@vantageos/cloud-identity 0.9.1 → 0.10.0

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0]
+
+**Additive — identity gaps a consumer had are now in the package.** Every
+consumer adapts these; none copies them. No existing function changes behaviour.
+
+### Added
+
+- `resolveMinRole` / `assertMinRole`: minimum-role check over an order the
+  caller supplies as data. Unknown role, unknown minimum, invalid order refuse.
+- `mapRoleClaim`: claim to role through caller data, with a fallback that must
+  be explicit. Absent or unmapped claim without a fallback refuses.
+- `resolveMembership` (injected async lookup; error, miss, inactive, malformed
+  and other-organisation all refuse), `isRowInTenant` (strict equality,
+  unstamped row refused), `membershipRecordSchema`.
+- `requireOrgAdmin`: the proof is bound to the caller's verified organisation.
+- `assertNamespaceWrite` and the shared boundary rule `namespaceMatchesPrefix`
+  (now also used by the read filter, same behaviour).
+- `timingSafeEqualSync` / `assertSecretSync`: synchronous constant-time
+  comparison; an unset expected secret matches nothing.
+- `IdentityRefusalError` and the `IdentityRefusal` types.
+- New subpath exports `./identity-refusal`, `./role-policy`,
+  `./tenant-membership`, `./namespace-write`, `./secret-compare-sync`.
+
 ## [0.9.1]
 
 ### Fixed

package/README.md

@@ -450,6 +450,77 @@ const mayWrite = resolveWriterRole({
 The module verifies no credential. The token record must come from your own
 lookup of the bearer the person presented, never from a request body.
 
+## Role policy, membership, namespace writes and secrets (0.10.0)
+
+Seven primitives that consumers used to copy. Each is pure, takes its policy as
+DATA from the call site, and refuses on every absence: no role, no claim, no
+list, no prefix, no secret and a failing lookup are all refusals, never a
+default grant. Refusals share one shape, `IdentityRefusal` (`code`, `reason`,
+`door`, `detail`), thrown inside an `IdentityRefusalError` by the asserting
+forms. `IdentityRefusalCode` is `RBAC_DENIED` or `CREDENTIAL_REFUSED`;
+`IdentityRefusalReason` is the closed list of reasons. Every function that
+refuses accepts an optional `door` so the refusal names your own entry point.
+
+**Minimum role over an order you supply** (`./role-policy`)
+
+- `resolveMinRole({ role, minimum, order, door? })` — `order` is your ordered
+  list, MOST privileged first (for example `["admin", "editor", "viewer"]`).
+  Returns `{ ok: true, role }` or `{ ok: false, refusal }` (`MinRoleInput`,
+  `MinRoleResult`). Refuses an empty or duplicated order, a `minimum` outside
+  the order, an absent or unknown role, and a role below the minimum. Matching
+  is exact.
+- `assertMinRole(input)` — the throwing form; returns the role or throws
+  `IdentityRefusalError`.
+
+**Role-claim mapping with an explicit fallback** (`./role-policy`)
+
+- `mapRoleClaim({ claim, mapping, fallback?, door? })` — maps a verified claim
+  (for example `"org:admin"`) to your role through `mapping`, your data
+  (`MapRoleClaimInput`, `MapRoleClaimResult`). The package never picks a
+  default: an absent or unmapped claim is served only when YOU pass `fallback`
+  (use your least-privileged role), and is refused otherwise. A claim that is
+  not a string counts as absent; prototype keys are never mapped. The result
+  says whether the role was `mapped` or came from the `fallback`.
+
+**Membership and tenant visibility** (`./tenant-membership`)
+
+- `resolveMembership({ subject, orgId, lookup, door? })` — async. `lookup` is
+  your read of one membership (`MembershipRecord`: `active`, optional `role`,
+  optional `orgId`). A throwing lookup, a miss, an inactive row, a malformed
+  row and a row naming another organisation are all refusals; the lookup's own
+  error text is not surfaced. Served result: `{ ok: true, membership }`
+  (`ResolvedMembership`, `ResolveMembershipInput`, `ResolveMembershipResult`).
+  `membershipRecordSchema` is the zod schema of the record.
+- `isRowInTenant({ rowOrgId, callerOrgId })` — `true` only on strict equality
+  of two non-empty ids. An unstamped row is never visible, not even to a caller
+  with no organisation.
+- `requireOrgAdmin({ verifiedOrgId, targetOrgId, role, adminRoles, door? })` —
+  the organisation-admin proof, bound to the caller's VERIFIED organisation:
+  the target must equal it, and the role must be one of `adminRoles` (your
+  data; an empty list admits nobody). Throws `IdentityRefusalError`
+  (`RequireOrgAdminInput`).
+
+**Namespace writes** (`./namespace-write`, `./scope-filter`)
+
+- `assertNamespaceWrite(oauthCtx, namespace, door?)` — throws unless the
+  caller's `namespaceWritePrefixes` admit the namespace. Master scope passes;
+  a non-master with no write prefix is refused; read prefixes never grant a
+  write; an empty-string prefix grants nothing.
+- `namespaceMatchesPrefix(namespace, prefix)` — the one path-boundary rule:
+  equality, or the prefix followed by `/`. `team/finance-archive` is not inside
+  `team/finance`. The read filter and `assertNamespaceWrite` both use it.
+
+**Synchronous constant-time comparison** (`./secret-compare-sync`)
+
+- `timingSafeEqualSync(a, b)` — strings (UTF-8) or `Uint8Array`, pure
+  JavaScript, no early exit on content. It walks the longer length and folds a
+  length difference into the result. Any other input type is `false`. The async
+  `timingSafeEqual` is unchanged.
+- `assertSecretSync(presented, expected, door?)` — throws `IdentityRefusalError`
+  (`CREDENTIAL_REFUSED`) on mismatch. An unset `expected` (undefined, null or
+  empty) matches nothing, so a missing configuration never opens a door. The
+  refusal carries neither value.
+
 ## What this package does not do
 
 Worth reading before you rely on it.

package/dist/identity-refusal.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
+ * org-admin proof, namespace write, secret comparison).
+ *
+ * A refusal is a value carrying its own code, reason and door, so a caller
+ * branches on content rather than on the mere presence of an exception, and an
+ * absence can never be mistaken for a refusal. It carries no credential.
+ *
+ * Mirrors the shape of `PersonRefusal` / `PersonRefusalError` on purpose: same
+ * `code`/`reason`/`door`/`detail` fields, same `ERROR: detail (reason, door)`
+ * message form. It is a separate type only because `PersonRefusalCode` is a
+ * closed vocabulary for the person path.
+ */
+export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch";
+export type IdentityRefusal = {
+    code: IdentityRefusalCode;
+    reason: IdentityRefusalReason;
+    /** The consumer's own name for the entry point that refused. */
+    door: string;
+    /** One sentence, safe to show to the caller. Never a credential. */
+    detail: string;
+};
+/** Thrown by the asserting forms. Carries the typed refusal untouched. */
+export declare class IdentityRefusalError extends Error {
+    readonly refusal: IdentityRefusal;
+    constructor(refusal: IdentityRefusal);
+}
+/** @internal Build a refusal. Not exported from the package. */
+export declare function refusal(code: IdentityRefusalCode, reason: IdentityRefusalReason, door: string, detail: string): IdentityRefusal;
+//# sourceMappingURL=identity-refusal.d.ts.map

package/dist/identity-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,CAAC;AAEtB,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js

@@ -0,0 +1,27 @@
+/**
+ * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
+ * org-admin proof, namespace write, secret comparison).
+ *
+ * A refusal is a value carrying its own code, reason and door, so a caller
+ * branches on content rather than on the mere presence of an exception, and an
+ * absence can never be mistaken for a refusal. It carries no credential.
+ *
+ * Mirrors the shape of `PersonRefusal` / `PersonRefusalError` on purpose: same
+ * `code`/`reason`/`door`/`detail` fields, same `ERROR: detail (reason, door)`
+ * message form. It is a separate type only because `PersonRefusalCode` is a
+ * closed vocabulary for the person path.
+ */
+/** Thrown by the asserting forms. Carries the typed refusal untouched. */
+export class IdentityRefusalError extends Error {
+    refusal;
+    constructor(refusal) {
+        super(`${refusal.code}: ${refusal.detail} (${refusal.reason}, ${refusal.door})`);
+        this.name = "IdentityRefusalError";
+        this.refusal = refusal;
+    }
+}
+/** @internal Build a refusal. Not exported from the package. */
+export function refusal(code, reason, door, detail) {
+    return { code, reason, door, detail };
+}
+//# sourceMappingURL=identity-refusal.js.map

package/dist/identity-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwCH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -6,7 +6,7 @@
  * validation.
  */
 export { timingSafeEqual, sha256Hex } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, namespaceMatchesPrefix, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 export type { OAuthCtx, ScopeProfile, NamespacePrefix, FromAllowListEntry, ValidateMasterBearerResult, } from "./types.js";
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
@@ -29,4 +29,12 @@ export { oauthErrorFor, pkceChallengeFromVerifier } from "./authorize-shared.js"
 export type { AuthorizeRefusal, AuthorizeRefusalReason, } from "./authorize-shared.js";
 export { PERSON_ACTOR_PREFIX, PersonRefusalError, personActorName, isPersonActorName, personTokenRecordSchema, resolvePersonPrincipal, resolvePersonActingName, checkPersonCallShape, resolvePersonTenantAccess, resolveWriterRole, requireWriterRole, } from "./person-principal.js";
 export type { PersonRefusal, PersonRefusalCode, PersonRefusalReason, PersonTokenRecord, PersonPrincipal, OrganisationState, PersonPrincipalDeps, PersonPrincipalResult, PersonActingNameResult, PersonAccessResult, } from "./person-principal.js";
+export { IdentityRefusalError } from "./identity-refusal.js";
+export type { IdentityRefusal, IdentityRefusalCode, IdentityRefusalReason, } from "./identity-refusal.js";
+export { resolveMinRole, assertMinRole, mapRoleClaim } from "./role-policy.js";
+export type { MinRoleInput, MinRoleResult, MapRoleClaimInput, MapRoleClaimResult, } from "./role-policy.js";
+export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSchema, } from "./tenant-membership.js";
+export type { MembershipRecord, ResolvedMembership, ResolveMembershipInput, ResolveMembershipResult, RequireOrgAdminInput, } from "./tenant-membership.js";
+export { assertNamespaceWrite } from "./namespace-write.js";
+export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * validation.
  */
 export { timingSafeEqual, sha256Hex } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, namespaceMatchesPrefix, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 // 0.2.0 — Domain-tenancy layer (additive)
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
@@ -29,4 +29,10 @@ export { oauthErrorFor, pkceChallengeFromVerifier } from "./authorize-shared.js"
 // pure data, the own-name actor rule, the tenant compare and the writer-role
 // assertion. Every consumer wires a person the same way.
 export { PERSON_ACTOR_PREFIX, PersonRefusalError, personActorName, isPersonActorName, personTokenRecordSchema, resolvePersonPrincipal, resolvePersonActingName, checkPersonCallShape, resolvePersonTenantAccess, resolveWriterRole, requireWriterRole, } from "./person-principal.js";
+// 0.10.0 — Identity gaps closed in the package so consumers adapt, never copy.
+export { IdentityRefusalError } from "./identity-refusal.js";
+export { resolveMinRole, assertMinRole, mapRoleClaim } from "./role-policy.js";
+export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSchema, } from "./tenant-membership.js";
+export { assertNamespaceWrite } from "./namespace-write.js";
+export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/namespace-write.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Namespace WRITE assertion.
+ *
+ * `OAuthCtx.namespaceWritePrefixes` has always been on the type with the note
+ * "enforced by the caller". This is that enforcement, so no consumer carries
+ * its own copy. It uses `namespaceMatchesPrefix` from `./scope-filter`, the
+ * same boundary rule as the read filter: prefix equality, or prefix + '/'.
+ *
+ * A write is never granted by a READ prefix, by an empty prefix list (for a
+ * non-master) or by an empty-string prefix.
+ */
+import type { OAuthCtx } from "./types.js";
+/**
+ * Throws `IdentityRefusalError` unless the caller may write `namespace`.
+ * Master scope (`scope === "master"` or `"*"` in `fromAllowList`) passes.
+ *
+ * @param door The consumer's own name for the entry point, for the refusal.
+ */
+export declare function assertNamespaceWrite(oauthCtx: OAuthCtx, namespace: string, door?: string): void;
+//# sourceMappingURL=namespace-write.d.ts.map

package/dist/namespace-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace-write.d.ts","sourceRoot":"","sources":["../src/namespace-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,SAAyB,GAC5B,IAAI,CA2BN"}

package/dist/namespace-write.js

@@ -0,0 +1,40 @@
+/**
+ * Namespace WRITE assertion.
+ *
+ * `OAuthCtx.namespaceWritePrefixes` has always been on the type with the note
+ * "enforced by the caller". This is that enforcement, so no consumer carries
+ * its own copy. It uses `namespaceMatchesPrefix` from `./scope-filter`, the
+ * same boundary rule as the read filter: prefix equality, or prefix + '/'.
+ *
+ * A write is never granted by a READ prefix, by an empty prefix list (for a
+ * non-master) or by an empty-string prefix.
+ */
+import { IdentityRefusalError, refusal } from "./identity-refusal.js";
+import { isMasterScope, namespaceMatchesPrefix } from "./scope-filter.js";
+/**
+ * Throws `IdentityRefusalError` unless the caller may write `namespace`.
+ * Master scope (`scope === "master"` or `"*"` in `fromAllowList`) passes.
+ *
+ * @param door The consumer's own name for the entry point, for the refusal.
+ */
+export function assertNamespaceWrite(oauthCtx, namespace, door = "assertNamespaceWrite") {
+    if (oauthCtx == null) {
+        throw new TypeError("assertNamespaceWrite: oauthCtx is required — pass an explicit OAuthCtx.");
+    }
+    const deny = (reason, detail) => {
+        throw new IdentityRefusalError(refusal("RBAC_DENIED", reason, door, detail));
+    };
+    if (isMasterScope(oauthCtx))
+        return;
+    if (typeof namespace !== "string" || namespace.length === 0) {
+        deny("namespace-invalid", "A non-empty namespace is required.");
+    }
+    const prefixes = (oauthCtx.namespaceWritePrefixes ?? []).filter((p) => typeof p === "string" && p.length > 0);
+    if (prefixes.length === 0) {
+        deny("no-write-prefixes", "This caller holds no namespace write prefix.");
+    }
+    if (!prefixes.some((p) => namespaceMatchesPrefix(namespace, p))) {
+        deny("namespace-write-denied", "The namespace is outside this caller's write prefixes.");
+    }
+}
+//# sourceMappingURL=namespace-write.js.map

package/dist/namespace-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace-write.js","sourceRoot":"","sources":["../src/namespace-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAkB,EAClB,SAAiB,EACjB,IAAI,GAAG,sBAAsB;IAE7B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CACX,MAA4E,EAC5E,MAAc,EACP,EAAE;QACT,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC7C,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,mBAAmB,EAAE,8CAA8C,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,wBAAwB,EAAE,wDAAwD,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC"}

package/dist/role-policy.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Role policy as DATA: a minimum-role check over a caller-supplied order, and a
+ * role-claim mapping with no package-chosen default.
+ *
+ * The package never knows what roles exist. "admin > editor > viewer" is one
+ * consumer's vocabulary, passed in at the call site; another consumer passes
+ * another. Every absence (no role, unknown role, empty order, no mapping, no
+ * fallback) is a refusal, never a default grant.
+ *
+ * Pure functions: no framework SDK, no I/O.
+ */
+import { type IdentityRefusal } from "./identity-refusal.js";
+export type MinRoleInput = {
+    /** The verified role of the caller. null/undefined/"" is "no role". */
+    role: string | null | undefined;
+    /** The least-privileged role that is admitted. Must appear in `order`. */
+    minimum: string;
+    /**
+     * The caller's ordered role list, MOST privileged FIRST
+     * (e.g. `["admin", "editor", "viewer"]`). No empty list, no duplicates.
+     */
+    order: readonly string[];
+    /** The consumer's own name for the entry point. Defaults to the function name. */
+    door?: string;
+};
+export type MinRoleResult = {
+    ok: true;
+    role: string;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Admit `role` when it is at or above `minimum` in `order`.
+ *
+ * Refuses: an invalid order (empty, duplicated, non-string entries), a
+ * `minimum` outside the order, a missing or unknown role, a role below the
+ * minimum. Matching is exact (no case-folding), and a role is only ever found
+ * by array position, so `"constructor"` or `"__proto__"` are unknown roles.
+ */
+export declare function resolveMinRole(input: MinRoleInput): MinRoleResult;
+/** Throwing form of {@link resolveMinRole}; returns the role, throws `IdentityRefusalError`. */
+export declare function assertMinRole(input: MinRoleInput): string;
+export type MapRoleClaimInput = {
+    /** The raw claim from the verified credential. Only a non-empty string counts. */
+    claim: unknown;
+    /** Claim value -> consumer role. Data supplied by the caller. */
+    mapping: Readonly<Record<string, string>>;
+    /**
+     * The role to use when the claim is absent or not in `mapping`. The package
+     * never picks one: omit it and an absent or unmapped claim is REFUSED.
+     * Supply the least-privileged role you have.
+     */
+    fallback?: string;
+    door?: string;
+};
+export type MapRoleClaimResult = {
+    ok: true;
+    role: string;
+    source: "mapped" | "fallback";
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Map a verified role claim to the consumer's role, with a least-privilege
+ * fallback that the CALLER must name. A claim that is not a string (array,
+ * object, number) is absent, never coerced. Lookup uses own keys only, so a
+ * claim of `"constructor"` is unmapped.
+ */
+export declare function mapRoleClaim(input: MapRoleClaimInput): MapRoleClaimResult;
+//# sourceMappingURL=role-policy.d.ts.map

package/dist/role-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.d.ts","sourceRoot":"","sources":["../src/role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAS/B,MAAM,MAAM,YAAY,GAAG;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CA2DjE;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAIzD;AAMD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,kFAAkF;IAClF,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAgDzE"}

package/dist/role-policy.js

@@ -0,0 +1,101 @@
+/**
+ * Role policy as DATA: a minimum-role check over a caller-supplied order, and a
+ * role-claim mapping with no package-chosen default.
+ *
+ * The package never knows what roles exist. "admin > editor > viewer" is one
+ * consumer's vocabulary, passed in at the call site; another consumer passes
+ * another. Every absence (no role, unknown role, empty order, no mapping, no
+ * fallback) is a refusal, never a default grant.
+ *
+ * Pure functions: no framework SDK, no I/O.
+ */
+import { IdentityRefusalError, refusal, } from "./identity-refusal.js";
+const DOOR_MIN = "resolveMinRole";
+const DOOR_MAP = "mapRoleClaim";
+/**
+ * Admit `role` when it is at or above `minimum` in `order`.
+ *
+ * Refuses: an invalid order (empty, duplicated, non-string entries), a
+ * `minimum` outside the order, a missing or unknown role, a role below the
+ * minimum. Matching is exact (no case-folding), and a role is only ever found
+ * by array position, so `"constructor"` or `"__proto__"` are unknown roles.
+ */
+export function resolveMinRole(input) {
+    const door = input.door ?? DOOR_MIN;
+    const { order, role, minimum } = input;
+    const orderValid = Array.isArray(order) &&
+        order.length > 0 &&
+        order.every((r) => typeof r === "string" && r.length > 0) &&
+        new Set(order).size === order.length;
+    if (!orderValid) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "invalid-role-order", door, "The role order must be a non-empty list of distinct role names."),
+        };
+    }
+    const minIndex = order.indexOf(minimum);
+    if (minIndex === -1) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "unknown-minimum-role", door, "The required minimum role is not part of the role order."),
+        };
+    }
+    const roleIndex = typeof role === "string" && role.length > 0 ? order.indexOf(role) : -1;
+    if (roleIndex === -1) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "unknown-role", door, "The caller's role is absent or not part of the role order."),
+        };
+    }
+    if (roleIndex > minIndex) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "role-below-minimum", door, "The caller's role is below the required minimum."),
+        };
+    }
+    return { ok: true, role: order[roleIndex] };
+}
+/** Throwing form of {@link resolveMinRole}; returns the role, throws `IdentityRefusalError`. */
+export function assertMinRole(input) {
+    const result = resolveMinRole(input);
+    if (!result.ok)
+        throw new IdentityRefusalError(result.refusal);
+    return result.role;
+}
+/**
+ * Map a verified role claim to the consumer's role, with a least-privilege
+ * fallback that the CALLER must name. A claim that is not a string (array,
+ * object, number) is absent, never coerced. Lookup uses own keys only, so a
+ * claim of `"constructor"` is unmapped.
+ */
+export function mapRoleClaim(input) {
+    const door = input.door ?? DOOR_MAP;
+    const { claim, mapping, fallback } = input;
+    if (mapping === null || typeof mapping !== "object" || Array.isArray(mapping)) {
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "invalid-role-mapping", door, "The role mapping must be a plain object of claim to role."),
+        };
+    }
+    const present = typeof claim === "string" && claim.length > 0;
+    if (present && Object.hasOwn(mapping, claim)) {
+        const mapped = mapping[claim];
+        if (typeof mapped === "string" && mapped.length > 0) {
+            return { ok: true, role: mapped, source: "mapped" };
+        }
+        return {
+            ok: false,
+            refusal: refusal("RBAC_DENIED", "invalid-role-mapping", door, "The role mapping holds a non-string or empty role."),
+        };
+    }
+    if (typeof fallback === "string" && fallback.length > 0) {
+        return { ok: true, role: fallback, source: "fallback" };
+    }
+    return {
+        ok: false,
+        refusal: refusal("RBAC_DENIED", present ? "role-claim-unmapped" : "role-claim-absent", door, present
+            ? "The role claim is not in the mapping and no fallback was supplied."
+            : "No role claim was presented and no fallback was supplied."),
+    };
+}
+//# sourceMappingURL=role-policy.js.map

package/dist/role-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../src/role-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,oBAAoB,EACpB,OAAO,GAER,MAAM,uBAAuB,CAAC;AAE/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,QAAQ,GAAG,cAAc,CAAC;AAwBhC;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAEvC,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,iEAAiE,CAClE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,0DAA0D,CAC3D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,cAAc,EACd,IAAI,EACJ,4DAA4D,CAC7D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,oBAAoB,EACpB,IAAI,EACJ,kDAAkD,CACnD;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAW,EAAE,CAAC;AACxD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAwBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,2DAA2D,CAC5D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,oDAAoD,CACrD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CACd,aAAa,EACb,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,EACrD,IAAI,EACJ,OAAO;YACL,CAAC,CAAC,oEAAoE;YACtE,CAAC,CAAC,2DAA2D,CAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/scope-filter.d.ts

@@ -61,6 +61,13 @@ import type { OAuthCtx } from "./types.js";
  * and pass it BY NAME. It is never inferred from an omitted argument.
  */
 export declare const LEGACY_WILDCARD_CTX: OAuthCtx;
+/**
+ * THE path-boundary rule for namespaces: `namespace` is inside `prefix` when it
+ * equals it, or continues it after a '/'. `team/finance-archive` is NOT inside
+ * `team/finance`. One implementation, used by the read filter and by
+ * `assertNamespaceWrite`, so the two can never drift apart.
+ */
+export declare function namespaceMatchesPrefix(namespace: string, prefix: string): boolean;
 /**
  * Row shape accepted by the scope filter. All fields optional because real
  * Convex documents from list_peers / list_messages / etc. don't all carry both.

package/dist/scope-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAgBT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}
+{"version":3,"file":"scope-filter.d.ts","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAKjC,CAAC;AAWF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,MAAM,EAAE,CAAC;AActD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACzD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,EACN,WAAW,GAAE,qBAAuC,GACnD,OAAO,CAeT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,eAAe,EACvD,QAAQ,EAAE,QAAQ,EAClB,IAAI,EAAE,CAAC,EAAE,EACT,WAAW,GAAE,qBAAuC,GACnD,CAAC,EAAE,CAGL;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,eAAe,EACtD,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EACzB,WAAW,GAAE,qBAAuC,GACnD,CAAC,GAAG,IAAI,CAIV;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAGtD"}

package/dist/scope-filter.js

@@ -71,6 +71,15 @@ function assertOauthCtx(oauthCtx) {
             "if you deliberately want the pre-0.3.0 legacy-bearer wildcard behaviour.");
     }
 }
+/**
+ * THE path-boundary rule for namespaces: `namespace` is inside `prefix` when it
+ * equals it, or continues it after a '/'. `team/finance-archive` is NOT inside
+ * `team/finance`. One implementation, used by the read filter and by
+ * `assertNamespaceWrite`, so the two can never drift apart.
+ */
+export function namespaceMatchesPrefix(namespace, prefix) {
+    return namespace === prefix || namespace.startsWith(`${prefix}/`);
+}
 /**
  * Returns true when the scope profile grants full, wildcard access.
  * Mirrors `isMasterScope` from the source module: `scope === "master"` OR
@@ -126,9 +135,7 @@ export function passesScopeFilter(oauthCtx, row, grantFields = NO_GRANT_FIELDS)
         return true;
     if (namespace) {
         for (const p of oauthCtx.namespaceReadPrefixes) {
-            if (namespace === p)
-                return true;
-            if (namespace.startsWith(`${p}/`))
+            if (namespaceMatchesPrefix(namespace, p))
                 return true;
         }
     }

package/dist/scope-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,SAAS,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"scope-filter.js","sourceRoot":"","sources":["../src/scope-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,KAAK,EAAE,QAAQ;IACf,aAAa,EAAE,CAAC,GAAG,CAAC;IACpB,qBAAqB,EAAE,EAAE;IACzB,sBAAsB,EAAE,EAAE;CAC3B,CAAC;AAEF,SAAS,cAAc,CAAC,QAAkB;IACxC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,2EAA2E;YACzE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IACtE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACpE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAeD,MAAM,eAAe,GAA0B,EAAE,CAAC;AAElD,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAuB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,GAAM,EACN,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAI,GAA0C,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,IAAS,EACT,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,GAAyB,EACzB,cAAqC,eAAe;IAEpD,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/secret-compare-sync.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Synchronous constant-time secret comparison.
+ *
+ * `timingSafeEqual` in `./crypto` is async (it uses Web Crypto for its dummy
+ * work) and takes bytes. A synchronous call site — a plain admin-secret gate,
+ * a framework hook that cannot await — needs a synchronous equivalent. This is
+ * pure JavaScript with no runtime dependency, so it also runs on any edge
+ * runtime. The async comparator is unchanged.
+ *
+ * Constant time here means: the number of loop iterations depends only on the
+ * LONGER input's length, never on where the first difference is. JavaScript
+ * gives no hard timing guarantee; this removes the content-dependent early
+ * exit, which is the leak a naive `===` has.
+ */
+/**
+ * Compare two strings (UTF-8) or byte arrays in constant time with respect to
+ * their content. Always walks the longer length; a length difference is folded
+ * into the result rather than returned early. Any other input type is `false`.
+ */
+export declare function timingSafeEqualSync(a: string | Uint8Array, b: string | Uint8Array): boolean;
+/**
+ * Assert a presented secret equals the configured one. Throws
+ * `IdentityRefusalError` (`CREDENTIAL_REFUSED`) on mismatch. An unset expected
+ * secret (undefined, null, empty) matches NOTHING, not even an empty
+ * presentation: a missing configuration must never open a door. The refusal
+ * carries neither value.
+ */
+export declare function assertSecretSync(presented: string | Uint8Array | null | undefined, expected: string | Uint8Array | null | undefined, door?: string): void;
+//# sourceMappingURL=secret-compare-sync.d.ts.map

package/dist/secret-compare-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-compare-sync.d.ts","sourceRoot":"","sources":["../src/secret-compare-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,MAAM,GAAG,UAAU,EACtB,CAAC,EAAE,MAAM,GAAG,UAAU,GACrB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,EACjD,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,EAChD,IAAI,SAAqB,GACxB,IAAI,CAyBN"}

package/dist/secret-compare-sync.js

@@ -0,0 +1,64 @@
+/**
+ * Synchronous constant-time secret comparison.
+ *
+ * `timingSafeEqual` in `./crypto` is async (it uses Web Crypto for its dummy
+ * work) and takes bytes. A synchronous call site — a plain admin-secret gate,
+ * a framework hook that cannot await — needs a synchronous equivalent. This is
+ * pure JavaScript with no runtime dependency, so it also runs on any edge
+ * runtime. The async comparator is unchanged.
+ *
+ * Constant time here means: the number of loop iterations depends only on the
+ * LONGER input's length, never on where the first difference is. JavaScript
+ * gives no hard timing guarantee; this removes the content-dependent early
+ * exit, which is the leak a naive `===` has.
+ */
+import { IdentityRefusalError, refusal } from "./identity-refusal.js";
+const encoder = new TextEncoder();
+function toBytes(value) {
+    if (typeof value === "string")
+        return encoder.encode(value);
+    if (value instanceof Uint8Array)
+        return value;
+    return null;
+}
+/**
+ * Compare two strings (UTF-8) or byte arrays in constant time with respect to
+ * their content. Always walks the longer length; a length difference is folded
+ * into the result rather than returned early. Any other input type is `false`.
+ */
+export function timingSafeEqualSync(a, b) {
+    const x = toBytes(a);
+    const y = toBytes(b);
+    if (x === null || y === null)
+        return false;
+    const xl = x.length;
+    const yl = y.length;
+    const max = xl > yl ? xl : yl;
+    let diff = xl ^ yl;
+    for (let i = 0; i < max; i++) {
+        const xi = i < xl ? x[i] : 0;
+        const yi = i < yl ? y[i] : 0;
+        diff |= xi ^ yi;
+    }
+    return diff === 0;
+}
+/**
+ * Assert a presented secret equals the configured one. Throws
+ * `IdentityRefusalError` (`CREDENTIAL_REFUSED`) on mismatch. An unset expected
+ * secret (undefined, null, empty) matches NOTHING, not even an empty
+ * presentation: a missing configuration must never open a door. The refusal
+ * carries neither value.
+ */
+export function assertSecretSync(presented, expected, door = "assertSecretSync") {
+    const expectedBytes = toBytes(expected);
+    if (expectedBytes === null || expectedBytes.length === 0) {
+        throw new IdentityRefusalError(refusal("CREDENTIAL_REFUSED", "secret-not-configured", door, "No secret is configured for this entry point, so nothing can match."));
+    }
+    const presentedBytes = toBytes(presented) ?? new Uint8Array(0);
+    // Compare even when presented is empty so the work does not depend on it.
+    const equal = timingSafeEqualSync(presentedBytes, expectedBytes);
+    if (!equal || presentedBytes.length === 0) {
+        throw new IdentityRefusalError(refusal("CREDENTIAL_REFUSED", "secret-mismatch", door, "The presented secret does not match."));
+    }
+}
+//# sourceMappingURL=secret-compare-sync.js.map

package/dist/secret-compare-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-compare-sync.js","sourceRoot":"","sources":["../src/secret-compare-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEtE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,CAAsB,EACtB,CAAsB;IAEtB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpB,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiD,EACjD,QAAgD,EAChD,IAAI,GAAG,kBAAkB;IAEzB,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,oBAAoB,EACpB,uBAAuB,EACvB,IAAI,EACJ,qEAAqE,CACtE,CACF,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,MAAM,KAAK,GAAG,mBAAmB,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,oBAAoB,CAC5B,OAAO,CACL,oBAAoB,EACpB,iBAAiB,EACjB,IAAI,EACJ,sCAAsC,CACvC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/tenant-membership.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Membership resolution, row-in-tenant visibility and the org-admin proof.
+ *
+ * The package cannot query a datastore, so the membership read is an INJECTED
+ * async lookup. Everything that can be got wrong stays here: a throwing lookup,
+ * a miss, an inactive row, a row of the wrong shape and a row that names a
+ * different organisation are all refusals. Nothing in this module returns a
+ * grant on an error path.
+ *
+ * Identifiers are OPAQUE and compared byte-for-byte: no trimming, no case
+ * folding, and never a slug compared against an id (supply the same kind of
+ * identifier on both sides).
+ */
+import { z } from "zod";
+import { type IdentityRefusal } from "./identity-refusal.js";
+/**
+ * True only when the row is stamped with an organisation, the caller has one,
+ * and the two are strictly equal. An unstamped row is NEVER visible, including
+ * to a caller that also has no organisation (absence equals absence is not a
+ * match).
+ */
+export declare function isRowInTenant(input: {
+    rowOrgId: string | null | undefined;
+    callerOrgId: string | null | undefined;
+}): boolean;
+/**
+ * What the consumer's lookup returns for (subject, organisation).
+ * `orgId`, when the row carries it, is re-checked here so a loose lookup (a
+ * prefix match, a wrong index) cannot become a membership in another org.
+ */
+export declare const membershipRecordSchema: z.ZodObject<{
+    active: z.ZodBoolean;
+    role: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    orgId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type MembershipRecord = z.infer<typeof membershipRecordSchema>;
+export type ResolvedMembership = {
+    subject: string;
+    orgId: string;
+    /** The role the record carries, or null when it carries none. */
+    role: string | null;
+};
+export type ResolveMembershipInput = {
+    /** The verified subject. Never a client-supplied argument. */
+    subject: string;
+    /** The verified organisation id. */
+    orgId: string;
+    /** Indexed read of one membership. Return null/undefined on a miss. */
+    lookup: (subject: string, orgId: string) => Promise<MembershipRecord | null | undefined> | MembershipRecord | null | undefined;
+    door?: string;
+};
+export type ResolveMembershipResult = {
+    ok: true;
+    membership: ResolvedMembership;
+} | {
+    ok: false;
+    refusal: IdentityRefusal;
+};
+/**
+ * Resolve the membership of a verified subject in a verified organisation via
+ * the injected `lookup`. Only `active === true` on a well-shaped record that
+ * names no other organisation is served. The lookup's own error text is never
+ * surfaced.
+ */
+export declare function resolveMembership(input: ResolveMembershipInput): Promise<ResolveMembershipResult>;
+export type RequireOrgAdminInput = {
+    /** The organisation the credential was VERIFIED for (a verified claim). */
+    verifiedOrgId: string | null | undefined;
+    /** The organisation the action is aimed at. Must equal `verifiedOrgId`. */
+    targetOrgId: string | null | undefined;
+    /** The caller's verified role. */
+    role: string | null | undefined;
+    /** Roles that count as organisation admin: data, supplied by the consumer. */
+    adminRoles: readonly string[];
+    door?: string;
+};
+/**
+ * An org-admin proof is bound to the caller's own verified organisation: the
+ * target must equal it, and the role must be one of `adminRoles`. Being an
+ * admin somewhere is not being an admin of the target. Throws
+ * `IdentityRefusalError`; returns nothing when served. An empty `adminRoles`
+ * admits nobody.
+ */
+export declare function requireOrgAdmin(input: RequireOrgAdminInput): void;
+//# sourceMappingURL=tenant-membership.d.ts.map

package/dist/tenant-membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-membership.d.ts","sourceRoot":"","sources":["../src/tenant-membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAU/B;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACxC,GAAG,OAAO,CAGV;AAMD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,MAAM,EAAE,CACN,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;IACxF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC;AAU5C;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA4ClC;AAMD,MAAM,MAAM,oBAAoB,GAAG;IACjC,2EAA2E;IAC3E,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,kCAAkC;IAClC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC,8EAA8E;IAC9E,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAmBjE"}

package/dist/tenant-membership.js

@@ -0,0 +1,113 @@
+/**
+ * Membership resolution, row-in-tenant visibility and the org-admin proof.
+ *
+ * The package cannot query a datastore, so the membership read is an INJECTED
+ * async lookup. Everything that can be got wrong stays here: a throwing lookup,
+ * a miss, an inactive row, a row of the wrong shape and a row that names a
+ * different organisation are all refusals. Nothing in this module returns a
+ * grant on an error path.
+ *
+ * Identifiers are OPAQUE and compared byte-for-byte: no trimming, no case
+ * folding, and never a slug compared against an id (supply the same kind of
+ * identifier on both sides).
+ */
+import { z } from "zod";
+import { IdentityRefusalError, refusal, } from "./identity-refusal.js";
+function nonEmpty(value) {
+    return typeof value === "string" && value.length > 0;
+}
+// ---------------------------------------------------------------------------
+// Row in tenant
+// ---------------------------------------------------------------------------
+/**
+ * True only when the row is stamped with an organisation, the caller has one,
+ * and the two are strictly equal. An unstamped row is NEVER visible, including
+ * to a caller that also has no organisation (absence equals absence is not a
+ * match).
+ */
+export function isRowInTenant(input) {
+    const { rowOrgId, callerOrgId } = input;
+    return nonEmpty(rowOrgId) && nonEmpty(callerOrgId) && rowOrgId === callerOrgId;
+}
+// ---------------------------------------------------------------------------
+// Membership
+// ---------------------------------------------------------------------------
+/**
+ * What the consumer's lookup returns for (subject, organisation).
+ * `orgId`, when the row carries it, is re-checked here so a loose lookup (a
+ * prefix match, a wrong index) cannot become a membership in another org.
+ */
+export const membershipRecordSchema = z.object({
+    active: z.boolean(),
+    role: z.string().nullish(),
+    orgId: z.string().nullish(),
+});
+function deny(reason, door, detail) {
+    return { ok: false, refusal: refusal("RBAC_DENIED", reason, door, detail) };
+}
+/**
+ * Resolve the membership of a verified subject in a verified organisation via
+ * the injected `lookup`. Only `active === true` on a well-shaped record that
+ * names no other organisation is served. The lookup's own error text is never
+ * surfaced.
+ */
+export async function resolveMembership(input) {
+    const door = input.door ?? "resolveMembership";
+    if (typeof input?.lookup !== "function") {
+        // A programming error in the consumer, not a claim about any caller.
+        throw new TypeError("resolveMembership: lookup must be a function.");
+    }
+    const { subject, orgId, lookup } = input;
+    if (!nonEmpty(subject) || !nonEmpty(orgId)) {
+        return deny("membership-invalid-input", door, "A verified subject and a verified organisation are both required.");
+    }
+    let record;
+    try {
+        record = await lookup(subject, orgId);
+    }
+    catch {
+        return deny("membership-lookup-failed", door, "The membership could not be read, so none is granted.");
+    }
+    if (record === null || record === undefined) {
+        return deny("membership-not-found", door, "No membership for this subject in this organisation.");
+    }
+    const parsed = membershipRecordSchema.safeParse(record);
+    if (!parsed.success) {
+        return deny("membership-record-invalid", door, "The membership record is not well formed.");
+    }
+    const row = parsed.data;
+    if (nonEmpty(row.orgId) && row.orgId !== orgId) {
+        return deny("other-organisation", door, "The membership belongs to another organisation.");
+    }
+    if (row.active !== true) {
+        return deny("membership-inactive", door, "The membership is not active.");
+    }
+    return {
+        ok: true,
+        membership: { subject, orgId, role: nonEmpty(row.role) ? row.role : null },
+    };
+}
+/**
+ * An org-admin proof is bound to the caller's own verified organisation: the
+ * target must equal it, and the role must be one of `adminRoles`. Being an
+ * admin somewhere is not being an admin of the target. Throws
+ * `IdentityRefusalError`; returns nothing when served. An empty `adminRoles`
+ * admits nobody.
+ */
+export function requireOrgAdmin(input) {
+    const door = input.door ?? "requireOrgAdmin";
+    const { verifiedOrgId, targetOrgId, role, adminRoles } = input;
+    const fail = (reason, detail) => {
+        throw new IdentityRefusalError(refusal("RBAC_DENIED", reason, door, detail));
+    };
+    if (!nonEmpty(verifiedOrgId)) {
+        fail("no-verified-organisation", "The caller has no verified organisation.");
+    }
+    if (!nonEmpty(targetOrgId) || targetOrgId !== verifiedOrgId) {
+        fail("other-organisation", "The target organisation is not the caller's verified organisation.");
+    }
+    if (!nonEmpty(role) || !Array.isArray(adminRoles) || !adminRoles.includes(role)) {
+        fail("role-not-admin", "The caller's role is not an organisation-admin role.");
+    }
+}
+//# sourceMappingURL=tenant-membership.js.map

package/dist/tenant-membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-membership.js","sourceRoot":"","sources":["../src/tenant-membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,OAAO,GAER,MAAM,uBAAuB,CAAC;AAE/B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAG7B;IACC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,WAAW,CAAC;AACjF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AA4BH,SAAS,IAAI,CACX,MAAqC,EACrC,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B;IAE7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,mBAAmB,CAAC;IAC/C,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QACxC,qEAAqE;QACrE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CACT,0BAA0B,EAC1B,IAAI,EACJ,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CACT,0BAA0B,EAC1B,IAAI,EACJ,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,sBAAsB,EAAE,IAAI,EAAE,sDAAsD,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,2BAA2B,EAAE,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,oBAAoB,EAAE,IAAI,EAAE,iDAAiD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,qBAAqB,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;KAC3E,CAAC;AACJ,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAC7C,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC/D,MAAM,IAAI,GAAG,CACX,MAAqC,EACrC,MAAc,EACP,EAAE;QACT,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QAC5D,IAAI,CAAC,oBAAoB,EAAE,oEAAoE,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;IACjF,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantageos/cloud-identity",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Framework-agnostic identity + scope-filter primitives for VantagePeers Cloud (multi-tenant MCP).",
   "type": "module",
   "main": "./dist/index.js",
@@ -57,6 +57,26 @@
     "./person-principal": {
       "types": "./dist/person-principal.d.ts",
       "import": "./dist/person-principal.js"
+    },
+    "./identity-refusal": {
+      "types": "./dist/identity-refusal.d.ts",
+      "import": "./dist/identity-refusal.js"
+    },
+    "./role-policy": {
+      "types": "./dist/role-policy.d.ts",
+      "import": "./dist/role-policy.js"
+    },
+    "./tenant-membership": {
+      "types": "./dist/tenant-membership.d.ts",
+      "import": "./dist/tenant-membership.js"
+    },
+    "./namespace-write": {
+      "types": "./dist/namespace-write.d.ts",
+      "import": "./dist/namespace-write.js"
+    },
+    "./secret-compare-sync": {
+      "types": "./dist/secret-compare-sync.d.ts",
+      "import": "./dist/secret-compare-sync.js"
     }
   },
   "files": [