@substrat-run/vertical-auth 0.17.0 → 0.18.1

package/README.md

@@ -66,7 +66,12 @@ A closed window is not a lost desk: the seat stays pending (`needsSetup` keeps s
 keeps the window it has and never re-opens a claimed seat. Access is invite-only afterwards.
 
 Also exported: `resolveCookieDomain`, which refuses to set a session cookie on a public suffix
-(guarded by [`@substrat-run/psl`](https://npmjs.com/package/@substrat-run/psl)).
+(guarded by [`@substrat-run/psl`](https://npmjs.com/package/@substrat-run/psl)) or anywhere
+in the shared platform hostname space. `instanceAuthFor` reads the trusted
+`PLATFORM_BASE_DOMAINS` worker binding; direct `oidcRpAuthProvider` and `doAuthProvider`
+callers pass the same list as `platformBaseDomains` when using `cookieDomain`. The
+default `substrat.run` zone is always refused. A rejected domain uses a host-only cookie,
+expires old domain cookies, and invalidates sessions issued under the old policy.
 
 ## Runtime
 

package/dist/cookie-domain.d.ts

@@ -1,2 +1,15 @@
-export declare function resolveCookieDomain(configured: string | undefined, host: string): string | null;
+export interface CookieDomainDecision {
+    domain: string | null;
+    /** A previously issued domain cookie that must be expired on the response. */
+    cleanupDomain: string | null;
+}
+export declare function cookieDomainDecision(configured: string | undefined, host: string, platformBaseDomains?: readonly string[]): CookieDomainDecision;
+export declare function resolveCookieDomain(configured: string | undefined, host: string, platformBaseDomains?: readonly string[]): string | null;
+/** Replace caller-supplied internal headers with the worker's delivered cookie settings. */
+export declare function forwardIdentityCookieConfig(request: Request, opts?: {
+    cookieDomain?: string;
+    platformBaseDomains?: readonly string[];
+}): Request;
+/** Clear the domain-scoped Better Auth cookies issued before a platform zone was refused. */
+export declare function expireBetterAuthDomainCookies(response: Response, origin: string, domain: string | null): Response;
 //# sourceMappingURL=cookie-domain.d.ts.map

package/dist/cookie-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-domain.d.ts","sourceRoot":"","sources":["../src/cookie-domain.ts"],"names":[],"mappings":"AAuBA,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW/F"}
+{"version":3,"file":"cookie-domain.d.ts","sourceRoot":"","sources":["../src/cookie-domain.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,MAAM,EACZ,mBAAmB,GAAE,SAAS,MAAM,EAAO,GAC1C,oBAAoB,CAkBtB;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,MAAM,EACZ,mBAAmB,GAAE,SAAS,MAAM,EAAO,GAC1C,MAAM,GAAG,IAAI,CAEf;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACxE,OAAO,CAWT;AAED,6FAA6F;AAC7F,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CASjH"}

package/dist/cookie-domain.js

@@ -16,24 +16,60 @@
  * multi-level registry suffix a label-count check would miss — is rejected via the
  * vendored Public Suffix List (`@substrat-run/psl`). A cookie on a public suffix spans
  * every tenant registered under it, so it must never be honoured. The platform's own
- * apex (`substrat.run`) is an ordinary registrable domain, NOT a public suffix, so it is
- * additionally guarded upstream (the platform refuses to deliver it as a cookie-domain).
+ * hostname space is an ordinary registrable domain, not a public suffix, and is
+ * refused here too: sibling platform hostnames can belong to different tenants.
  */
 import { isPublicSuffix } from '@substrat-run/psl';
-export function resolveCookieDomain(configured, host) {
+import { DEFAULT_PLATFORM_BASE_DOMAIN, isPlatformHost } from '@substrat-run/contracts';
+export function cookieDomainDecision(configured, host, platformBaseDomains = []) {
+    const hostOnly = { domain: null, cleanupDomain: null };
     if (!configured)
-        return null;
+        return hostOnly;
     const domain = configured.trim().toLowerCase().replace(/^\./, '');
     if (!domain.includes('.'))
-        return null; // a bare TLD is never a session boundary
+        return hostOnly; // a bare TLD is never a session boundary
     const h = host.toLowerCase();
     if (h !== domain && !h.endsWith(`.${domain}`))
-        return null; // browser would reject it anyway
+        return hostOnly; // browser would reject it anyway
+    // A configured parent within the platform's own hostname space can cover another
+    // tenant's app. Even an exact app hostname needs no Domain attribute: host-only is
+    // the safe default and also avoids sending its cookie to subdomains.
+    if (isPlatformHost(domain, [DEFAULT_PLATFORM_BASE_DOMAIN, ...platformBaseDomains])) {
+        return { domain: null, cleanupDomain: domain };
+    }
     // Registrable-suffix guard (D-35): a cookie whose Domain is a public suffix — `co.uk`,
     // `pages.dev`, any multi-level registry suffix a label-count check misses — spans every
     // tenant under it. Reject it; the session degrades to host-only rather than leaking.
     if (isPublicSuffix(domain))
-        return null;
-    return domain;
+        return hostOnly;
+    return { domain, cleanupDomain: null };
+}
+export function resolveCookieDomain(configured, host, platformBaseDomains = []) {
+    return cookieDomainDecision(configured, host, platformBaseDomains).domain;
+}
+/** Replace caller-supplied internal headers with the worker's delivered cookie settings. */
+export function forwardIdentityCookieConfig(request, opts) {
+    const relayed = new Request(request);
+    relayed.headers.delete('x-substrat-cookie-domain');
+    relayed.headers.delete('x-substrat-platform-base-domains');
+    if (opts?.cookieDomain) {
+        relayed.headers.set('x-substrat-cookie-domain', opts.cookieDomain);
+        if (opts.platformBaseDomains?.length) {
+            relayed.headers.set('x-substrat-platform-base-domains', opts.platformBaseDomains.join(','));
+        }
+    }
+    return relayed;
+}
+/** Clear the domain-scoped Better Auth cookies issued before a platform zone was refused. */
+export function expireBetterAuthDomainCookies(response, origin, domain) {
+    if (!domain)
+        return response;
+    const headers = new Headers(response.headers);
+    for (const name of ['session_token', 'session_data', 'account_data', 'dont_remember']) {
+        for (const prefix of ['better-auth.', '__Secure-better-auth.']) {
+            headers.append('set-cookie', `${prefix}${name}=; Path=/; Domain=${domain}; Max-Age=0; HttpOnly; SameSite=Lax${origin.startsWith('https:') ? '; Secure' : ''}`);
+        }
+    }
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
 }
 //# sourceMappingURL=cookie-domain.js.map

package/dist/cookie-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-domain.js","sourceRoot":"","sources":["../src/cookie-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,UAAU,mBAAmB,CAAC,UAA8B,EAAE,IAAY;IAC9E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACjF,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IAC7F,uFAAuF;IACvF,wFAAwF;IACxF,qFAAqF;IACrF,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"cookie-domain.js","sourceRoot":"","sources":["../src/cookie-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAQvF,MAAM,UAAU,oBAAoB,CAClC,UAA8B,EAC9B,IAAY,EACZ,mBAAmB,GAAsB,EAAE;IAE3C,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,yCAAyC;IACrF,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,iCAAiC;IACjG,iFAAiF;IACjF,mFAAmF;IACnF,qEAAqE;IACrE,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC,4BAA4B,EAAE,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,uFAAuF;IACvF,wFAAwF;IACxF,qFAAqF;IACrF,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,UAA8B,EAC9B,IAAY,EACZ,mBAAmB,GAAsB,EAAE;IAE3C,OAAO,oBAAoB,CAAC,UAAU,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC;AAC5E,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,2BAA2B,CACzC,OAAgB,EAChB,IAAyE;IAEzE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACnD,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3D,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,mBAAmB,EAAE,MAAM,EAAE,CAAC;YACrC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,6BAA6B,CAAC,QAAkB,EAAE,MAAc,EAAE,MAAqB;IACrG,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;QACtF,KAAK,MAAM,MAAM,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,qBAAqB,MAAM,sCAAsC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjK,CAAC;IACH,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5G,CAAC"}

package/dist/identity-do.d.ts

@@ -138,6 +138,9 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
      * binding was there. `unbindMember` in `places.ts` pairs it with telling the identity pool.
      */
     unbind(scopeId: string, sub: string): Promise<boolean>;
+    /** Remove all of a principal's bindings in this scope, returning their subjects so the
+     * caller can report each absent place. A removal cannot miss a login behind a scan cap. */
+    unbindPrincipal(scopeId: string, principal: string): Promise<string[]>;
     /** The subjects bound in this scope, at most `limit` — the whole set a places repair sends. */
     subjectsOf(scopeId: string, limit: number): Promise<string[]>;
     /** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
@@ -196,6 +199,7 @@ export type IdentityStub = {
     revokeInvite(scopeId: string, principal: string): Promise<void>;
     claimInvite(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
     unbind(scopeId: string, sub: string): Promise<boolean>;
+    unbindPrincipal(scopeId: string, principal: string): Promise<string[]>;
     subjectsOf(scopeId: string, limit: number): Promise<string[]>;
 };
 type _StubCarriesClass = IdentityDO extends IdentityStub ? true : never;
@@ -211,6 +215,7 @@ export declare const _identityStubPin: [_StubCarriesClass, _ClassMethodsMissingF
  */
 export declare function doAuthProvider(stub: Pick<IdentityStub, 'fetch'>, origin: string, opts?: {
     cookieDomain?: string;
+    platformBaseDomains?: readonly string[];
 }): AuthProvider;
 export {};
 //# sourceMappingURL=identity-do.d.ts.map

package/dist/identity-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAeL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AA+EzB,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAmBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3G;IAED,kGAAkG;IAC5F,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAEzH;IAED;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,iHAAiH;IAC3G,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEnD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAE9F;IAED;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExF;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9H;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAKvD;IAED;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7E;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQzF;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED,+FAA+F;IACzF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElE;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuBxD;CACF;AAED,2EAA2E;AAC3E,MAAM,MAAM,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AASxG,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/D,CAAC;AAKF,KAAK,iBAAiB,GAAG,UAAU,SAAS,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AACxE,KAAK,4BAA4B,GAAG,OAAO,CAAC,MAAM,UAAU,EAAE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,CAAC;AACxG,eAAO,MAAM,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,KAAY,CAAC;AAE7H;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,YAAY,CAcd"}
+{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAG/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAgBL,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AA+EzB,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAmBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3G;IAED,kGAAkG;IAC5F,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAEzH;IAED;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,iHAAiH;IAC3G,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEnD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAE9F;IAED;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExF;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9H;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAKvD;IAED;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM7E;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQzF;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED;+FAC2F;IACrF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;IAED,+FAA+F;IACzF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElE;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCxD;CACF;AAED,2EAA2E;AAC3E,MAAM,MAAM,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AASxG,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/D,CAAC;AAKF,KAAK,iBAAiB,GAAG,UAAU,SAAS,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AACxE,KAAK,4BAA4B,GAAG,OAAO,CAAC,MAAM,UAAU,EAAE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,CAAC;AACxG,eAAO,MAAM,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,KAAY,CAAC;AAE7H;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACxE,YAAY,CASd"}

package/dist/identity-do.js

@@ -3,9 +3,10 @@ import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
 import { drizzle } from 'drizzle-orm/durable-sqlite';
 import * as schema from './auth-schema.js';
-import { resolveCookieDomain } from './cookie-domain.js';
+import { cookieDomainDecision, expireBetterAuthDomainCookies, forwardIdentityCookieConfig } from './cookie-domain.js';
+import { parsePlatformBaseDomains } from '@substrat-run/contracts';
 import { SITE_REGISTRY_DDL, recordSite as recordSiteRow, listSites as listSiteRows, resolveSiteScope as resolveSiteScopeRow, forgetSite as forgetSiteRow, } from './site-registry.js';
-import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, mintOwnerClaim as mintOwnerClaimRow, claimOwner as claimOwnerRow, unbindSubject as unbindSubjectRow, subjectsOf as subjectsOfRows, transferOwner as transferOwnerRow, completeOwnerTransfer as completeOwnerTransferRow, abandonOwnerTransfer as abandonOwnerTransferRow, } from './owner-seat.js';
+import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, mintOwnerClaim as mintOwnerClaimRow, claimOwner as claimOwnerRow, unbindSubject as unbindSubjectRow, unbindPrincipal as unbindPrincipalRow, subjectsOf as subjectsOfRows, transferOwner as transferOwnerRow, completeOwnerTransfer as completeOwnerTransferRow, abandonOwnerTransfer as abandonOwnerTransferRow, } from './owner-seat.js';
 /**
  * The per-tenant IDENTITY Durable Object — one per tenant, running its OWN Better Auth
  * over its OWN SQLite (Drizzle's Durable-Object driver, not a shared D1), and holding the
@@ -297,18 +298,23 @@ export class IdentityDO extends DurableObject {
     async unbind(scopeId, sub) {
         return unbindSubjectRow(this.registrySql, scopeId, sub);
     }
+    /** Remove all of a principal's bindings in this scope, returning their subjects so the
+     * caller can report each absent place. A removal cannot miss a login behind a scan cap. */
+    async unbindPrincipal(scopeId, principal) {
+        return unbindPrincipalRow(this.registrySql, scopeId, principal);
+    }
     /** The subjects bound in this scope, at most `limit` — the whole set a places repair sends. */
     async subjectsOf(scopeId, limit) {
         return subjectsOfRows(this.registrySql, scopeId, limit);
     }
     /** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
-    auth(origin, cookieDomain) {
+    auth(origin, cookieDomain, rejectOldDomainSession = false) {
         const db = drizzle(this.ctx.storage, { schema });
         return betterAuth({
             database: drizzleAdapter(db, { provider: 'sqlite', schema }),
             emailAndPassword: { enabled: true, autoSignIn: true, minPasswordLength: 8 },
             // Per-tenant, generated + persisted in THIS DO (see the constructor) — never shared.
-            secret: this.authSecret,
+            secret: rejectOldDomainSession ? `${this.authSecret}\u0000platform-domain-v2` : this.authSecret,
             baseURL: origin,
             trustedOrigins: [origin],
             // Shared login across a scope's surfaces (crm.…, eka.… — one parent domain): the
@@ -331,8 +337,19 @@ export class IdentityDO extends DurableObject {
      */
     async fetch(request) {
         const url = new URL(request.url);
-        const cookieDomain = resolveCookieDomain(request.headers.get('x-substrat-cookie-domain') ?? undefined, url.hostname);
-        const auth = this.auth(url.origin, cookieDomain);
+        const { domain: cookieDomain, cleanupDomain } = cookieDomainDecision(request.headers.get('x-substrat-cookie-domain') ?? undefined, url.hostname, parsePlatformBaseDomains(request.headers.get('x-substrat-platform-base-domains')));
+        if (cleanupDomain) {
+            // Better Auth session tokens are opaque database keys, so changing its secret
+            // alone does not revoke an old cookie. Revoke once per rejected domain before
+            // processing even the first request that presents one.
+            const marker = [...this.ctx.storage.sql.exec("SELECT value FROM config WHERE key = 'rejected_cookie_domain'")][0];
+            if (marker?.value !== cleanupDomain) {
+                this.ctx.storage.sql.exec('DELETE FROM session');
+                this.ctx.storage.sql.exec("INSERT OR REPLACE INTO config (key, value) VALUES ('rejected_cookie_domain', ?)", cleanupDomain);
+            }
+        }
+        const auth = this.auth(url.origin, cookieDomain, cleanupDomain !== null);
+        const withCleanup = (response) => expireBetterAuthDomainCookies(response, url.origin, cleanupDomain);
         if (url.pathname === '/__session') {
             const session = await auth.api.getSession({ headers: request.headers });
             const subject = session?.user
@@ -346,9 +363,9 @@ export class IdentityDO extends DurableObject {
                     emailVerified: session.user.emailVerified,
                 }
                 : null;
-            return Response.json(subject);
+            return withCleanup(Response.json(subject));
         }
-        return auth.handler(request);
+        return withCleanup(await auth.handler(request));
     }
 }
 const inviteRowOf = (r) => ({
@@ -367,17 +384,11 @@ export const _identityStubPin = true;
  * header because the worker holds the config and the DO holds Better Auth — see fetch().
  */
 export function doAuthProvider(stub, origin, opts) {
-    const forward = (request) => {
-        if (!opts?.cookieDomain)
-            return request;
-        const relayed = new Request(request);
-        relayed.headers.set('x-substrat-cookie-domain', opts.cookieDomain);
-        return relayed;
-    };
+    const forward = (request) => forwardIdentityCookieConfig(request, opts);
     return {
         handle: (request) => stub.fetch(forward(request)),
         async resolve(headers) {
-            const res = await stub.fetch(new Request(`${origin}/__session`, { headers }));
+            const res = await stub.fetch(forward(new Request(`${origin}/__session`, { headers })));
             return (await res.json());
         },
     };

package/dist/identity-do.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,cAAc,IAAI,iBAAiB,EACnC,UAAU,IAAI,aAAa,EAC3B,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,0FAA0F;IAC1F,0FAA0F;IAC1F,GAAG,cAAc;IACjB,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F;;;0FAGwF;IACxF,iEAAiE;IACjE,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,SAAiB;QACrD,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAClC,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACrC,gHAAgH,EAChH,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,KAAK,SAAS,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAEzI,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B;QACvD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,mBAAmB,CACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAKD,MAAM,WAAW,GAAG,CAAC,CAAkC,EAAa,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,CAAC,CAAC,UAAoB;CAClC,CAAC,CAAC;AAqCH,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAgC;IAEhC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE;QAC5C,IAAI,CAAC,IAAI,EAAE,YAAY;YAAE,OAAO,OAAO,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,cAAc,IAAI,iBAAiB,EACnC,UAAU,IAAI,aAAa,EAC3B,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,EACrC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,0FAA0F;IAC1F,0FAA0F;IAC1F,GAAG,cAAc;IACjB,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F;;;0FAGwF;IACxF,iEAAiE;IACjE,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,SAAiB;QACrD,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAClC,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACrC,gHAAgH,EAChH,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,KAAK,SAAS,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAEzI,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B,EAAE,sBAAsB,GAAG,KAAK;QACvF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YAC/F,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,EACZ,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAClF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,8EAA8E;YAC9E,8EAA8E;YAC9E,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAC1C,+DAA+D,CAChE,CAAC,CAAC,CAAC,CAAkC,CAAC;YACvC,IAAI,MAAM,EAAE,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,iFAAiF,EAAE,aAAa,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAY,EAAE,CACnD,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AAKD,MAAM,WAAW,GAAG,CAAC,CAAkC,EAAa,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,CAAC,CAAC,UAAoB;CAClC,CAAC,CAAC;AAsCH,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/instance-auth.d.ts

@@ -126,5 +126,6 @@ export declare function selectAuthProvider(opts: {
      * choice only — the deployment default's issuer is the operator's own.
      */
     sharedIssuer?: boolean;
+    platformBaseDomains?: readonly string[];
 }): AuthProvider;
 //# sourceMappingURL=instance-auth.d.ts.map

package/dist/instance-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAI7G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;iBAQrB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IAD5B,YACW,MAAM,EAAE,GAAG,GAAG,GAAG,EAC1B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,IAAI,YAAY,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,qCAAqC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBxB;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C,GAAG,MAAM,EAAE,CAQX;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,YAAY,CAwCf"}
+{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4E,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAIvI,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;iBAQrB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IAD5B,YACW,MAAM,EAAE,GAAG,GAAG,GAAG,EAC1B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,IAAI,YAAY,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,qCAAqC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,YAAY,CAAC,CAoBxB;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C,GAAG,MAAM,EAAE,CAQX;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC,GAAG,YAAY,CAyCf"}

package/dist/instance-auth.js

@@ -1,4 +1,4 @@
-import { SHARED_ISSUER_CONFIG_KEY, resolveScopedEnvSpec, z } from '@substrat-run/contracts';
+import { SHARED_ISSUER_CONFIG_KEY, parsePlatformBaseDomains, resolveScopedEnvSpec, z } from '@substrat-run/contracts';
 import { issuerRefusal } from '@substrat-run/oidc-rp/discovery';
 import { oidcAuthProvider } from './oidc.js';
 import { oidcRpAuthProvider } from './oidc-rp-provider.js';
@@ -72,6 +72,7 @@ export async function instanceAuthFor(opts) {
             sessionSecret: wiring.sessionSecret,
             settings,
             sharedIssuer: wiring.config[SHARED_ISSUER_CONFIG_KEY] === 'true',
+            platformBaseDomains: parsePlatformBaseDomains(typeof opts.env.PLATFORM_BASE_DOMAINS === 'string' ? opts.env.PLATFORM_BASE_DOMAINS : undefined),
         }),
     };
 }
@@ -151,6 +152,7 @@ export function selectAuthProvider(opts) {
             ...(identity.audience ? { audience: identity.audience } : {}),
             ...(identity.cookieDomain ? { cookieDomain: identity.cookieDomain } : {}),
             ...(opts.sharedIssuer ? { sharedIssuer: true } : {}),
+            platformBaseDomains: opts.platformBaseDomains,
         });
     }
     if (settings.AUTH_PROVIDER === 'oidc') {

package/dist/instance-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AAC7G,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CACb,kBAAkB,CAAC;YACjB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,MAAM;SACjE,CAAC;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,4FAA4F;IAC5F,+EAA+E;IAC/E,MAAM,KAAK,GAAG,CAAC,MAA0B,EAAY,EAAE,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAUlC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,wFAAwF;QACxF,2FAA2F;QAC3F,0FAA0F;QAC1F,oDAAoD;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;YACzC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,uIAAuI,CACxI,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CACb,kBAAkB,CAAC;YACjB,QAAQ;YACR,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,MAAM;YAChE,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAChG;SACF,CAAC;KACL,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,4FAA4F;IAC5F,+EAA+E;IAC/E,MAAM,KAAK,GAAG,CAAC,MAA0B,EAAY,EAAE,CAAC,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAWlC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,wFAAwF;QACxF,2FAA2F;QAC3F,0FAA0F;QAC1F,oDAAoD;QACpD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;YACzC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QAClG,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,uIAAuI,CACxI,CAAC;AACJ,CAAC"}

package/dist/oidc-rp-provider.d.ts

@@ -37,6 +37,8 @@ export interface OidcRpConfig {
      * where the cookie is set (cookie-domain.ts); invalid ⇒ host-only, never broken sign-in.
      */
     cookieDomain?: string;
+    /** Trusted platform zones from PLATFORM_BASE_DOMAINS on the serving worker. */
+    platformBaseDomains?: readonly string[];
 }
 export declare function oidcRpAuthProvider(cfg: OidcRpConfig): AuthProvider;
 //# sourceMappingURL=oidc-rp-provider.d.ts.map

package/dist/oidc-rp-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAI/D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoGD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CAgGlE"}
+{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAI/D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AA2GD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CAqGlE"}

package/dist/oidc-rp-provider.js

@@ -1,12 +1,15 @@
 import { beginLogin, completeLogin, federatedLogoutUrl, verifySession, readCookie, safePath, SESSION_COOKIE, FLOW_COOKIE, LOGOUT_HINT_COOKIE, LOGOUT_PATH, SESSION_MAXAGE, FLOW_MAXAGE, } from '@substrat-run/oidc-rp';
 import { mcpResourceOf } from '@substrat-run/contracts';
 import { oidcAuthProvider } from './oidc.js';
-import { resolveCookieDomain } from './cookie-domain.js';
+import { cookieDomainDecision } from './cookie-domain.js';
 const envOf = (cfg) => ({
     OIDC_ISSUER: cfg.issuer,
     OIDC_CLIENT_ID: cfg.clientId,
     OIDC_CLIENT_SECRET: cfg.clientSecret,
-    SESSION_SECRET: cfg.sessionSecret,
+    // A previously issued platform-domain cookie can reach another tenant before this
+    // browser returns for cleanup. Rotate the signing key for that configuration so the
+    // old credential is refused immediately; new host-only sessions use the new key.
+    SESSION_SECRET: cookieDomainDecision(cfg.cookieDomain, cfg.cookieDomain?.trim().replace(/^\./, '') ?? '', cfg.platformBaseDomains).cleanupDomain ? `${cfg.sessionSecret}\u0000platform-domain-v2` : cfg.sessionSecret,
 });
 /** Serialize one Set-Cookie value — HttpOnly, and by default Lax on path=/ (the oidc-rp mount's flags). */
 function cookie(name, value, origin, maxAge, domain, path = '/', sameSite = 'Lax') {
@@ -99,7 +102,11 @@ export function oidcRpAuthProvider(cfg) {
         // The flow cookie stays HOST-ONLY even with a cookieDomain: the code flow begins and
         // completes on one hostname (redirect_uri is this origin's callback), and a domain-wide
         // flow cookie would only let two surfaces' concurrent logins clobber each other.
-        const domain = resolveCookieDomain(cfg.cookieDomain, url.hostname);
+        const { domain, cleanupDomain } = cookieDomainDecision(cfg.cookieDomain, url.hostname, cfg.platformBaseDomains);
+        const cleanup = cleanupDomain ? [
+            cookie(SESSION_COOKIE, '', origin, 0, cleanupDomain),
+            cookie(LOGOUT_HINT_COOKIE, '', origin, 0, cleanupDomain, LOGOUT_PATH, 'Strict'),
+        ] : [];
         if (url.pathname === '/api/auth/login') {
             const screen = url.searchParams.get('screen_hint');
             // `prompt` is forwarded (allowlisted to the two IdP-recognised values) for the same
@@ -113,7 +120,7 @@ export function oidcRpAuthProvider(cfg) {
                 screenHint: screen === 'signup' || screen === 'login' ? screen : undefined,
                 prompt: prompt === 'login' || prompt === 'select_account' ? prompt : undefined,
             });
-            return redirectWith(location, [cookie(FLOW_COOKIE, flow, origin, FLOW_MAXAGE)]);
+            return redirectWith(location, [cookie(FLOW_COOKIE, flow, origin, FLOW_MAXAGE), ...cleanup]);
         }
         if (url.pathname === '/api/auth/callback') {
             const flow = readCookie(request.headers.get('cookie'), FLOW_COOKIE);
@@ -126,17 +133,18 @@ export function oidcRpAuthProvider(cfg) {
                     // Same lifetime as the session, so the two expire together and a stale hint is
                     // never the thing left over.
                     ...hintCookies(idToken, origin, SESSION_MAXAGE, domain),
+                    ...cleanup,
                 ]);
             }
             catch (err) {
                 // Loud in the logs, opaque to the browser — same stance as the oidc-rp mount.
                 console.error('oidc.callback.failed', { reason: err instanceof Error ? err.message : String(err) });
-                return redirectWith('/?error=auth', [clearFlow]);
+                return redirectWith('/?error=auth', [clearFlow, ...cleanup]);
             }
         }
         if (url.pathname === LOGOUT_PATH) {
             const local = safePath(url.searchParams.get('returnTo')) ?? '/';
-            const cleared = [...sessionCookies('', origin, 0, domain), ...hintCookies('', origin, 0, domain)];
+            const cleared = [...sessionCookies('', origin, 0, domain), ...hintCookies('', origin, 0, domain), ...cleanup];
             /**
              * `?federated` ALSO ends the issuer's own session (OIDC RP-Initiated Logout 1.0).
              * Without it the issuer's cookie silently signs the same person straight back in on

package/dist/oidc-rp-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA0CzD,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAW,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM;IACvB,cAAc,EAAE,GAAG,CAAC,QAAQ;IAC5B,kBAAkB,EAAE,GAAG,CAAC,YAAY;IACpC,cAAc,EAAE,GAAG,CAAC,aAAa;CAClC,CAAC,CAAC;AAEH,2GAA2G;AAC3G,SAAS,MAAM,CACb,IAAY,EACZ,KAAa,EACb,MAAc,EACd,MAAc,EACd,MAAsB,EACtB,IAAI,GAAG,GAAG,EACV,QAAQ,GAAqB,KAAK;IAElC,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,IAAI,EAAE;QACd,WAAW,MAAM,EAAE;QACnB,UAAU;QACV,YAAY,QAAQ,EAAE;KACvB,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;QAChF,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAiB;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,2FAA2F;AAC3F,yFAAyF;AACzF,sFAAsF;AACtF,kFAAkF;AAClF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,SAAS,cAAc,CAAC,GAAiB;IACvC,0FAA0F;IAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC;IAC/D,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,gBAAgB,CAAC;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvB,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,qFAAqF;QACrF,wFAAwF;QACxF,iFAAiF;QACjF,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnD,oFAAoF;YACpF,qFAAqF;YACrF,mFAAmF;YACnF,6EAA6E;YAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1D,UAAU,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC1E,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC/E,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnF,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE;oBAC7C,SAAS;oBACT,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;oBAC1D,+EAA+E;oBAC/E,6BAA6B;oBAC7B,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG;;;;;;;;;;;;eAYG;YACH,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBAC3E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAChE,IAAI,IAAI;oBAAE,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAY;QACnD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,EAAE;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;gBAC1B,+EAA+E;gBAC/E,6EAA6E;gBAC7E,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC;QACJ,CAAC;QACD,qFAAqF;QACrF,sFAAsF;QACtF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AA4C1D,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAW,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM;IACvB,cAAc,EAAE,GAAG,CAAC,QAAQ;IAC5B,kBAAkB,EAAE,GAAG,CAAC,YAAY;IACpC,kFAAkF;IAClF,oFAAoF;IACpF,iFAAiF;IACjF,cAAc,EAAE,oBAAoB,CAClC,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EACjD,GAAG,CAAC,mBAAmB,CACxB,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,aAAa,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa;CACrF,CAAC,CAAC;AAEH,2GAA2G;AAC3G,SAAS,MAAM,CACb,IAAY,EACZ,KAAa,EACb,MAAc,EACd,MAAc,EACd,MAAsB,EACtB,IAAI,GAAG,GAAG,EACV,QAAQ,GAAqB,KAAK;IAElC,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ,IAAI,EAAE;QACd,WAAW,MAAM,EAAE;QACnB,UAAU;QACV,YAAY,QAAQ,EAAE;KACvB,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,MAAM,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;QAChF,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAiB;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,2FAA2F;AAC3F,yFAAyF;AACzF,sFAAsF;AACtF,kFAAkF;AAClF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,SAAS,cAAc,CAAC,GAAiB;IACvC,0FAA0F;IAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC;IAC/D,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,gBAAgB,CAAC;YACnB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvB,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,qFAAqF;QACrF,wFAAwF;QACxF,iFAAiF;QACjF,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChH,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC;YAC9B,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,CAAC;YACpD,MAAM,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC;SAChF,CAAC,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnD,oFAAoF;YACpF,qFAAqF;YACrF,mFAAmF;YACnF,6EAA6E;YAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1D,UAAU,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBAC1E,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC/E,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBACnF,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE;oBAC7C,SAAS;oBACT,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;oBAC1D,+EAA+E;oBAC/E,6BAA6B;oBAC7B,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;oBACvD,GAAG,OAAO;iBACX,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC;YAChE,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;YAC9G;;;;;;;;;;;;eAYG;YACH,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;gBAC3E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAChE,IAAI,IAAI;oBAAE,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAgB,EAAE,GAAY;QACnD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,EAAE;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;gBAC1B,+EAA+E;gBAC/E,6EAA6E;gBAC7E,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC;QACJ,CAAC;QACD,qFAAqF;QACrF,sFAAsF;QACtF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/owner-seat.d.ts

@@ -167,6 +167,10 @@ export declare function resolvePrincipal(sql: RegistrySql, scopeId: string, sub:
  * seat claimed and the owner of record intact, and getting back in is a claim link's job.
  */
 export declare function unbindSubject(sql: RegistrySql, scopeId: string, sub: string): boolean;
+/** Remove every subject bound to one principal in this scope (#1939). The directory owns
+ * the whole lookup, so no caller's bounded scope scan can leave a second login live.
+ * Return the removed subjects so the caller can report each absent place to its issuer. */
+export declare function unbindPrincipal(sql: RegistrySql, scopeId: string, principal: string): string[];
 /**
  * The subjects bound in a scope, at most `limit`, in a stable order — the whole set a places
  * repair reports (#1670). The caller asks for one more than it will send, so it can tell a

package/dist/owner-seat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAmB3C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAKvD;AAED,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4FAA4F;IAC5F,WAAW,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,6FAA6F;IAC7F,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAgC,GACzC,IAAI,CASN;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,aAAa,CAoCf;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAK1G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,oBAAoB,CAMtB;AAgBD,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAuBD,wCAAwC;AACxC,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAenF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3G;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,MAA2B,GACjC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAU9B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxH"}
+{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAoB3C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAKvD;AAED,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4FAA4F;IAC5F,WAAW,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,6FAA6F;IAC7F,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAgC,GACzC,IAAI,CASN;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,aAAa,CAoCf;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAK1G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,oBAAoB,CAMtB;AAgBD,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AAuBD,wCAAwC;AACxC,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAenF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3G;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;2FAE2F;AAC3F,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ9F;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,MAA2B,GACjC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAU9B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxH"}

package/dist/owner-seat.js

@@ -43,6 +43,7 @@ export const OWNER_CLAIM_TTL_MS = 15 * 60_000;
  */
 export const OWNER_SEAT_DDL = [
     `CREATE TABLE IF NOT EXISTS identity (scope_id TEXT NOT NULL, sub TEXT NOT NULL, principal TEXT NOT NULL, PRIMARY KEY (scope_id, sub))`,
+    `CREATE INDEX IF NOT EXISTS identity_by_principal ON identity (scope_id, principal, sub)`,
     // The owner seat waiting to be claimed: set at provision, consumed by the claim. `claim_until`
     // bounds the plain first-sign-in path (ms epoch); NULL — a row from before the column existed —
     // reads as CLOSED, since a seat that sat unclaimed across an upgrade is exactly the case.
@@ -279,6 +280,14 @@ export function unbindSubject(sql, scopeId, sub) {
     sql.exec('DELETE FROM identity WHERE scope_id = ? AND sub = ?', scopeId, sub);
     return had;
 }
+/** Remove every subject bound to one principal in this scope (#1939). The directory owns
+ * the whole lookup, so no caller's bounded scope scan can leave a second login live.
+ * Return the removed subjects so the caller can report each absent place to its issuer. */
+export function unbindPrincipal(sql, scopeId, principal) {
+    const subs = [...sql.exec('SELECT sub FROM identity WHERE scope_id = ? AND principal = ? ORDER BY sub', scopeId, principal)].map((r) => r.sub);
+    sql.exec('DELETE FROM identity WHERE scope_id = ? AND principal = ?', scopeId, principal);
+    return subs;
+}
 /**
  * The subjects bound in a scope, at most `limit`, in a stable order — the whole set a places
  * repair reports (#1670). The caller asks for one more than it will send, so it can tell a

package/dist/owner-seat.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,uIAAuI;IACvI,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,oHAAoH;IACpH,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,0FAA0F;IAC1F,iFAAiF;IACjF,2HAA2H;IAC3H,4FAA4F;IAC5F,sFAAsF;IACtF,wDAAwD;IACxD,8FAA8F;IAC9F,uCAAuC;IACvC,mJAAmJ;CACpJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAcD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,QAAQ,GAAW,uBAAuB;IAE1C,IAAI,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO;IACjD,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChG,GAAG,CAAC,IAAI,CACN,+EAA+E,EAC/E,OAAO,EACP,SAAS,EACT,GAAG,GAAG,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEnF,CAAC;IACd,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChF,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,IAAI,WAAW,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1E,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,yFAAyF;QACzF,IAAI,IAAI,EAAE,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,+EAA+E,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7G,GAAG,CAAC,IAAI,CACN,gHAAgH,EAChH,OAAO,EACP,IAAI,EACJ,EAAE,CACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAU;IAC/F,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACrG,GAAG,CAAC,IAAI,CAAC,6DAA6D,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IAC1G,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,GAAgB,EAChB,OAAe;IAEf,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gFAAgF,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEpG,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IACnE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7H,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IAC1D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,OAAe;IACnD,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEzF,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAE5F,CAAC;IACd,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IACjF,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjH,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;IAClE,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,KAAK;QACL,WAAW,EAAE;YACX,IAAI,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG;YAC/D,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;SACtE;QACD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAE/F,CAAC;IACd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5G,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAa;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAC1G,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,KAAK,GAAW,kBAAkB;IAElC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC;IAC9B,GAAG,CAAC,IAAI,CACN,wFAAwF,EACxF,OAAO,EACP,SAAS,EACT,SAAS,CACV,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB,EAAE,GAAW;IACvG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,uIAAuI;IACvI,yFAAyF;IACzF,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,oHAAoH;IACpH,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,0FAA0F;IAC1F,iFAAiF;IACjF,2HAA2H;IAC3H,4FAA4F;IAC5F,sFAAsF;IACtF,wDAAwD;IACxD,8FAA8F;IAC9F,uCAAuC;IACvC,mJAAmJ;CACpJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAcD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,QAAQ,GAAW,uBAAuB;IAE1C,IAAI,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO;IACjD,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChG,GAAG,CAAC,IAAI,CACN,+EAA+E,EAC/E,OAAO,EACP,SAAS,EACT,GAAG,GAAG,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEnF,CAAC;IACd,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChF,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,IAAI,WAAW,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1E,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,yFAAyF;QACzF,IAAI,IAAI,EAAE,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,+EAA+E,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7G,GAAG,CAAC,IAAI,CACN,gHAAgH,EAChH,OAAO,EACP,IAAI,EACJ,EAAE,CACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAU;IAC/F,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACrG,GAAG,CAAC,IAAI,CAAC,6DAA6D,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IAC1G,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,GAAgB,EAChB,OAAe;IAEf,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gFAAgF,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEpG,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IACnE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7H,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IAC1D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,OAAe;IACnD,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEzF,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,mEAAmE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAE5F,CAAC;IACd,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IACjF,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjH,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;IAClE,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,KAAK;QACL,WAAW,EAAE;YACX,IAAI,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG;YAC/D,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;SACtE;QACD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAE/F,CAAC;IACd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5G,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,eAAe,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAClF,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACvB,4EAA4E,EAC5E,OAAO,EACP,SAAS,CACV,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CAAC,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAa;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAC1G,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,KAAK,GAAW,kBAAkB;IAElC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,GAAG,KAAK,CAAC;IAC9B,GAAG,CAAC,IAAI,CACN,wFAAwF,EACxF,OAAO,EACP,SAAS,EACT,SAAS,CACV,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB,EAAE,GAAW;IACvG,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/vertical-auth",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -44,10 +44,10 @@
     "better-auth": "^1.7.1",
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",
-    "@substrat-run/contracts": "^0.131.0",
+    "@substrat-run/contracts": "^0.132.1",
     "@substrat-run/oidc-rp": "^0.9.1",
-    "@substrat-run/kernel": "^0.131.0",
-    "@substrat-run/psl": "^0.2.5"
+    "@substrat-run/psl": "^0.2.5",
+    "@substrat-run/kernel": "^0.132.1"
   },
   "peerDependencies": {
     "hono": "^4.13.9"