@wtfalch/people 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 William Tallis Falch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,140 @@
+# @wtfalch/people
+
+The estate's directory of people: profiles, the member list of an
+organisation, and grant/remove membership — including the guard that stops
+the last independent owner from being removed. It sits on top of
+[`@wtfalch/authz-store`](https://github.com/wtfalch/authz), which keeps the
+authority itself (tenants, memberships, credentials).
+
+## Status
+
+v1. Not published yet: that needs the user's npm 2FA. It depends on
+`@wtfalch/authz-store` 0.1.0, which is on npm since 2026-09-22.
+
+## Install
+
+```sh
+pnpm add @wtfalch/people
+pnpm exec people-migrations   # copies migrations/*.sql into drizzle/ as the next numbers
+```
+
+The copy is recorded in `drizzle/.people-migrations.json`; running it again
+copies nothing. Apply the copied file with the host's own migrate script.
+
+## Use
+
+1. Apply the migration — either the file `people-migrations` copied into
+   `drizzle/`, or, for a quick local setup with no host migrate script,
+   `migrate()` against any drizzle `DbOrTx`:
+
+   ```ts
+   import { migrate } from '@wtfalch/people';
+
+   await migrate(db); // idempotent
+   ```
+
+   This applies only the `profiles` table. `@wtfalch/authz-store`'s own
+   tables (`memberships`, `tenants`, `credentials`, …) are that package's to
+   migrate, via its exported `migrateStore(db)` — run it first, or in either
+   order: there is no foreign key between the two baselines.
+
+2. A profile, created on first sign-in and refreshed on every later one:
+
+   ```ts
+   import { ensureProfile, setDisplayName, DISPLAY_NAME_MAX } from '@wtfalch/people';
+
+   const profile = await ensureProfile(db, { id: user.id, name: user.name, email: user.email });
+   await setDisplayName(db, user.id, 'Amy'); // only the signed-in person's own id
+   ```
+
+3. An organisation's roster:
+
+   ```ts
+   import { membersOf } from '@wtfalch/people';
+
+   const members = await membersOf(db, tenantId);
+   // [{ principalId, principalClass, source, viaTenantName, joinedAt, lastSeenAt, display, email }]
+   ```
+
+   `display` falls back through profile name → email → credential name → a
+   class-specific label ("An agent no longer on record"), so a non-human
+   member (an agent, a service, an API key) never shows as a raw id — carried
+   forward from manage's roster, generalised for every host.
+
+   `role`/`roleLabel` are not part of this row. Role resolution is
+   `@wtfalch/authz`'s policy layer (a correlated subquery over
+   `authz_assignments`), not exposed by `authz-store` yet and out of this
+   package's scope — see the root README.
+
+4. Grant, remove and guard a membership:
+
+   ```ts
+   import { grantMembership, removeMembership, guardStaysHeld } from '@wtfalch/people';
+
+   const granted = await grantMembership(db, {
+     tenantId, tenantName, principal: { id, class: 'human' },
+   });
+   // { ok: true } | { ok: false, reason: 'already_member' }
+
+   // Before removing or demoting a principal that might hold a guarded role,
+   // check independent coverage stays — `guards` is the union of whatever
+   // roles are being revoked's own `.guards` (the host's own role data):
+   const held = await guardStaysHeld(db, { applicationId, platformId }, tenantId, principal, guards);
+   if (!held) throw new Error('appoint another independent owner first');
+
+   const removed = await removeMembership(db, { tenantId, principal });
+   // { ok: true } | { ok: false, reason: 'not_found' }
+   ```
+
+   This is narrower than the `grantMembership`/`changeRole`/`removeMembership`
+   every host writes today: role assignment, boundary refusal checks,
+   tenant-tree propagation and participation-policy writes stay in each
+   host's own authz layer. See the root README's *Out of scope*.
+
+   Pass an `AuditOptions` (a bound `@wtfalch/audit` `AuditWriter` plus the
+   acting `Actor`) as the third argument to either function to write the
+   audit row in the same transaction as the membership change:
+
+   ```ts
+   await grantMembership(db, input, { writer: auditWriter, actor });
+   ```
+
+5. GDPR hooks, scoped to this package's own tables:
+
+   ```ts
+   import { erasePerson, exportPerson } from '@wtfalch/people';
+
+   const { pseudonym } = await erasePerson(db, personId); // scrubs displayName/email
+   const record = await exportPerson(db, personId); // { profile, memberships }
+   ```
+
+   Call these inside the host's own transaction when composing a larger
+   erasure or export sweep across services — neither function opens its own
+   transaction.
+
+6. Authorization, checked before every read or write above (this package's
+   store functions do not check it themselves — the same separation
+   `package-template`'s widget toy keeps):
+
+   ```ts
+   import { catalogue, checkPeopleRead, checkPeopleManage } from '@wtfalch/people';
+   // checkPeopleManage checks the `people:members` permission — not
+   // `people:manage`: @wtfalch/authz's permission-id schema refuses that
+   // exact action name.
+   import { resourceAccess } from '@wtfalch/authz';
+
+   const access = resourceAccess({ catalogue, principal, /* ...organisations, grants */ });
+   const result = checkPeopleRead(access, { id, type: 'member', applicationId, platformId, organisationId, teamId: null });
+   if (!result.allowed) throw new Error(result.reason);
+   ```
+
+## Tests
+
+```sh
+pnpm test                                  # PGlite, in memory
+TEST_DATABASE_URL=postgres://... pnpm test # a real Postgres; a scratch schema per run
+```
+
+Test fixtures run both `@wtfalch/authz-store`'s `migrateStore` and this
+package's own `migrate`, so roster/membership tests exercise real joins
+against authz-store's tables, not a mock.

package/dist/authorization.d.ts

@@ -0,0 +1,18 @@
+import type { AccessResource, ResourceAccess, ResourceDenial } from '@wtfalch/authz';
+/**
+ * One member row or profile, in the shape `@wtfalch/authz` needs to
+ * evaluate a resource-scoped permission against it.
+ */
+export interface MemberResource extends AccessResource {
+    readonly type: 'member';
+}
+export type PeopleCheckResult = {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly reason: ResourceDenial;
+};
+/** Whether `access` may read the roster or a profile in `resource`'s organisation. */
+export declare function checkPeopleRead(access: ResourceAccess<'people:read'>, resource: MemberResource): PeopleCheckResult;
+/** Whether `access` may grant, remove or erase membership in `resource`'s organisation. */
+export declare function checkPeopleManage(access: ResourceAccess<'people:members'>, resource: MemberResource): PeopleCheckResult;

package/dist/authorization.js

@@ -0,0 +1,12 @@
+/** Whether `access` may read the roster or a profile in `resource`'s organisation. */
+export function checkPeopleRead(access, resource) {
+    if (access.allows('people:read', resource))
+        return { allowed: true };
+    return { allowed: false, reason: access.whyDenied('people:read', resource) ?? 'unknown' };
+}
+/** Whether `access` may grant, remove or erase membership in `resource`'s organisation. */
+export function checkPeopleManage(access, resource) {
+    if (access.allows('people:members', resource))
+        return { allowed: true };
+    return { allowed: false, reason: access.whyDenied('people:members', resource) ?? 'unknown' };
+}

package/dist/bin/migrations.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/migrations.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * `people-migrations [dir]`: copy this package's migrations the app has not
+ * yet copied into `dir` (default `drizzle`) as the next numbers. Idempotent;
+ * run it after every upgrade of @wtfalch/people, then commit what it wrote.
+ * Apply the copied file with the host's own migrate script.
+ */
+const MANIFEST = '.people-migrations.json';
+const NUMBERED = /^(\d{4})_(.+\.sql)$/;
+function readManifest(dir) {
+    const file = join(dir, MANIFEST);
+    if (!existsSync(file))
+        return { copied: {} };
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    return { copied: parsed.copied ?? {} };
+}
+function nextNumber(dir) {
+    let max = -1;
+    for (const name of readdirSync(dir)) {
+        const match = NUMBERED.exec(name);
+        if (match?.[1])
+            max = Math.max(max, Number(match[1]));
+    }
+    return max + 1;
+}
+function copyMigrations(opts) {
+    mkdirSync(opts.to, { recursive: true });
+    const manifest = readManifest(opts.to);
+    const copied = [];
+    const sources = readdirSync(opts.from)
+        .filter((name) => NUMBERED.test(name))
+        .sort();
+    let next = nextNumber(opts.to);
+    for (const name of sources) {
+        if (manifest.copied[name])
+            continue;
+        const rest = NUMBERED.exec(name)?.[2] ?? name;
+        const target = `${String(next).padStart(4, '0')}_${rest}`;
+        const body = readFileSync(join(opts.from, name), 'utf8');
+        const header = `-- Copied from @wtfalch/people${opts.version ? ` ${opts.version}` : ''} (migrations/${name}) by people-migrations.\n-- Do not edit here; the next package version ships the next file.\n\n`;
+        writeFileSync(join(opts.to, target), header + body);
+        manifest.copied[name] = target;
+        copied.push({ from: name, to: target });
+        next += 1;
+    }
+    writeFileSync(join(opts.to, MANIFEST), `${JSON.stringify(manifest, null, 2)}\n`);
+    return { copied };
+}
+function describeCopy(result) {
+    if (result.copied.length === 0)
+        return 'people-migrations: nothing to copy';
+    return result.copied.map((c) => `people-migrations: ${c.from} -> ${basename(c.to)}`).join('\n');
+}
+const here = dirname(fileURLToPath(import.meta.url));
+const from = join(here, '..', 'migrations');
+const to = resolve(process.cwd(), process.argv[2] ?? 'drizzle');
+const { version } = JSON.parse(readFileSync(join(here, '..', '..', 'package.json'), 'utf8'));
+console.log(describeCopy(copyMigrations({ from, to, version })));

package/dist/catalogue.d.ts

@@ -0,0 +1,68 @@
+/**
+ * This package's authorization vocabulary (ADR 0005 of `package-template`:
+ * `@wtfalch/authz` is scaffolded, not optional). Two permissions: reading the
+ * roster and a profile, and changing membership (grant/remove) or erasing a
+ * person — the second is `sensitive` and refused in a support session
+ * (`support: 'never'`), the same refusal manage, app-template and operator
+ * all hard-code today for `grantMembership`/`changeRole`/`removeMembership`.
+ */
+export declare const resourceModule: {
+    readonly namespace: "people";
+    readonly permissions: readonly [{
+        readonly id: "people:read";
+        readonly label: "Read people";
+        readonly description: "Read an organisation's member list and profiles.";
+        readonly resourceType: "member";
+        readonly effect: "read";
+        readonly scopes: readonly ["organisation"];
+        readonly boundaries: readonly ["organisation"];
+        readonly relations: readonly ["any"];
+        readonly tenantKinds: readonly ["customer", "operator"];
+        readonly offered: false;
+        readonly assignable: true;
+        readonly sensitive: false;
+        readonly survives: readonly [];
+        readonly support: "read";
+    }, {
+        readonly id: "people:members";
+        readonly label: "Manage people";
+        readonly description: "Grant or remove membership, and erase a person.";
+        readonly resourceType: "member";
+        readonly effect: "write";
+        readonly scopes: readonly ["organisation"];
+        readonly boundaries: readonly ["organisation"];
+        readonly relations: readonly ["any"];
+        readonly tenantKinds: readonly ["customer", "operator"];
+        readonly offered: false;
+        readonly assignable: true;
+        readonly sensitive: true;
+        readonly survives: readonly [];
+        readonly support: "never";
+    }];
+};
+export declare const catalogue: Readonly<Record<"people:read" | "people:members", {
+    id: string;
+    label: string;
+    description: string;
+    resourceType: string;
+    effect: "read" | "write";
+    scopes: ("organisation" | "team" | "own_teams" | "resource")[];
+    boundaries: ("organisation" | "organisations" | "platform")[];
+    relations: ("any" | "owner" | "actor" | "subject")[];
+    tenantKinds: ("operator" | "customer")[];
+    offered: boolean;
+    assignable: boolean;
+    sensitive: boolean;
+    survives: ("frozen" | "read_only" | "suspended")[];
+    support: "read" | "write" | "never";
+    guest?: "read" | "write" | "never" | undefined;
+    requiresPurpose?: boolean | undefined;
+    maxDelegationDepth?: number | undefined;
+    requiresCoSign?: boolean | undefined;
+    fields?: string[] | undefined;
+    acceptsFrom?: {
+        applicationId: string;
+        permission: string;
+    }[] | undefined;
+}>>;
+export type PeoplePermission = (typeof resourceModule.permissions)[number]['id'];

package/dist/catalogue.js

@@ -0,0 +1,49 @@
+import { defineResourceCatalogue } from '@wtfalch/authz';
+/**
+ * This package's authorization vocabulary (ADR 0005 of `package-template`:
+ * `@wtfalch/authz` is scaffolded, not optional). Two permissions: reading the
+ * roster and a profile, and changing membership (grant/remove) or erasing a
+ * person — the second is `sensitive` and refused in a support session
+ * (`support: 'never'`), the same refusal manage, app-template and operator
+ * all hard-code today for `grantMembership`/`changeRole`/`removeMembership`.
+ */
+export const resourceModule = {
+    namespace: 'people',
+    permissions: [
+        {
+            id: 'people:read',
+            label: 'Read people',
+            description: "Read an organisation's member list and profiles.",
+            resourceType: 'member',
+            effect: 'read',
+            scopes: ['organisation'],
+            boundaries: ['organisation'],
+            relations: ['any'],
+            tenantKinds: ['customer', 'operator'],
+            offered: false,
+            assignable: true,
+            sensitive: false,
+            survives: [],
+            support: 'read',
+        },
+        {
+            // Not `people:manage` or `people:write`: @wtfalch/authz's permission-id
+            // schema refuses those exact action names (reserved).
+            id: 'people:members',
+            label: 'Manage people',
+            description: 'Grant or remove membership, and erase a person.',
+            resourceType: 'member',
+            effect: 'write',
+            scopes: ['organisation'],
+            boundaries: ['organisation'],
+            relations: ['any'],
+            tenantKinds: ['customer', 'operator'],
+            offered: false,
+            assignable: true,
+            sensitive: true,
+            survives: [],
+            support: 'never',
+        },
+    ],
+};
+export const catalogue = defineResourceCatalogue([resourceModule]);

package/dist/erase.d.ts

@@ -0,0 +1,36 @@
+import type { DbOrTx } from '@wtfalch/authz-store';
+/**
+ * Stable and derived from the subject id, never random and never a counter:
+ * the same person has to read the same way across every row of theirs and
+ * across two separate calls, or a log stops being followable at exactly the
+ * moment somebody needs to follow it. sha256 of the id, truncated to 16 hex
+ * characters purely to keep the column short.
+ */
+export declare function pseudonymFor(subjectId: string): string;
+export interface ErasePersonResult {
+    readonly pseudonym: string;
+    /** False when there was no profile row to begin with — erasing an id that never signed in is a no-op, not an error. */
+    readonly erased: boolean;
+}
+/**
+ * Scrubs one person's own row: `displayName` and `email` become a stable
+ * pseudonym and null, so "who that was" no longer reads back, the same
+ * choice app-template and operator's `erase.ts` make (`ledger.erase` plus an
+ * inline `profiles` update, both in one transaction). manage's
+ * `erase_person()` — a Postgres `SECURITY DEFINER` function this package
+ * would need a privileged role to call — is not followed here; this package
+ * holds no database credential of its own (ADR 0005's shape reasoning) and a
+ * generated host should not need one just to erase a profile.
+ *
+ * The row itself is kept, not deleted: a `memberships` row and the audit
+ * trail both refer to this id, and removing the profile would leave them
+ * pointing at nothing.
+ *
+ * This is one statement, not a transaction: it touches only the table this
+ * package owns. A host composing a full erasure (its own `authz_events`
+ * sweep, invitations, analytics rollups, …) calls this with a `db` that is
+ * already its own open transaction, so everything commits or rolls back
+ * together — the same pattern `db.transaction` callers use elsewhere in this
+ * package.
+ */
+export declare function erasePerson(db: DbOrTx, personId: string): Promise<ErasePersonResult>;

package/dist/erase.js

@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { profiles } from './schema.js';
+/**
+ * Non-secret prefix on every erasure pseudonym, so a reader recognises one on
+ * sight without the prefix itself revealing anything about the id it
+ * replaced. Ported from `app-template/src/lib/authz/erase.ts`.
+ */
+const PSEUDONYM_PREFIX = 'erased-person-';
+/**
+ * Stable and derived from the subject id, never random and never a counter:
+ * the same person has to read the same way across every row of theirs and
+ * across two separate calls, or a log stops being followable at exactly the
+ * moment somebody needs to follow it. sha256 of the id, truncated to 16 hex
+ * characters purely to keep the column short.
+ */
+export function pseudonymFor(subjectId) {
+    const digest = createHash('sha256').update(subjectId).digest('hex').slice(0, 16);
+    return `${PSEUDONYM_PREFIX}${digest}`;
+}
+/**
+ * Scrubs one person's own row: `displayName` and `email` become a stable
+ * pseudonym and null, so "who that was" no longer reads back, the same
+ * choice app-template and operator's `erase.ts` make (`ledger.erase` plus an
+ * inline `profiles` update, both in one transaction). manage's
+ * `erase_person()` — a Postgres `SECURITY DEFINER` function this package
+ * would need a privileged role to call — is not followed here; this package
+ * holds no database credential of its own (ADR 0005's shape reasoning) and a
+ * generated host should not need one just to erase a profile.
+ *
+ * The row itself is kept, not deleted: a `memberships` row and the audit
+ * trail both refer to this id, and removing the profile would leave them
+ * pointing at nothing.
+ *
+ * This is one statement, not a transaction: it touches only the table this
+ * package owns. A host composing a full erasure (its own `authz_events`
+ * sweep, invitations, analytics rollups, …) calls this with a `db` that is
+ * already its own open transaction, so everything commits or rolls back
+ * together — the same pattern `db.transaction` callers use elsewhere in this
+ * package.
+ */
+export async function erasePerson(db, personId) {
+    const pseudonym = pseudonymFor(personId);
+    const rows = await db
+        .update(profiles)
+        .set({ displayName: pseudonym, email: null, updatedAt: new Date() })
+        .where(eq(profiles.id, personId))
+        .returning({ id: profiles.id });
+    return { pseudonym, erased: rows.length > 0 };
+}

package/dist/export.d.ts

@@ -0,0 +1,20 @@
+import { type DbOrTx } from '@wtfalch/authz-store';
+import { type Profile } from './schema.js';
+export interface PersonExportMembership {
+    readonly tenantId: string;
+    readonly principalClass: string;
+    readonly source: string;
+    readonly joinedAt: Date;
+}
+export interface PersonExport {
+    readonly profile: Profile | null;
+    readonly memberships: readonly PersonExportMembership[];
+}
+/**
+ * One person's data, scoped to the tables this package owns or reads: their
+ * profile, and every membership row naming them. This is not the "future
+ * erasure orchestrator" the README names — that sweeps every service for one
+ * person; this is the one hook it would call for the `people` slice of that
+ * sweep, and is usable on its own for a host that has no orchestrator yet.
+ */
+export declare function exportPerson(db: DbOrTx, personId: string, principalClass?: string): Promise<PersonExport>;

package/dist/export.js

@@ -0,0 +1,23 @@
+import { memberships } from '@wtfalch/authz-store';
+import { and, eq } from 'drizzle-orm';
+import { profiles } from './schema.js';
+/**
+ * One person's data, scoped to the tables this package owns or reads: their
+ * profile, and every membership row naming them. This is not the "future
+ * erasure orchestrator" the README names — that sweeps every service for one
+ * person; this is the one hook it would call for the `people` slice of that
+ * sweep, and is usable on its own for a host that has no orchestrator yet.
+ */
+export async function exportPerson(db, personId, principalClass = 'human') {
+    const [profile] = await db.select().from(profiles).where(eq(profiles.id, personId)).limit(1);
+    const memberRows = await db
+        .select({
+        tenantId: memberships.tenantId,
+        principalClass: memberships.principalClass,
+        source: memberships.source,
+        joinedAt: memberships.createdAt,
+    })
+        .from(memberships)
+        .where(and(eq(memberships.principalId, personId), eq(memberships.principalClass, principalClass)));
+    return { profile: profile ?? null, memberships: memberRows };
+}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export type { NewProfile, Profile } from './schema.js';
+export { profiles } from './schema.js';
+export { DISPLAY_NAME_MAX, ensureProfile, setDisplayName } from './profiles.js';
+export type { Member } from './roster.js';
+export { membersOf } from './roster.js';
+export type { AuditOptions, GrantMembershipInput, GrantMembershipResult, Principal, RemoveMembershipInput, RemoveMembershipResult, } from './membership.js';
+export { grantMembership, guardStaysHeld, removeMembership } from './membership.js';
+export type { ErasePersonResult } from './erase.js';
+export { erasePerson, pseudonymFor } from './erase.js';
+export type { PersonExport, PersonExportMembership } from './export.js';
+export { exportPerson } from './export.js';
+export type { PeoplePermission } from './catalogue.js';
+export { catalogue, resourceModule } from './catalogue.js';
+export type { MemberResource, PeopleCheckResult } from './authorization.js';
+export { checkPeopleManage, checkPeopleRead } from './authorization.js';
+export { migrate } from './migrate.js';

package/dist/index.js

@@ -0,0 +1,9 @@
+export { profiles } from './schema.js';
+export { DISPLAY_NAME_MAX, ensureProfile, setDisplayName } from './profiles.js';
+export { membersOf } from './roster.js';
+export { grantMembership, guardStaysHeld, removeMembership } from './membership.js';
+export { erasePerson, pseudonymFor } from './erase.js';
+export { exportPerson } from './export.js';
+export { catalogue, resourceModule } from './catalogue.js';
+export { checkPeopleManage, checkPeopleRead } from './authorization.js';
+export { migrate } from './migrate.js';

package/dist/membership.d.ts

@@ -0,0 +1,61 @@
+import type { Actor, AuditWriter } from '@wtfalch/audit';
+import { type DbOrTx, type PolicyBinding } from '@wtfalch/authz-store';
+export interface Principal {
+    readonly id: string;
+    readonly class: string;
+}
+/** The host's already-bound audit writer, plus who to credit the change to. Optional: a caller with no audit trail wired up yet still gets a working membership change. */
+export interface AuditOptions {
+    readonly writer: AuditWriter;
+    readonly actor: Actor;
+}
+export interface GrantMembershipInput {
+    readonly tenantId: string;
+    /** Denormalised onto the row, same as the three hosts do (D5: the switcher reads one index range). */
+    readonly tenantName: string;
+    readonly principal: Principal;
+    /** Defaults to `'direct'`. `'inherited'` is the tenant tree giving it — a host writes that itself, this package does not compute a tree. */
+    readonly source?: string;
+    readonly viaTenantId?: string | null;
+    readonly grantedBy?: string | null;
+}
+export type GrantMembershipResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: 'already_member';
+};
+/**
+ * Adds one membership row. This is deliberately narrower than the
+ * `grantMembership` every host has today: role assignment
+ * (`writePrimaryAssignment`), the role-boundary refusal checks
+ * (`roleAssignmentRefusal`), tenant-tree propagation and participation-policy
+ * writes are `@wtfalch/authz`'s policy layer, not `memberships` table rows,
+ * and out of this package's scope (its own README: "Out of scope: ...
+ * permission checks"). The caller checks whether the acting principal may
+ * grant this membership before calling this.
+ */
+export declare function grantMembership(db: DbOrTx, input: GrantMembershipInput, audit?: AuditOptions): Promise<GrantMembershipResult>;
+export interface RemoveMembershipInput {
+    readonly tenantId: string;
+    readonly principal: Principal;
+}
+export type RemoveMembershipResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: 'not_found';
+};
+/** Removes one membership row. Call `guardStaysHeld` first when the removed principal might hold a guarded role — this function does not know what roles a principal holds. */
+export declare function removeMembership(db: DbOrTx, input: RemoveMembershipInput, audit?: AuditOptions): Promise<RemoveMembershipResult>;
+/**
+ * Whether removing `principal`'s membership (or changing it away from a
+ * guarded role) would leave a protected role with no independent recovery
+ * owner. Ported from manage's `guardStaysHeld`, with one change: it takes
+ * `guards` — the union of `role.guards` across whatever roles are being
+ * revoked — instead of `ResourceRole[]`, because role definitions are
+ * `@wtfalch/authz`'s, not this package's. The caller (which already resolved
+ * the roles to compute a refusal reason) reduces them to this set the same
+ * way the original did: `new Set(roles.flatMap((r) => r.guards))`.
+ */
+export declare function guardStaysHeld(db: DbOrTx, binding: PolicyBinding, tenantId: string, principal: Principal, guards: ReadonlySet<string>): Promise<boolean>;

package/dist/membership.js

@@ -0,0 +1,83 @@
+import { memberships, ownerCoverage, ownerSeatCovered, } from '@wtfalch/authz-store';
+import { and, eq } from 'drizzle-orm';
+/**
+ * Adds one membership row. This is deliberately narrower than the
+ * `grantMembership` every host has today: role assignment
+ * (`writePrimaryAssignment`), the role-boundary refusal checks
+ * (`roleAssignmentRefusal`), tenant-tree propagation and participation-policy
+ * writes are `@wtfalch/authz`'s policy layer, not `memberships` table rows,
+ * and out of this package's scope (its own README: "Out of scope: ...
+ * permission checks"). The caller checks whether the acting principal may
+ * grant this membership before calling this.
+ */
+export async function grantMembership(db, input, audit) {
+    const [existing] = await db
+        .select({ principalId: memberships.principalId })
+        .from(memberships)
+        .where(identityWhere(input.tenantId, input.principal))
+        .limit(1);
+    if (existing)
+        return { ok: false, reason: 'already_member' };
+    const source = input.source ?? 'direct';
+    await db.insert(memberships).values({
+        tenantId: input.tenantId,
+        principalId: input.principal.id,
+        principalClass: input.principal.class,
+        source,
+        viaTenantId: input.viaTenantId ?? null,
+        tenantName: input.tenantName,
+        grantedBy: input.grantedBy ?? null,
+    });
+    if (audit) {
+        await audit.writer({
+            action: 'membership.created',
+            actor: audit.actor,
+            target: { type: 'membership', id: input.principal.id },
+            tenantId: input.tenantId,
+            after: { principalClass: input.principal.class, source },
+        }, db);
+    }
+    return { ok: true };
+}
+/** Removes one membership row. Call `guardStaysHeld` first when the removed principal might hold a guarded role — this function does not know what roles a principal holds. */
+export async function removeMembership(db, input, audit) {
+    const [existing] = await db
+        .select({ principalId: memberships.principalId })
+        .from(memberships)
+        .where(identityWhere(input.tenantId, input.principal))
+        .limit(1);
+    if (!existing)
+        return { ok: false, reason: 'not_found' };
+    await db.delete(memberships).where(identityWhere(input.tenantId, input.principal));
+    if (audit) {
+        await audit.writer({
+            action: 'membership.ended',
+            actor: audit.actor,
+            target: { type: 'membership', id: input.principal.id },
+            tenantId: input.tenantId,
+        }, db);
+    }
+    return { ok: true };
+}
+/**
+ * Whether removing `principal`'s membership (or changing it away from a
+ * guarded role) would leave a protected role with no independent recovery
+ * owner. Ported from manage's `guardStaysHeld`, with one change: it takes
+ * `guards` — the union of `role.guards` across whatever roles are being
+ * revoked — instead of `ResourceRole[]`, because role definitions are
+ * `@wtfalch/authz`'s, not this package's. The caller (which already resolved
+ * the roles to compute a refusal reason) reduces them to this set the same
+ * way the original did: `new Set(roles.flatMap((r) => r.guards))`.
+ */
+export async function guardStaysHeld(db, binding, tenantId, principal, guards) {
+    if (guards.size === 0)
+        return true;
+    const coverage = await ownerCoverage(db, binding, tenantId, {
+        excludePrincipalId: principal.id,
+        excludePrincipalClass: principal.class,
+    });
+    return guards.has('members:grant-owner') ? ownerSeatCovered(coverage) : coverage.directOwners > 0;
+}
+function identityWhere(tenantId, principal) {
+    return and(eq(memberships.tenantId, tenantId), eq(memberships.principalClass, principal.class), eq(memberships.principalId, principal.id));
+}

package/dist/migrate.d.ts

@@ -0,0 +1,12 @@
+import type { DbOrTx } from '@wtfalch/authz-store';
+/**
+ * Applies every migration this package ships that `people_migrations` does
+ * not yet record, in file order, one transaction per file. Idempotent: a
+ * second call applies nothing and returns `[]`.
+ *
+ * Does not touch `@wtfalch/authz-store`'s tables. A caller that also needs
+ * those (every test in this package does) calls that package's own
+ * `migrateStore(db)` as well — the two run independently, in either order:
+ * this package's baseline has no foreign key into authz-store's tables.
+ */
+export declare function migrate(db: DbOrTx): Promise<string[]>;

package/dist/migrate.js

@@ -0,0 +1,48 @@
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { sql } from 'drizzle-orm';
+const here = dirname(fileURLToPath(import.meta.url));
+const MIGRATIONS_DIR = join(here, 'migrations');
+/** The marker drizzle-kit writes; also a valid `--` SQL line comment, so both `migrate()` here and a host's own `psql` ignore it uniformly. */
+const BREAKPOINT = '--> statement-breakpoint';
+/** postgres-js returns the rows as the result; node-postgres and PGlite wrap them in `rows`. */
+function rowsOf(result) {
+    return Array.isArray(result)
+        ? result
+        : (result.rows ?? []);
+}
+/**
+ * Applies every migration this package ships that `people_migrations` does
+ * not yet record, in file order, one transaction per file. Idempotent: a
+ * second call applies nothing and returns `[]`.
+ *
+ * Does not touch `@wtfalch/authz-store`'s tables. A caller that also needs
+ * those (every test in this package does) calls that package's own
+ * `migrateStore(db)` as well — the two run independently, in either order:
+ * this package's baseline has no foreign key into authz-store's tables.
+ */
+export async function migrate(db) {
+    const files = readdirSync(MIGRATIONS_DIR)
+        .filter((name) => name.endsWith('.sql'))
+        .sort();
+    const ran = [];
+    for (const file of files) {
+        const applied = await db.transaction(async (tx) => {
+            await tx.execute(sql `create table if not exists people_migrations (name text primary key, applied_at timestamptz not null default now())`);
+            const done = rowsOf(await tx.execute(sql `select 1 from people_migrations where name = ${file}`));
+            if (done.length > 0)
+                return false;
+            const text = readFileSync(join(MIGRATIONS_DIR, file), 'utf8');
+            for (const statement of text.split(BREAKPOINT)) {
+                if (statement.trim())
+                    await tx.execute(sql.raw(statement));
+            }
+            await tx.execute(sql `insert into people_migrations (name) values (${file})`);
+            return true;
+        });
+        if (applied)
+            ran.push(file);
+    }
+    return ran;
+}

package/dist/migrations/0001_profiles.sql

@@ -0,0 +1,20 @@
+-- @wtfalch/people: the profiles table. A profile belongs to one person
+-- (keyed by the ZITADEL person id) and holds the display fields every host
+-- shows in a member list.
+--
+-- Applied by the host's own migrate script after the host copies this file
+-- into its drizzle/ directory (people-migrations); never edited there. A
+-- host without one can instead apply this package's own migrate() against
+-- any DbOrTx, which is what src/test/db.ts and src/migrate.ts do.
+
+create table if not exists profiles (
+  id                text primary key,
+  display_name      text,
+  email             text,
+  last_seen_at      timestamptz,
+  created_at        timestamptz not null default now(),
+  updated_at        timestamptz not null default now()
+);
+--> statement-breakpoint
+create index if not exists profiles_email_idx
+  on profiles (email);

package/dist/profiles.d.ts

@@ -0,0 +1,41 @@
+import type { DbOrTx } from '@wtfalch/authz-store';
+import { type Profile } from './schema.js';
+/**
+ * The row this package keeps for a person, created the first time it is
+ * needed and refreshed on every later sign-in. Ported from
+ * `app-template/src/lib/db/profiles.ts`, byte-identical across app-template,
+ * manage and operator except for the import of `db` itself, which the host
+ * now supplies as `db: DbOrTx`.
+ *
+ * Idempotent on the id, and deliberately asymmetric between its two other
+ * mutable fields: `email` is a display copy of what the issuer reports, so a
+ * fresh sign-in overwrites it whenever the caller supplies one; `displayName`
+ * is something a person sets inside a host app and a later sign-in must never
+ * stomp on, so it is only ever written on the first insert.
+ */
+export declare function ensureProfile(db: DbOrTx, person: {
+    id: string;
+    name: string | null;
+    email?: string | null;
+}): Promise<Profile>;
+/**
+ * The longest display name a members list can show without the layout
+ * fighting it. Names are truncated in the UI; this stops the column being
+ * defended by CSS alone.
+ */
+export declare const DISPLAY_NAME_MAX = 80;
+/**
+ * What a person calls themselves inside a host app, set from that host's own
+ * account page.
+ *
+ * The counterpart to `ensureProfile`'s asymmetry: that function writes
+ * `displayName` only on the first insert, precisely so this one can own it
+ * afterwards and a later sign-in cannot stomp on it.
+ *
+ * Scoped to one id by the caller, which must be the signed-in person's own:
+ * there is no permission to check here, because a display name is not
+ * anybody's authority. Clearing it is allowed and meaningful; a null name
+ * falls back to the email the profile already holds (see `roster.ts`), so a
+ * person can withdraw a name without becoming anonymous in a members list.
+ */
+export declare function setDisplayName(db: DbOrTx, personId: string, displayName: string | null): Promise<void>;

package/dist/profiles.js

@@ -0,0 +1,70 @@
+import { eq, sql } from 'drizzle-orm';
+import { profiles } from './schema.js';
+/**
+ * The row this package keeps for a person, created the first time it is
+ * needed and refreshed on every later sign-in. Ported from
+ * `app-template/src/lib/db/profiles.ts`, byte-identical across app-template,
+ * manage and operator except for the import of `db` itself, which the host
+ * now supplies as `db: DbOrTx`.
+ *
+ * Idempotent on the id, and deliberately asymmetric between its two other
+ * mutable fields: `email` is a display copy of what the issuer reports, so a
+ * fresh sign-in overwrites it whenever the caller supplies one; `displayName`
+ * is something a person sets inside a host app and a later sign-in must never
+ * stomp on, so it is only ever written on the first insert.
+ */
+export async function ensureProfile(db, person) {
+    const emailGiven = person.email !== undefined;
+    const [row] = await db
+        .insert(profiles)
+        .values({
+        id: person.id,
+        displayName: person.name,
+        email: emailGiven ? person.email : null,
+        lastSeenAt: sql `now()`,
+    })
+        .onConflictDoUpdate({
+        target: profiles.id,
+        // displayName is deliberately absent here: an existing row's own value
+        // survives every later call. email is refreshed whenever the caller
+        // gives one; a caller that does not know it leaves the stored value
+        // alone rather than blanking it to null.
+        set: emailGiven
+            ? { email: person.email, lastSeenAt: sql `now()`, updatedAt: sql `now()` }
+            : { lastSeenAt: sql `now()`, updatedAt: sql `now()` },
+    })
+        .returning();
+    if (!row)
+        throw new Error(`profile ${person.id} vanished on insert`);
+    return row;
+}
+/**
+ * The longest display name a members list can show without the layout
+ * fighting it. Names are truncated in the UI; this stops the column being
+ * defended by CSS alone.
+ */
+export const DISPLAY_NAME_MAX = 80;
+/**
+ * What a person calls themselves inside a host app, set from that host's own
+ * account page.
+ *
+ * The counterpart to `ensureProfile`'s asymmetry: that function writes
+ * `displayName` only on the first insert, precisely so this one can own it
+ * afterwards and a later sign-in cannot stomp on it.
+ *
+ * Scoped to one id by the caller, which must be the signed-in person's own:
+ * there is no permission to check here, because a display name is not
+ * anybody's authority. Clearing it is allowed and meaningful; a null name
+ * falls back to the email the profile already holds (see `roster.ts`), so a
+ * person can withdraw a name without becoming anonymous in a members list.
+ */
+export async function setDisplayName(db, personId, displayName) {
+    const trimmed = displayName?.trim();
+    await db
+        .update(profiles)
+        .set({
+        displayName: trimmed === undefined || trimmed.length === 0 ? null : trimmed,
+        updatedAt: sql `now()`,
+    })
+        .where(eq(profiles.id, personId));
+}

package/dist/roster.d.ts

@@ -0,0 +1,38 @@
+import { type DbOrTx } from '@wtfalch/authz-store';
+/**
+ * One row of an organisation's member list: who they are, how they got
+ * here, and what to call them.
+ *
+ * `role`/`roleLabel` are deliberately absent. `manage`'s `membersOf` computes
+ * them from a correlated subquery over `authz_assignments`
+ * (`primaryRoleKey`, in that app's own `assignments.ts`) — role resolution is
+ * `@wtfalch/authz`'s policy layer, not exposed by `@wtfalch/authz-store` yet,
+ * and out of this package's scope (its own README: "Out of scope: ...
+ * permission checks"). A host that needs the role joins it in on top of this.
+ */
+export interface Member {
+    readonly principalId: string;
+    readonly principalClass: string;
+    readonly source: string;
+    readonly display: string;
+    readonly email: string | null;
+    /**
+     * Where this membership came from — `null` for `source === 'direct'`, the
+     * parent organisation's name otherwise (manage's addition, carried forward
+     * for every host: scout finding #1).
+     */
+    readonly viaTenantName: string | null;
+    readonly joinedAt: Date;
+    readonly lastSeenAt: Date | null;
+}
+/**
+ * Every member of one tenant, newest membership first is not assumed here —
+ * callers that want an order sort by `joinedAt` themselves; this returns in
+ * principal order, which is what makes the query itself stable to test
+ * against.
+ *
+ * The caller checks `people:read` before calling this — see
+ * `authorization.ts` — this function does not check it itself, the same
+ * separation `@wtfalch/widget`'s store keeps from its authorization module.
+ */
+export declare function membersOf(db: DbOrTx, tenantId: string): Promise<readonly Member[]>;

package/dist/roster.js

@@ -0,0 +1,68 @@
+import { credentials, memberships, tenants } from '@wtfalch/authz-store';
+import { and, asc, eq, inArray, sql } from 'drizzle-orm';
+import { profiles } from './schema.js';
+/**
+ * A name for a non-human member once no credential row explains it either —
+ * a dangling reference, not the normal case, since every credential is
+ * minted with a `name`. Still never a raw principal id: a UUID says nothing
+ * a person can act on. Ported from manage's `memberships.ts`.
+ */
+function fallbackCredentialLabel(principalClass) {
+    switch (principalClass) {
+        case 'api_key':
+            return 'An API key no longer on record';
+        case 'agent':
+            return 'An agent no longer on record';
+        case 'service':
+            return 'A service no longer on record';
+        default:
+            return 'A credential no longer on record';
+    }
+}
+/**
+ * Every member of one tenant, newest membership first is not assumed here —
+ * callers that want an order sort by `joinedAt` themselves; this returns in
+ * principal order, which is what makes the query itself stable to test
+ * against.
+ *
+ * The caller checks `people:read` before calling this — see
+ * `authorization.ts` — this function does not check it itself, the same
+ * separation `@wtfalch/widget`'s store keeps from its authorization module.
+ */
+export async function membersOf(db, tenantId) {
+    const rows = await db
+        .select({
+        principalId: memberships.principalId,
+        principalClass: memberships.principalClass,
+        source: memberships.source,
+        viaTenantId: memberships.viaTenantId,
+        joinedAt: memberships.createdAt,
+        displayName: profiles.displayName,
+        email: profiles.email,
+        lastSeenAt: profiles.lastSeenAt,
+        // A non-human member's name is the name its own credential was minted
+        // with, not the principal id `display` falls back to next — a raw
+        // UUID where a name belongs.
+        credentialName: credentials.name,
+    })
+        .from(memberships)
+        .leftJoin(profiles, and(eq(memberships.principalClass, 'human'), eq(profiles.id, memberships.principalId)))
+        .leftJoin(credentials, and(eq(memberships.principalClass, credentials.kind), sql `${memberships.principalId} = ${credentials.id}::text`))
+        .where(eq(memberships.tenantId, tenantId))
+        .orderBy(asc(memberships.principalId), asc(memberships.principalClass));
+    const viaTenantIds = [...new Set(rows.map((r) => r.viaTenantId).filter((id) => id !== null))];
+    const viaTenantNames = viaTenantIds.length
+        ? new Map((await db
+            .select({ id: tenants.id, name: tenants.name })
+            .from(tenants)
+            .where(inArray(tenants.id, viaTenantIds))).map((t) => [t.id, t.name]))
+        : new Map();
+    return rows.map(({ displayName, credentialName, viaTenantId, ...r }) => ({
+        ...r,
+        display: displayName ?? r.email ?? credentialName ?? fallbackCredentialLabel(r.principalClass),
+        email: r.email ?? null,
+        viaTenantName: viaTenantId
+            ? (viaTenantNames.get(viaTenantId) ?? 'a parent organisation')
+            : null,
+    }));
+}

package/dist/schema.d.ts

@@ -0,0 +1,121 @@
+/**
+ * The row this package owns for a person: display name and the fields every
+ * host shows. Keyed by the ZITADEL person id (the README's own scope line),
+ * a `text` id because that id is not a uuid.
+ *
+ * `memberships`, `tenants` and `credentials` — the tables `roster.ts` joins
+ * this against — are not defined here. They belong to `@wtfalch/authz-store`,
+ * which ships and migrates them; this package only reads and writes its own
+ * `profiles` table (`src/migrations/0001_profiles.sql`).
+ */
+export declare const profiles: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "profiles";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        displayName: import("drizzle-orm/pg-core").PgColumn<{
+            name: "display_name";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        email: import("drizzle-orm/pg-core").PgColumn<{
+            name: "email";
+            tableName: "profiles";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastSeenAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_seen_at";
+            tableName: "profiles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "profiles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "profiles";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type Profile = typeof profiles.$inferSelect;
+export type NewProfile = typeof profiles.$inferInsert;

package/dist/schema.js

@@ -0,0 +1,20 @@
+import { sql } from 'drizzle-orm';
+import { pgTable, text, timestamp } from 'drizzle-orm/pg-core';
+/**
+ * The row this package owns for a person: display name and the fields every
+ * host shows. Keyed by the ZITADEL person id (the README's own scope line),
+ * a `text` id because that id is not a uuid.
+ *
+ * `memberships`, `tenants` and `credentials` — the tables `roster.ts` joins
+ * this against — are not defined here. They belong to `@wtfalch/authz-store`,
+ * which ships and migrates them; this package only reads and writes its own
+ * `profiles` table (`src/migrations/0001_profiles.sql`).
+ */
+export const profiles = pgTable('profiles', {
+    id: text('id').primaryKey(),
+    displayName: text('display_name'),
+    email: text('email'),
+    lastSeenAt: timestamp('last_seen_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().default(sql `now()`),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().default(sql `now()`),
+});

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@wtfalch/people",
+  "version": "0.1.0",
+  "description": "The estate's directory of people: profiles, org membership and roster reads, on top of @wtfalch/authz-store.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/wtfalch/people",
+    "directory": "packages/people"
+  },
+  "license": "MIT",
+  "type": "module",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "bin": {
+    "people-migrations": "dist/bin/migrations.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./migrations/*.sql": "./dist/migrations/*.sql",
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "dependencies": {
+    "@wtfalch/authz-store": "0.1.0"
+  },
+  "peerDependencies": {
+    "@wtfalch/audit": "0.4.0",
+    "@wtfalch/authz": "0.12.0",
+    "drizzle-orm": "^0.39.0"
+  },
+  "peerDependenciesMeta": {
+    "@wtfalch/audit": {
+      "optional": true
+    },
+    "@wtfalch/authz": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@electric-sql/pglite": "^0.5.8",
+    "@types/node": "^22",
+    "@wtfalch/audit": "0.4.0",
+    "@wtfalch/authz": "0.12.0",
+    "drizzle-orm": "^0.39.0",
+    "postgres": "^3.4.5",
+    "typescript": "^5.9.0",
+    "vitest": "^4.1.6",
+    "zod": "^4.5.4"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/copy-migrations.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}