@vantageos/cloud-identity 0.6.0 → 0.8.0

package/dist/presented-bearer.js

@@ -0,0 +1,226 @@
+/**
+ * Presented-bearer resolution — the opaque-token trust boundary.
+ * (See package.json "version" for the release this shipped in.)
+ *
+ * Closes the gap between the two credential paths the package already had:
+ *
+ *   - `validateMasterBearer` covers the MASTER credential only (one configured
+ *     secret, no datastore, no identity beyond "it was the master").
+ *   - `decodeUnverifiedBearer` says in its own name that it verifies nothing;
+ *     its payload is attacker-controlled and is not a trust boundary.
+ *
+ * Between them there was no function taking a PRESENTED, NON-MASTER bearer,
+ * hashing it, looking the row up and returning a resolved identity or a typed
+ * refusal. Consumers therefore wrote that primitive locally — a second
+ * authority answering "who is calling", which is exactly what must not exist.
+ * This module is the single one.
+ *
+ * DIVISION OF LABOUR. The package cannot query a datastore, so the row lookup
+ * arrives as a caller-supplied callback. Everything that can be got wrong
+ * stays here: the header parse, the hashing, the constant-time digest compare,
+ * revocation, expiry, row-shape validation, and the SHAPE of the refusal. The
+ * caller supplies one indexed read and nothing else.
+ *
+ * Errors are coarse-grained on purpose — callers should not surface the exact
+ * reason to remote clients beyond a generic 401/403. The vocabulary is
+ * `validateMasterBearer`'s, unchanged: "missing", "malformed", "mismatch".
+ *
+ * @security The callback is invoked with the SHA-256 HEX DIGEST of the
+ * presented token, never the token. A consumer's datastore query, query log
+ * and slow-query log therefore never see a usable secret. The raw token does
+ * not appear in any returned value, any refusal, or any logging callback.
+ */
+import { z } from "zod";
+import { sha256Hex, timingSafeEqual } from "./crypto.js";
+const BEARER_PREFIX_LOWER = "bearer ";
+// ---------------------------------------------------------------------------
+// The stored row
+// ---------------------------------------------------------------------------
+/**
+ * Shape of the row a consumer's datastore returns for a given digest.
+ *
+ * `agentId` ABSENT (undefined or null) means an ORGANIZATION-WIDE token: it
+ * carries a tenant but no agent identity. Such a row is valid and resolves
+ * successfully; what it may NOT do is stand in for an agent. See
+ * `requireAgentScopedIdentity`.
+ *
+ * `secretHash` is the digest as stored by the consumer. It is re-compared here
+ * against the digest computed from the presented token, in constant time, so a
+ * lookup that performs a loose match (prefix, LIKE, case-folded index) or that
+ * returns the wrong row cannot become an authentication.
+ */
+export const storedBearerRowSchema = z.object({
+    tenantId: z.string().min(1),
+    secretHash: z.string().min(1),
+    agentId: z.string().min(1).nullish(),
+    revoked: z.boolean().nullish(),
+    expiresAt: z.number().nullish(),
+    scopes: z.array(z.string()).nullish(),
+});
+// ---------------------------------------------------------------------------
+// The refusals, as shared frozen singletons
+// ---------------------------------------------------------------------------
+const MISSING = Object.freeze({
+    ok: false,
+    error: "missing",
+});
+const MALFORMED = Object.freeze({
+    ok: false,
+    error: "malformed",
+});
+const UNAVAILABLE = Object.freeze({
+    ok: false,
+    error: "unavailable",
+});
+/**
+ * THE collapsed refusal. One frozen value, shared by every branch that must be
+ * externally indistinguishable — unknown digest, revoked, expired, invalid row
+ * shape, stored-digest mismatch. Not five literals that happen to be equal
+ * today: one object, so the branches cannot drift apart by an added field.
+ */
+const COLLAPSED_REFUSAL = Object.freeze({
+    ok: false,
+    error: "mismatch",
+});
+function report(deps, reason) {
+    const sink = deps.onRefusal;
+    if (typeof sink !== "function")
+        return;
+    try {
+        sink(reason);
+    }
+    catch {
+        // A failing logger must never change an authorization outcome.
+    }
+}
+function collapse(deps, reason) {
+    report(deps, reason);
+    return COLLAPSED_REFUSAL;
+}
+// ---------------------------------------------------------------------------
+// validatePresentedBearer
+// ---------------------------------------------------------------------------
+/**
+ * Resolve an `Authorization: Bearer <token>` header presented by a NON-MASTER
+ * caller into a verified identity, or into a typed refusal.
+ *
+ * Order of operations, and why:
+ *   1. Parse the header. A missing or malformed header is refused WITHOUT
+ *      calling the lookup, so a garbage request costs no datastore read.
+ *   2. Hash the token to a SHA-256 hex digest. The raw token goes no further.
+ *   3. Look the row up BY THAT DIGEST.
+ *   4. Re-compare the row's stored digest against the computed one with
+ *      `timingSafeEqual` — never `!==` on a secret or a digest.
+ *   5. Validate the row's shape, then revocation, then expiry.
+ *   6. Resolve the tenant, and the agent as a presence or an explicit absence.
+ *
+ * Steps 3–5 all refuse with the SAME frozen value. A right is never granted by
+ * absence or by failure: there is no branch that returns `ok: true` without
+ * having passed every check above.
+ *
+ * @example
+ * ```ts
+ * const result = await validatePresentedBearer(req.headers.get("authorization"), {
+ *   lookupBySecretHash: (digest) => db.tokens.byDigest(digest),
+ * });
+ * if (!result.ok) return respond(result.error === "unavailable" ? 503 : 401);
+ * const tenantId = result.identity.tenantId;
+ * ```
+ */
+export async function validatePresentedBearer(authHeader, deps) {
+    if (typeof deps?.lookupBySecretHash !== "function") {
+        // A programming error in the consumer, not a claim about any caller: it
+        // must not be reported as a credential refusal.
+        throw new TypeError("validatePresentedBearer: deps.lookupBySecretHash must be a function.");
+    }
+    if (authHeader === undefined || authHeader === null || authHeader === "") {
+        report(deps, "no-header");
+        return MISSING;
+    }
+    // Case-insensitive scheme match without lower-casing the token bytes
+    // (RFC 7235 §2.1), identical to `validateMasterBearer`.
+    const lower = authHeader.toLowerCase();
+    if (!lower.startsWith(BEARER_PREFIX_LOWER)) {
+        report(deps, "malformed-header");
+        return MALFORMED;
+    }
+    const token = authHeader.slice(BEARER_PREFIX_LOWER.length).trim();
+    if (token.length === 0) {
+        report(deps, "malformed-header");
+        return MALFORMED;
+    }
+    const presentedDigest = await sha256Hex(token);
+    let row;
+    try {
+        row = await deps.lookupBySecretHash(presentedDigest);
+    }
+    catch {
+        report(deps, "lookup-failed");
+        return UNAVAILABLE;
+    }
+    if (row === null || row === undefined) {
+        return collapse(deps, "unknown-token");
+    }
+    const parsed = storedBearerRowSchema.safeParse(row);
+    if (!parsed.success) {
+        return collapse(deps, "row-shape-invalid");
+    }
+    const stored = parsed.data;
+    const encoder = new TextEncoder();
+    const digestsMatch = await timingSafeEqual(encoder.encode(stored.secretHash.toLowerCase()), encoder.encode(presentedDigest));
+    if (!digestsMatch) {
+        return collapse(deps, "stored-digest-mismatch");
+    }
+    if (stored.revoked === true) {
+        return collapse(deps, "revoked-token");
+    }
+    const nowMs = deps.now ? deps.now() : Date.now();
+    if (typeof stored.expiresAt === "number" && stored.expiresAt <= nowMs) {
+        return collapse(deps, "expired-token");
+    }
+    const agent = typeof stored.agentId === "string" && stored.agentId.length > 0
+        ? { present: true, agentId: stored.agentId }
+        : {
+            present: false,
+            code: "AGENT_ABSENT",
+            reason: "organization-wide-token",
+        };
+    return {
+        ok: true,
+        identity: {
+            tenantId: stored.tenantId,
+            agent,
+            scopes: stored.scopes ?? [],
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// requireAgentScopedIdentity
+// ---------------------------------------------------------------------------
+/**
+ * Narrow a resolved identity to a PER-AGENT surface, refusing when the token
+ * carries no agent.
+ *
+ * An organization-wide token is a legitimate credential that is simply not an
+ * agent; treating it as one would silently widen it into whichever agent the
+ * surface happened to be about. So this is a second, mandatory call, and its
+ * output type is branded: a per-agent handler declares `AgentScopedIdentity`
+ * and the only way to obtain one is here.
+ *
+ * Grants nothing on its own — it can only ever narrow an identity
+ * `validatePresentedBearer` already resolved.
+ */
+export function requireAgentScopedIdentity(identity) {
+    if (!identity.agent.present) {
+        return { ok: false, error: "no-agent-on-token" };
+    }
+    const scoped = {
+        tenantId: identity.tenantId,
+        agentId: identity.agent.agentId,
+        scopes: identity.scopes,
+        // The brand exists only in the type system; there is no runtime field to
+        // forge, and no value to construct outside this module.
+    };
+    return { ok: true, identity: scoped };
+}
+//# sourceMappingURL=presented-bearer.js.map

package/dist/presented-bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presented-bearer.js","sourceRoot":"","sources":["../src/presented-bearer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC,CAAC;AA+HH,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E,MAAM,OAAO,GAAkC,MAAM,CAAC,MAAM,CAAC;IAC3D,EAAE,EAAE,KAAc;IAClB,KAAK,EAAE,SAAkB;CAC1B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAkC,MAAM,CAAC,MAAM,CAAC;IAC7D,EAAE,EAAE,KAAc;IAClB,KAAK,EAAE,WAAoB;CAC5B,CAAC,CAAC;AAEH,MAAM,WAAW,GAAkC,MAAM,CAAC,MAAM,CAAC;IAC/D,EAAE,EAAE,KAAc;IAClB,KAAK,EAAE,aAAsB;CAC9B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAkC,MAAM,CAAC,MAAM,CAAC;IACrE,EAAE,EAAE,KAAc;IAClB,KAAK,EAAE,UAAmB;CAC3B,CAAC,CAAC;AAEH,SAAS,MAAM,CACb,IAAyB,EACzB,MAAqC;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,IAAyB,EACzB,MAAqC;IAErC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrB,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAqC,EACrC,IAAyB;IAEzB,IAAI,OAAO,IAAI,EAAE,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACnD,wEAAwE;QACxE,gDAAgD;QAChD,MAAM,IAAI,SAAS,CACjB,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,wDAAwD;IACxD,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAE/C,IAAI,GAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAE3B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,eAAe,CACxC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAC/C,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAChC,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACjD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,KAAK,GACT,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QAC5C,CAAC,CAAC;YACE,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,yBAAyB;SAClC,CAAC;IAER,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;SAC5B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgC;IAEhC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;QAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,yEAAyE;QACzE,wDAAwD;KAClC,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/tenancy-domain.d.ts

@@ -105,9 +105,12 @@ export declare function getEffectiveTenantId(ctx: TenantContext, args: {
  *   - decoder for a bearer that was ALREADY verified by an upstream signed-JWT
  *     middleware (the production trust boundary)
  *
- * For the production trust boundary, callers MUST substitute a signed JWT
- * verifier (not yet exported by this package) or an opaque-token lookup
- * against a Convex tenancy table.
+ * For the production trust boundary on an OPAQUE token, callers MUST use
+ * `validatePresentedBearer` (see `./presented-bearer.ts`), which hashes the
+ * presented token, looks the row up by digest through a caller-supplied read,
+ * re-compares the stored digest in constant time, and honours revocation and
+ * expiry. For a SIGNED JWT, callers must substitute a signature verifier; this
+ * package does not export one.
  *
  * Renamed from `resolveBearer` (0.2.0 pre-release) to make the lack of
  * verification impossible to miss at the call-site.

package/dist/tenancy-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy-domain.d.ts","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,eAAO,MAAM,qBAAqB;;;;;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,mBAAmB;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;gBAE5B,OAAO,EAAE,qBAAqB;CAS3C;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5B,MAAM,CASR;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CAmBxB"}
+{"version":3,"file":"tenancy-domain.d.ts","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,mBAAmB;;;;EAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAMxD,eAAO,MAAM,qBAAqB;;;;;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,mBAAmB;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;gBAE5B,OAAO,EAAE,qBAAqB;CAS3C;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5B,MAAM,CASR;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,QAAA,MAAM,mBAAmB;;;;;;;;iBAIvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,CAmBxB"}

package/dist/tenancy-domain.js

@@ -115,9 +115,12 @@ export function getEffectiveTenantId(ctx, args) {
  *   - decoder for a bearer that was ALREADY verified by an upstream signed-JWT
  *     middleware (the production trust boundary)
  *
- * For the production trust boundary, callers MUST substitute a signed JWT
- * verifier (not yet exported by this package) or an opaque-token lookup
- * against a Convex tenancy table.
+ * For the production trust boundary on an OPAQUE token, callers MUST use
+ * `validatePresentedBearer` (see `./presented-bearer.ts`), which hashes the
+ * presented token, looks the row up by digest through a caller-supplied read,
+ * re-compares the stored digest in constant time, and honours revocation and
+ * expiry. For a SIGNED JWT, callers must substitute a signature verifier; this
+ * package does not export one.
  *
  * Renamed from `resolveBearer` (0.2.0 pre-release) to make the lack of
  * verification impossible to miss at the call-site.

package/dist/tenancy-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy-domain.js","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAaH;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,iBAA0B,CAAC;IAClC,OAAO,CAAwB;IAExC,YAAY,OAA8B;QACxC,KAAK,CACH,sCAAsC,OAAO,CAAC,iBAAiB,oCAAoC,OAAO,CAAC,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,CAClJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,kFAAkF;QAClF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkB,EAClB,IAA6B;IAE7B,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,mBAAmB,CAAC;YAC5B,iBAAiB,EAAE,IAAI,CAAC,WAAW;YACnC,eAAe,EAAE,GAAG,CAAC,WAAW;YAChC,MAAM,EAAE,qEAAqE;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa;IAEb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"tenancy-domain.js","sourceRoot":"","sources":["../src/tenancy-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAaH;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,iBAA0B,CAAC;IAClC,OAAO,CAAwB;IAExC,YAAY,OAA8B;QACxC,KAAK,CACH,sCAAsC,OAAO,CAAC,iBAAiB,oCAAoC,OAAO,CAAC,eAAe,OAAO,OAAO,CAAC,MAAM,EAAE,CAClJ,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,kFAAkF;QAClF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkB,EAClB,IAA6B;IAE7B,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,mBAAmB,CAAC;YAC5B,iBAAiB,EAAE,IAAI,CAAC,WAAW;YACnC,eAAe,EAAE,GAAG,CAAC,WAAW;YAChC,MAAM,EAAE,qEAAqE;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;CACpC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAa;IAEb,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC"}

package/dist/token-exchange.d.ts

@@ -0,0 +1,53 @@
+import type { AuthorizationCodeStore } from "./authorize-flow.js";
+import { type AuthorizeRefusal } from "./authorize-shared.js";
+/**
+ * The claims a token minted from an authorization code carries. They are
+ * copied from the code's own binding, which was written from the verified
+ * Clerk user and a membership that user holds. There is no `scopeProfile`
+ * here and no code path that reads one: an identity is never supplied by the
+ * client-registration row.
+ */
+export interface AuthorizedTokenClaims {
+    sub: string;
+    org_id: string;
+    org_slug: string | null;
+    org_role: string;
+    aud: string;
+    client_id: string;
+    scope: string;
+}
+export interface ExchangeInput {
+    /** The authorization code the client presents. */
+    code: string;
+    /** PKCE verifier (RFC 7636). */
+    codeVerifier: string;
+    /** Must equal the redirect_uri of the authorize request. */
+    redirectUri: string;
+    /** The authenticated client's id. */
+    clientId: string;
+    /** Optional RFC 8707 resource; when present it must equal the bound one. */
+    resource?: string;
+}
+export interface ExchangeDeps {
+    codeStore: AuthorizationCodeStore;
+    /** Epoch milliseconds. */
+    now?: () => number;
+}
+export type ExchangeResult = {
+    ok: true;
+    claims: AuthorizedTokenClaims;
+} | {
+    ok: false;
+    refusal: AuthorizeRefusal;
+};
+/**
+ * Redeems an authorization code. The code is CONSUMED first (atomically, by
+ * the store) so that every attempt, successful or not, burns it: a wrong
+ * verifier cannot be retried against the same code. A code presented twice is
+ * `code-reused`, distinct from `code-unknown`, so the consumer can revoke what
+ * the first redemption issued.
+ *
+ * Checks, in order: expiry, client, redirect_uri, resource, PKCE.
+ */
+export declare function exchangeAuthorizationCode(input: ExchangeInput, deps: ExchangeDeps): Promise<ExchangeResult>;
+//# sourceMappingURL=token-exchange.d.ts.map

package/dist/token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../src/token-exchange.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACL,KAAK,gBAAgB,EAKtB,MAAM,uBAAuB,CAAC;AAG/B;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,sBAAsB,CAAC;IAClC,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAO7C;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CAuCzB"}

package/dist/token-exchange.js

@@ -0,0 +1,60 @@
+import { isWellFormedVerifier, pkceChallengeFromVerifier, refusal, utf8, } from "./authorize-shared.js";
+import { sha256Hex, timingSafeEqual } from "./crypto.js";
+const fail = (reason) => ({
+    ok: false,
+    refusal: refusal(reason),
+});
+/**
+ * Redeems an authorization code. The code is CONSUMED first (atomically, by
+ * the store) so that every attempt, successful or not, burns it: a wrong
+ * verifier cannot be retried against the same code. A code presented twice is
+ * `code-reused`, distinct from `code-unknown`, so the consumer can revoke what
+ * the first redemption issued.
+ *
+ * Checks, in order: expiry, client, redirect_uri, resource, PKCE.
+ */
+export async function exchangeAuthorizationCode(input, deps) {
+    if (typeof input.code !== "string" || input.code.length === 0) {
+        return fail("code-unknown");
+    }
+    let consumed;
+    try {
+        consumed = await deps.codeStore.consume(await sha256Hex(input.code));
+    }
+    catch {
+        return fail("code-store-unavailable");
+    }
+    if (consumed.status === "unknown")
+        return fail("code-unknown");
+    if (consumed.status === "already-used")
+        return fail("code-reused");
+    const rec = consumed.record;
+    if (rec.expiresAt <= (deps.now ?? Date.now)())
+        return fail("code-expired");
+    if (rec.clientId !== input.clientId)
+        return fail("client-mismatch");
+    if (rec.redirectUri !== input.redirectUri)
+        return fail("redirect-uri-changed");
+    if (input.resource !== undefined && input.resource !== rec.resource) {
+        return fail("resource-mismatch");
+    }
+    if (!isWellFormedVerifier(input.codeVerifier))
+        return fail("verifier-malformed");
+    const derived = await pkceChallengeFromVerifier(input.codeVerifier);
+    if (!(await timingSafeEqual(utf8(derived), utf8(rec.codeChallenge)))) {
+        return fail("pkce-mismatch");
+    }
+    return {
+        ok: true,
+        claims: {
+            sub: rec.clerkUserId,
+            org_id: rec.orgId,
+            org_slug: rec.orgSlug,
+            org_role: rec.orgRole,
+            aud: rec.resource,
+            client_id: rec.clientId,
+            scope: rec.scope,
+        },
+    };
+}
+//# sourceMappingURL=token-exchange.js.map

package/dist/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../src/token-exchange.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,oBAAoB,EACpB,yBAAyB,EACzB,OAAO,EACP,IAAI,GACL,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA0CzD,MAAM,IAAI,GAAG,CAAC,MAAqC,EAAkB,EAAE,CAAC,CAAC;IACvE,EAAE,EAAE,KAAK;IACT,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAoB,EACpB,IAAkB;IAElB,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE5B,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,WAAW;YACpB,MAAM,EAAE,GAAG,CAAC,KAAK;YACjB,QAAQ,EAAE,GAAG,CAAC,OAAO;YACrB,QAAQ,EAAE,GAAG,CAAC,OAAO;YACrB,GAAG,EAAE,GAAG,CAAC,QAAQ;YACjB,SAAS,EAAE,GAAG,CAAC,QAAQ;YACvB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,6 +33,26 @@
     "./human-path": {
       "types": "./dist/human-path.d.ts",
       "import": "./dist/human-path.js"
+    },
+    "./presented-bearer": {
+      "types": "./dist/presented-bearer.d.ts",
+      "import": "./dist/presented-bearer.js"
+    },
+    "./authorize": {
+      "types": "./dist/authorize-flow.d.ts",
+      "import": "./dist/authorize-flow.js"
+    },
+    "./token-exchange": {
+      "types": "./dist/token-exchange.d.ts",
+      "import": "./dist/token-exchange.js"
+    },
+    "./clerk-session": {
+      "types": "./dist/clerk-session.d.ts",
+      "import": "./dist/clerk-session.js"
+    },
+    "./oidc": {
+      "types": "./dist/oidc.d.ts",
+      "import": "./dist/oidc.js"
     }
   },
   "files": [