@vantageos/cloud-identity 0.9.1 → 0.11.0

package/CHANGELOG.md

@@ -3,6 +3,116 @@
 All notable changes to `@vantageos/cloud-identity` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.11.0]
+
+**Additive — the acting principal by ID, and the target checked by ID
+(`./principal-by-id`).** An actor and a target are identified by their stored
+IDs; a name is a display label and never selects or authorises a row. Motivating
+incident: an agent of one organisation, calling by name through the service
+account, landed on another organisation's same-named agent's task at ten task
+doors, because admission compared names. No existing function changes behaviour.
+
+### Added
+
+- `resolveActingPrincipal(credential, lookups, door?)`: a verified credential
+  (agent bearer, person token, or the service account acting as itself or for
+  an agent named BY ID within its own organisation) to `{ principalId, orgId,
+  kind, viaServiceAccountId? }` read from stored rows, or a typed refusal.
+  Strict credential schemas: a credential carrying a name field is refused
+  whole. Missing or throwing lookups, misses, malformed, inactive, unstamped
+  and wrong-organisation rows, and inactive organisations all refuse.
+- `assertTargetBelongsTo(principal, target, lookups, opts?)` (async):
+  compares the target's stored `orgId` (and `ownerId` with `ownerOnly`) with
+  the resolved IDs. An unstamped target is refused to every principal, the
+  fleet principal included: no right is inferred from an absence, and a fleet
+  row carries the operator organisation's ID explicitly.
+- The fleet is the OPERATOR ORGANISATION, decided from data by the adapter
+  method `orgKindOf(orgId) => "operator" | "client" | null` on
+  `PrincipalLookups` (and `OrgKindLookups` for `assertTargetBelongsTo`). `null`,
+  a miss or any other answer is not the fleet; a missing or throwing adapter
+  refuses. An operator-organisation row is refused to every client; the
+  fleet principal reaches a client organisation's row only with
+  `fleetCrossOrg: true` and only when the adapter reports it as `"client"`.
+- RULING 5: membership of the operator organisation is ordinary membership.
+  Its agents and persons resolve as `kind: "agent"` / `"person"` of that
+  organisation and reach its rows only; cross-organisation reach (`kind:
+  "fleet"` + `fleetCrossOrg`) belongs to its service account alone, and
+  `reserved-fleet-scope` refuses a claim of that scope (a `kind: "fleet"`
+  credential, or `fleetCrossOrg` used by any other principal), never plain
+  membership.
+  The operator organisation is checked by `organisationById` like any other.
+- `FLEET_SCOPE_ORG_ID` (a reserved `"vantageos:fleet"` constant, merged on
+  `main` but never published) is REMOVED before release, with no alias (RULING
+  4). A row stamped with that literal is an unknown organisation and is refused
+  to every caller.
+- `actingCredentialSchema`, `principalRowSchema`, `organisationRowSchema` and
+  the types `ActingCredential`, `PrincipalRow`, `OrganisationRow`,
+  `PrincipalLookups`, `OrgKind`, `OrgKindLookups`, `ActingPrincipalKind`,
+  `ActingPrincipal`,
+  `ResolveActingPrincipalResult`, `TargetIds`, `AssertTargetOptions`,
+  `AssertTargetResult`.
+- New `IdentityRefusalReason` values: `credential-invalid`,
+  `principal-lookup-failed`, `principal-not-found`, `principal-record-invalid`,
+  `principal-inactive`, `organisation-not-active`, `reserved-fleet-scope`,
+  `acting-agent-other-organisation`, `target-unstamped`,
+  `target-other-organisation`, `target-owner-mismatch`.
+- New subpath export `./principal-by-id`.
+- A test that reads the exported signatures with the TypeScript checker and
+  fails if any identity input of this module is spelled like a name.
+
+### Deprecated
+
+- `resolvePersonActingName` (0.9.0). It takes names (`claimedName`,
+  `agentCredential.agentName`) as identity input; backend standard R-53
+  clause 4 makes it non-conforming for any new door. Use
+  `resolveActingPrincipal` and `assertTargetBelongsTo`. Behaviour unchanged;
+  removal is a major change, made only after consumers migrate off it.
+- `passesScopeFilter`, `scopeFilterGet` and `scopeFilterList` (the last two
+  through the first). A `createdBy` name matched against `fromAllowList`
+  selects the row; backend standard R-53 clause 1 forbids it. Use
+  `resolveActingPrincipal` and `assertTargetBelongsTo`. Behaviour unchanged;
+  they stay exported until consumers migrate off them.
+- The name-input test now covers every callable export of the package root: a
+  new export taking a name-like identity input fails. The deprecated legacy
+  exceptions are exactly `resolvePersonActingName`, `passesScopeFilter`,
+  `scopeFilterGet` and `scopeFilterList`, and the test fails if any of them
+  loses its `@deprecated Since 0.11.0` tag. The scan reads a generic input
+  through its constraint, so a name field behind `T extends ScopeFilterable`
+  is seen. Two 0.10.0 exports that carry a name-like field without selecting a
+  row by it (`isPersonActorName`: `name`; `checkPersonCallShape`:
+  `actingName`, accepted only to be refused) are pinned in a frozen map that
+  can only shrink.
+
+### Migration (required consumer step)
+
+- Before switching a door to `assertTargetBelongsTo`, stamp every existing row
+  that has no `orgId` with its real organisation ID or with the operator
+  organisation's ID, and supply `orgKindOf` reading the stored `orgKind`. Unstamped rows are refused to every caller, so a door
+  switched before the backfill stops serving them.
+
+## [0.10.0]
+
+**Additive — identity gaps a consumer had are now in the package.** Every
+consumer adapts these; none copies them. No existing function changes behaviour.
+
+### Added
+
+- `resolveMinRole` / `assertMinRole`: minimum-role check over an order the
+  caller supplies as data. Unknown role, unknown minimum, invalid order refuse.
+- `mapRoleClaim`: claim to role through caller data, with a fallback that must
+  be explicit. Absent or unmapped claim without a fallback refuses.
+- `resolveMembership` (injected async lookup; error, miss, inactive, malformed
+  and other-organisation all refuse), `isRowInTenant` (strict equality,
+  unstamped row refused), `membershipRecordSchema`.
+- `requireOrgAdmin`: the proof is bound to the caller's verified organisation.
+- `assertNamespaceWrite` and the shared boundary rule `namespaceMatchesPrefix`
+  (now also used by the read filter, same behaviour).
+- `timingSafeEqualSync` / `assertSecretSync`: synchronous constant-time
+  comparison; an unset expected secret matches nothing.
+- `IdentityRefusalError` and the `IdentityRefusal` types.
+- New subpath exports `./identity-refusal`, `./role-policy`,
+  `./tenant-membership`, `./namespace-write`, `./secret-compare-sync`.
+
 ## [0.9.1]
 
 ### Fixed

package/README.md

@@ -174,13 +174,24 @@ await resolveTenant({ session: null }); // throws Error("Unauthenticated: no ses
 **Row filtering**
 
 - `passesScopeFilter(ctx, row)` — true when this row is visible to this
-  caller.
+  caller. **Deprecated since 0.11.0** (see below).
 - `scopeFilterList(ctx, rows)` — the subset of rows the caller may see.
+  **Deprecated since 0.11.0** (see below).
 - `scopeFilterGet(ctx, row)` — the row, or `null` if the caller may not see it.
+  **Deprecated since 0.11.0** (see below).
 - `isMasterScope(ctx)` / `isWildcardScope(ctx)` — true when the caller holds
   unrestricted access. Useful for skipping filtering you know is pointless;
   never as a substitute for it.
 
+**Deprecated since 0.11.0: `passesScopeFilter`, `scopeFilterGet` and
+`scopeFilterList`.** All three (the last two through the first) admit a row
+when its `createdBy` NAME appears in the caller's `fromAllowList`, so a name
+selects the row, which backend standard R-53 clause 1 forbids. For a target
+that carries an organisation or owner ID, use `resolveActingPrincipal` and
+`assertTargetBelongsTo`, which compare stored IDs (see "The acting principal
+by ID, and the target checked by ID"). Their behaviour is unchanged; they stay
+exported until consumers migrate off them, and are removed in a major release.
+
 Visibility is granted two ways: the row's `createdBy` appears in the caller's
 `fromAllowList`, or the row's `namespace` sits under one of the caller's
 `namespaceReadPrefixes`. Prefixes match on a path boundary, so a caller allowed
@@ -410,6 +421,7 @@ const who = await resolvePersonPrincipal(
 if (!who.ok) return deny(who.refusal);
 
 // 2. Under what name: the token's, never the argument's.
+//    Deprecated since 0.11.0: a new door uses resolveActingPrincipal instead.
 const name = resolvePersonActingName({
   principal: who.principal, claimedName: args.createdBy,
   agentCredential: presentedAgent, door: "my-tool",
@@ -427,6 +439,12 @@ const mayWrite = resolveWriterRole({
 - `resolvePersonPrincipal(token, deps, door)` refuses a token that is expired,
   revoked, not a person's, bound to no organisation, or bound to an inactive or
   unmapped one. It looks up only the token's own organisation.
+- **Deprecated since 0.11.0:** `resolvePersonActingName`. It takes names
+  (`claimedName`, `agentCredential.agentName`) as identity input, which backend
+  standard R-53 clause 4 makes non-conforming for any new door. Use
+  `resolveActingPrincipal` and `assertTargetBelongsTo` (see "The acting
+  principal by ID, and the target checked by ID"). Its behaviour is unchanged;
+  it will be removed in a major release once consumers have migrated off it.
 - `resolvePersonActingName` returns `{ ok: true, actingAs: "person", actor }`
   for no name or the person's own (`user:<subject>`), and refuses another
   user's name (`PERSON_ACTS_AS_ITSELF`) and an agent's name without that
@@ -450,6 +468,241 @@ const mayWrite = resolveWriterRole({
 The module verifies no credential. The token record must come from your own
 lookup of the bearer the person presented, never from a request body.
 
+## Role policy, membership, namespace writes and secrets (0.10.0)
+
+Seven primitives that consumers used to copy. Each is pure, takes its policy as
+DATA from the call site, and refuses on every absence: no role, no claim, no
+list, no prefix, no secret and a failing lookup are all refusals, never a
+default grant. Refusals share one shape, `IdentityRefusal` (`code`, `reason`,
+`door`, `detail`), thrown inside an `IdentityRefusalError` by the asserting
+forms. `IdentityRefusalCode` is `RBAC_DENIED` or `CREDENTIAL_REFUSED`;
+`IdentityRefusalReason` is the closed list of reasons. Every function that
+refuses accepts an optional `door` so the refusal names your own entry point.
+
+**Minimum role over an order you supply** (`./role-policy`)
+
+- `resolveMinRole({ role, minimum, order, door? })` — `order` is your ordered
+  list, MOST privileged first (for example `["admin", "editor", "viewer"]`).
+  Returns `{ ok: true, role }` or `{ ok: false, refusal }` (`MinRoleInput`,
+  `MinRoleResult`). Refuses an empty or duplicated order, a `minimum` outside
+  the order, an absent or unknown role, and a role below the minimum. Matching
+  is exact.
+- `assertMinRole(input)` — the throwing form; returns the role or throws
+  `IdentityRefusalError`.
+
+**Role-claim mapping with an explicit fallback** (`./role-policy`)
+
+- `mapRoleClaim({ claim, mapping, fallback?, door? })` — maps a verified claim
+  (for example `"org:admin"`) to your role through `mapping`, your data
+  (`MapRoleClaimInput`, `MapRoleClaimResult`). The package never picks a
+  default: an absent or unmapped claim is served only when YOU pass `fallback`
+  (use your least-privileged role), and is refused otherwise. A claim that is
+  not a string counts as absent; prototype keys are never mapped. The result
+  says whether the role was `mapped` or came from the `fallback`.
+
+**Membership and tenant visibility** (`./tenant-membership`)
+
+- `resolveMembership({ subject, orgId, lookup, door? })` — async. `lookup` is
+  your read of one membership (`MembershipRecord`: `active`, optional `role`,
+  optional `orgId`). A throwing lookup, a miss, an inactive row, a malformed
+  row and a row naming another organisation are all refusals; the lookup's own
+  error text is not surfaced. Served result: `{ ok: true, membership }`
+  (`ResolvedMembership`, `ResolveMembershipInput`, `ResolveMembershipResult`).
+  `membershipRecordSchema` is the zod schema of the record.
+- `isRowInTenant({ rowOrgId, callerOrgId })` — `true` only on strict equality
+  of two non-empty ids. An unstamped row is never visible, not even to a caller
+  with no organisation.
+- `requireOrgAdmin({ verifiedOrgId, targetOrgId, role, adminRoles, door? })` —
+  the organisation-admin proof, bound to the caller's VERIFIED organisation:
+  the target must equal it, and the role must be one of `adminRoles` (your
+  data; an empty list admits nobody). Throws `IdentityRefusalError`
+  (`RequireOrgAdminInput`).
+
+**Namespace writes** (`./namespace-write`, `./scope-filter`)
+
+- `assertNamespaceWrite(oauthCtx, namespace, door?)` — throws unless the
+  caller's `namespaceWritePrefixes` admit the namespace. Master scope passes;
+  a non-master with no write prefix is refused; read prefixes never grant a
+  write; an empty-string prefix grants nothing.
+- `namespaceMatchesPrefix(namespace, prefix)` — the one path-boundary rule:
+  equality, or the prefix followed by `/`. `team/finance-archive` is not inside
+  `team/finance`. The read filter and `assertNamespaceWrite` both use it.
+
+**Synchronous constant-time comparison** (`./secret-compare-sync`)
+
+- `timingSafeEqualSync(a, b)` — strings (UTF-8) or `Uint8Array`, pure
+  JavaScript, no early exit on content. It walks the longer length and folds a
+  length difference into the result. Any other input type is `false`. The async
+  `timingSafeEqual` is unchanged.
+- `assertSecretSync(presented, expected, door?)` — throws `IdentityRefusalError`
+  (`CREDENTIAL_REFUSED`) on mismatch. An unset `expected` (undefined, null or
+  empty) matches nothing, so a missing configuration never opens a door. The
+  refusal carries neither value.
+
+## The acting principal by ID, and the target checked by ID (0.11.0)
+
+**Why this exists.** Two organisations each had an agent displayed as `eta`.
+An organisation A agent, calling through the shared service account and naming
+itself `eta`, completed, updated and deleted organisation B's `eta` task at ten
+different task doors. Every door admitted the call by comparing the typed name
+with a name stored on the task. The names were equal; the two agents were not.
+Nothing compared an ID.
+
+The rule this module carries: **an actor and a target are identified by their
+stored IDs. A name is a display label; it never selects a row and never
+authorises one.** Resolving the principal and checking the target both happen
+here, so a product never writes its own identity layer.
+
+```js
+import {
+  resolveActingPrincipal,
+  assertTargetBelongsTo,
+} from "@vantageos/cloud-identity";
+
+// The operator org is DATA: the org whose mapping row says orgKind "operator".
+const orgKindOf = async (id) => (await db.orgs.get(id))?.orgKind ?? null;
+
+// 1. Who is acting? IDs from the VERIFIED credential, rows read by ID.
+const who = await resolveActingPrincipal(
+  { kind: "service", serviceAccountId: "svc_a", actingForAgentId: "agent_a_eta" },
+  {
+    agentById: (id) => db.agents.get(id),          // -> { id, orgId, active }
+    serviceAccountById: (id) => db.services.get(id),
+    organisationById: (id) => db.orgs.get(id),     // -> { id, active }
+    orgKindOf,                                     // -> "operator" | "client" | null
+  },
+  "tasks:complete",
+);
+if (!who.ok) throw toHttpError(who.refusal);       // RBAC_DENIED, typed reason
+
+// 2. Does the target belong to them? Stored IDs against resolved IDs.
+const task = await db.tasks.get(taskId);
+const may = await assertTargetBelongsTo(
+  who.principal,
+  { orgId: task.orgId, ownerId: task.ownerId },
+  { orgKindOf },
+  { ownerOnly: true, door: "tasks:complete" },
+);
+if (!may.ok) throw toHttpError(may.refusal);
+```
+
+Organisation B's `eta` task carries `orgId: "org_b"`; the principal above
+resolved to `orgId: "org_a"`. The target check refuses it with
+`target-other-organisation`, whatever either agent is called.
+
+**`resolveActingPrincipal(credential, lookups, door?)`** (`./principal-by-id`)
+
+Async. Returns `{ ok: true, principal }` or `{ ok: false, refusal }`
+(`ResolveActingPrincipalResult`). The `principal` (`ActingPrincipal`) is
+`{ principalId, orgId, kind, viaServiceAccountId? }`, where `kind` is
+`"agent" | "person" | "service" | "fleet"` (`ActingPrincipalKind`).
+
+`credential` (`ActingCredential`, validated by `actingCredentialSchema`) is one
+of three shapes, every identity field an ID:
+
+- `{ kind: "agent", agentId, verifiedOrgId }` — the machine path: an agent's
+  own bearer, already verified by you (for example with
+  `validatePresentedBearer`). The agent row's stored `orgId` must equal
+  `verifiedOrgId`.
+- `{ kind: "person", personId, verifiedOrgId }` — the human path: a person's
+  token, already verified by you. The person's row in that organisation is read
+  by `(personId, verifiedOrgId)`.
+- `{ kind: "service", serviceAccountId, actingForAgentId? }` — the service
+  account. Alone it acts as itself (`kind: "service"`, or `kind: "fleet"` if
+  `orgKindOf` reports its organisation as `"operator"`). With `actingForAgentId` it acts for that
+  agent, named BY ID and resolved within the service account's OWN
+  organisation; the principal is the agent, and `viaServiceAccountId` records
+  the carrier.
+
+The schemas are strict: a credential carrying any other key (`agentName`,
+`callerOrchestrator`, `name`, `assignedTo`) is refused whole with
+`credential-invalid`, before any lookup runs.
+
+`lookups` (`PrincipalLookups`) are your indexed reads by ID: `agentById(id)`,
+`personById(id, orgId)`, `serviceAccountById(id)` returning a `PrincipalRow`
+(`{ id, orgId?, active }`, schema `principalRowSchema`), and
+`organisationById(id)` returning an `OrganisationRow` (`{ id, active }`, schema
+`organisationRowSchema`), and `orgKindOf(orgId)` returning an `OrgKind`
+(`"operator" | "client"`) or `null`. Only the lookups of the presented path
+are called; `orgKindOf` is called on every path.
+Each row must repeat the ID that was asked for, and `active` is required and
+must be `true`.
+
+Refused, each with a typed `IdentityRefusal` reason: a credential that does not
+parse; a missing or throwing lookup (its error text is never surfaced); a miss;
+a malformed, inactive or unstamped row; a row of another organisation than its
+credential; an unmapped or inactive organisation; a service account acting for
+an agent of another organisation. Nothing falls back to a default or master
+principal.
+
+**`assertTargetBelongsTo(principal, target, lookups, opts?)`** (`./principal-by-id`)
+
+Async. Returns `{ ok: true }` or `{ ok: false, refusal }`
+(`AssertTargetResult`). `target` (`TargetIds`) is `{ orgId?, ownerId? }` read
+from the STORED row; `lookups` (`OrgKindLookups`) is `{ orgKindOf }`, the same
+adapter as above, and is required (a missing or throwing adapter refuses with
+`principal-lookup-failed`); `opts` (`AssertTargetOptions`) is
+`{ door?, ownerOnly?, fleetCrossOrg? }`. IDs are compared byte for byte.
+
+- The target's `orgId` must equal the principal's `orgId`
+  (`target-other-organisation` otherwise).
+- `ownerOnly: true` also requires `ownerId` to equal `principalId`; a target
+  with no owner is refused (`target-owner-mismatch`).
+- A target with no `orgId` is refused (`target-unstamped`) to EVERY
+  principal, the fleet principal included, with or without `fleetCrossOrg`.
+  No right is inferred from an absence: a row with no organisation is never
+  treated as a master row.
+- An absent principal, or one with an empty ID, is refused
+  (`credential-invalid`).
+
+**The fleet is the operator organisation.** The fleet is not a reserved ID: it
+is the organisation your `orgKindOf` adapter reports as `"operator"` (for
+example the organisation whose mapping row carries `orgKind: "operator"`),
+read from your data at run time. The package spells no organisation ID. An
+adapter answering `null`, a miss, or anything other than exactly
+`"operator"` means "not the fleet"; a missing or throwing adapter refuses.
+
+**RULING 5: membership of the operator organisation is ordinary membership.**
+Its agents and persons resolve as `kind: "agent"` / `"person"` of that
+organisation and reach its rows only; cross-organisation reach (`kind: "fleet"`
+with `fleetCrossOrg`) belongs to the operator organisation's service account
+alone, and `reserved-fleet-scope` refuses a CLAIM of that scope, never plain
+membership:
+
+- an agent or person credential verified for the operator organisation
+  resolves as an ordinary principal of it, with no cross-organisation reach;
+  only a service account stamped with it resolves to `kind: "fleet"`;
+- a credential carrying `kind: "fleet"` is refused (`reserved-fleet-scope`),
+  whoever presents it;
+- any non-fleet principal reaching another organisation's row under
+  `fleetCrossOrg: true` is refused (`reserved-fleet-scope`); without it,
+  `target-other-organisation`;
+- an operator-organisation row is refused to every client principal, with or
+  without `fleetCrossOrg` (`reserved-fleet-scope`);
+- a `kind: "fleet"` principal whose organisation the adapter does not report
+  as `"operator"` is refused, and so is a `kind: "service"` principal in the
+  operator organisation (its service account is the fleet);
+- the fleet principal reaches a CLIENT organisation's row only when the door
+  passes `fleetCrossOrg: true` (a master export) AND the adapter reports that
+  organisation as `"client"`. An unknown organisation is refused;
+- the operator organisation is an ordinary stored organisation:
+  `organisationById` must return it mapped and active, like any other;
+- a fleet row is a row stamped with the operator organisation's ID explicitly.
+  A row with no `orgId` is not a fleet row and is refused to the fleet
+  principal too.
+
+**Migration (required consumer step).** Before a product switches any door to
+`assertTargetBelongsTo`, it must stamp every existing row that has no `orgId`:
+with its real organisation ID, or with the operator organisation's ID if it
+belongs to the operator's own scope. An unstamped row is refused to every caller,
+including the fleet principal, so a door switched before the backfill stops
+serving those rows. Run the backfill first, confirm that no unstamped row is
+left in the tables the door reads, then switch the door.
+
+`viaServiceAccountId` and `door` are not identity; no function in this module
+takes a name as an identity input, and a test reads the exported signatures to
+keep it that way.
+
 ## What this package does not do
 
 Worth reading before you rely on it.

package/dist/identity-refusal.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
+ * org-admin proof, namespace write, secret comparison) and the 0.11.0
+ * principal-by-id resolver and target check.
+ *
+ * A refusal is a value carrying its own code, reason and door, so a caller
+ * branches on content rather than on the mere presence of an exception, and an
+ * absence can never be mistaken for a refusal. It carries no credential.
+ *
+ * Mirrors the shape of `PersonRefusal` / `PersonRefusalError` on purpose: same
+ * `code`/`reason`/`door`/`detail` fields, same `ERROR: detail (reason, door)`
+ * message form. It is a separate type only because `PersonRefusalCode` is a
+ * closed vocabulary for the person path.
+ */
+export type IdentityRefusalCode = "RBAC_DENIED" | "CREDENTIAL_REFUSED";
+export type IdentityRefusalReason = "unknown-role" | "unknown-minimum-role" | "invalid-role-order" | "role-below-minimum" | "role-claim-absent" | "role-claim-unmapped" | "invalid-role-mapping" | "membership-invalid-input" | "membership-lookup-failed" | "membership-not-found" | "membership-record-invalid" | "membership-inactive" | "other-organisation" | "no-verified-organisation" | "role-not-admin" | "namespace-invalid" | "no-write-prefixes" | "namespace-write-denied" | "secret-not-configured" | "secret-mismatch" | "credential-invalid" | "principal-lookup-failed" | "principal-not-found" | "principal-record-invalid" | "principal-inactive" | "organisation-not-active" | "reserved-fleet-scope" | "acting-agent-other-organisation" | "target-unstamped" | "target-other-organisation" | "target-owner-mismatch";
+export type IdentityRefusal = {
+    code: IdentityRefusalCode;
+    reason: IdentityRefusalReason;
+    /** The consumer's own name for the entry point that refused. */
+    door: string;
+    /** One sentence, safe to show to the caller. Never a credential. */
+    detail: string;
+};
+/** Thrown by the asserting forms. Carries the typed refusal untouched. */
+export declare class IdentityRefusalError extends Error {
+    readonly refusal: IdentityRefusal;
+    constructor(refusal: IdentityRefusal);
+}
+/** @internal Build a refusal. Not exported from the package. */
+export declare function refusal(code: IdentityRefusalCode, reason: IdentityRefusalReason, door: string, detail: string): IdentityRefusal;
+//# sourceMappingURL=identity-refusal.d.ts.map

package/dist/identity-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-refusal.d.ts","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,qBAAqB,GAE7B,cAAc,GACd,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GAEtB,0BAA0B,GAC1B,0BAA0B,GAC1B,sBAAsB,GACtB,2BAA2B,GAC3B,qBAAqB,GACrB,oBAAoB,GAEpB,0BAA0B,GAC1B,gBAAgB,GAEhB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GAExB,uBAAuB,GACvB,iBAAiB,GAEjB,oBAAoB,GACpB,yBAAyB,GACzB,qBAAqB,GACrB,0BAA0B,GAC1B,oBAAoB,GACpB,yBAAyB,GACzB,sBAAsB,GACtB,iCAAiC,GACjC,kBAAkB,GAClB,2BAA2B,GAC3B,uBAAuB,CAAC;AAE5B,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBACtB,OAAO,EAAE,eAAe;CAKrC;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CACrB,IAAI,EAAE,mBAAmB,EACzB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,eAAe,CAEjB"}

package/dist/identity-refusal.js

@@ -0,0 +1,28 @@
+/**
+ * Typed refusal shared by the 0.10.0 primitives (role policy, membership,
+ * org-admin proof, namespace write, secret comparison) and the 0.11.0
+ * principal-by-id resolver and target check.
+ *
+ * A refusal is a value carrying its own code, reason and door, so a caller
+ * branches on content rather than on the mere presence of an exception, and an
+ * absence can never be mistaken for a refusal. It carries no credential.
+ *
+ * Mirrors the shape of `PersonRefusal` / `PersonRefusalError` on purpose: same
+ * `code`/`reason`/`door`/`detail` fields, same `ERROR: detail (reason, door)`
+ * message form. It is a separate type only because `PersonRefusalCode` is a
+ * closed vocabulary for the person path.
+ */
+/** Thrown by the asserting forms. Carries the typed refusal untouched. */
+export class IdentityRefusalError extends Error {
+    refusal;
+    constructor(refusal) {
+        super(`${refusal.code}: ${refusal.detail} (${refusal.reason}, ${refusal.door})`);
+        this.name = "IdentityRefusalError";
+        this.refusal = refusal;
+    }
+}
+/** @internal Build a refusal. Not exported from the package. */
+export function refusal(code, reason, door, detail) {
+    return { code, reason, door, detail };
+}
+//# sourceMappingURL=identity-refusal.js.map

package/dist/identity-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-refusal.js","sourceRoot":"","sources":["../src/identity-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAoDH,0EAA0E;AAC1E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAkB;IAClC,YAAY,OAAwB;QAClC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CACrB,IAAyB,EACzB,MAA6B,EAC7B,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -6,7 +6,7 @@
  * validation.
  */
 export { timingSafeEqual, sha256Hex } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, namespaceMatchesPrefix, LEGACY_WILDCARD_CTX, type ScopeFilterable, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 export type { OAuthCtx, ScopeProfile, NamespacePrefix, FromAllowListEntry, ValidateMasterBearerResult, } from "./types.js";
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
@@ -29,4 +29,14 @@ export { oauthErrorFor, pkceChallengeFromVerifier } from "./authorize-shared.js"
 export type { AuthorizeRefusal, AuthorizeRefusalReason, } from "./authorize-shared.js";
 export { PERSON_ACTOR_PREFIX, PersonRefusalError, personActorName, isPersonActorName, personTokenRecordSchema, resolvePersonPrincipal, resolvePersonActingName, checkPersonCallShape, resolvePersonTenantAccess, resolveWriterRole, requireWriterRole, } from "./person-principal.js";
 export type { PersonRefusal, PersonRefusalCode, PersonRefusalReason, PersonTokenRecord, PersonPrincipal, OrganisationState, PersonPrincipalDeps, PersonPrincipalResult, PersonActingNameResult, PersonAccessResult, } from "./person-principal.js";
+export { IdentityRefusalError } from "./identity-refusal.js";
+export type { IdentityRefusal, IdentityRefusalCode, IdentityRefusalReason, } from "./identity-refusal.js";
+export { resolveMinRole, assertMinRole, mapRoleClaim } from "./role-policy.js";
+export type { MinRoleInput, MinRoleResult, MapRoleClaimInput, MapRoleClaimResult, } from "./role-policy.js";
+export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSchema, } from "./tenant-membership.js";
+export type { MembershipRecord, ResolvedMembership, ResolveMembershipInput, ResolveMembershipResult, RequireOrgAdminInput, } from "./tenant-membership.js";
+export { assertNamespaceWrite } from "./namespace-write.js";
+export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, } from "./principal-by-id.js";
+export type { ActingCredential, PrincipalRow, OrganisationRow, PrincipalLookups, OrgKind, OrgKindLookups, ActingPrincipalKind, ActingPrincipal, ResolveActingPrincipalResult, TargetIds, AssertTargetOptions, AssertTargetResult, } from "./principal-by-id.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,eAAe,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,SAAS,EACT,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,mBAAmB,EACnB,6BAA6B,EAC7B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EACV,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,YAAY,EACV,QAAQ,EACR,SAAS,EACT,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAClE,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,QAAQ,EACR,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACjF,YAAY,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,YAAY,EACV,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAIjF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,4BAA4B,EAC5B,SAAS,EACT,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * validation.
  */
 export { timingSafeEqual, sha256Hex } from "./crypto.js";
-export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
+export { passesScopeFilter, scopeFilterList, scopeFilterGet, isMasterScope, isWildcardScope, namespaceMatchesPrefix, LEGACY_WILDCARD_CTX, } from "./scope-filter.js";
 export { validateMasterBearer } from "./bearer-validation.js";
 // 0.2.0 — Domain-tenancy layer (additive)
 export { workspaceSchema, workspaceMemberSchema, workspaceRoleSchema, tenantContextSchema, ScopeViolationError, getEffectiveTenantId, decodeUnverifiedBearer, } from "./tenancy-domain.js";
@@ -29,4 +29,13 @@ export { oauthErrorFor, pkceChallengeFromVerifier } from "./authorize-shared.js"
 // pure data, the own-name actor rule, the tenant compare and the writer-role
 // assertion. Every consumer wires a person the same way.
 export { PERSON_ACTOR_PREFIX, PersonRefusalError, personActorName, isPersonActorName, personTokenRecordSchema, resolvePersonPrincipal, resolvePersonActingName, checkPersonCallShape, resolvePersonTenantAccess, resolveWriterRole, requireWriterRole, } from "./person-principal.js";
+// 0.10.0 — Identity gaps closed in the package so consumers adapt, never copy.
+export { IdentityRefusalError } from "./identity-refusal.js";
+export { resolveMinRole, assertMinRole, mapRoleClaim } from "./role-policy.js";
+export { isRowInTenant, resolveMembership, requireOrgAdmin, membershipRecordSchema, } from "./tenant-membership.js";
+export { assertNamespaceWrite } from "./namespace-write.js";
+export { timingSafeEqualSync, assertSecretSync } from "./secret-compare-sync.js";
+// 0.11.0 — The acting principal by ID and the target checked by ID. A name is
+// a display label: it never selects a row and never authorises one.
+export { actingCredentialSchema, principalRowSchema, organisationRowSchema, resolveActingPrincipal, assertTargetBelongsTo, } from "./principal-by-id.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,0CAA0C;AAC1C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAU7B,gFAAgF;AAChF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAU1E,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AAWzB,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAY/B,+EAA+E;AAC/E,mEAAmE;AACnE,OAAO,EACL,cAAc,EACd,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAa7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAQ7D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AASlE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAMjF,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAc/B,+EAA+E;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAO/E,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,8EAA8E;AAC9E,oEAAoE;AACpE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}

package/dist/namespace-write.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Namespace WRITE assertion.
+ *
+ * `OAuthCtx.namespaceWritePrefixes` has always been on the type with the note
+ * "enforced by the caller". This is that enforcement, so no consumer carries
+ * its own copy. It uses `namespaceMatchesPrefix` from `./scope-filter`, the
+ * same boundary rule as the read filter: prefix equality, or prefix + '/'.
+ *
+ * A write is never granted by a READ prefix, by an empty prefix list (for a
+ * non-master) or by an empty-string prefix.
+ */
+import type { OAuthCtx } from "./types.js";
+/**
+ * Throws `IdentityRefusalError` unless the caller may write `namespace`.
+ * Master scope (`scope === "master"` or `"*"` in `fromAllowList`) passes.
+ *
+ * @param door The consumer's own name for the entry point, for the refusal.
+ */
+export declare function assertNamespaceWrite(oauthCtx: OAuthCtx, namespace: string, door?: string): void;
+//# sourceMappingURL=namespace-write.d.ts.map

package/dist/namespace-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace-write.d.ts","sourceRoot":"","sources":["../src/namespace-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,SAAyB,GAC5B,IAAI,CA2BN"}

package/dist/namespace-write.js

@@ -0,0 +1,40 @@
+/**
+ * Namespace WRITE assertion.
+ *
+ * `OAuthCtx.namespaceWritePrefixes` has always been on the type with the note
+ * "enforced by the caller". This is that enforcement, so no consumer carries
+ * its own copy. It uses `namespaceMatchesPrefix` from `./scope-filter`, the
+ * same boundary rule as the read filter: prefix equality, or prefix + '/'.
+ *
+ * A write is never granted by a READ prefix, by an empty prefix list (for a
+ * non-master) or by an empty-string prefix.
+ */
+import { IdentityRefusalError, refusal } from "./identity-refusal.js";
+import { isMasterScope, namespaceMatchesPrefix } from "./scope-filter.js";
+/**
+ * Throws `IdentityRefusalError` unless the caller may write `namespace`.
+ * Master scope (`scope === "master"` or `"*"` in `fromAllowList`) passes.
+ *
+ * @param door The consumer's own name for the entry point, for the refusal.
+ */
+export function assertNamespaceWrite(oauthCtx, namespace, door = "assertNamespaceWrite") {
+    if (oauthCtx == null) {
+        throw new TypeError("assertNamespaceWrite: oauthCtx is required — pass an explicit OAuthCtx.");
+    }
+    const deny = (reason, detail) => {
+        throw new IdentityRefusalError(refusal("RBAC_DENIED", reason, door, detail));
+    };
+    if (isMasterScope(oauthCtx))
+        return;
+    if (typeof namespace !== "string" || namespace.length === 0) {
+        deny("namespace-invalid", "A non-empty namespace is required.");
+    }
+    const prefixes = (oauthCtx.namespaceWritePrefixes ?? []).filter((p) => typeof p === "string" && p.length > 0);
+    if (prefixes.length === 0) {
+        deny("no-write-prefixes", "This caller holds no namespace write prefix.");
+    }
+    if (!prefixes.some((p) => namespaceMatchesPrefix(namespace, p))) {
+        deny("namespace-write-denied", "The namespace is outside this caller's write prefixes.");
+    }
+}
+//# sourceMappingURL=namespace-write.js.map

package/dist/namespace-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace-write.js","sourceRoot":"","sources":["../src/namespace-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG1E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAkB,EAClB,SAAiB,EACjB,IAAI,GAAG,sBAAsB;IAE7B,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,SAAS,CACjB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CACX,MAA4E,EAC5E,MAAc,EACP,EAAE;QACT,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAC7C,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,mBAAmB,EAAE,8CAA8C,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,wBAAwB,EAAE,wDAAwD,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC"}

package/dist/person-principal.d.ts

@@ -136,6 +136,13 @@ export type PersonActingNameResult = {
  *                                           resolved by the consumer): none ->
  *                                           AGENT_CREDENTIAL_REQUIRED, a
  *                                           different agent -> AGENT_IDENTITY_MISMATCH.
+ *
+ * @deprecated Since 0.11.0. Use `resolveActingPrincipal` (and
+ * `assertTargetBelongsTo` for the target), which resolve the actor by stored
+ * ID. This function takes names (`claimedName`, `agentCredential.agentName`)
+ * as identity input, which backend standard R-53 clause 4 makes
+ * non-conforming for any new door. Behaviour is unchanged; it will be removed
+ * in a major release once consumers have migrated off it.
  */
 export declare function resolvePersonActingName(input: {
     /** Only the actor name is read: the rule needs no organisation. */