@vantageos/cloud-identity 0.2.0 → 0.4.0

package/dist/human-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-path.d.ts","sourceRoot":"","sources":["../src/human-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;;;EAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAMF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAoBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,qBAAqB,CAiCvB"}

package/dist/human-path.js

@@ -0,0 +1,117 @@
+/**
+ * @vantageos/cloud-identity 0.4.0 — Human-path resolver (Clerk → { tenant,
+ * subject, role }).
+ *
+ * Additive-only: does not import any Clerk SDK, and does not modify any
+ * existing export. The caller resolves a Clerk session (or any session
+ * provider with an equivalent shape) *outside* this package and passes in a
+ * plain, already-resolved object; this module only normalizes it into the
+ * package's contract.
+ *
+ * `role` is a NEW literal union (`owner | admin | member | client`),
+ * distinct from `workspaceRoleSchema` (`Admin | Editor | Viewer`) in
+ * `./tenancy-domain.ts` — the two are unrelated vocabularies (workspace
+ * membership role vs. organization-account role) and are never conflated.
+ *
+ * Consistent with the package's "a right is presented, never inferred from
+ * an absence" contract: a session with no organization refuses (throws),
+ * and an unrecognized/absent Clerk org role refuses (throws) rather than
+ * silently defaulting to a role.
+ */
+import { z } from "zod";
+// ---------------------------------------------------------------------------
+// HumanAccountRole
+// ---------------------------------------------------------------------------
+export const humanAccountRoleSchema = z.enum([
+    "owner",
+    "admin",
+    "member",
+    "client",
+]);
+/**
+ * Maps Clerk's own org-role strings (`org:admin`, `org:member`, etc. — and
+ * their bare forms `admin`, `member`) onto the package's `HumanAccountRole`
+ * union. Deliberately explicit and exhaustive-by-throw: any string not
+ * listed here is refused rather than silently coerced to a default, per
+ * "presented, never inferred from an absence."
+ */
+const CLERK_ORG_ROLE_MAP = {
+    "org:owner": "owner",
+    owner: "owner",
+    "org:admin": "admin",
+    admin: "admin",
+    "org:member": "member",
+    member: "member",
+    "org:client": "client",
+    client: "client",
+};
+/**
+ * @security ⚠️ DECODE/NORMALIZE-ONLY. NOT AUTHENTICATION. NOT VERIFICATION.
+ *
+ * This function does NOT authenticate a request and does NOT verify
+ * anything. It NORMALIZES a session that the caller has ALREADY verified
+ * upstream — e.g. via Clerk's own server-side `auth()` in a Next.js/Convex
+ * server context — into this package's `{ tenant, subject, role }` contract.
+ *
+ * Passing an unverified, client-supplied object here (for example
+ * `req.body`, a query-string payload, or anything else an attacker
+ * controls) makes THAT object the trusted source of `tenant`, `subject`,
+ * AND `role` — a privilege-escalation bug. The shape checks below (missing
+ * orgId/userId/orgRole) only guard against malformed input; they perform
+ * NO signature check, NO issuer check, NO session-validity check.
+ *
+ * Callers MUST verify the session upstream (Clerk `auth()` server-side, or
+ * an equivalent signed-session verifier) BEFORE calling this function. Only
+ * pass in the object Clerk itself already verified — never pass through an
+ * unverified request body.
+ *
+ * Resolves an already-verified, framework-agnostic Clerk session object into
+ * the package's `{ tenant, subject, role }` contract.
+ *
+ *   - throws when `session` is null/undefined ("Unauthenticated: no
+ *     session.") — same refusal message class as `requireTenantId`'s
+ *     session branch, for consistent error handling across both resolvers.
+ *   - throws when `session.orgId` is missing or empty ("No active
+ *     organization on this session...") — human path is cloud fail-closed,
+ *     same invariant as `requireTenantId`.
+ *   - throws when `session.userId` is missing or empty.
+ *   - throws when `session.orgRole` is missing, empty, or not a recognized
+ *     Clerk org role (unknown roles are refused, never defaulted).
+ *
+ * Named to make the already-verified precondition explicit at the
+ * call-site — see CHANGELOG.md 0.4.0 for the naming history — mirroring
+ * `decodeUnverifiedBearer`'s equivalent rename in `./tenancy-domain.ts`.
+ *
+ * @example
+ * ```ts
+ * // session MUST already be verified upstream, e.g.:
+ * // const { orgId, userId, orgRole } = await auth(); // Clerk server-side
+ * const { tenant, subject, role } = normalizeVerifiedHumanSession({
+ *   orgId: "org_abc",
+ *   userId: "user_123",
+ *   orgRole: "org:admin",
+ * });
+ * // -> { tenant: "org_abc", subject: "user_123", role: "admin" }
+ * ```
+ */
+export function normalizeVerifiedHumanSession(session) {
+    if (!session) {
+        throw new Error("Unauthenticated: no session.");
+    }
+    const { orgId, userId, orgRole } = session;
+    if (typeof orgId !== "string" || orgId.length === 0) {
+        throw new Error("No active organization on this session: select an organization before accessing agents.");
+    }
+    if (typeof userId !== "string" || userId.length === 0) {
+        throw new Error("No user id on this session: cannot resolve subject.");
+    }
+    if (typeof orgRole !== "string" || orgRole.length === 0) {
+        throw new Error("No organization role on this session: role must be presented explicitly, never inferred.");
+    }
+    const mapped = CLERK_ORG_ROLE_MAP[orgRole];
+    if (!mapped) {
+        throw new Error(`Unrecognized organization role "${orgRole}": expected one of ${Object.keys(CLERK_ORG_ROLE_MAP).join(", ")}.`);
+    }
+    return { tenant: orgId, subject: userId, role: mapped };
+}
+//# sourceMappingURL=human-path.js.map

package/dist/human-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-path.js","sourceRoot":"","sources":["../src/human-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AA6BH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAqC;IAC3D,WAAW,EAAE,OAAO;IACpB,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,OAAO;IACpB,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C;IAE5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,sBAAsB,MAAM,CAAC,IAAI,CACzE,kBAAkB,CACnB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC"}

package/dist/index.d.ts

@@ -1,14 +1,18 @@
 /**
  * @vantageos/cloud-identity — public surface.
  *
- * Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud
- * (multi-tenant MCP). Consumed by `vantage-peers-mcp` and
- * `@vantageos/vantage-crm-mcp`.
+ * Framework-agnostic building blocks for multi-tenant authorization:
+ * tenant resolution, membership requirement, row filtering and bearer
+ * validation.
  */
 export { timingSafeEqual } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, type ScopeFilterable, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 export type { OAuthCtx, ScopeProfile, NamespacePrefix, FromAllowListEntry, ValidateMasterBearerResult, } from "./types.js";
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
 export type { Workspace, WorkspaceMember, WorkspaceRole, TenantContext, ScopeViolationPayload, BearerPayload, } from "./tenancy-domain.js";
+export { requireTenantId } from "./org-guard.js";
+export type { SessionIdentity, TenantSource, DeploymentMode, } from "./org-guard.js";
+export { humanAccountRoleSchema, normalizeVerifiedHumanSession } from "./human-path.js";
+export type { HumanAccountRole, ClerkSessionLike, ResolvedHumanIdentity, } from "./human-path.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EACV,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AACxF,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -1,13 +1,17 @@
 /**
  * @vantageos/cloud-identity — public surface.
  *
- * Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud
- * (multi-tenant MCP). Consumed by `vantage-peers-mcp` and
- * `@vantageos/vantage-crm-mcp`.
+ * Framework-agnostic building blocks for multi-tenant authorization:
+ * tenant resolution, membership requirement, row filtering and bearer
+ * validation.
  */
 export { timingSafeEqual } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 // 0.2.0 — Domain-tenancy layer (additive)
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
+// Organization-membership guard (unified session + bearer + self-host contract)
+export { requireTenantId } from "./org-guard.js";
+// 0.4.0 — Human-path resolver (Clerk-shaped session -> { tenant, subject, role })
+export { humanAccountRoleSchema, normalizeVerifiedHumanSession } from "./human-path.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAOjD,kFAAkF;AAClF,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/org-guard.d.ts

@@ -0,0 +1,95 @@
+/**
+ * @vantageos/cloud-identity — Organization-membership guard.
+ * (See package.json "version" for the release this shipped in.)
+ *
+ * Closes the second measured 0.2.0 defect: the published package exposed no
+ * "must belong to an organization" gate anywhere (`grep -rlE
+ * "requireOrg|orgRequired|orgId" package/dist/*.js` returned no matches on
+ * the 0.2.0 tarball). Absence of an organization must REFUSE, never fall
+ * through to full access — the same defect class as the scope-filter fix in
+ * `./scope-filter.ts`.
+ *
+ * The semantics are reused verbatim from a Convex implementation of the same
+ * guard rather than reinvented — a second implementation of one authorization
+ * check is a second chance to get it wrong. That original:
+ *
+ *   - takes a Convex `QueryCtx | MutationCtx | ActionCtx`
+ *   - derives identity via `ctx.auth.getUserIdentity()`
+ *   - throws when there is no session
+ *   - throws when `identity.org_id` is not a non-empty string
+ *   - returns the org id
+ *
+ * ADAPTATION (named per the brief's requirement to flag any semantic
+ * deviation): this package is framework-agnostic and has no `ctx.auth`. The
+ * caller pre-resolves whichever identity/bearer object it already has
+ * (Clerk session identity for the human path, or the package's own
+ * `TenantContext` — see `./tenancy-domain.ts` — for the machine/bearer path)
+ * and passes it in as a `TenantSource`. The refuse-on-absence /
+ * refuse-on-empty semantics are otherwise identical to the source function;
+ * no other behavioural change was made.
+ *
+ * This is the membership half of the package's contract; tenant resolution,
+ * row filtering and identifier validation are covered by
+ * `getEffectiveTenantId`, `passesScopeFilter`/`scopeFilterList` and
+ * `validateMasterBearer` respectively. Framework adapters wrap
+ * `requireTenantId`; they must never reimplement its checks.
+ */
+import type { TenantContext } from "./tenancy-domain.js";
+/**
+ * Minimal shape of a resolved human-path session identity. Intentionally
+ * framework-agnostic: the caller derives this from Clerk (or any other
+ * session provider) before calling `requireTenantId` — this package never
+ * imports a session SDK.
+ */
+export type SessionIdentity = {
+    orgId?: string | null;
+};
+/**
+ * Named deployment mode — 0.4.0. `cloud` requires an organization/workspace
+ * on every request (the existing, unchanged `session`/`bearer` behaviour
+ * below). `self-host` is single-tenant: the tenant id is DECLARED via
+ * explicit configuration, never inferred from the absence of an
+ * organization. See the `self-host` branch of `TenantSource` and
+ * `requireTenantId` for the refuse-on-missing-config semantics.
+ */
+export type DeploymentMode = "cloud" | "self-host";
+/**
+ * Discriminated union covering both VantagePeers Cloud entry paths behind
+ * one contract:
+ *   - `session`: human path, via a connection/login provider (Clerk, etc.).
+ *   - `bearer`: machine path, via a resolved, ALREADY-VERIFIED token
+ *     (`TenantContext` — see `decodeUnverifiedBearer` / the planned signed-JWT
+ *     verifier for how a `TenantContext` gets produced).
+ *   - `self-host`: single-tenant path (0.4.0, additive). The tenant id is
+ *     presented explicitly by configuration, not inferred: `requireTenantId`
+ *     returns `tenantId` only when it is a non-empty string, and throws
+ *     otherwise — a right is never granted by absence, here either.
+ */
+export type TenantSource = {
+    kind: "session";
+    identity: SessionIdentity | null | undefined;
+} | {
+    kind: "bearer";
+    context: TenantContext;
+} | {
+    kind: "self-host";
+    tenantId: string | null | undefined;
+};
+/**
+ * Resolve the caller's tenant id, refusing when no organization/workspace is
+ * attached — for EITHER entry path, behind one contract.
+ *
+ *   - `kind: "session"` and `identity` is null/undefined → throws
+ *     ("Unauthenticated: no session.")
+ *   - `kind: "session"` and `identity.orgId` is missing or empty → throws
+ *     ("No active organization on this session...")
+ *   - `kind: "bearer"` and `context.workspaceId` is missing or empty → throws
+ *     ("No workspace on this bearer-resolved tenant context...")
+ *   - otherwise → returns the tenant id (orgId, or workspaceId)
+ *
+ * A right is never granted by absence: every branch above refuses by
+ * throwing, there is no fallback branch that returns a value when
+ * organization/workspace information is missing.
+ */
+export declare function requireTenantId(source: TenantSource): string;
+//# sourceMappingURL=org-guard.d.ts.map

package/dist/org-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-guard.d.ts","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA+B5D"}

package/dist/org-guard.js

@@ -0,0 +1,77 @@
+/**
+ * @vantageos/cloud-identity — Organization-membership guard.
+ * (See package.json "version" for the release this shipped in.)
+ *
+ * Closes the second measured 0.2.0 defect: the published package exposed no
+ * "must belong to an organization" gate anywhere (`grep -rlE
+ * "requireOrg|orgRequired|orgId" package/dist/*.js` returned no matches on
+ * the 0.2.0 tarball). Absence of an organization must REFUSE, never fall
+ * through to full access — the same defect class as the scope-filter fix in
+ * `./scope-filter.ts`.
+ *
+ * The semantics are reused verbatim from a Convex implementation of the same
+ * guard rather than reinvented — a second implementation of one authorization
+ * check is a second chance to get it wrong. That original:
+ *
+ *   - takes a Convex `QueryCtx | MutationCtx | ActionCtx`
+ *   - derives identity via `ctx.auth.getUserIdentity()`
+ *   - throws when there is no session
+ *   - throws when `identity.org_id` is not a non-empty string
+ *   - returns the org id
+ *
+ * ADAPTATION (named per the brief's requirement to flag any semantic
+ * deviation): this package is framework-agnostic and has no `ctx.auth`. The
+ * caller pre-resolves whichever identity/bearer object it already has
+ * (Clerk session identity for the human path, or the package's own
+ * `TenantContext` — see `./tenancy-domain.ts` — for the machine/bearer path)
+ * and passes it in as a `TenantSource`. The refuse-on-absence /
+ * refuse-on-empty semantics are otherwise identical to the source function;
+ * no other behavioural change was made.
+ *
+ * This is the membership half of the package's contract; tenant resolution,
+ * row filtering and identifier validation are covered by
+ * `getEffectiveTenantId`, `passesScopeFilter`/`scopeFilterList` and
+ * `validateMasterBearer` respectively. Framework adapters wrap
+ * `requireTenantId`; they must never reimplement its checks.
+ */
+/**
+ * Resolve the caller's tenant id, refusing when no organization/workspace is
+ * attached — for EITHER entry path, behind one contract.
+ *
+ *   - `kind: "session"` and `identity` is null/undefined → throws
+ *     ("Unauthenticated: no session.")
+ *   - `kind: "session"` and `identity.orgId` is missing or empty → throws
+ *     ("No active organization on this session...")
+ *   - `kind: "bearer"` and `context.workspaceId` is missing or empty → throws
+ *     ("No workspace on this bearer-resolved tenant context...")
+ *   - otherwise → returns the tenant id (orgId, or workspaceId)
+ *
+ * A right is never granted by absence: every branch above refuses by
+ * throwing, there is no fallback branch that returns a value when
+ * organization/workspace information is missing.
+ */
+export function requireTenantId(source) {
+    if (source.kind === "session") {
+        if (!source.identity) {
+            throw new Error("Unauthenticated: no session.");
+        }
+        const orgId = source.identity.orgId;
+        if (typeof orgId !== "string" || orgId.length === 0) {
+            throw new Error("No active organization on this session: select an organization before accessing agents.");
+        }
+        return orgId;
+    }
+    if (source.kind === "self-host") {
+        const tenantId = source.tenantId;
+        if (typeof tenantId !== "string" || tenantId.length === 0) {
+            throw new Error("No tenant id configured for self-host mode: declare a tenantId explicitly — it is never inferred from absence.");
+        }
+        return tenantId;
+    }
+    const workspaceId = source.context?.workspaceId;
+    if (typeof workspaceId !== "string" || workspaceId.length === 0) {
+        throw new Error("No workspace on this bearer-resolved tenant context: the bearer must resolve to a non-empty workspaceId.");
+    }
+    return workspaceId;
+}
+//# sourceMappingURL=org-guard.js.map

package/dist/org-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-guard.js","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAyCH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;IAChD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/scope-filter.d.ts

@@ -1,18 +1,24 @@
 /**
- * Sprint S3.1 B2 — scope-aware filter helpers for VP MCP tools.
+ * Scope-aware row filter.
  *
- * Ported from `vantage-memory/mcp-server/src/scope-filter.ts`. Behaviour is
- * preserved verbatim; only the type dependency on the in-tree `OAuthContext`
- * is replaced by the framework-agnostic `OAuthCtx` from `./types`.
+ * The behaviour was preserved verbatim from an earlier in-tree
+ * implementation; the only change was replacing a framework-specific context
+ * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
- * Doctrine references:
- *   - decisions/doctrine-scope-aware-filter-2026-05-26.md (D3 base)
- *   - memory j579y6f31g7xzgtgdnpgetdmjx87ztyj (D9-D14 extension)
- *
- * Contract:
+ * Contract (0.3.0 — BREAKING vs. 0.2.0):
+ *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
+ *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
+ *     (as if the caller were master-scoped) was the exact defect class this
+ *     release closes. Every exported function below now requires `OAuthCtx`
+ *     at the type level — an omitted argument breaks the caller's build,
+ *     it never falls through to a more permissive runtime path.
+ *   - Callers that genuinely need the old legacy-bearer wildcard behaviour
+ *     MUST import and pass `LEGACY_WILDCARD_CTX` explicitly — the compat
+ *     path is requested by name, never inferred from a missing argument.
+ *   - As defense-in-depth against callers that bypass the type system
+ *     (untyped JS, `as any`), every function also throws at runtime if
+ *     `oauthCtx` is nullish, instead of silently granting access.
  *   - Master scope (scope === "master" OR fromAllowList includes "*") = wildcard pass.
- *   - Legacy bearer (oauthCtx === undefined) = wildcard pass (treated as master-
- *     equivalent for backward-compatibility with mcpTenants Pi/Tau/Phi paths).
  *   - Non-master scope = row passes iff:
  *       row.createdBy ∈ oauthCtx.fromAllowList
  *       OR
@@ -24,6 +30,12 @@
  * imports — to keep the helpers trivially unit-testable.
  */
 import type { OAuthCtx } from "./types.js";
+/**
+ * Explicit legacy-compat sentinel. Passing this constant reproduces the
+ * pre-0.3.0 "no oauthCtx" wildcard behaviour — but the caller must import
+ * and pass it BY NAME. It is never inferred from an omitted argument.
+ */
+export declare const LEGACY_WILDCARD_CTX: OAuthCtx;
 /**
  * Row shape accepted by the scope filter. All fields optional because real
  * Convex documents from list_peers / list_messages / etc. don't all carry both.
@@ -37,35 +49,38 @@ export type ScopeFilterable = {
  * Mirrors `isMasterScope` from the source module: `scope === "master"` OR
  * `fromAllowList` contains the `"*"` sentinel.
  */
-export declare function isMasterScope(ctx: OAuthCtx | undefined): boolean;
+export declare function isMasterScope(ctx: OAuthCtx): boolean;
 /**
  * Core predicate. Returns true when the row is visible to the caller.
  *
  *   - Master scope (isMasterScope === true)            → true (wildcard)
- *   - Legacy bearer (oauthCtx === undefined)           → true (back-compat)
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
  *   - otherwise                                        → false
  *
+ * `oauthCtx` is mandatory (see module-level contract note above): an omitted
+ * argument throws instead of silently granting wildcard access. Callers that
+ * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
+ * explicitly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
-export declare function passesScopeFilter(oauthCtx: OAuthCtx | undefined, row: ScopeFilterable): boolean;
+export declare function passesScopeFilter(oauthCtx: OAuthCtx, row: ScopeFilterable): boolean;
 /**
  * Filter a list of rows (post-query). Used by list_* tools.
  */
-export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx | undefined, rows: T[]): T[];
+export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[]): T[];
 /**
  * Assert a single row passes (get_* tools). Returns the row when allowed, null
  * otherwise — callers translate null to a 404-equivalent "not found" MCP error
  * to avoid leaking the difference between "absent" and "filtered out".
  */
-export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx | undefined, row: T | null | undefined): T | null;
+export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined): T | null;
 /**
  * Helper for callers that want a single "is master / legacy" predicate.
- * Mirrors the legacy-bearer-passes-through convention.
  */
-export declare function isWildcardScope(ctx: OAuthCtx | undefined): boolean;
+export declare function isWildcardScope(ctx: OAuthCtx): boolean;
 //# sourceMappingURL=scope-filter.d.ts.map

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAIhE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,GAAG,EAAE,eAAe,GACnB,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,IAAI,EAAE,CAAC,EAAE,GACR,CAAC,EAAE,CAEL;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACxB,CAAC,GAAG,IAAI,CAGV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAGlE"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,eAAe,GACnB,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,GACR,CAAC,EAAE,CAGL;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACxB,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -1,18 +1,24 @@
 /**
- * Sprint S3.1 B2 — scope-aware filter helpers for VP MCP tools.
+ * Scope-aware row filter.
  *
- * Ported from `vantage-memory/mcp-server/src/scope-filter.ts`. Behaviour is
- * preserved verbatim; only the type dependency on the in-tree `OAuthContext`
- * is replaced by the framework-agnostic `OAuthCtx` from `./types`.
+ * The behaviour was preserved verbatim from an earlier in-tree
+ * implementation; the only change was replacing a framework-specific context
+ * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
- * Doctrine references:
- *   - decisions/doctrine-scope-aware-filter-2026-05-26.md (D3 base)
- *   - memory j579y6f31g7xzgtgdnpgetdmjx87ztyj (D9-D14 extension)
- *
- * Contract:
+ * Contract (0.3.0 — BREAKING vs. 0.2.0):
+ *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
+ *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
+ *     (as if the caller were master-scoped) was the exact defect class this
+ *     release closes. Every exported function below now requires `OAuthCtx`
+ *     at the type level — an omitted argument breaks the caller's build,
+ *     it never falls through to a more permissive runtime path.
+ *   - Callers that genuinely need the old legacy-bearer wildcard behaviour
+ *     MUST import and pass `LEGACY_WILDCARD_CTX` explicitly — the compat
+ *     path is requested by name, never inferred from a missing argument.
+ *   - As defense-in-depth against callers that bypass the type system
+ *     (untyped JS, `as any`), every function also throws at runtime if
+ *     `oauthCtx` is nullish, instead of silently granting access.
  *   - Master scope (scope === "master" OR fromAllowList includes "*") = wildcard pass.
- *   - Legacy bearer (oauthCtx === undefined) = wildcard pass (treated as master-
- *     equivalent for backward-compatibility with mcpTenants Pi/Tau/Phi paths).
  *   - Non-master scope = row passes iff:
  *       row.createdBy ∈ oauthCtx.fromAllowList
  *       OR
@@ -23,14 +29,30 @@
  * NOTE: this module is intentionally framework-agnostic — no McpServer / Hono
  * imports — to keep the helpers trivially unit-testable.
  */
+/**
+ * Explicit legacy-compat sentinel. Passing this constant reproduces the
+ * pre-0.3.0 "no oauthCtx" wildcard behaviour — but the caller must import
+ * and pass it BY NAME. It is never inferred from an omitted argument.
+ */
+export const LEGACY_WILDCARD_CTX = {
+    scope: "master",
+    fromAllowList: ["*"],
+    namespaceReadPrefixes: [],
+    namespaceWritePrefixes: [],
+};
+function assertOauthCtx(oauthCtx) {
+    if (oauthCtx == null) {
+        throw new TypeError("oauthCtx is required — pass an explicit OAuthCtx, or LEGACY_WILDCARD_CTX " +
+            "if you deliberately want the pre-0.3.0 legacy-bearer wildcard behaviour.");
+    }
+}
 /**
  * Returns true when the scope profile grants full, wildcard access.
  * Mirrors `isMasterScope` from the source module: `scope === "master"` OR
  * `fromAllowList` contains the `"*"` sentinel.
  */
 export function isMasterScope(ctx) {
-    if (!ctx)
-        return false;
+    assertOauthCtx(ctx);
     if (ctx.scope === "master")
         return true;
     return ctx.fromAllowList.includes("*");
@@ -39,19 +61,22 @@ export function isMasterScope(ctx) {
  * Core predicate. Returns true when the row is visible to the caller.
  *
  *   - Master scope (isMasterScope === true)            → true (wildcard)
- *   - Legacy bearer (oauthCtx === undefined)           → true (back-compat)
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
  *   - otherwise                                        → false
  *
+ * `oauthCtx` is mandatory (see module-level contract note above): an omitted
+ * argument throws instead of silently granting wildcard access. Callers that
+ * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
+ * explicitly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
 export function passesScopeFilter(oauthCtx, row) {
-    if (!oauthCtx)
-        return true;
+    assertOauthCtx(oauthCtx);
     if (isMasterScope(oauthCtx))
         return true;
     const { createdBy, namespace } = row;
@@ -71,6 +96,7 @@ export function passesScopeFilter(oauthCtx, row) {
  * Filter a list of rows (post-query). Used by list_* tools.
  */
 export function scopeFilterList(oauthCtx, rows) {
+    assertOauthCtx(oauthCtx);
     return rows.filter((r) => passesScopeFilter(oauthCtx, r));
 }
 /**
@@ -79,17 +105,16 @@ export function scopeFilterList(oauthCtx, rows) {
  * to avoid leaking the difference between "absent" and "filtered out".
  */
 export function scopeFilterGet(oauthCtx, row) {
+    assertOauthCtx(oauthCtx);
     if (row == null)
         return null;
     return passesScopeFilter(oauthCtx, row) ? row : null;
 }
 /**
  * Helper for callers that want a single "is master / legacy" predicate.
- * Mirrors the legacy-bearer-passes-through convention.
  */
 export function isWildcardScope(ctx) {
-    if (!ctx)
-        return true;
+    assertOauthCtx(ctx);
     return isMasterScope(ctx);
 }
 //# sourceMappingURL=scope-filter.js.map

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAyB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA8B,EAC9B,GAAoB;IAEpB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA8B,EAC9B,IAAS;IAET,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA8B,EAC9B,GAAyB;IAEzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAoB;IAEpB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS;IAET,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB;IAEzB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/tenancy-domain.d.ts

@@ -12,12 +12,8 @@
  *   - getEffectiveTenantId(ctx, args) — multi-tenant isolation guard
  *   - decodeUnverifiedBearer(token) — DECODE-ONLY helper, NOT authentication.
  *     The decoded payload is attacker-controlled. Production code MUST use a
- *     signed JWT or opaque-token lookup (planned: 0.3.0) before treating the
- *     payload as a trust boundary.
- *
- * Task: k177hejb4tc5em5p70m9hxwn3x88kyp4
- * Mission: k57b4t2q VR Cloud MVP Day 100
- * Orchestrator: Sigma — VantagePeers | 2026-06-13
+ *     signed JWT or opaque-token lookup before treating the payload as a
+ *     trust boundary.
  */
 import { z } from "zod";
 export declare const workspaceRoleSchema: z.ZodEnum<{
@@ -110,8 +106,8 @@ export declare function getEffectiveTenantId(ctx: TenantContext, args: {
  *     middleware (the production trust boundary)
  *
  * For the production trust boundary, callers MUST substitute a signed JWT
- * (planned export in 0.3.0) or an opaque-token lookup against a Convex
- * tenancy table.
+ * verifier (not yet exported by this package) or an opaque-token lookup
+ * against a Convex tenancy table.
  *
  * Renamed from `resolveBearer` (0.2.0 pre-release) to make the lack of
  * verification impossible to miss at the call-site.

package/dist/tenancy-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy-domain.d.ts","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,eAAO,MAAM,qBAAqB;;;;;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,mBAAmB;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;gBAE5B,OAAO,EAAE,qBAAqB;CAS3C;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5B,MAAM,CASR;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CAmBxB"}
+{"version":3,"file":"tenancy-domain.d.ts","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,eAAO,MAAM,qBAAqB;;;;;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,mBAAmB;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;gBAE5B,OAAO,EAAE,qBAAqB;CAS3C;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5B,MAAM,CASR;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CAmBxB"}