@vantageos/cloud-identity 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -3,6 +3,30 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0]
+
+**Additive — grant-aware scope filter.** Closes the other pole of the
+fail-closed defect class: 0.3.0/0.4.0 closed "a right granted by ABSENCE"
+(missing `oauthCtx` silently passing everything); this closes "a right
+REFUSED by absence" — a per-row grant (a named mission agent/pilot, a
+mandate's `fulfilledBy`) that IS present on the row but that
+`passesScopeFilter`/`scopeFilterList`/`scopeFilterGet` were structurally
+blind to, because they only ever consulted `createdBy`/`namespace`.
+
+### Added
+
+- `passesScopeFilter`, `scopeFilterList`, `scopeFilterGet` (`src/scope-filter.ts`)
+  now accept an optional `grantFields: readonly string[]` parameter, defaulting
+  to `[]`. Each entry names a property on the row that the CALLER declares as
+  a per-row grant — the field's runtime value is treated as a single identity
+  (`string`, equality match) or multiple identities (`string[]`, any-element
+  match) against `oauthCtx.fromAllowList`. The package never hardcodes which
+  fields are grants for which table; that declaration is caller-supplied data.
+- **Fail-closed regression preserved byte-for-byte:** omitting `grantFields`
+  (or passing `[]`) reproduces 0.4.0 behaviour exactly — this is a pure
+  widening, no existing caller's behaviour changes without an explicit
+  opt-in declaration at its own call site.
+
 ## [0.4.0]
 
 **Additive.** Two new primitives so one identity layer covers both deployment

package/dist/scope-filter.d.ts

@@ -5,6 +5,31 @@
  * implementation; the only change was replacing a framework-specific context
  * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
+ * Contract (0.5.0 — additive, widening only, vs. 0.4.0):
+ *   - Every exported predicate/filter now accepts an OPTIONAL `grantFields`
+ *     parameter: `readonly string[]`, defaulting to `[]`. Each entry names a
+ *     property on the row that the CALLER declares as a per-row grant (e.g.
+ *     "agents", "pilot", "fulfilledBy"). The package never hardcodes which
+ *     fields are grants for which table — that declaration is data supplied
+ *     by the caller at the call site, not business knowledge baked into this
+ *     shared module (no-hardcoded-business-knowledge).
+ *   - A row passes for a non-master caller if createdBy/namespace already
+ *     passed (0.4.0 behaviour, unchanged) OR if ANY declared grant field's
+ *     value names an identity in `oauthCtx.fromAllowList` — the field may be
+ *     a single string (e.g. "pilot") or a string[] (e.g. "agents"): a string
+ *     value matches by equality, an array value matches if any element is in
+ *     `fromAllowList`.
+ *   - `grantFields` defaulting to `[]` means a caller that declares NO grants
+ *     gets EXACTLY the 0.4.0 behaviour, byte-for-byte — this is a pure
+ *     widening, no existing caller's behaviour changes without an explicit
+ *     opt-in declaration at its own call site.
+ *   - This closes the OTHER pole of the fail-closed defect: 0.3.0/0.4.0
+ *     closed "a right granted by ABSENCE" (missing oauthCtx silently passing
+ *     everything); this closes "a right REFUSED by absence" — a grant that
+ *     IS present on the row (a named agent, pilot, or fulfiller) but that the
+ *     filter was structurally blind to because it only ever consulted
+ *     createdBy/namespace.
+ *
  * Contract (0.3.0 — BREAKING vs. 0.2.0):
  *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
  *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
@@ -50,6 +75,18 @@ export type ScopeFilterable = {
  * `fromAllowList` contains the `"*"` sentinel.
  */
 export declare function isMasterScope(ctx: OAuthCtx): boolean;
+/**
+ * Names of row properties the CALLER declares as per-row grants. Each named
+ * property's runtime value must be a `string` (single identity) or
+ * `string[]` (multiple identities) to be consulted — any other runtime shape
+ * is silently skipped (not a match), never thrown, since these are duck-typed
+ * against arbitrary Convex documents.
+ *
+ * This is DATA supplied by the call site, never a list hardcoded inside this
+ * package: the package does not and must not know that "agents" means
+ * missions or "fulfilledBy" means mandates.
+ */
+export type GrantFieldDeclaration = readonly string[];
 /**
  * Core predicate. Returns true when the row is visible to the caller.
  *
@@ -57,6 +94,9 @@ export declare function isMasterScope(ctx: OAuthCtx): boolean;
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
+ *   - row[grantField] (for any declared grantField) names an identity in
+ *     oauthCtx.fromAllowList, where the field is a string (equality) or a
+ *     string[] (any-element membership)                → true
  *   - otherwise                                        → false
  *
  * `oauthCtx` is mandatory (see module-level contract note above): an omitted
@@ -64,21 +104,32 @@ export declare function isMasterScope(ctx: OAuthCtx): boolean;
  * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
  * explicitly.
  *
+ * `grantFields` (0.5.0, optional, defaults to `[]`) lets a caller widen the
+ * predicate for its own table without this package hardcoding which fields
+ * are grants — see the module-level 0.5.0 contract note above. Omitting it
+ * (or passing `[]`) reproduces 0.4.0 behaviour exactly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
-export declare function passesScopeFilter(oauthCtx: OAuthCtx, row: ScopeFilterable): boolean;
+export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T, grantFields?: GrantFieldDeclaration): boolean;
 /**
  * Filter a list of rows (post-query). Used by list_* tools.
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[]): T[];
+export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[], grantFields?: GrantFieldDeclaration): T[];
 /**
  * Assert a single row passes (get_* tools). Returns the row when allowed, null
  * otherwise — callers translate null to a 404-equivalent "not found" MCP error
  * to avoid leaking the difference between "absent" and "filtered out".
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined): T | null;
+export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined, grantFields?: GrantFieldDeclaration): T | null;
 /**
  * Helper for callers that want a single "is master / legacy" predicate.
  */

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,eAAe,GACnB,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,GACR,CAAC,EAAE,CAGL;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACxB,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAgBT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -5,6 +5,31 @@
  * implementation; the only change was replacing a framework-specific context
  * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
+ * Contract (0.5.0 — additive, widening only, vs. 0.4.0):
+ *   - Every exported predicate/filter now accepts an OPTIONAL `grantFields`
+ *     parameter: `readonly string[]`, defaulting to `[]`. Each entry names a
+ *     property on the row that the CALLER declares as a per-row grant (e.g.
+ *     "agents", "pilot", "fulfilledBy"). The package never hardcodes which
+ *     fields are grants for which table — that declaration is data supplied
+ *     by the caller at the call site, not business knowledge baked into this
+ *     shared module (no-hardcoded-business-knowledge).
+ *   - A row passes for a non-master caller if createdBy/namespace already
+ *     passed (0.4.0 behaviour, unchanged) OR if ANY declared grant field's
+ *     value names an identity in `oauthCtx.fromAllowList` — the field may be
+ *     a single string (e.g. "pilot") or a string[] (e.g. "agents"): a string
+ *     value matches by equality, an array value matches if any element is in
+ *     `fromAllowList`.
+ *   - `grantFields` defaulting to `[]` means a caller that declares NO grants
+ *     gets EXACTLY the 0.4.0 behaviour, byte-for-byte — this is a pure
+ *     widening, no existing caller's behaviour changes without an explicit
+ *     opt-in declaration at its own call site.
+ *   - This closes the OTHER pole of the fail-closed defect: 0.3.0/0.4.0
+ *     closed "a right granted by ABSENCE" (missing oauthCtx silently passing
+ *     everything); this closes "a right REFUSED by absence" — a grant that
+ *     IS present on the row (a named agent, pilot, or fulfiller) but that the
+ *     filter was structurally blind to because it only ever consulted
+ *     createdBy/namespace.
+ *
  * Contract (0.3.0 — BREAKING vs. 0.2.0):
  *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
  *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
@@ -57,6 +82,15 @@ export function isMasterScope(ctx) {
         return true;
     return ctx.fromAllowList.includes("*");
 }
+const NO_GRANT_FIELDS = [];
+function grantFieldMatches(value, fromAllowList) {
+    if (typeof value === "string")
+        return fromAllowList.includes(value);
+    if (Array.isArray(value)) {
+        return value.some((entry) => typeof entry === "string" && fromAllowList.includes(entry));
+    }
+    return false;
+}
 /**
  * Core predicate. Returns true when the row is visible to the caller.
  *
@@ -64,6 +98,9 @@ export function isMasterScope(ctx) {
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
+ *   - row[grantField] (for any declared grantField) names an identity in
+ *     oauthCtx.fromAllowList, where the field is a string (equality) or a
+ *     string[] (any-element membership)                → true
  *   - otherwise                                        → false
  *
  * `oauthCtx` is mandatory (see module-level contract note above): an omitted
@@ -71,11 +108,16 @@ export function isMasterScope(ctx) {
  * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
  * explicitly.
  *
+ * `grantFields` (0.5.0, optional, defaults to `[]`) lets a caller widen the
+ * predicate for its own table without this package hardcoding which fields
+ * are grants — see the module-level 0.5.0 contract note above. Omitting it
+ * (or passing `[]`) reproduces 0.4.0 behaviour exactly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
-export function passesScopeFilter(oauthCtx, row) {
+export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
     if (isMasterScope(oauthCtx))
         return true;
@@ -90,25 +132,36 @@ export function passesScopeFilter(oauthCtx, row) {
                 return true;
         }
     }
+    for (const field of grantFields) {
+        const value = row[field];
+        if (grantFieldMatches(value, oauthCtx.fromAllowList))
+            return true;
+    }
     return false;
 }
 /**
  * Filter a list of rows (post-query). Used by list_* tools.
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export function scopeFilterList(oauthCtx, rows) {
+export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
-    return rows.filter((r) => passesScopeFilter(oauthCtx, r));
+    return rows.filter((r) => passesScopeFilter(oauthCtx, r, grantFields));
 }
 /**
  * Assert a single row passes (get_* tools). Returns the row when allowed, null
  * otherwise — callers translate null to a 404-equivalent "not found" MCP error
  * to avoid leaking the difference between "absent" and "filtered out".
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export function scopeFilterGet(oauthCtx, row) {
+export function scopeFilterGet(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
     if (row == null)
         return null;
-    return passesScopeFilter(oauthCtx, row) ? row : null;
+    return passesScopeFilter(oauthCtx, row, grantFields) ? row : null;
 }
 /**
  * Helper for callers that want a single "is master / legacy" predicate.

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAoB;IAEpB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS;IAET,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB;IAEzB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",