@substrat-run/vertical-auth 0.13.2 → 0.14.1

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOlG,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -4,5 +4,11 @@ export { IdentityDO, doAuthProvider } from './identity-do.js';
 export { resolveCookieDomain } from './cookie-domain.js';
 export { FIRST_SIGN_IN_WINDOW_MS, OWNER_CLAIM_TTL_MS } from './owner-seat.js';
 export { invitePath, mintOwnerClaimLink, ownerClaimPath, sha256Hex } from './owner-claim-link.js';
+// `mountInviteRoutes` is deliberately NOT re-exported here. It is the one module in this
+// package that imports `hono` at runtime, and a barrel re-export would make every
+// `import '@substrat-run/vertical-auth'` evaluate it — so a consumer that wants only an
+// `AuthProvider` or the OIDC helpers would resolve a peer it never uses. It lives on the
+// `@substrat-run/vertical-auth/invite-routes` subpath, beside `./provider` and `./oidc`,
+// for the same reason those do.
 export { AUTH_CONFIG_KEY, AuthConfigError, authChoice, authorizationServersOf, instanceAuthFor, parseAuthChoice, selectAuthProvider, } from './instance-auth.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClG,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClG,yFAAyF;AACzF,kFAAkF;AAClF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,gCAAgC;AAChC,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}

package/dist/invite-routes.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The MEMBER INVITE routes a vertical mounts — the post-setup join path (#1150).
+ *
+ * Three demo workers carried these four routes verbatim: list the open invites, create
+ * one, revoke one, and accept one. The copies agreed byte-for-byte on the parts that
+ * matter — the token shape, that only its HASH is stored, that the role is granted BEFORE
+ * the invite is recorded, the status codes and the messages — and nothing but a diff held
+ * them in step. So the routes live here once, and a vertical supplies only what is its own:
+ * how a request resolves to a scope, who counts as an admin, which roles a teammate may be
+ * invited at, and the host that grants the role.
+ *
+ * What an invite IS does not change by moving here. Creating one pre-mints a member
+ * principal, grants it the chosen role at scope level (a real grant — the principal can
+ * act the moment somebody binds to it), and records the invite in the tenant's identity
+ * directory keyed by the token's SHA-256; the plaintext token rides only in the returned
+ * accept link. Accepting binds the invitee's verified subject to that pre-minted principal,
+ * and the directory then resolves them as that member. Revoking removes the invite row;
+ * the scope-level grant on a principal nobody was ever bound to is inert.
+ *
+ * Deliberately NOT here: the dashboard-side members view over an installed vertical's
+ * directory — that widens the platform's reach into a vertical's identity and is a
+ * separate decision — and the richer invite a support desk runs (contact-bound roles,
+ * staff profiles), which is a different flow rather than this one with more fields.
+ */
+import type { Context, Hono } from 'hono';
+import { z, type PrincipalId } from '@substrat-run/contracts';
+import type { IdentityStub } from './identity-do.js';
+import type { AuthProvider } from './provider.js';
+/** The slice of the identity directory the invite routes touch. */
+export type InviteDirectory = Pick<IdentityStub, 'listInvites' | 'createInvite' | 'revokeInvite' | 'claimInvite'>;
+/** The body `POST /api/invites` takes. */
+export declare const inviteBody: z.ZodObject<{
+    email: z.ZodOptional<z.ZodString>;
+    roleKey: z.ZodString;
+}, z.core.$strip>;
+/** The body `POST /api/accept-invite` takes. */
+export declare const acceptInviteBody: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strip>;
+/**
+ * What the vertical supplies. `E` is its worker's bindings; `N` is whatever it resolves a
+ * request to — the routes only read `scopeId` off it, and hand the whole node back to
+ * `directory`, so a vertical whose node carries more (a tenant, a site) loses nothing.
+ */
+export interface InviteRouteDeps<E extends object, N extends {
+    scopeId: string;
+}> {
+    /** The (tenant, scope) this request addresses — behind the router, from the assertion. */
+    nodeFor: (req: Request, env: E) => N | Promise<N>;
+    /**
+     * Gate the three admin routes: throw 401 for nobody, 403 for a caller who may not manage
+     * members. The vertical decides what "admin" means — a role, a permission, a whoami.
+     */
+    requireAdmin: (c: Context<{
+        Bindings: E;
+    }>) => Promise<unknown>;
+    /** The role keys a teammate may be invited at — the vertical's own ROLES. */
+    roles: readonly string[];
+    /** The tenant's identity directory — the invite rows and the sub → principal binding. */
+    directory: (env: E, node: N) => InviteDirectory;
+    /** Grant the pre-minted principal its role at scope level — the host's `assignScopeRole`. */
+    assignScopeRole: (env: E, scopeId: N['scopeId'], principal: PrincipalId, roleKey: string) => Promise<void>;
+    /**
+     * Take that grant back — the host's `revokeScopeRole`. The grant and the invite row live
+     * in two different Durable Objects, so the create has no transaction across them: when
+     * the row cannot be written after the role was granted, this is what puts the scope back
+     * where it was, rather than leaving a principal nobody can ever bind to holding a role.
+     */
+    revokeScopeRole: (env: E, scopeId: N['scopeId'], principal: PrincipalId, roleKey: string) => Promise<unknown>;
+    /** The configured `AuthProvider` — who is accepting. Resolved per request, as the vertical does. */
+    authProvider: (env: E, req: Request) => Promise<AuthProvider>;
+    /**
+     * The origin the accept link is built on. Defaults to the request's own. A trailing
+     * slash is tolerated — `mintOwnerClaimLink` strips one the same way — so a vertical that
+     * hands over a configured `https://host/` does not send invitees to `https://host//`.
+     */
+    origin?: (req: Request) => string;
+}
+/**
+ * Mount the four invite routes on a vertical's Hono app:
+ *
+ *   GET  /api/invites                    → { roles, invites }            (admin)
+ *   POST /api/invites                    → 201 { principal, roleKey, email, acceptUrl } (admin)
+ *   POST /api/invites/:principal/revoke  → 204                           (admin)
+ *   POST /api/accept-invite              → { ok: true, principal }       (any signed-in subject)
+ *
+ * Every error these routes raise themselves is an `HTTPException` — a body that is not
+ * JSON or does not fit its schema included, which `bodyOf` turns into a 400 rather than
+ * letting a `SyntaxError` or `ZodError` out — so the vertical's own `onError`, or the
+ * envelope `mountPlatformSurface` installs, renders them exactly as it renders its own,
+ * and needs no branch for this mount. What the vertical's OWN deps throw (`requireAdmin`,
+ * the directory, the host) is passed through untouched: those are its errors to shape.
+ */
+export declare function mountInviteRoutes<E extends object, N extends {
+    scopeId: string;
+}>(app: Hono<{
+    Bindings: E;
+}>, deps: InviteRouteDeps<E, N>): void;
+//# sourceMappingURL=invite-routes.d.ts.map

package/dist/invite-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-routes.d.ts","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAe,CAAC,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,cAAc,GAAG,cAAc,GAAG,aAAa,CAAC,CAAC;AAElH,0CAA0C;AAC1C,eAAO,MAAM,UAAU;;;iBAIrB,CAAC;AAEH,gDAAgD;AAChD,eAAO,MAAM,gBAAgB;;iBAAyC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;IAC9E,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,6EAA6E;IAC7E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yFAAyF;IACzF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC;IAChD,6FAA6F;IAC7F,eAAe,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3G;;;;;OAKG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oGAAoG;IACpG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACnC;AA2BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC/E,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAC1B,IAAI,CAkDN"}

package/dist/invite-routes.js

@@ -0,0 +1,128 @@
+/**
+ * The MEMBER INVITE routes a vertical mounts — the post-setup join path (#1150).
+ *
+ * Three demo workers carried these four routes verbatim: list the open invites, create
+ * one, revoke one, and accept one. The copies agreed byte-for-byte on the parts that
+ * matter — the token shape, that only its HASH is stored, that the role is granted BEFORE
+ * the invite is recorded, the status codes and the messages — and nothing but a diff held
+ * them in step. So the routes live here once, and a vertical supplies only what is its own:
+ * how a request resolves to a scope, who counts as an admin, which roles a teammate may be
+ * invited at, and the host that grants the role.
+ *
+ * What an invite IS does not change by moving here. Creating one pre-mints a member
+ * principal, grants it the chosen role at scope level (a real grant — the principal can
+ * act the moment somebody binds to it), and records the invite in the tenant's identity
+ * directory keyed by the token's SHA-256; the plaintext token rides only in the returned
+ * accept link. Accepting binds the invitee's verified subject to that pre-minted principal,
+ * and the directory then resolves them as that member. Revoking removes the invite row;
+ * the scope-level grant on a principal nobody was ever bound to is inert.
+ *
+ * Deliberately NOT here: the dashboard-side members view over an installed vertical's
+ * directory — that widens the platform's reach into a vertical's identity and is a
+ * separate decision — and the richer invite a support desk runs (contact-bound roles,
+ * staff profiles), which is a different flow rather than this one with more fields.
+ */
+import { HTTPException } from 'hono/http-exception';
+import { principalId, z } from '@substrat-run/contracts';
+import { ulid } from '@substrat-run/kernel';
+import { claimToken, invitePath, sha256Hex } from './owner-claim-link.js';
+/** The body `POST /api/invites` takes. */
+export const inviteBody = z.object({
+    email: z.string().email().optional(),
+    /** One of the vertical's roles — validated against `roles` below. */
+    roleKey: z.string().min(1),
+});
+/** The body `POST /api/accept-invite` takes. */
+export const acceptInviteBody = z.object({ token: z.string().min(1) });
+/**
+ * The request body, parsed against the route's schema — or a 400 that names what was
+ * wrong. Both failure shapes are turned into an `HTTPException` here so the promise
+ * `mountInviteRoutes` makes holds: a body that is not JSON would otherwise surface as the
+ * `SyntaxError` `c.req.json()` throws (a 500 under any `onError` that does not know it),
+ * and a body that does not fit the schema as a `ZodError` the vertical would have to map
+ * itself. The issue list is written into the message rather than a structured body
+ * because the vertical's own envelope decides the body shape, and a message is the one
+ * thing every envelope carries through.
+ */
+async function bodyOf(c, schema) {
+    let raw;
+    try {
+        raw = await c.req.json();
+    }
+    catch {
+        throw new HTTPException(400, { message: 'the request body must be JSON' });
+    }
+    const parsed = schema.safeParse(raw);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => `${i.path.join('.') || 'body'}: ${i.message}`).join('; ');
+        throw new HTTPException(400, { message: `invalid request body — ${issues}` });
+    }
+    return parsed.data;
+}
+/**
+ * Mount the four invite routes on a vertical's Hono app:
+ *
+ *   GET  /api/invites                    → { roles, invites }            (admin)
+ *   POST /api/invites                    → 201 { principal, roleKey, email, acceptUrl } (admin)
+ *   POST /api/invites/:principal/revoke  → 204                           (admin)
+ *   POST /api/accept-invite              → { ok: true, principal }       (any signed-in subject)
+ *
+ * Every error these routes raise themselves is an `HTTPException` — a body that is not
+ * JSON or does not fit its schema included, which `bodyOf` turns into a 400 rather than
+ * letting a `SyntaxError` or `ZodError` out — so the vertical's own `onError`, or the
+ * envelope `mountPlatformSurface` installs, renders them exactly as it renders its own,
+ * and needs no branch for this mount. What the vertical's OWN deps throw (`requireAdmin`,
+ * the directory, the host) is passed through untouched: those are its errors to shape.
+ */
+export function mountInviteRoutes(app, deps) {
+    const originOf = (req) => (deps.origin?.(req) ?? new URL(req.url).origin).replace(/\/$/, '');
+    app.get('/api/invites', async (c) => {
+        const node = await deps.nodeFor(c.req.raw, c.env);
+        await deps.requireAdmin(c);
+        return c.json({ roles: [...deps.roles], invites: await deps.directory(c.env, node).listInvites(node.scopeId) });
+    });
+    app.post('/api/invites', async (c) => {
+        const node = await deps.nodeFor(c.req.raw, c.env);
+        await deps.requireAdmin(c);
+        const { email, roleKey } = await bodyOf(c, inviteBody);
+        if (!deps.roles.includes(roleKey))
+            throw new HTTPException(400, { message: `unknown role '${roleKey}'` });
+        const principal = principalId.parse(ulid());
+        // A long, URL-safe token; only its hash is stored. Two UUIDs = 256 bits of entropy.
+        const token = claimToken();
+        // The grant first: an invite row whose principal holds nothing is a link that binds a
+        // teammate to no access, whereas a grant with no row is inert — nobody can bind to it.
+        await deps.assignScopeRole(c.env, node.scopeId, principal, roleKey);
+        try {
+            await deps.directory(c.env, node).createInvite(node.scopeId, principal, roleKey, email ?? null, await sha256Hex(token));
+        }
+        catch (err) {
+            // Two Durable Objects, no transaction between them. Inert is not the same as
+            // harmless: every retry of a failing create would mint another principal with a
+            // role and no row, so the grant is taken back before the failure is reported. If
+            // the revoke fails too, the ORIGINAL failure is what the caller hears — it is the
+            // one that explains the request — and the orphan is the state this comment names.
+            await deps.revokeScopeRole(c.env, node.scopeId, principal, roleKey).catch(() => undefined);
+            throw err;
+        }
+        return c.json({ principal, roleKey, email: email ?? null, acceptUrl: `${originOf(c.req.raw)}${invitePath(token)}` }, 201);
+    });
+    app.post('/api/invites/:principal/revoke', async (c) => {
+        const node = await deps.nodeFor(c.req.raw, c.env);
+        await deps.requireAdmin(c);
+        await deps.directory(c.env, node).revokeInvite(node.scopeId, c.req.param('principal'));
+        return c.body(null, 204);
+    });
+    app.post('/api/accept-invite', async (c) => {
+        const node = await deps.nodeFor(c.req.raw, c.env);
+        const subject = await (await deps.authProvider(c.env, c.req.raw)).resolve(c.req.raw.headers);
+        if (!subject)
+            throw new HTTPException(401, { message: 'sign in before accepting an invite' });
+        const { token } = await bodyOf(c, acceptInviteBody);
+        const principal = await deps.directory(c.env, node).claimInvite(node.scopeId, subject.sub, await sha256Hex(token));
+        if (!principal)
+            throw new HTTPException(400, { message: 'this invite is invalid or already used' });
+        return c.json({ ok: true, principal });
+    });
+}
+//# sourceMappingURL=invite-routes.js.map

package/dist/invite-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-routes.js","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAoB,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAM1E,0CAA0C;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAsCvE;;;;;;;;;GASG;AACH,KAAK,UAAU,MAAM,CAAI,CAAU,EAAE,MAAoB;IACvD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxG,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0BAA0B,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA0B,EAC1B,IAA2B;IAE3B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9G,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,OAAO,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,oFAAoF;QACpF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,gFAAgF;YAChF,iFAAiF;YACjF,kFAAkF;YAClF,kFAAkF;YAClF,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3F,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/vertical-auth",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -31,6 +31,10 @@
     "./oidc-rp-provider": {
       "types": "./dist/oidc-rp-provider.d.ts",
       "default": "./dist/oidc-rp-provider.js"
+    },
+    "./invite-routes": {
+      "types": "./dist/invite-routes.d.ts",
+      "default": "./dist/invite-routes.js"
     }
   },
   "files": [
@@ -40,14 +44,19 @@
     "better-auth": "^1.7.1",
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",
-    "@substrat-run/contracts": "^0.110.0",
-    "@substrat-run/psl": "^0.2.4",
-    "@substrat-run/oidc-rp": "^0.9.0"
+    "@substrat-run/contracts": "^0.112.0",
+    "@substrat-run/oidc-rp": "^0.9.0",
+    "@substrat-run/kernel": "^0.112.0",
+    "@substrat-run/psl": "^0.2.5"
+  },
+  "peerDependencies": {
+    "hono": "^4.6.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250109.0",
     "@types/better-sqlite3": "^9.6.0",
     "better-sqlite3": "^13.0.3",
+    "hono": "^4.6.0",
     "typescript": "^7.0.0",
     "vitest": "^3.2.7"
   },