@vantageos/cloud-identity 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -3,6 +3,41 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased] - 0.3.0
+
+**BREAKING.** Closes two measured 0.2.0 defects — a right must never be
+granted by absence.
+
+### Changed (breaking)
+
+- `passesScopeFilter`, `scopeFilterList`, `scopeFilterGet`, `isMasterScope`,
+  `isWildcardScope`: `oauthCtx` is now **mandatory** (`OAuthCtx`, no longer
+  `OAuthCtx | undefined`). The 0.2.0 behaviour of an omitted `oauthCtx`
+  silently passing every row (wildcard, as if master-scoped) is removed.
+  Omitting the argument now breaks the caller's build; at runtime (for
+  callers that bypass TypeScript) it throws instead of granting access.
+  Callers that deliberately want the old legacy-bearer wildcard behaviour
+  must import and pass the new `LEGACY_WILDCARD_CTX` sentinel explicitly.
+
+### Added
+
+- `LEGACY_WILDCARD_CTX` — explicit, by-name opt-in for the pre-0.3.0
+  legacy-bearer wildcard behaviour (`src/scope-filter.ts`).
+- `requireTenantId(source: TenantSource): string` — organization/workspace
+  membership guard, unifying the human (session) and machine (bearer) entry
+  paths behind one contract. Refuses on missing session, missing/empty `orgId`, and
+  missing/empty bearer-resolved `workspaceId` (`src/org-guard.ts`).
+- `SessionIdentity`, `TenantSource` types.
+
+### Scope note
+
+The package now exposes, behind one contract, all four primitives an
+application needs and should never reimplement: tenant resolution
+(`getEffectiveTenantId`), membership requirement (`requireTenantId`), row
+filtering (`passesScopeFilter` / `scopeFilterList` / `scopeFilterGet`), and
+identifier validation (`validateMasterBearer`). Framework adapters (Convex,
+Hono, etc.) wrap these; they must not reimplement the checks.
+
 ## [0.2.0] - 2026-06-13
 
 Additive release — domain-tenancy layer. No breaking changes. All 0.1.0 exports unchanged.
@@ -38,5 +73,5 @@ Initial release.
 - Public type surface: `OAuthCtx`, `ScopeProfile`, `NamespacePrefix`, `FromAllowListEntry`, `ValidateMasterBearerResult`.
 
 ### Notes
-- `getEffectiveWorkspaceId` deferred to 0.2.0 (depends on `vantageos-crm` workspace helper, owned by Theta).
+- `getEffectiveWorkspaceId` deferred to 0.2.0.
 - No `provenance: true` in `publishConfig` — provenance only from CI per fleet friction lesson `npm-publish-provenance-only-from-ci-not-local-host`.

package/LICENSE

@@ -1,21 +1,110 @@
-MIT License
+Functional Source License, Version 1.1, Apache 2.0 Future License
 
-Copyright (c) 2026 VantagePeers Cloud
+Abbreviation
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+FSL-1.1-Apache-2.0
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+Notice
+
+Copyright 2026 VantageOS (ElPi Corp)
+
+Terms and Conditions
+
+Licensor:             VantageOS (ElPi Corp)
+
+Licensed Work:        VantagePeers
+                      The Licensed Work is (c) 2026 VantageOS (ElPi Corp)
+
+Additional Use Grant: You may make production use of the Licensed Work,
+                      provided Your use does not include offering the Licensed
+                      Work to third parties as a hosted or managed service
+                      where the service provides users with access to any
+                      substantial set of the features or functionality of the
+                      Licensed Work.
+
+Change Date:          2028-04-03 (two years from publication)
+
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact: contact@vantageos.com
+
+License text below is provided for informational purposes only.
+
+---
+
+Functional Source License, Version 1.1, Apache 2.0 Future License
+
+1. Purpose
+
+This license gives you broad permission to use, modify, and share this
+software, with one important condition: you may not use it to compete with us.
+
+2. Acceptance
+
+To use the software, you must agree to these terms. If you do not agree, you
+may not use the software.
+
+3. Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide, non-
+sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations below.
+
+4. Limitations
+
+You may not make the functionality of the software available to third parties
+as a service, or otherwise use the software to provide a service to third
+parties that competes with the licensor.
+
+5. Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license or becomes able to license, to make, have made, use, sell, offer for
+sale, import, and have imported the software, in each case subject to the
+limitations and conditions in this license.
+
+6. Fair Use
+
+This license is not intended to limit any rights you may have under applicable
+fair use or other laws.
+
+7. No Other Rights
+
+These terms do not grant any other rights. The licensor reserves all rights not
+expressly granted.
+
+8. Termination
+
+Your license is automatically terminated if you violate the terms. However, if
+you cure the violation within 30 days of discovering it, your license is
+reinstated retroactively.
+
+9. Disclaimer
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+IMPLIED.
+
+10. Limitation of Liability
+
+TO THE EXTENT PERMITTED BY LAW, THE LICENSOR IS NOT LIABLE FOR ANY DAMAGES
+ARISING FROM THE USE OF THE SOFTWARE.
+
+11. Change Date and License
+
+After the Change Date, the licensor grants you the rights under the Change
+License.
+
+12. Definitions
+
+"Compete" means providing a product or service that is substantially similar
+to, or a replacement for, all or a significant portion of the Licensed Work.
+
+---
+
+Apache License, Version 2.0
+
+After the Change Date (2028-04-03), this software will be available under the
+Apache License, Version 2.0. See https://www.apache.org/licenses/LICENSE-2.0
+for full text.

package/README.md

@@ -1,8 +1,16 @@
 # @vantageos/cloud-identity
 
-Framework-agnostic identity + scope-filter primitives for **VantagePeers Cloud** (multi-tenant MCP).
+Building blocks for multi-tenant authorization: decide which tenant a caller
+belongs to, and keep every other tenant's rows out of the response.
 
-Consumed by `vantage-peers-mcp` and `@vantageos/vantage-crm-mcp` — provides the small, testable building blocks that gate cross-tenant data access in the MCP transport layer.
+If your service holds data for several customers behind one deployment, you
+answer the same four questions on every request — who is calling, which tenant
+they belong to, which rows they may see, and whether their token is genuine.
+This package answers them once, in plain functions with no framework attached,
+so each service does not re-implement (and re-misimplement) its own version.
+
+It depends on no web framework, router or database, and runs anywhere
+JavaScript runs.
 
 ## Install
 
@@ -10,182 +18,198 @@ Consumed by `vantage-peers-mcp` and `@vantageos/vantage-crm-mcp` — provides th
 npm install @vantageos/cloud-identity
 ```
 
-## Modules
-
-| Module | Symbols | Purpose |
-| --- | --- | --- |
-| `@vantageos/cloud-identity/crypto` | `timingSafeEqual` | Constant-time byte comparison (no branch-timing leak). |
-| `@vantageos/cloud-identity/scope-filter` | `passesScopeFilter`, `scopeFilterList`, `scopeFilterGet` | Row-level visibility filter on `(createdBy, namespace)` using the caller's OAuth scope. |
-| `@vantageos/cloud-identity/bearer-validation` | `validateMasterBearer` | Bearer-token parsing + sha256 constant-time match against a configured master secret. |
-| `@vantageos/cloud-identity/types` | `OAuthCtx`, `ScopeProfile`, `NamespacePrefix`, `FromAllowListEntry`, `ValidateMasterBearerResult` | Public type surface (0.1.0). |
-| `@vantageos/cloud-identity/tenancy-domain` | `Workspace`, `WorkspaceMember`, `WorkspaceRole`, `TenantContext`, `workspaceSchema`, `workspaceMemberSchema`, `workspaceRoleSchema`, `tenantContextSchema`, `ScopeViolationError`, `getEffectiveTenantId`, `decodeUnverifiedBearer` | Domain-tenancy layer (0.2.0) — multi-tenant isolation guard + Zod schemas + bearer DECODER (not auth — see security note). |
-
-## 0.1.0 scope
-
-This release ships the **transport-agnostic** core:
-
-- `crypto.timingSafeEqual`
-- `scope-filter.{passesScopeFilter, scopeFilterList, scopeFilterGet}`
-- `bearer-validation.validateMasterBearer`
-- types
+Node 18 or later. ESM only.
 
-## 0.2.0 domain-tenancy layer
+## Quick start
 
-Released 2026-06-13. Additive — no breaking changes.
+```js
+import { requireTenantId, scopeFilterList } from "@vantageos/cloud-identity";
 
-New in 0.2.0:
-- `WorkspaceRole` literal union + Zod schema
-- `Workspace` + `WorkspaceMember` + `TenantContext` types + Zod schemas
-- `ScopeViolationError` — canonical cross-tenant isolation error
-- `getEffectiveTenantId(ctx, args)` — multi-tenant guard (call at the top of every tool handler)
-- `decodeUnverifiedBearer(token)` — DECODE-ONLY helper. ⚠️ NOT authentication. NOT a trust boundary. See [Security: bearer decoding](#security-bearer-decoding) below.
+// 1. Which tenant is this caller in? Throws if the answer is "none".
+const tenantId = requireTenantId({
+  kind: "session",
+  identity: { userId: "user_123", orgId: "org_abc" },
+});
 
-## 0.3.0 roadmap
-
-- D1 ghost Clerk identity injection.
-- Signed-JWT bearer verification (replacing the decode-only helper as the production trust boundary).
-- Co-designed in a Theta cycle.
-
-## Usage examples
-
-### Constant-time byte comparison
-
-```ts
-import { timingSafeEqual } from "@vantageos/cloud-identity/crypto";
-
-const a = new TextEncoder().encode(presentedHash);
-const b = new TextEncoder().encode(expectedHash);
-if (!(await timingSafeEqual(a, b))) {
-  return new Response("forbidden", { status: 403 });
-}
-```
-
-### Scope-aware row filtering
-
-```ts
-import { scopeFilterList } from "@vantageos/cloud-identity/scope-filter";
-import type { OAuthCtx } from "@vantageos/cloud-identity/types";
-
-const ctx: OAuthCtx = {
-  fromAllowList: ["alice"],
-  namespaceReadPrefixes: ["orchestrator/alpha"],
+// 2. Which of these rows may they see?
+const ctx = {
+  fromAllowList: ["reports"],
+  namespaceReadPrefixes: ["team/finance"],
   namespaceWritePrefixes: [],
 };
-const visible = scopeFilterList(ctx, rowsFromConvex);
-```
 
-### Master Bearer validation
+const rows = [
+  { createdBy: "reports", namespace: "team/finance" },    // kept
+  { createdBy: "someone-else", namespace: "team/legal" }, // dropped
+];
 
-```ts
-import { validateMasterBearer } from "@vantageos/cloud-identity/bearer-validation";
-
-const res = await validateMasterBearer(
-  request.headers.get("authorization") ?? undefined,
-  process.env.BEARER_SECRET_MASTER ?? "",
-);
-if (!res.ok) {
-  return new Response(`unauthorized: ${res.error}`, { status: 401 });
-}
+console.log(tenantId);                    // "org_abc"
+console.log(scopeFilterList(ctx, rows));  // only the first row
 ```
 
-### Domain-tenancy layer (0.2.0)
-
-#### getEffectiveTenantId — multi-tenant isolation guard
+Every symbol is available from the package root. Subpath imports
+(`@vantageos/cloud-identity/scope-filter` and friends) also work if you prefer
+to be explicit about where something comes from.
 
-```ts
-import { getEffectiveTenantId, ScopeViolationError } from "@vantageos/cloud-identity/tenancy-domain";
-import type { TenantContext } from "@vantageos/cloud-identity/tenancy-domain";
-
-// 1. Obtain ctx from your VERIFIED auth middleware. Examples:
-//    - Clerk session (clerkClient.verifyToken + claims → TenantContext)
-//    - signed-JWT middleware (jose / jsonwebtoken with public key)
-//    - Convex tenancy-table lookup against an opaque token
-//    Whatever path: ctx.workspaceId MUST come from a SIGNATURE-VERIFIED source.
-const ctx: TenantContext = await verifiedAuthMiddleware(request);
-
-// 2. At the top of every tool handler that receives a workspaceId argument:
-try {
-  const tenantId = getEffectiveTenantId(ctx, args);
-  // tenantId is safe — caller's verified ctx matches the requested workspace
-  const rows = await db.list({ workspaceId: tenantId });
-} catch (err) {
-  if (err instanceof ScopeViolationError) {
-    // Translate to 403 — do NOT expose details to caller
-    return new Response("forbidden", { status: 403 });
-  }
-  throw err;
-}
-```
+## Both caller paths, one contract
 
-#### decodeUnverifiedBearer — DECODE-ONLY helper
-
-> ⚠️ **NOT AUTHENTICATION. NOT A TRUST BOUNDARY.** See the [Security: bearer decoding](#security-bearer-decoding) section below.
+A right is never granted by an absent argument. `requireTenantId` refuses by
+default — a missing session, a missing organization, or a missing
+bearer-resolved workspace all throw; there is no branch that falls through to
+"full access" when tenant information is absent. The same function resolves
+both entry paths a VantagePeers Cloud request can arrive on:
 
 ```ts
-import { decodeUnverifiedBearer } from "@vantageos/cloud-identity/tenancy-domain";
-
-// Use cases:
-//   (a) tests / fixtures
-//   (b) shape-inspection of a payload that was ALREADY verified upstream
-//
-// Do NOT feed the returned `workspaceId` into getEffectiveTenantId as the
-// trusted `ctx.workspaceId` — the payload is attacker-controlled.
-
-const token = Buffer.from(JSON.stringify({
-  userId: "user_alice",
-  workspaceId: "ws_prod",
-  roles: ["Admin"],
-})).toString("base64");
-
-const { userId, workspaceId, roles } = await decodeUnverifiedBearer(token);
-```
-
-#### Zod schemas — validate workspace objects at boundaries
+import {
+  requireTenantId,
+  decodeUnverifiedBearer,
+  type TenantSource,
+} from "@vantageos/cloud-identity";
+
+async function resolveTenant(req: {
+  session?: { orgId?: string | null } | null;
+  bearerToken?: string;
+}): Promise<string> {
+  const source: TenantSource = req.session
+    ? { kind: "session", identity: req.session }
+    : {
+        // decodeUnverifiedBearer only decodes the shape — verify the token's
+        // signature (or look it up against your own store) before trusting
+        // any field on the payload. See "What this package does not do".
+        kind: "bearer",
+        context: await decodeUnverifiedBearer(req.bearerToken!),
+      };
+
+  // Throws for BOTH paths if no tenant is attached — never returns a
+  // "default" tenant id when one is missing.
+  return requireTenantId(source);
+}
 
-```ts
-import { workspaceSchema, tenantContextSchema } from "@vantageos/cloud-identity/tenancy-domain";
+// Human path: a signed-in user with an active organization.
+await resolveTenant({ session: { orgId: "org_abc" } }); // -> "org_abc"
 
-// Validate at API boundary
-const ws = workspaceSchema.parse(requestBody);
+// Machine path: a caller presenting an already-resolved bearer token.
+await resolveTenant({ bearerToken: someBase64Token }); // -> the token's workspaceId
 
-// Validate TenantContext from an external JWT payload
-const ctx = tenantContextSchema.parse(jwtPayload);
+// Either path with nothing attached throws instead of granting access.
+await resolveTenant({ session: null }); // throws Error("Unauthenticated: no session.")
 ```
 
-## Security: bearer decoding
-
-`decodeUnverifiedBearer` performs **no signature verification, no issuer check, no expiry check, no replay-attack protection**. The decoded payload is **attacker-controlled**.
-
-Forgery example:
-
-```ts
-// Any attacker can produce this token — no key, no signature required.
-const forged = Buffer.from(JSON.stringify({
-  userId: "x",
-  workspaceId: "victim-org",     // crosses tenant boundary
-  roles: ["Admin"],              // elevates privileges
-})).toString("base64");
-
-const payload = await decodeUnverifiedBearer(forged); // accepts it
+## What each function does
+
+**Tenant resolution and membership**
+
+- `requireTenantId(source)` — returns the caller's tenant id, or throws if
+  there is none. It accepts both entry paths behind one contract:
+  `{ kind: "session", identity }` for a signed-in human, and
+  `{ kind: "bearer", context }` for a machine caller. A missing session, a
+  missing organization and an empty organization id are all refusals, never a
+  default.
+- `getEffectiveTenantId(ctx, args)` — resolves which tenant a request should
+  act on when a caller may legitimately act on more than one.
+
+**Row filtering**
+
+- `passesScopeFilter(ctx, row)` — true when this row is visible to this
+  caller.
+- `scopeFilterList(ctx, rows)` — the subset of rows the caller may see.
+- `scopeFilterGet(ctx, row)` — the row, or `null` if the caller may not see it.
+- `isMasterScope(ctx)` / `isWildcardScope(ctx)` — true when the caller holds
+  unrestricted access. Useful for skipping filtering you know is pointless;
+  never as a substitute for it.
+
+Visibility is granted two ways: the row's `createdBy` appears in the caller's
+`fromAllowList`, or the row's `namespace` sits under one of the caller's
+`namespaceReadPrefixes`. Prefixes match on a path boundary, so a caller allowed
+`team/finance` does not thereby see `team/finance-archive`.
+
+**Token validation**
+
+- `validateMasterBearer(header, secret)` — compares an `Authorization: Bearer`
+  header against a shared secret in constant time, and reports *why* it failed:
+  header absent, header malformed, or value mismatched.
+- `timingSafeEqual(a, b)` — constant-time byte comparison, if you need to build
+  your own check.
+
+**Shapes**
+
+Zod schemas and their inferred TypeScript types for workspaces, members,
+roles and tenant context: `workspaceSchema` (type `Workspace`),
+`workspaceMemberSchema` (type `WorkspaceMember`), `workspaceRoleSchema`
+(type `WorkspaceRole`), `tenantContextSchema` (type `TenantContext`) — plus
+`ScopeViolationError` (payload type `ScopeViolationPayload`), for refusals you
+want to catch by type, and `BearerPayload`, the type returned by
+`decodeUnverifiedBearer`.
+
+**Supporting types** (no runtime code — import with `import type`)
+
+- `OAuthCtx` — the context object every scope-filter function above requires:
+  `{ fromAllowList, namespaceReadPrefixes, namespaceWritePrefixes, scope? }`.
+- `ScopeProfile`, `NamespacePrefix`, `FromAllowListEntry` — the field types
+  that make up `OAuthCtx`.
+- `ValidateMasterBearerResult` — the return type of `validateMasterBearer`.
+- `ScopeFilterable` — the minimal row shape (`{ createdBy?, namespace? }`)
+  accepted by `passesScopeFilter` / `scopeFilterList` / `scopeFilterGet`.
+- `SessionIdentity` — the human-path shape `requireTenantId` accepts under
+  `{ kind: "session", identity }` (see "Both caller paths, one contract").
+- `TenantSource` — the discriminated union `requireTenantId` accepts:
+  `{ kind: "session", identity }` or `{ kind: "bearer", context }`.
+
+## What this package does not do
+
+Worth reading before you rely on it.
+
+- **`decodeUnverifiedBearer` decodes a token. It does not verify one.** The
+  name is literal. It reads the payload out of a bearer token and checks its
+  shape; it does not check a signature, so the contents are whatever the caller
+  chose to put there. Treating its output as trusted is a vulnerability, not a
+  shortcut. Verify the token — a signed JWT, or a lookup against your own store
+  — before you believe any field in it.
+- **This is not an authentication system.** There is no user store, no login,
+  no session issuance. It takes an identity you have already established and
+  tells you what that identity may reach.
+- **It does not talk to your database.** `scopeFilterList` filters rows you
+  have already fetched. If fetching them was itself expensive or unsafe, filter
+  earlier, in your query.
+
+## Upgrading to 0.3.0
+
+**This release changes a default, and it breaks compilation on purpose.**
+
+Before 0.3.0, calling a scope-filter function without an authorization context
+returned `true` — no context meant full access. A caller who simply forgot to
+pass the context received every row, and no warning. From 0.3.0 the context is
+required: omitting it is a type error, and passing `null` or `undefined`
+throws.
+
+The breakage is deliberate, and it is the point. A caller that stops compiling
+is a caller that has been told. A caller that still compiles and quietly
+returns different rows is an incident nobody attributes to the upgrade.
+
+What to do:
+
+- If the call site has a real authorization context, pass it. This is almost
+  always the right fix, and the context is usually already in scope.
+- If the call site genuinely means "unrestricted", pass the exported constant
+  `LEGACY_WILDCARD_CTX` by name. It reproduces the old behaviour exactly. It
+  has to be written out, because an intentional bypass belongs in a code review
+  and an accidental one should not be possible.
+
+```js
+import { scopeFilterList, LEGACY_WILDCARD_CTX } from "@vantageos/cloud-identity";
+
+scopeFilterList(LEGACY_WILDCARD_CTX, rows); // explicit, unrestricted
 ```
 
-Feeding the decoded `workspaceId` into `getEffectiveTenantId` as the trusted `ctx.workspaceId` silently grants cross-tenant access — the multi-tenant isolation guard collapses because both `ctx` and `args` are then attacker-controlled.
+`requireTenantId` is also new in 0.3.0. Nothing existing calls it, so it breaks
+nothing.
 
-**Use only as**:
-- a test fixture / harness helper, OR
-- a decoder for a bearer that was ALREADY verified by an upstream signed-JWT or opaque-token middleware (the production trust boundary).
+Version history is in [CHANGELOG.md](./CHANGELOG.md).
 
-**Production trust boundary** is one of:
-- Clerk session verification (planned 0.3.0 D1 ghost identity injection)
-- signed JWT with rotating issuer key (planned 0.3.0)
-- opaque-token lookup against a Convex tenancy table
-
-Do **not** publish a service that treats `decodeUnverifiedBearer` as authentication.
-
-## Security doctrine
+## License
 
-Canonical reference: `docs/cloud/security-multi-tenant.md` in the `vantage-peers` repo.
+FSL-1.1-Apache-2.0. See [LICENSE](./LICENSE).
 
-## License
+## Issues
 
-MIT — VantagePeers Cloud, 2026.
+https://github.com/vantageos-agency/cloud-identity/issues

package/dist/bearer-validation.d.ts

@@ -1,9 +1,8 @@
 /**
  * Master-token Bearer validation.
  *
- * Extracted from the master-gate logic in
- * `vantage-memory/mcp-server/server-http.ts` (`masterOnlyMiddleware`) and
- * HARDENED per @vantageos/cloud-identity 0.1.0 contract:
+ * Extracted from an earlier in-tree master-gate middleware and HARDENED per
+ * this package's contract:
  *   - SHA-256 hash both the presented token AND the configured master secret,
  *     then compare the two digests with `timingSafeEqual` (constant time).
  *   - The original middleware did a direct `token !== masterToken` string

package/dist/bearer-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-validation.d.ts","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAU7D;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAsBrC"}
+{"version":3,"file":"bearer-validation.d.ts","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAU7D;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAsBrC"}

package/dist/bearer-validation.js

@@ -1,9 +1,8 @@
 /**
  * Master-token Bearer validation.
  *
- * Extracted from the master-gate logic in
- * `vantage-memory/mcp-server/server-http.ts` (`masterOnlyMiddleware`) and
- * HARDENED per @vantageos/cloud-identity 0.1.0 contract:
+ * Extracted from an earlier in-tree master-gate middleware and HARDENED per
+ * this package's contract:
  *   - SHA-256 hash both the presented token AND the configured master secret,
  *     then compare the two digests with `timingSafeEqual` (constant time).
  *   - The original middleware did a direct `token !== masterToken` string

package/dist/bearer-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-validation.js","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC,KAAK,UAAU,WAAW,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAA8B,EAC9B,YAAoB;IAEpB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,sEAAsE;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,WAAW,CAAC,KAAK,CAAC;QAClB,WAAW,CAAC,YAAY,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"bearer-validation.js","sourceRoot":"","sources":["../src/bearer-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC,KAAK,UAAU,WAAW,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAA8B,EAC9B,YAAoB;IAEpB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,sEAAsE;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpD,WAAW,CAAC,KAAK,CAAC;QAClB,WAAW,CAAC,YAAY,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC"}

package/dist/crypto.d.ts

@@ -1,11 +1,9 @@
 /**
  * Constant-time byte-array comparison.
  *
- * Ported from `vantage-memory/mcp-server/src/crypto.ts` (Day 47 master-token
- * gate, Eta F1 MAJOR PR #621). Surface adapted from `(string, string)` to
- * `(Uint8Array, Uint8Array)` per @vantageos/cloud-identity 0.1.0 contract so
- * the helper is framework-agnostic and reusable by any caller (hash bytes,
- * raw token bytes, HMAC tags, etc.).
+ * Takes `(Uint8Array, Uint8Array)` rather than strings so the helper stays
+ * framework-agnostic and reusable by any caller: hash bytes, raw token
+ * bytes, HMAC tags.
  *
  * Algorithm (identical to source):
  *   1. Length mismatch → still run a dummy Web Crypto HMAC over equal-length

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,UAAU,EACb,CAAC,EAAE,UAAU,GACZ,OAAO,CAAC,OAAO,CAAC,CAoBlB"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,CAAC,EAAE,UAAU,EACb,CAAC,EAAE,UAAU,GACZ,OAAO,CAAC,OAAO,CAAC,CAoBlB"}

package/dist/crypto.js

@@ -1,11 +1,9 @@
 /**
  * Constant-time byte-array comparison.
  *
- * Ported from `vantage-memory/mcp-server/src/crypto.ts` (Day 47 master-token
- * gate, Eta F1 MAJOR PR #621). Surface adapted from `(string, string)` to
- * `(Uint8Array, Uint8Array)` per @vantageos/cloud-identity 0.1.0 contract so
- * the helper is framework-agnostic and reusable by any caller (hash bytes,
- * raw token bytes, HMAC tags, etc.).
+ * Takes `(Uint8Array, Uint8Array)` rather than strings so the helper stays
+ * framework-agnostic and reusable by any caller: hash bytes, raw token
+ * bytes, HMAC tags.
  *
  * Algorithm (identical to source):
  *   1. Length mismatch → still run a dummy Web Crypto HMAC over equal-length

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAa,EACb,CAAa;IAEb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAgC,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,CAAa,EACb,CAAa;IAEb,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAsC,EACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAgC,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/index.d.ts

@@ -1,14 +1,16 @@
 /**
  * @vantageos/cloud-identity — public surface.
  *
- * Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud
- * (multi-tenant MCP). Consumed by `vantage-peers-mcp` and
- * `@vantageos/vantage-crm-mcp`.
+ * Framework-agnostic building blocks for multi-tenant authorization:
+ * tenant resolution, membership requirement, row filtering and bearer
+ * validation.
  */
 export { timingSafeEqual } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, type ScopeFilterable, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 export type { OAuthCtx, ScopeProfile, NamespacePrefix, FromAllowListEntry, ValidateMasterBearerResult, } from "./types.js";
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
 export type { Workspace, WorkspaceMember, WorkspaceRole, TenantContext, ScopeViolationPayload, BearerPayload, } from "./tenancy-domain.js";
+export { requireTenantId } from "./org-guard.js";
+export type { SessionIdentity, TenantSource } from "./org-guard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,13 +1,15 @@
 /**
  * @vantageos/cloud-identity — public surface.
  *
- * Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud
- * (multi-tenant MCP). Consumed by `vantage-peers-mcp` and
- * `@vantageos/vantage-crm-mcp`.
+ * Framework-agnostic building blocks for multi-tenant authorization:
+ * tenant resolution, membership requirement, row filtering and bearer
+ * validation.
  */
 export { timingSafeEqual } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 // 0.2.0 — Domain-tenancy layer (additive)
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
+// Organization-membership guard (unified session + bearer contract)
+export { requireTenantId } from "./org-guard.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,oEAAoE;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/org-guard.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @vantageos/cloud-identity — Organization-membership guard.
+ * (See package.json "version" for the release this shipped in.)
+ *
+ * Closes the second measured 0.2.0 defect: the published package exposed no
+ * "must belong to an organization" gate anywhere (`grep -rlE
+ * "requireOrg|orgRequired|orgId" package/dist/*.js` returned no matches on
+ * the 0.2.0 tarball). Absence of an organization must REFUSE, never fall
+ * through to full access — the same defect class as the scope-filter fix in
+ * `./scope-filter.ts`.
+ *
+ * The semantics are reused verbatim from a Convex implementation of the same
+ * guard rather than reinvented — a second implementation of one authorization
+ * check is a second chance to get it wrong. That original:
+ *
+ *   - takes a Convex `QueryCtx | MutationCtx | ActionCtx`
+ *   - derives identity via `ctx.auth.getUserIdentity()`
+ *   - throws when there is no session
+ *   - throws when `identity.org_id` is not a non-empty string
+ *   - returns the org id
+ *
+ * ADAPTATION (named per the brief's requirement to flag any semantic
+ * deviation): this package is framework-agnostic and has no `ctx.auth`. The
+ * caller pre-resolves whichever identity/bearer object it already has
+ * (Clerk session identity for the human path, or the package's own
+ * `TenantContext` — see `./tenancy-domain.ts` — for the machine/bearer path)
+ * and passes it in as a `TenantSource`. The refuse-on-absence /
+ * refuse-on-empty semantics are otherwise identical to the source function;
+ * no other behavioural change was made.
+ *
+ * This is the membership half of the package's contract; tenant resolution,
+ * row filtering and identifier validation are covered by
+ * `getEffectiveTenantId`, `passesScopeFilter`/`scopeFilterList` and
+ * `validateMasterBearer` respectively. Framework adapters wrap
+ * `requireTenantId`; they must never reimplement its checks.
+ */
+import type { TenantContext } from "./tenancy-domain.js";
+/**
+ * Minimal shape of a resolved human-path session identity. Intentionally
+ * framework-agnostic: the caller derives this from Clerk (or any other
+ * session provider) before calling `requireTenantId` — this package never
+ * imports a session SDK.
+ */
+export type SessionIdentity = {
+    orgId?: string | null;
+};
+/**
+ * Discriminated union covering both VantagePeers Cloud entry paths behind
+ * one contract:
+ *   - `session`: human path, via a connection/login provider (Clerk, etc.).
+ *   - `bearer`: machine path, via a resolved, ALREADY-VERIFIED token
+ *     (`TenantContext` — see `decodeUnverifiedBearer` / the planned signed-JWT
+ *     verifier for how a `TenantContext` gets produced).
+ */
+export type TenantSource = {
+    kind: "session";
+    identity: SessionIdentity | null | undefined;
+} | {
+    kind: "bearer";
+    context: TenantContext;
+};
+/**
+ * Resolve the caller's tenant id, refusing when no organization/workspace is
+ * attached — for EITHER entry path, behind one contract.
+ *
+ *   - `kind: "session"` and `identity` is null/undefined → throws
+ *     ("Unauthenticated: no session.")
+ *   - `kind: "session"` and `identity.orgId` is missing or empty → throws
+ *     ("No active organization on this session...")
+ *   - `kind: "bearer"` and `context.workspaceId` is missing or empty → throws
+ *     ("No workspace on this bearer-resolved tenant context...")
+ *   - otherwise → returns the tenant id (orgId, or workspaceId)
+ *
+ * A right is never granted by absence: every branch above refuses by
+ * throwing, there is no fallback branch that returns a value when
+ * organization/workspace information is missing.
+ */
+export declare function requireTenantId(source: TenantSource): string;
+//# sourceMappingURL=org-guard.d.ts.map

package/dist/org-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-guard.d.ts","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAqB5D"}

package/dist/org-guard.js

@@ -0,0 +1,70 @@
+/**
+ * @vantageos/cloud-identity — Organization-membership guard.
+ * (See package.json "version" for the release this shipped in.)
+ *
+ * Closes the second measured 0.2.0 defect: the published package exposed no
+ * "must belong to an organization" gate anywhere (`grep -rlE
+ * "requireOrg|orgRequired|orgId" package/dist/*.js` returned no matches on
+ * the 0.2.0 tarball). Absence of an organization must REFUSE, never fall
+ * through to full access — the same defect class as the scope-filter fix in
+ * `./scope-filter.ts`.
+ *
+ * The semantics are reused verbatim from a Convex implementation of the same
+ * guard rather than reinvented — a second implementation of one authorization
+ * check is a second chance to get it wrong. That original:
+ *
+ *   - takes a Convex `QueryCtx | MutationCtx | ActionCtx`
+ *   - derives identity via `ctx.auth.getUserIdentity()`
+ *   - throws when there is no session
+ *   - throws when `identity.org_id` is not a non-empty string
+ *   - returns the org id
+ *
+ * ADAPTATION (named per the brief's requirement to flag any semantic
+ * deviation): this package is framework-agnostic and has no `ctx.auth`. The
+ * caller pre-resolves whichever identity/bearer object it already has
+ * (Clerk session identity for the human path, or the package's own
+ * `TenantContext` — see `./tenancy-domain.ts` — for the machine/bearer path)
+ * and passes it in as a `TenantSource`. The refuse-on-absence /
+ * refuse-on-empty semantics are otherwise identical to the source function;
+ * no other behavioural change was made.
+ *
+ * This is the membership half of the package's contract; tenant resolution,
+ * row filtering and identifier validation are covered by
+ * `getEffectiveTenantId`, `passesScopeFilter`/`scopeFilterList` and
+ * `validateMasterBearer` respectively. Framework adapters wrap
+ * `requireTenantId`; they must never reimplement its checks.
+ */
+/**
+ * Resolve the caller's tenant id, refusing when no organization/workspace is
+ * attached — for EITHER entry path, behind one contract.
+ *
+ *   - `kind: "session"` and `identity` is null/undefined → throws
+ *     ("Unauthenticated: no session.")
+ *   - `kind: "session"` and `identity.orgId` is missing or empty → throws
+ *     ("No active organization on this session...")
+ *   - `kind: "bearer"` and `context.workspaceId` is missing or empty → throws
+ *     ("No workspace on this bearer-resolved tenant context...")
+ *   - otherwise → returns the tenant id (orgId, or workspaceId)
+ *
+ * A right is never granted by absence: every branch above refuses by
+ * throwing, there is no fallback branch that returns a value when
+ * organization/workspace information is missing.
+ */
+export function requireTenantId(source) {
+    if (source.kind === "session") {
+        if (!source.identity) {
+            throw new Error("Unauthenticated: no session.");
+        }
+        const orgId = source.identity.orgId;
+        if (typeof orgId !== "string" || orgId.length === 0) {
+            throw new Error("No active organization on this session: select an organization before accessing agents.");
+        }
+        return orgId;
+    }
+    const workspaceId = source.context?.workspaceId;
+    if (typeof workspaceId !== "string" || workspaceId.length === 0) {
+        throw new Error("No workspace on this bearer-resolved tenant context: the bearer must resolve to a non-empty workspaceId.");
+    }
+    return workspaceId;
+}
+//# sourceMappingURL=org-guard.js.map

package/dist/org-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-guard.js","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA0BH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;IAChD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/scope-filter.d.ts

@@ -1,18 +1,24 @@
 /**
- * Sprint S3.1 B2 — scope-aware filter helpers for VP MCP tools.
+ * Scope-aware row filter.
  *
- * Ported from `vantage-memory/mcp-server/src/scope-filter.ts`. Behaviour is
- * preserved verbatim; only the type dependency on the in-tree `OAuthContext`
- * is replaced by the framework-agnostic `OAuthCtx` from `./types`.
+ * The behaviour was preserved verbatim from an earlier in-tree
+ * implementation; the only change was replacing a framework-specific context
+ * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
- * Doctrine references:
- *   - decisions/doctrine-scope-aware-filter-2026-05-26.md (D3 base)
- *   - memory j579y6f31g7xzgtgdnpgetdmjx87ztyj (D9-D14 extension)
- *
- * Contract:
+ * Contract (0.3.0 — BREAKING vs. 0.2.0):
+ *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
+ *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
+ *     (as if the caller were master-scoped) was the exact defect class this
+ *     release closes. Every exported function below now requires `OAuthCtx`
+ *     at the type level — an omitted argument breaks the caller's build,
+ *     it never falls through to a more permissive runtime path.
+ *   - Callers that genuinely need the old legacy-bearer wildcard behaviour
+ *     MUST import and pass `LEGACY_WILDCARD_CTX` explicitly — the compat
+ *     path is requested by name, never inferred from a missing argument.
+ *   - As defense-in-depth against callers that bypass the type system
+ *     (untyped JS, `as any`), every function also throws at runtime if
+ *     `oauthCtx` is nullish, instead of silently granting access.
  *   - Master scope (scope === "master" OR fromAllowList includes "*") = wildcard pass.
- *   - Legacy bearer (oauthCtx === undefined) = wildcard pass (treated as master-
- *     equivalent for backward-compatibility with mcpTenants Pi/Tau/Phi paths).
  *   - Non-master scope = row passes iff:
  *       row.createdBy ∈ oauthCtx.fromAllowList
  *       OR
@@ -24,6 +30,12 @@
  * imports — to keep the helpers trivially unit-testable.
  */
 import type { OAuthCtx } from "./types.js";
+/**
+ * Explicit legacy-compat sentinel. Passing this constant reproduces the
+ * pre-0.3.0 "no oauthCtx" wildcard behaviour — but the caller must import
+ * and pass it BY NAME. It is never inferred from an omitted argument.
+ */
+export declare const LEGACY_WILDCARD_CTX: OAuthCtx;
 /**
  * Row shape accepted by the scope filter. All fields optional because real
  * Convex documents from list_peers / list_messages / etc. don't all carry both.
@@ -37,35 +49,38 @@ export type ScopeFilterable = {
  * Mirrors `isMasterScope` from the source module: `scope === "master"` OR
  * `fromAllowList` contains the `"*"` sentinel.
  */
-export declare function isMasterScope(ctx: OAuthCtx | undefined): boolean;
+export declare function isMasterScope(ctx: OAuthCtx): boolean;
 /**
  * Core predicate. Returns true when the row is visible to the caller.
  *
  *   - Master scope (isMasterScope === true)            → true (wildcard)
- *   - Legacy bearer (oauthCtx === undefined)           → true (back-compat)
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
  *   - otherwise                                        → false
  *
+ * `oauthCtx` is mandatory (see module-level contract note above): an omitted
+ * argument throws instead of silently granting wildcard access. Callers that
+ * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
+ * explicitly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
-export declare function passesScopeFilter(oauthCtx: OAuthCtx | undefined, row: ScopeFilterable): boolean;
+export declare function passesScopeFilter(oauthCtx: OAuthCtx, row: ScopeFilterable): boolean;
 /**
  * Filter a list of rows (post-query). Used by list_* tools.
  */
-export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx | undefined, rows: T[]): T[];
+export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[]): T[];
 /**
  * Assert a single row passes (get_* tools). Returns the row when allowed, null
  * otherwise — callers translate null to a 404-equivalent "not found" MCP error
  * to avoid leaking the difference between "absent" and "filtered out".
  */
-export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx | undefined, row: T | null | undefined): T | null;
+export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined): T | null;
 /**
  * Helper for callers that want a single "is master / legacy" predicate.
- * Mirrors the legacy-bearer-passes-through convention.
  */
-export declare function isWildcardScope(ctx: OAuthCtx | undefined): boolean;
+export declare function isWildcardScope(ctx: OAuthCtx): boolean;
 //# sourceMappingURL=scope-filter.d.ts.map

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAIhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,GAAG,EAAE,eAAe,GACnB,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,IAAI,EAAE,CAAC,EAAE,GACR,CAAC,EAAE,CAEL;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACxB,CAAC,GAAG,IAAI,CAGV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAGlE"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,eAAe,GACnB,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,GACR,CAAC,EAAE,CAGL;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACxB,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -1,18 +1,24 @@
 /**
- * Sprint S3.1 B2 — scope-aware filter helpers for VP MCP tools.
+ * Scope-aware row filter.
  *
- * Ported from `vantage-memory/mcp-server/src/scope-filter.ts`. Behaviour is
- * preserved verbatim; only the type dependency on the in-tree `OAuthContext`
- * is replaced by the framework-agnostic `OAuthCtx` from `./types`.
+ * The behaviour was preserved verbatim from an earlier in-tree
+ * implementation; the only change was replacing a framework-specific context
+ * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
- * Doctrine references:
- *   - decisions/doctrine-scope-aware-filter-2026-05-26.md (D3 base)
- *   - memory j579y6f31g7xzgtgdnpgetdmjx87ztyj (D9-D14 extension)
- *
- * Contract:
+ * Contract (0.3.0 — BREAKING vs. 0.2.0):
+ *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
+ *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
+ *     (as if the caller were master-scoped) was the exact defect class this
+ *     release closes. Every exported function below now requires `OAuthCtx`
+ *     at the type level — an omitted argument breaks the caller's build,
+ *     it never falls through to a more permissive runtime path.
+ *   - Callers that genuinely need the old legacy-bearer wildcard behaviour
+ *     MUST import and pass `LEGACY_WILDCARD_CTX` explicitly — the compat
+ *     path is requested by name, never inferred from a missing argument.
+ *   - As defense-in-depth against callers that bypass the type system
+ *     (untyped JS, `as any`), every function also throws at runtime if
+ *     `oauthCtx` is nullish, instead of silently granting access.
  *   - Master scope (scope === "master" OR fromAllowList includes "*") = wildcard pass.
- *   - Legacy bearer (oauthCtx === undefined) = wildcard pass (treated as master-
- *     equivalent for backward-compatibility with mcpTenants Pi/Tau/Phi paths).
  *   - Non-master scope = row passes iff:
  *       row.createdBy ∈ oauthCtx.fromAllowList
  *       OR
@@ -23,14 +29,30 @@
  * NOTE: this module is intentionally framework-agnostic — no McpServer / Hono
  * imports — to keep the helpers trivially unit-testable.
  */
+/**
+ * Explicit legacy-compat sentinel. Passing this constant reproduces the
+ * pre-0.3.0 "no oauthCtx" wildcard behaviour — but the caller must import
+ * and pass it BY NAME. It is never inferred from an omitted argument.
+ */
+export const LEGACY_WILDCARD_CTX = {
+    scope: "master",
+    fromAllowList: ["*"],
+    namespaceReadPrefixes: [],
+    namespaceWritePrefixes: [],
+};
+function assertOauthCtx(oauthCtx) {
+    if (oauthCtx == null) {
+        throw new TypeError("oauthCtx is required — pass an explicit OAuthCtx, or LEGACY_WILDCARD_CTX " +
+            "if you deliberately want the pre-0.3.0 legacy-bearer wildcard behaviour.");
+    }
+}
 /**
  * Returns true when the scope profile grants full, wildcard access.
  * Mirrors `isMasterScope` from the source module: `scope === "master"` OR
  * `fromAllowList` contains the `"*"` sentinel.
  */
 export function isMasterScope(ctx) {
-    if (!ctx)
-        return false;
+    assertOauthCtx(ctx);
     if (ctx.scope === "master")
         return true;
     return ctx.fromAllowList.includes("*");
@@ -39,19 +61,22 @@ export function isMasterScope(ctx) {
  * Core predicate. Returns true when the row is visible to the caller.
  *
  *   - Master scope (isMasterScope === true)            → true (wildcard)
- *   - Legacy bearer (oauthCtx === undefined)           → true (back-compat)
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
  *   - otherwise                                        → false
  *
+ * `oauthCtx` is mandatory (see module-level contract note above): an omitted
+ * argument throws instead of silently granting wildcard access. Callers that
+ * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
+ * explicitly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
 export function passesScopeFilter(oauthCtx, row) {
-    if (!oauthCtx)
-        return true;
+    assertOauthCtx(oauthCtx);
     if (isMasterScope(oauthCtx))
         return true;
     const { createdBy, namespace } = row;
@@ -71,6 +96,7 @@ export function passesScopeFilter(oauthCtx, row) {
  * Filter a list of rows (post-query). Used by list_* tools.
  */
 export function scopeFilterList(oauthCtx, rows) {
+    assertOauthCtx(oauthCtx);
     return rows.filter((r) => passesScopeFilter(oauthCtx, r));
 }
 /**
@@ -79,17 +105,16 @@ export function scopeFilterList(oauthCtx, rows) {
  * to avoid leaking the difference between "absent" and "filtered out".
  */
 export function scopeFilterGet(oauthCtx, row) {
+    assertOauthCtx(oauthCtx);
     if (row == null)
         return null;
     return passesScopeFilter(oauthCtx, row) ? row : null;
 }
 /**
  * Helper for callers that want a single "is master / legacy" predicate.
- * Mirrors the legacy-bearer-passes-through convention.
  */
 export function isWildcardScope(ctx) {
-    if (!ctx)
-        return true;
+    assertOauthCtx(ctx);
     return isMasterScope(ctx);
 }
 //# sourceMappingURL=scope-filter.js.map

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA8B,EAC9B,GAAoB;IAEpB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA8B,EAC9B,IAAS;IAET,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA8B,EAC9B,GAAyB;IAEzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAoB;IAEpB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS;IAET,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB;IAEzB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/tenancy-domain.d.ts

@@ -12,12 +12,8 @@
  *   - getEffectiveTenantId(ctx, args) — multi-tenant isolation guard
  *   - decodeUnverifiedBearer(token) — DECODE-ONLY helper, NOT authentication.
  *     The decoded payload is attacker-controlled. Production code MUST use a
- *     signed JWT or opaque-token lookup (planned: 0.3.0) before treating the
- *     payload as a trust boundary.
- *
- * Task: k177hejb4tc5em5p70m9hxwn3x88kyp4
- * Mission: k57b4t2q VR Cloud MVP Day 100
- * Orchestrator: Sigma — VantagePeers | 2026-06-13
+ *     signed JWT or opaque-token lookup before treating the payload as a
+ *     trust boundary.
  */
 import { z } from "zod";
 export declare const workspaceRoleSchema: z.ZodEnum<{
@@ -110,8 +106,8 @@ export declare function getEffectiveTenantId(ctx: TenantContext, args: {
  *     middleware (the production trust boundary)
  *
  * For the production trust boundary, callers MUST substitute a signed JWT
- * (planned export in 0.3.0) or an opaque-token lookup against a Convex
- * tenancy table.
+ * verifier (not yet exported by this package) or an opaque-token lookup
+ * against a Convex tenancy table.
  *
  * Renamed from `resolveBearer` (0.2.0 pre-release) to make the lack of
  * verification impossible to miss at the call-site.

package/dist/tenancy-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy-domain.d.ts","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,eAAO,MAAM,qBAAqB;;;;;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,mBAAmB;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;gBAE5B,OAAO,EAAE,qBAAqB;CAS3C;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5B,MAAM,CASR;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CAmBxB"}
+{"version":3,"file":"tenancy-domain.d.ts","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,eAAO,MAAM,qBAAqB;;;;;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,mBAAmB;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;gBAE5B,OAAO,EAAE,qBAAqB;CAS3C;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5B,MAAM,CASR;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CAmBxB"}

package/dist/tenancy-domain.js

@@ -12,12 +12,8 @@
  *   - getEffectiveTenantId(ctx, args) — multi-tenant isolation guard
  *   - decodeUnverifiedBearer(token) — DECODE-ONLY helper, NOT authentication.
  *     The decoded payload is attacker-controlled. Production code MUST use a
- *     signed JWT or opaque-token lookup (planned: 0.3.0) before treating the
- *     payload as a trust boundary.
- *
- * Task: k177hejb4tc5em5p70m9hxwn3x88kyp4
- * Mission: k57b4t2q VR Cloud MVP Day 100
- * Orchestrator: Sigma — VantagePeers | 2026-06-13
+ *     signed JWT or opaque-token lookup before treating the payload as a
+ *     trust boundary.
  */
 import { z } from "zod";
 // ---------------------------------------------------------------------------
@@ -120,8 +116,8 @@ export function getEffectiveTenantId(ctx, args) {
  *     middleware (the production trust boundary)
  *
  * For the production trust boundary, callers MUST substitute a signed JWT
- * (planned export in 0.3.0) or an opaque-token lookup against a Convex
- * tenancy table.
+ * verifier (not yet exported by this package) or an opaque-token lookup
+ * against a Convex tenancy table.
  *
  * Renamed from `resolveBearer` (0.2.0 pre-release) to make the lack of
  * verification impossible to miss at the call-site.

package/dist/tenancy-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy-domain.js","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAaH;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,iBAA0B,CAAC;IAClC,OAAO,CAAwB;IAExC,YAAY,OAA8B;QACxC,KAAK,CACH,sCAAsC,OAAO,CAAC,iBAAiB,oCAAoC,OAAO,CAAC,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,CAClJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,kFAAkF;QAClF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkB,EAClB,IAA6B;IAE7B,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,mBAAmB,CAAC;YAC5B,iBAAiB,EAAE,IAAI,CAAC,WAAW;YACnC,eAAe,EAAE,GAAG,CAAC,WAAW;YAChC,MAAM,EAAE,qEAAqE;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa;IAEb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"tenancy-domain.js","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAaH;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,iBAA0B,CAAC;IAClC,OAAO,CAAwB;IAExC,YAAY,OAA8B;QACxC,KAAK,CACH,sCAAsC,OAAO,CAAC,iBAAiB,oCAAoC,OAAO,CAAC,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,CAClJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,kFAAkF;QAClF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkB,EAClB,IAA6B;IAE7B,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,mBAAmB,CAAC;YAC5B,iBAAiB,EAAE,IAAI,CAAC,WAAW;YACnC,eAAe,EAAE,GAAG,CAAC,WAAW;YAChC,MAAM,EAAE,qEAAqE;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa;IAEb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -53,7 +53,7 @@
     "identity"
   ],
   "author": "VantagePeers Cloud",
-  "license": "MIT",
+  "license": "FSL-1.1-Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vantageos-agency/cloud-identity.git"