@vantageos/cloud-identity 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -3,6 +3,75 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0]
+
+**Additive — typed refusal for reads, and a role assertion.**
+
+### Added
+
+- `resolveTenantIdOrAbsent(source)` (`src/org-guard.ts`): non-throwing sibling
+  of `requireTenantId`. Returns `{ present: true, tenantId }` or a typed
+  `{ present: false, absence: { code: "TENANT_ABSENT", reason } }`. A read that
+  throws crashes a mounted render; a read that returns a bare empty value is
+  byte-identical to "there is nothing". This returns neither.
+- `requireHumanRole(session, required)` and
+  `resolveHumanRoleOrRefusal(session, required)` (`src/human-path.ts`): role
+  assertion on the verified session's `orgRole`, throwing and non-throwing
+  forms. Exact match, no hierarchy; an empty required list admits nobody.
+- Types: `TenantAbsence`, `TenantAbsenceReason`, `TenantResolution`,
+  `RequiredHumanRole`, `RoleRefusal`, `RoleRefusalReason`, `RoleResolution`.
+
+### Fixed
+
+- The Clerk org-role map is now prototype-less (`Object.create(null)`). As a
+  plain object literal it inherited `Object.prototype`, so a presented
+  `orgRole` of `toString`, `constructor`, `valueOf` or `__proto__` did not
+  MISS the lookup — it returned an inherited value, which is truthy, and the
+  resolver handed back a FUNCTION as the role instead of refusing. Any key
+  that is not one of the eight own keys is now `undefined`, so the existing
+  refusal path rejects it. Fixed at the data; no lookup expression and no
+  function body changed, and no list of forbidden names was introduced.
+
+### Unchanged
+
+- `requireTenantId` and `normalizeVerifiedHumanSession` are byte-for-byte
+  unchanged and still throw on every refusal.
+- The tenant key stays opaque: no export takes or returns a slug. That
+  opacity is now pinned on all four served paths (session, bearer,
+  self-host, `role.identity.tenant`), through BOTH the throwing and the
+  non-throwing sibling, with a fixture carrying edge whitespace so that
+  splicing a `.trim()` onto a served id goes RED instead of passing.
+
+### Removed
+
+- `bun.lock`, committed by accident in 0.5.0. `package-lock.json` is the
+  lockfile of record; two lockfiles for two package managers guarantee a
+  silent divergence.
+
+## [0.5.0]
+
+**Additive — grant-aware scope filter.** Closes the other pole of the
+fail-closed defect class: 0.3.0/0.4.0 closed "a right granted by ABSENCE"
+(missing `oauthCtx` silently passing everything); this closes "a right
+REFUSED by absence" — a per-row grant (a named mission agent/pilot, a
+mandate's `fulfilledBy`) that IS present on the row but that
+`passesScopeFilter`/`scopeFilterList`/`scopeFilterGet` were structurally
+blind to, because they only ever consulted `createdBy`/`namespace`.
+
+### Added
+
+- `passesScopeFilter`, `scopeFilterList`, `scopeFilterGet` (`src/scope-filter.ts`)
+  now accept an optional `grantFields: readonly string[]` parameter, defaulting
+  to `[]`. Each entry names a property on the row that the CALLER declares as
+  a per-row grant — the field's runtime value is treated as a single identity
+  (`string`, equality match) or multiple identities (`string[]`, any-element
+  match) against `oauthCtx.fromAllowList`. The package never hardcodes which
+  fields are grants for which table; that declaration is caller-supplied data.
+- **Fail-closed regression preserved byte-for-byte:** omitting `grantFields`
+  (or passing `[]`) reproduces 0.4.0 behaviour exactly — this is a pure
+  widening, no existing caller's behaviour changes without an explicit
+  opt-in declaration at its own call site.
+
 ## [0.4.0]
 
 **Additive.** Two new primitives so one identity layer covers both deployment

package/README.md

@@ -105,6 +105,27 @@ await resolveTenant({ session: null }); // throws Error("Unauthenticated: no ses
   `{ kind: "bearer", context }` for a machine caller. A missing session, a
   missing organization and an empty organization id are all refusals, never a
   default.
+- `resolveTenantIdOrAbsent(source)` — the NON-throwing sibling of
+  `requireTenantId`, for a public READ. Same `TenantSource` union, same
+  refusal conditions; instead of throwing it returns
+  `{ present: true, tenantId }` or
+  `{ present: false, absence: { code: "TENANT_ABSENT", reason } }`
+  (`TenantAbsence`, `TenantAbsenceReason`, `TenantResolution`). The absence
+  is a non-empty object: it is never `[]`, `{}`, `null` or a zeroed count, so
+  "no organization" and "an organization with nothing in it" cannot collapse
+  into one value. Use `requireTenantId` at a WRITE boundary and
+  `resolveTenantIdOrAbsent` where a throw would crash a mounted render. The
+  tenant id is OPAQUE — returned byte-for-byte, never a slug or display name.
+- `requireHumanRole(session, required)` — asserts the VERIFIED session
+  carries `required` (a `HumanAccountRole` or a list of them, exact match, no
+  hierarchy) and returns the resolved identity; throws otherwise. The role is
+  read from `session.orgRole`, never from an argument. `RequiredHumanRole`
+  is its `required` type.
+- `resolveHumanRoleOrRefusal(session, required)` — the non-throwing form:
+  `{ admitted: true, identity }` or
+  `{ admitted: false, refusal: { code: "ROLE_REFUSED", reason } }`
+  (`RoleResolution`, `RoleRefusal`, `RoleRefusalReason`). `reason` is
+  `role-not-held` for a verified member lacking the role.
 - `getEffectiveTenantId(ctx, args)` — resolves which tenant a request should
   act on when a caller may legitimately act on more than one.
 

package/dist/human-path.d.ts

@@ -92,4 +92,50 @@ export type ResolvedHumanIdentity = {
  * ```
  */
 export declare function normalizeVerifiedHumanSession(session: ClerkSessionLike | null | undefined): ResolvedHumanIdentity;
+/**
+ * Why a caller was not admitted. `role-not-held` is the one that matters: a
+ * verified member of the organization who does not carry the required role.
+ */
+export type RoleRefusalReason = "no-session" | "no-organization" | "no-verified-role" | "role-not-held";
+/** The typed refusal. A non-empty object carrying its own code. */
+export type RoleRefusal = {
+    code: "ROLE_REFUSED";
+    reason: RoleRefusalReason;
+};
+/** Result of `resolveHumanRoleOrRefusal`. Branch on `admitted`. */
+export type RoleResolution = {
+    admitted: true;
+    identity: ResolvedHumanIdentity;
+} | {
+    admitted: false;
+    refusal: RoleRefusal;
+};
+/**
+ * `required` is the POLICY the call site declares; the caller's role is the
+ * CLAIM, and it is read only from `session.orgRole` (which the caller has
+ * already verified upstream — see the @security note on
+ * `normalizeVerifiedHumanSession`). There is no parameter through which a
+ * caller can supply its own role. Matching is EXACT, with no hierarchy:
+ * `owner` does not satisfy `"admin"`; pass `["owner", "admin"]` to admit
+ * either. An empty list admits nobody.
+ */
+export type RequiredHumanRole = HumanAccountRole | readonly HumanAccountRole[];
+/**
+ * THROWING form, for a write boundary. Returns the resolved identity when
+ * the verified session carries one of the `required` roles; throws
+ * otherwise. Malformed sessions throw exactly what
+ * `normalizeVerifiedHumanSession` throws; a well-formed session lacking the
+ * role throws "Role refused: ...".
+ *
+ * Same `@security` precondition as `normalizeVerifiedHumanSession`: this
+ * asserts on a session that is ALREADY verified. It verifies nothing.
+ */
+export declare function requireHumanRole(session: ClerkSessionLike | null | undefined, required: RequiredHumanRole): ResolvedHumanIdentity;
+/**
+ * NON-THROWING form, for a public read. Returns `{ admitted: true, identity }`
+ * or `{ admitted: false, refusal }` where the refusal carries `ROLE_REFUSED`
+ * and a reason. Admits exactly the sessions `requireHumanRole` returns for
+ * and refuses exactly the ones it throws for.
+ */
+export declare function resolveHumanRoleOrRefusal(session: ClerkSessionLike | null | undefined, required: RequiredHumanRole): RoleResolution;
 //# sourceMappingURL=human-path.d.ts.map

package/dist/human-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"human-path.d.ts","sourceRoot":"","sources":["../src/human-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;;;EAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAMF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAoBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,qBAAqB,CAiCvB"}
+{"version":3,"file":"human-path.d.ts","sourceRoot":"","sources":["../src/human-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,sBAAsB;;;;;EAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAMtE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAMF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;CACxB,CAAC;AAgCF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,qBAAqB,CAiCvB;AAMD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB,YAAY,GACZ,iBAAiB,GACjB,kBAAkB,GAClB,eAAe,CAAC;AAEpB,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC;AAEF,mEAAmE;AACnE,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,qBAAqB,CAAA;CAAE,GACnD;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG,SAAS,gBAAgB,EAAE,CAAC;AAM/E;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC5C,QAAQ,EAAE,iBAAiB,GAC1B,qBAAqB,CAWvB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC5C,QAAQ,EAAE,iBAAiB,GAC1B,cAAc,CAqBhB"}

package/dist/human-path.js

@@ -35,7 +35,17 @@ export const humanAccountRoleSchema = z.enum([
  * listed here is refused rather than silently coerced to a default, per
  * "presented, never inferred from an absence."
  */
-const CLERK_ORG_ROLE_MAP = {
+const CLERK_ORG_ROLE_MAP = Object.assign(
+// PROTOTYPE-LESS on purpose. As a plain object literal this map INHERITED
+// `Object.prototype`, so a lookup of a presented role like `toString`,
+// `constructor` or `__proto__` did not MISS — it returned an inherited
+// value, which is truthy, and the resolver handed back a FUNCTION as the
+// role instead of refusing. With a null prototype, any key that is not one
+// of the eight own keys below is `undefined`, so the existing
+// `if (!mapped) throw` refuses it. The lookup expressions in
+// `normalizeVerifiedHumanSession` and `resolveHumanRoleOrRefusal` are
+// unchanged — this is a fix at the DATA, not a list of forbidden names.
+Object.create(null), {
     "org:owner": "owner",
     owner: "owner",
     "org:admin": "admin",
@@ -44,7 +54,7 @@ const CLERK_ORG_ROLE_MAP = {
     member: "member",
     "org:client": "client",
     client: "client",
-};
+});
 /**
  * @security ⚠️ DECODE/NORMALIZE-ONLY. NOT AUTHENTICATION. NOT VERIFICATION.
  *
@@ -114,4 +124,55 @@ export function normalizeVerifiedHumanSession(session) {
     }
     return { tenant: orgId, subject: userId, role: mapped };
 }
+function requiredList(required) {
+    return typeof required === "string" ? [required] : required;
+}
+/**
+ * THROWING form, for a write boundary. Returns the resolved identity when
+ * the verified session carries one of the `required` roles; throws
+ * otherwise. Malformed sessions throw exactly what
+ * `normalizeVerifiedHumanSession` throws; a well-formed session lacking the
+ * role throws "Role refused: ...".
+ *
+ * Same `@security` precondition as `normalizeVerifiedHumanSession`: this
+ * asserts on a session that is ALREADY verified. It verifies nothing.
+ */
+export function requireHumanRole(session, required) {
+    const identity = normalizeVerifiedHumanSession(session);
+    const allowed = requiredList(required);
+    if (!allowed.includes(identity.role)) {
+        throw new Error(`Role refused: this session is a verified member but does not carry ${allowed.length === 0 ? "any admitted role" : `role ${allowed.join(" or ")}`}.`);
+    }
+    return identity;
+}
+/**
+ * NON-THROWING form, for a public read. Returns `{ admitted: true, identity }`
+ * or `{ admitted: false, refusal }` where the refusal carries `ROLE_REFUSED`
+ * and a reason. Admits exactly the sessions `requireHumanRole` returns for
+ * and refuses exactly the ones it throws for.
+ */
+export function resolveHumanRoleOrRefusal(session, required) {
+    const refuse = (reason) => ({
+        admitted: false,
+        refusal: { code: "ROLE_REFUSED", reason },
+    });
+    if (!session)
+        return refuse("no-session");
+    const { orgId, userId, orgRole } = session;
+    if (typeof orgId !== "string" || orgId.length === 0) {
+        return refuse("no-organization");
+    }
+    if (typeof userId !== "string" || userId.length === 0) {
+        return refuse("no-verified-role");
+    }
+    if (typeof orgRole !== "string" || orgRole.length === 0) {
+        return refuse("no-verified-role");
+    }
+    const role = CLERK_ORG_ROLE_MAP[orgRole];
+    if (!role)
+        return refuse("no-verified-role");
+    if (!requiredList(required).includes(role))
+        return refuse("role-not-held");
+    return { admitted: true, identity: { tenant: orgId, subject: userId, role } };
+}
 //# sourceMappingURL=human-path.js.map

package/dist/human-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"human-path.js","sourceRoot":"","sources":["../src/human-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AA6BH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAqC;IAC3D,WAAW,EAAE,OAAO;IACpB,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,OAAO;IACpB,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C;IAE5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,sBAAsB,MAAM,CAAC,IAAI,CACzE,kBAAkB,CACnB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"human-path.js","sourceRoot":"","sources":["../src/human-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AA6BH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAqC,MAAM,CAAC,MAAM;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,6DAA6D;AAC7D,sEAAsE;AACtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAqC,EACvD;IACE,WAAW,EAAE,OAAO;IACpB,KAAK,EAAE,OAAO;IACd,WAAW,EAAE,OAAO;IACpB,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;CAC0B,CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA4C;IAE5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,sBAAsB,MAAM,CAAC,IAAI,CACzE,kBAAkB,CACnB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC;AAsCD,SAAS,YAAY,CAAC,QAA2B;IAC/C,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAA4C,EAC5C,QAA2B;IAE3B,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,sEACE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAC3E,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA4C,EAC5C,QAA2B;IAE3B,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAkB,EAAE,CAAC,CAAC;QAC7D,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE;KAC1C,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;AAChF,CAAC"}

package/dist/index.d.ts

@@ -11,8 +11,8 @@ export { validateMasterBearer } from "./bearer-validation.js";
 export type { OAuthCtx, ScopeProfile, NamespacePrefix, FromAllowListEntry, ValidateMasterBearerResult, } from "./types.js";
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
 export type { Workspace, WorkspaceMember, WorkspaceRole, TenantContext, ScopeViolationPayload, BearerPayload, } from "./tenancy-domain.js";
-export { requireTenantId } from "./org-guard.js";
-export type { SessionIdentity, TenantSource, DeploymentMode, } from "./org-guard.js";
-export { humanAccountRoleSchema, normalizeVerifiedHumanSession } from "./human-path.js";
-export type { HumanAccountRole, ClerkSessionLike, ResolvedHumanIdentity, } from "./human-path.js";
+export { requireTenantId, resolveTenantIdOrAbsent } from "./org-guard.js";
+export type { TenantAbsence, TenantAbsenceReason, TenantResolution, SessionIdentity, TenantSource, DeploymentMode, } from "./org-guard.js";
+export { humanAccountRoleSchema, normalizeVerifiedHumanSession, requireHumanRole, resolveHumanRoleOrRefusal, } from "./human-path.js";
+export type { RequiredHumanRole, RoleRefusal, RoleRefusalReason, RoleResolution, HumanAccountRole, ClerkSessionLike, ResolvedHumanIdentity, } from "./human-path.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EACV,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AACxF,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -11,7 +11,7 @@ export { validateMasterBearer } from "./bearer-validation.js";
 // 0.2.0 — Domain-tenancy layer (additive)
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
 // Organization-membership guard (unified session + bearer + self-host contract)
-export { requireTenantId } from "./org-guard.js";
+export { requireTenantId, resolveTenantIdOrAbsent } from "./org-guard.js";
 // 0.4.0 — Human-path resolver (Clerk-shaped session -> { tenant, subject, role })
-export { humanAccountRoleSchema, normalizeVerifiedHumanSession } from "./human-path.js";
+export { humanAccountRoleSchema, normalizeVerifiedHumanSession, requireHumanRole, resolveHumanRoleOrRefusal, } from "./human-path.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAOjD,kFAAkF;AAClF,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC"}

package/dist/org-guard.d.ts

@@ -92,4 +92,52 @@ export type TenantSource = {
  * organization/workspace information is missing.
  */
 export declare function requireTenantId(source: TenantSource): string;
+/**
+ * Why a caller resolved to no tenant. A closed set, so a consumer can branch
+ * on content.
+ */
+export type TenantAbsenceReason = "no-session" | "no-organization" | "no-workspace" | "no-tenant-configured";
+/**
+ * The typed absence. It is a NON-empty object carrying its own code: it can
+ * never be mistaken for `[]`, `{}`, `null`, `0` or a zeroed aggregate, all of
+ * which are what "an organization with nothing in it" looks like.
+ */
+export type TenantAbsence = {
+    code: "TENANT_ABSENT";
+    reason: TenantAbsenceReason;
+};
+/**
+ * Result of `resolveTenantIdOrAbsent`. Branch on `present`; the two arms
+ * share no field, so a consumer that forgets to branch gets a type error
+ * rather than a silently-empty read.
+ */
+export type TenantResolution = {
+    present: true;
+    tenantId: string;
+} | {
+    present: false;
+    absence: TenantAbsence;
+};
+/**
+ * The tenant id is OPAQUE. It is returned byte-for-byte as presented
+ * (`orgId`, `workspaceId` or the self-host `tenantId`), never trimmed,
+ * lower-cased or otherwise interpreted. This package never receives or
+ * derives a slug or any human-facing name; each product maps its own notion
+ * (an organization id, a workspace id) onto that string.
+ *
+ * NON-THROWING sibling of `requireTenantId`, for a public READ.
+ *
+ * `requireTenantId` throws on every branch, which is right for a WRITE
+ * boundary and wrong for a subscribed read: a throw at a caller with no
+ * organization crashes a mounted render, while a bare empty value is
+ * byte-identical to "there is nothing". This function does neither: it
+ * returns the tenant, or a typed absence that cannot be confused with an
+ * empty result.
+ *
+ * Same `TenantSource` union, same refusal conditions as `requireTenantId` —
+ * every input that makes it throw makes this return `{ present: false }`,
+ * and every input it serves is served identically. Grants nothing that
+ * `requireTenantId` refuses.
+ */
+export declare function resolveTenantIdOrAbsent(source: TenantSource): TenantResolution;
 //# sourceMappingURL=org-guard.d.ts.map

package/dist/org-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-guard.d.ts","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA+B5D"}
+{"version":3,"file":"org-guard.d.ts","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/D;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA+B5D;AAMD;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,iBAAiB,GACjB,cAAc,GACd,sBAAsB,CAAC;AAE3B;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CA4B9E"}

package/dist/org-guard.js

@@ -74,4 +74,52 @@ export function requireTenantId(source) {
     }
     return workspaceId;
 }
+/**
+ * The tenant id is OPAQUE. It is returned byte-for-byte as presented
+ * (`orgId`, `workspaceId` or the self-host `tenantId`), never trimmed,
+ * lower-cased or otherwise interpreted. This package never receives or
+ * derives a slug or any human-facing name; each product maps its own notion
+ * (an organization id, a workspace id) onto that string.
+ *
+ * NON-THROWING sibling of `requireTenantId`, for a public READ.
+ *
+ * `requireTenantId` throws on every branch, which is right for a WRITE
+ * boundary and wrong for a subscribed read: a throw at a caller with no
+ * organization crashes a mounted render, while a bare empty value is
+ * byte-identical to "there is nothing". This function does neither: it
+ * returns the tenant, or a typed absence that cannot be confused with an
+ * empty result.
+ *
+ * Same `TenantSource` union, same refusal conditions as `requireTenantId` —
+ * every input that makes it throw makes this return `{ present: false }`,
+ * and every input it serves is served identically. Grants nothing that
+ * `requireTenantId` refuses.
+ */
+export function resolveTenantIdOrAbsent(source) {
+    const absent = (reason) => ({
+        present: false,
+        absence: { code: "TENANT_ABSENT", reason },
+    });
+    if (source.kind === "session") {
+        if (!source.identity)
+            return absent("no-session");
+        const orgId = source.identity.orgId;
+        if (typeof orgId !== "string" || orgId.length === 0) {
+            return absent("no-organization");
+        }
+        return { present: true, tenantId: orgId };
+    }
+    if (source.kind === "self-host") {
+        const tenantId = source.tenantId;
+        if (typeof tenantId !== "string" || tenantId.length === 0) {
+            return absent("no-tenant-configured");
+        }
+        return { present: true, tenantId };
+    }
+    const workspaceId = source.context?.workspaceId;
+    if (typeof workspaceId !== "string" || workspaceId.length === 0) {
+        return absent("no-workspace");
+    }
+    return { present: true, tenantId: workspaceId };
+}
 //# sourceMappingURL=org-guard.js.map

package/dist/org-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-guard.js","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAyCH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;IAChD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"org-guard.js","sourceRoot":"","sources":["../src/org-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAyCH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoB;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;IAChD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,MAAM,MAAM,GAAG,CAAC,MAA2B,EAAoB,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE;KAC3C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;IAChD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAClD,CAAC"}

package/dist/scope-filter.d.ts

@@ -5,6 +5,31 @@
  * implementation; the only change was replacing a framework-specific context
  * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
+ * Contract (0.5.0 — additive, widening only, vs. 0.4.0):
+ *   - Every exported predicate/filter now accepts an OPTIONAL `grantFields`
+ *     parameter: `readonly string[]`, defaulting to `[]`. Each entry names a
+ *     property on the row that the CALLER declares as a per-row grant (e.g.
+ *     "agents", "pilot", "fulfilledBy"). The package never hardcodes which
+ *     fields are grants for which table — that declaration is data supplied
+ *     by the caller at the call site, not business knowledge baked into this
+ *     shared module (no-hardcoded-business-knowledge).
+ *   - A row passes for a non-master caller if createdBy/namespace already
+ *     passed (0.4.0 behaviour, unchanged) OR if ANY declared grant field's
+ *     value names an identity in `oauthCtx.fromAllowList` — the field may be
+ *     a single string (e.g. "pilot") or a string[] (e.g. "agents"): a string
+ *     value matches by equality, an array value matches if any element is in
+ *     `fromAllowList`.
+ *   - `grantFields` defaulting to `[]` means a caller that declares NO grants
+ *     gets EXACTLY the 0.4.0 behaviour, byte-for-byte — this is a pure
+ *     widening, no existing caller's behaviour changes without an explicit
+ *     opt-in declaration at its own call site.
+ *   - This closes the OTHER pole of the fail-closed defect: 0.3.0/0.4.0
+ *     closed "a right granted by ABSENCE" (missing oauthCtx silently passing
+ *     everything); this closes "a right REFUSED by absence" — a grant that
+ *     IS present on the row (a named agent, pilot, or fulfiller) but that the
+ *     filter was structurally blind to because it only ever consulted
+ *     createdBy/namespace.
+ *
  * Contract (0.3.0 — BREAKING vs. 0.2.0):
  *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
  *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
@@ -50,6 +75,18 @@ export type ScopeFilterable = {
  * `fromAllowList` contains the `"*"` sentinel.
  */
 export declare function isMasterScope(ctx: OAuthCtx): boolean;
+/**
+ * Names of row properties the CALLER declares as per-row grants. Each named
+ * property's runtime value must be a `string` (single identity) or
+ * `string[]` (multiple identities) to be consulted — any other runtime shape
+ * is silently skipped (not a match), never thrown, since these are duck-typed
+ * against arbitrary Convex documents.
+ *
+ * This is DATA supplied by the call site, never a list hardcoded inside this
+ * package: the package does not and must not know that "agents" means
+ * missions or "fulfilledBy" means mandates.
+ */
+export type GrantFieldDeclaration = readonly string[];
 /**
  * Core predicate. Returns true when the row is visible to the caller.
  *
@@ -57,6 +94,9 @@ export declare function isMasterScope(ctx: OAuthCtx): boolean;
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
+ *   - row[grantField] (for any declared grantField) names an identity in
+ *     oauthCtx.fromAllowList, where the field is a string (equality) or a
+ *     string[] (any-element membership)                → true
  *   - otherwise                                        → false
  *
  * `oauthCtx` is mandatory (see module-level contract note above): an omitted
@@ -64,21 +104,32 @@ export declare function isMasterScope(ctx: OAuthCtx): boolean;
  * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
  * explicitly.
  *
+ * `grantFields` (0.5.0, optional, defaults to `[]`) lets a caller widen the
+ * predicate for its own table without this package hardcoding which fields
+ * are grants — see the module-level 0.5.0 contract note above. Omitting it
+ * (or passing `[]`) reproduces 0.4.0 behaviour exactly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
-export declare function passesScopeFilter(oauthCtx: OAuthCtx, row: ScopeFilterable): boolean;
+export declare function passesScopeFilter<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T, grantFields?: GrantFieldDeclaration): boolean;
 /**
  * Filter a list of rows (post-query). Used by list_* tools.
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[]): T[];
+export declare function scopeFilterList<T extends ScopeFilterable>(oauthCtx: OAuthCtx, rows: T[], grantFields?: GrantFieldDeclaration): T[];
 /**
  * Assert a single row passes (get_* tools). Returns the row when allowed, null
  * otherwise — callers translate null to a 404-equivalent "not found" MCP error
  * to avoid leaking the difference between "absent" and "filtered out".
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined): T | null;
+export declare function scopeFilterGet<T extends ScopeFilterable>(oauthCtx: OAuthCtx, row: T | null | undefined, grantFields?: GrantFieldDeclaration): T | null;
 /**
  * Helper for callers that want a single "is master / legacy" predicate.
  */

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,eAAe,GACnB,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,GACR,CAAC,EAAE,CAGL;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,GACxB,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAgBT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -5,6 +5,31 @@
  * implementation; the only change was replacing a framework-specific context
  * type with the framework-agnostic `OAuthCtx` from `./types`.
  *
+ * Contract (0.5.0 — additive, widening only, vs. 0.4.0):
+ *   - Every exported predicate/filter now accepts an OPTIONAL `grantFields`
+ *     parameter: `readonly string[]`, defaulting to `[]`. Each entry names a
+ *     property on the row that the CALLER declares as a per-row grant (e.g.
+ *     "agents", "pilot", "fulfilledBy"). The package never hardcodes which
+ *     fields are grants for which table — that declaration is data supplied
+ *     by the caller at the call site, not business knowledge baked into this
+ *     shared module (no-hardcoded-business-knowledge).
+ *   - A row passes for a non-master caller if createdBy/namespace already
+ *     passed (0.4.0 behaviour, unchanged) OR if ANY declared grant field's
+ *     value names an identity in `oauthCtx.fromAllowList` — the field may be
+ *     a single string (e.g. "pilot") or a string[] (e.g. "agents"): a string
+ *     value matches by equality, an array value matches if any element is in
+ *     `fromAllowList`.
+ *   - `grantFields` defaulting to `[]` means a caller that declares NO grants
+ *     gets EXACTLY the 0.4.0 behaviour, byte-for-byte — this is a pure
+ *     widening, no existing caller's behaviour changes without an explicit
+ *     opt-in declaration at its own call site.
+ *   - This closes the OTHER pole of the fail-closed defect: 0.3.0/0.4.0
+ *     closed "a right granted by ABSENCE" (missing oauthCtx silently passing
+ *     everything); this closes "a right REFUSED by absence" — a grant that
+ *     IS present on the row (a named agent, pilot, or fulfiller) but that the
+ *     filter was structurally blind to because it only ever consulted
+ *     createdBy/namespace.
+ *
  * Contract (0.3.0 — BREAKING vs. 0.2.0):
  *   - `oauthCtx` is now MANDATORY. A right is never granted by absence: the
  *     0.2.0 behaviour of `oauthCtx === undefined` silently passing everything
@@ -57,6 +82,15 @@ export function isMasterScope(ctx) {
         return true;
     return ctx.fromAllowList.includes("*");
 }
+const NO_GRANT_FIELDS = [];
+function grantFieldMatches(value, fromAllowList) {
+    if (typeof value === "string")
+        return fromAllowList.includes(value);
+    if (Array.isArray(value)) {
+        return value.some((entry) => typeof entry === "string" && fromAllowList.includes(entry));
+    }
+    return false;
+}
 /**
  * Core predicate. Returns true when the row is visible to the caller.
  *
@@ -64,6 +98,9 @@ export function isMasterScope(ctx) {
  *   - row.createdBy ∈ oauthCtx.fromAllowList           → true
  *   - row.namespace === prefix OR startsWith prefix+'/'
  *     for any prefix ∈ oauthCtx.namespaceReadPrefixes  → true
+ *   - row[grantField] (for any declared grantField) names an identity in
+ *     oauthCtx.fromAllowList, where the field is a string (equality) or a
+ *     string[] (any-element membership)                → true
  *   - otherwise                                        → false
  *
  * `oauthCtx` is mandatory (see module-level contract note above): an omitted
@@ -71,11 +108,16 @@ export function isMasterScope(ctx) {
  * need the old legacy-bearer wildcard behaviour must pass `LEGACY_WILDCARD_CTX`
  * explicitly.
  *
+ * `grantFields` (0.5.0, optional, defaults to `[]`) lets a caller widen the
+ * predicate for its own table without this package hardcoding which fields
+ * are grants — see the module-level 0.5.0 contract note above. Omitting it
+ * (or passing `[]`) reproduces 0.4.0 behaviour exactly.
+ *
  * Substring matches that don't fall on a '/' boundary are explicitly rejected
  * (e.g. namespace="orchestrator/alphabet" does NOT match prefix
  * "orchestrator/alpha"). This avoids the classic prefix-isolation bypass.
  */
-export function passesScopeFilter(oauthCtx, row) {
+export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
     if (isMasterScope(oauthCtx))
         return true;
@@ -90,25 +132,36 @@ export function passesScopeFilter(oauthCtx, row) {
                 return true;
         }
     }
+    for (const field of grantFields) {
+        const value = row[field];
+        if (grantFieldMatches(value, oauthCtx.fromAllowList))
+            return true;
+    }
     return false;
 }
 /**
  * Filter a list of rows (post-query). Used by list_* tools.
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export function scopeFilterList(oauthCtx, rows) {
+export function scopeFilterList(oauthCtx, rows, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
-    return rows.filter((r) => passesScopeFilter(oauthCtx, r));
+    return rows.filter((r) => passesScopeFilter(oauthCtx, r, grantFields));
 }
 /**
  * Assert a single row passes (get_* tools). Returns the row when allowed, null
  * otherwise — callers translate null to a 404-equivalent "not found" MCP error
  * to avoid leaking the difference between "absent" and "filtered out".
+ *
+ * `grantFields` — see `passesScopeFilter`. Defaults to `[]` (0.4.0-identical
+ * behaviour).
  */
-export function scopeFilterGet(oauthCtx, row) {
+export function scopeFilterGet(oauthCtx, row, grantFields = NO_GRANT_FIELDS) {
     assertOauthCtx(oauthCtx);
     if (row == null)
         return null;
-    return passesScopeFilter(oauthCtx, row) ? row : null;
+    return passesScopeFilter(oauthCtx, row, grantFields) ? row : null;
 }
 /**
  * Helper for callers that want a single "is master / legacy" predicate.

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAoB;IAEpB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS;IAET,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB;IAEzB,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",