope))
+        return "refused";
+    const s = scope;
+    if (s.refused === true)
+        return "refused";
+    if (typeof s.isMaster !== "boolean" || typeof s.fleetWide !== "boolean")
+        return "refused";
+    if (s.isMaster !== s.fleetWide)
+        return "refused";
+    if (s.isMaster) {
+        if (typeof s.masterSource !== "string")
+            return "refused";
+        if (FLEET_SOURCES.has(s.masterSource))
+            return "fleet";
+        if (s.masterSource === "operator-admin")
+            return "operator-admin";
+        return "refused";
+    }
+    if (s.masterSource !== undefined)
+        return "refused";
+    if (nonEmptyString(s.orgClerkId) || nonEmptyString(s.orgSlug))
+        return "member";
+    return "refused";
+}
+/** True when the scope may read the whole fleet: "fleet" or "operator-admin". */
+export function hasFleetRead(scope) {
+    const standing = scopeStanding(scope);
+    return standing === "fleet" || standing === "operator-admin";
+}
+/**
+ * Returns the scope's standing when it is in `allowed`; otherwise throws
+ * `IdentityRefusalError` RBAC_DENIED naming `door`:
+ *   - "scope-not-resolved"   the scope is "refused";
+ *   - "standing-not-allowed" the standing exists but is not in `allowed`.
+ * An empty `allowed` is a programming error (TypeError), never a pass.
+ */
+export function requireStanding(scope, door, allowed) {
+    if (!Array.isArray(allowed) || allowed.length === 0) {
+        throw new TypeError("requireStanding: `allowed` must name at least one standing.");
+    }
+    const standing = scopeStanding(scope);
+    if (standing === "refused") {
+        throw new IdentityRefusalError(refusal("RBAC_DENIED", "scope-not-resolved", door, "The caller's scope did not resolve to a standing."));
+    }
+    if (!allowed.includes(standing)) {
+        throw new IdentityRefusalError(refusal("RBAC_DENIED", "standing-not-allowed", door, `Standing "${standing}" is not allowed here (allowed: ${allowed.join(", ")}).`));
+    }
+    return standing;
+}
+/** `requireStanding(scope, door, ["fleet"])`: the fleet's own service only. */
+export function requireFleetStanding(scope, door) {
+    return requireStanding(scope, door, ["fleet"]);
+}
+//# sourceMappingURL=scope-standing.js.map

package/dist/scope-standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-standing.js","sourceRoot":"","sources":["../src/scope-standing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AActE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1F,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjD,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;YAAE,OAAO,OAAO,CAAC;QACtD,IAAI,CAAC,CAAC,YAAY,KAAK,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,gBAAgB,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAc,EACd,IAAY,EACZ,OAAqD;IAErD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,mDAAmD,CAAC,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,aAAa,QAAQ,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC/E,CACF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAY;IAC/D,OAAO,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,CAAY,CAAC;AAC5D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -97,6 +97,14 @@
     "./tenant-from-token": {
       "types": "./dist/tenant-from-token.d.ts",
       "import": "./dist/tenant-from-token.js"
+    },
+    "./scope-standing": {
+      "types": "./dist/scope-standing.d.ts",
+      "import": "./dist/scope-standing.js"
+    },
+    "./caller-from-claims": {
+      "types": "./dist/caller-from-claims.d.ts",
+      "import": "./dist/caller-from-claims.js"
     }
   },
   "files": [