nucleus-core-ts 0.9.718 → 0.9.719

package/dist/src/Client/Proxy/authz.js

@@ -95,8 +95,15 @@ function matchesGlob(path, patterns) {
         reason: 'godmin',
         action
     };
-    const suppressed = suppressedClaims && suppressedClaims.length ? new Set(suppressedClaims) : null;
-    const effectiveClaims = suppressed ? claims.filter((c)=>!suppressed.has(c)) : claims;
+    // A ClaimGuard's `invalidates` entries are PREFIX-aware, mirroring how claim grants work
+    // (and how firedGuards naming below matches): suppressing `llm` (or `llm.prediction`) removes
+    // every claim AT or UNDER it. This lets a guard invalidate a whole capability with one short
+    // prefix instead of enumerating each discovered leaf — an exact leaf is just the zero-descendant
+    // case. (Without this, an operator/AI-proposed `invalidates:["llm"]` would silently no-op, since
+    // discovered claims are leaves and none equals the bare prefix.)
+    const suppressed = suppressedClaims && suppressedClaims.length ? suppressedClaims : null;
+    const isSuppressed = (c)=>!!suppressed && suppressed.some((s)=>c === s || c.startsWith(`${s}.`));
+    const effectiveClaims = suppressed ? claims.filter((c)=>!isSuppressed(c)) : claims;
     if (claimSatisfies(effectiveClaims, action)) return {
         decision: 'allow',
         reason: 'claim',

package/dist/src/Client/Proxy/authz.test.js

@@ -249,6 +249,34 @@ describe('evaluateAccess', ()=>{
             reason: 'claim'
         });
     });
+    it('suppresses by PREFIX — invalidating "agent" removes every agent.* leaf', ()=>{
+        // A guard whose invalidates is a short prefix must suppress the leaf the user actually
+        // holds (discovered claims are leaves). Regression: exact-only subtraction would ALLOW.
+        const d = evaluateAccess({
+            ...base,
+            method: 'GET',
+            path: '/api/v1/templates',
+            claims: [
+                'agent.templates.list'
+            ],
+            suppressedClaims: [
+                'agent'
+            ],
+            firedGuards: [
+                {
+                    action: 'maintenance_mode',
+                    invalidates: [
+                        'agent'
+                    ]
+                }
+            ]
+        });
+        expect(d).toMatchObject({
+            decision: 'deny',
+            reason: 'claim_guard',
+            guard: 'maintenance_mode'
+        });
+    });
     it('suppression never elevates godmin denial (godmin bypasses by role)', ()=>{
         const d = evaluateAccess({
             ...base,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.718",
+	"version": "0.9.719",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",