@substrat-run/vertical-auth 0.21.0 → 0.22.0

package/dist/become-link.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Redeeming a `become` link (#1686) — the one order an owner claim link and a member invite share,
+ * so the rule that keeps a stale secret's use unspent is written once:
+ *   1. the directory says the secret's hash is a live link of its kind, BEFORE the scope is asked —
+ *      a withdrawn, consumed or unrelated secret is refused here without spending its use;
+ *   2. the scope exchanges it as a `become` capability — expiry, revocation and the single use
+ *      judged atomically in its own storage, the exchange on the spine;
+ *   3. the directory binds, only while the link still names that capability and principal.
+ * Null for every refusal, so a probe learns nothing about which step said no.
+ */
+import type { CapabilityExchange, CapabilityId, PrincipalId } from '@substrat-run/contracts';
+export declare function redeemBecomeLink(steps: {
+    matches: (tokenHash: string) => Promise<boolean>;
+    exchange: (secret: string) => Promise<CapabilityExchange | null>;
+    bind: (capabilityId: CapabilityId, principal: PrincipalId) => Promise<string | null>;
+}, secret: string): Promise<string | null>;
+//# sourceMappingURL=become-link.d.ts.map

package/dist/become-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"become-link.d.ts","sourceRoot":"","sources":["../src/become-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG7F,wBAAsB,gBAAgB,CACpC,KAAK,EAAE;IACL,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjE,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtF,EACD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB"}

package/dist/become-link.js

@@ -0,0 +1,12 @@
+import { capabilityTokenHash, plausibleCapabilitySecret } from '@substrat-run/kernel';
+export async function redeemBecomeLink(steps, secret) {
+    if (!plausibleCapabilitySecret(secret))
+        return null;
+    if (!(await steps.matches(await capabilityTokenHash(secret))))
+        return null;
+    const exchanged = await steps.exchange(secret);
+    if (exchanged?.kind !== 'principal')
+        return null;
+    return steps.bind(exchanged.capabilityId, exchanged.principal);
+}
+//# sourceMappingURL=become-link.js.map

package/dist/become-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"become-link.js","sourceRoot":"","sources":["../src/become-link.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAIC,EACD,MAAc;IAEd,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,SAAS,EAAE,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;AACjE,CAAC"}

package/dist/identity-do.d.ts

@@ -118,17 +118,12 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
      * capability is the recorded live link and names the pending owner. Null otherwise.
      */
     claimOwnerByCapability(scopeId: string, sub: string, capabilityId: string, principal: string): Promise<string | null>;
-    /**
-     * LEGACY — claim the seat with a link minted before #1686, by its token's hash. Redeem-only;
-     * remove with `claimOwner` in owner-seat.ts (see the date there).
-     */
-    claimOwner(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
     /**
      * Record a member invite: a pre-minted `principal` + `roleKey` the caller has already
      * granted at scope level, claimable by whoever presents the token whose hash is `tokenHash`.
      * The plaintext token never reaches the DO — only its hash, so a DB read can't mint access.
      */
-    createInvite(scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string): Promise<void>;
+    createInvite(scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string, capabilityId?: string | null): Promise<void>;
     /** The scope's outstanding (unclaimed) invites — for the admin's pending-invites list. No token. */
     listInvites(scopeId: string): Promise<InviteRow[]>;
     /**
@@ -139,7 +134,7 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
     /** Is there an unclaimed invite for this token hash? (the sign-up gate consults this post-setup). */
     inviteExists(scopeId: string, tokenHash: string): Promise<boolean>;
     /** Withdraw an unclaimed invite by its (pre-minted) principal — the id the admin sees. */
-    revokeInvite(scopeId: string, principal: string): Promise<void>;
+    revokeInvite(scopeId: string, principal: string): Promise<string | null>;
     /**
      * Claim an invite: bind this verified subject to the invite's pre-minted principal and
      * consume the invite. Returns the principal, or null if no unclaimed invite matches the
@@ -147,6 +142,12 @@ export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
      * bound principal resolves its permissions immediately.
      */
     claimInvite(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
+    /** The `become` capability an open invite's link is (#1686), or null — what a withdrawal revokes first. */
+    inviteLink(scopeId: string, principal: string): Promise<string | null>;
+    /** Is this hash an open capability-era invite (#1686)? Asked before the scope spends its use. */
+    inviteMatches(scopeId: string, tokenHash: string): Promise<boolean>;
+    /** Accept an invite with an exchanged `become` capability (#1686) — `claimInviteByCapability`. */
+    claimInviteByCapability(scopeId: string, sub: string, capabilityId: string, principal: string): Promise<string | null>;
     /**
      * Unbind a subject from this scope — the removal half of the directory (#1670). True when a
      * binding was there. `unbindMember` in `places.ts` pairs it with telling the identity pool.
@@ -207,13 +208,15 @@ export type IdentityStub = {
     } | null>;
     ownerClaimMatches(scopeId: string, tokenHash: string): Promise<boolean>;
     claimOwnerByCapability(scopeId: string, sub: string, capabilityId: string, principal: string): Promise<string | null>;
-    claimOwner(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
-    createInvite(scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string): Promise<void>;
+    createInvite(scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string, capabilityId?: string | null): Promise<void>;
     listInvites(scopeId: string): Promise<InviteRow[]>;
     getInvite(scopeId: string, principal: string): Promise<InviteRow | null>;
     inviteExists(scopeId: string, tokenHash: string): Promise<boolean>;
-    revokeInvite(scopeId: string, principal: string): Promise<void>;
+    revokeInvite(scopeId: string, principal: string): Promise<string | null>;
     claimInvite(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
+    inviteMatches(scopeId: string, tokenHash: string): Promise<boolean>;
+    inviteLink(scopeId: string, principal: string): Promise<string | null>;
+    claimInviteByCapability(scopeId: string, sub: string, capabilityId: string, principal: string): Promise<string | null>;
     unbind(scopeId: string, sub: string): Promise<boolean>;
     unbindPrincipal(scopeId: string, principal: string): Promise<string[]>;
     subjectsOf(scopeId: string, limit: number): Promise<string[]>;

package/dist/identity-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAG/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAaL,KAAK,iBAAiB,EAOtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EASL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA4EtE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAmBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3G;IAED,kGAAkG;IAC5F,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAEzH;IAED;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,iHAAiH;IAC3G,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEnD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAE/H;IAED,iGAAiG;IAC3F,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5E;IAED;;;OAGG;IACG,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE1H;IAED;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExF;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9H;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEvD;IAED;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE7E;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEzF;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED;+FAC2F;IACrF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;IAED,+FAA+F;IACzF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElE;IAED;;;;OAIG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAElE;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCxD;CACF;AAED,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3H,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC/D,CAAC;AAKF,KAAK,iBAAiB,GAAG,UAAU,SAAS,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AACxE,KAAK,4BAA4B,GAAG,OAAO,CAAC,MAAM,UAAU,EAAE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,CAAC;AACxG,eAAO,MAAM,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,KAAY,CAAC;AAE7H;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACxE,YAAY,CASd"}
+{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAG/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAYL,KAAK,iBAAiB,EAOtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAaL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA2EtE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAqBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAE3G;IAED,kGAAkG;IAC5F,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;IAED,iFAAiF;IAC3E,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAEzH;IAED;;;;OAIG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,iHAAiH;IAC3G,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAEnD;IAED;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE9D;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAE/H;IAED,iGAAiG;IAC3F,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5E;IAED;;;OAGG;IACG,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE1H;IAED;;;;OAIG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,GAAG,IAAW,GAC/H,OAAO,CAAC,IAAI,CAAC,CAEf;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEvD;IAED;;;OAGG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE7E;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE7E;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEzF;IAED,2GAA2G;IACrG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3E;IAED,iGAAiG;IAC3F,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAExE;IAED,kGAAkG;IAC5F,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3H;IAED;;;OAGG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3D;IAED;+FAC2F;IACrF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE3E;IAED,+FAA+F;IACzF,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElE;IAED;;;;OAIG;IACG,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAElE;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCxD;CACF;AAED,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3H,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtH,YAAY,CACV,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GACzH,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrF,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAC/D,CAAC;AAKF,KAAK,iBAAiB,GAAG,UAAU,SAAS,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;AACxE,KAAK,4BAA4B,GAAG,OAAO,CAAC,MAAM,UAAU,EAAE,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,CAAC;AACxG,eAAO,MAAM,gBAAgB,EAAE,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,KAAY,CAAC;AAE7H;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACxE,YAAY,CASd"}

package/dist/identity-do.js

@@ -6,8 +6,8 @@ import * as schema from './auth-schema.js';
 import { cookieDomainDecision, expireBetterAuthDomainCookies, forwardIdentityCookieConfig } from './cookie-domain.js';
 import { parsePlatformBaseDomains } from '@substrat-run/contracts';
 import { SITE_REGISTRY_DDL, recordSite as recordSiteRow, listSites as listSiteRows, resolveSiteScope as resolveSiteScopeRow, forgetSite as forgetSiteRow, } from './site-registry.js';
-import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, ownerClaimTarget as ownerClaimTargetRow, recordOwnerClaim as recordOwnerClaimRow, ownerClaimMatches as ownerClaimMatchesRow, claimOwnerByCapability as claimOwnerByCapabilityRow, claimOwner as claimOwnerRow, unbindSubject as unbindSubjectRow, unbindPrincipal as unbindPrincipalRow, subjectsOf as subjectsOfRows, transferOwner as transferOwnerRow, completeOwnerTransfer as completeOwnerTransferRow, abandonOwnerTransfer as abandonOwnerTransferRow, } from './owner-seat.js';
-import { INVITE_DDL, createInvite as createInviteRow, listInvites as listInviteRows, getInvite as getInviteRow, inviteExists as inviteExistsRow, revokeInvite as revokeInviteRow, claimInvite as claimInviteRow, listMemberBindings as listMemberBindingRows, } from './member-directory.js';
+import { OWNER_SEAT_DDL, migrateOwnerSeat, recordOwnerSeat, ownerOfRecord as ownerOfRecordRow, needsSetup as needsSetupRow, ownerSeat as ownerSeatRow, resolvePrincipal as resolvePrincipalRow, ownerClaimTarget as ownerClaimTargetRow, recordOwnerClaim as recordOwnerClaimRow, ownerClaimMatches as ownerClaimMatchesRow, claimOwnerByCapability as claimOwnerByCapabilityRow, unbindSubject as unbindSubjectRow, unbindPrincipal as unbindPrincipalRow, subjectsOf as subjectsOfRows, transferOwner as transferOwnerRow, completeOwnerTransfer as completeOwnerTransferRow, abandonOwnerTransfer as abandonOwnerTransferRow, } from './owner-seat.js';
+import { INVITE_DDL, createInvite as createInviteRow, listInvites as listInviteRows, getInvite as getInviteRow, inviteExists as inviteExistsRow, revokeInvite as revokeInviteRow, claimInvite as claimInviteRow, claimInviteByCapability as claimInviteByCapabilityRow, inviteMatches as inviteMatchesRow, inviteLink as inviteLinkRow, migrateInvites, listMemberBindings as listMemberBindingRows, } from './member-directory.js';
 /**
  * The per-tenant IDENTITY Durable Object — one per tenant, running its OWN Better Auth
  * over its OWN SQLite (Drizzle's Durable-Object driver, not a shared D1), and holding the
@@ -21,7 +21,7 @@ import { INVITE_DDL, createInvite as createInviteRow, listInvites as listInviteR
  * Two roles, either or both used per deployment:
  *   - `doAuthProvider` (below) exposes Better Auth here as an `AuthProvider` (the
  *     `better-auth-do` config). With an OIDC provider instead, Better Auth stays dormant.
- *   - `setPendingOwner` / `resolvePrincipal` / `claimOwner` are the identity directory —
+ *   - `setPendingOwner` / `resolvePrincipal` / `claimOwnerByCapability` are the identity directory —
  *     used under EVERY provider, since the subject → principal mapping is provider-independent.
  *     The owner seat's rules (the bounded first sign-in, the claim link) are in owner-seat.ts.
  */
@@ -56,8 +56,7 @@ const SCHEMA_STATEMENTS = [
     // `pending_owner` (claimed and consumed), `owner_of_record` (#332, never consumed: the
     // vertical's own durable memory of the owner, in this per-tenant DO rather than the scope's
     // data DO, so it survives a scope-DO wipe and a reconcile can re-grant from it) and
-    // `owner_claim_capability` (which `become` capability is the current claim link, #1686; the
-    // legacy `owner_claim` hash rows of #925 are redeem-only until they expire). The tables and
+    // `owner_claim_capability` (which `become` capability is the current claim link, #1686). The tables and
     // the rules over them live in `owner-seat.ts` so they are unit-tested without a DO; the
     // methods below delegate there.
     ...OWNER_SEAT_DDL,
@@ -86,8 +85,10 @@ export class IdentityDO extends DurableObject {
         ctx.blockConcurrencyWhile(async () => {
             for (const stmt of SCHEMA_STATEMENTS)
                 ctx.storage.sql.exec(stmt);
-            // Columns the DDL cannot add to a table that already exists (#925's `claim_until`).
+            // Columns the DDL cannot add to a table that already exists (#925's `claim_until`,
+            // #1686's `invite.capability_id`).
             migrateOwnerSeat(ctx.storage.sql);
+            migrateInvites(ctx.storage.sql);
             // Load-or-generate this tenant's OWN signing secret. Each IdentityDO mints its own on
             // first init and persists it here, so the secret is per-tenant, never leaves the DO,
             // and needs no `wrangler secret put` (which would be one value shared across every
@@ -257,20 +258,13 @@ export class IdentityDO extends DurableObject {
     async claimOwnerByCapability(scopeId, sub, capabilityId, principal) {
         return claimOwnerByCapabilityRow(this.registrySql, scopeId, sub, capabilityId, principal, Date.now());
     }
-    /**
-     * LEGACY — claim the seat with a link minted before #1686, by its token's hash. Redeem-only;
-     * remove with `claimOwner` in owner-seat.ts (see the date there).
-     */
-    async claimOwner(scopeId, sub, tokenHash) {
-        return claimOwnerRow(this.registrySql, scopeId, sub, tokenHash, Date.now());
-    }
     /**
      * Record a member invite: a pre-minted `principal` + `roleKey` the caller has already
      * granted at scope level, claimable by whoever presents the token whose hash is `tokenHash`.
      * The plaintext token never reaches the DO — only its hash, so a DB read can't mint access.
      */
-    async createInvite(scopeId, principal, roleKey, email, tokenHash) {
-        createInviteRow(this.registrySql, scopeId, principal, roleKey, email, tokenHash);
+    async createInvite(scopeId, principal, roleKey, email, tokenHash, capabilityId = null) {
+        createInviteRow(this.registrySql, scopeId, principal, roleKey, email, tokenHash, capabilityId);
     }
     /** The scope's outstanding (unclaimed) invites — for the admin's pending-invites list. No token. */
     async listInvites(scopeId) {
@@ -289,7 +283,7 @@ export class IdentityDO extends DurableObject {
     }
     /** Withdraw an unclaimed invite by its (pre-minted) principal — the id the admin sees. */
     async revokeInvite(scopeId, principal) {
-        revokeInviteRow(this.registrySql, scopeId, principal);
+        return revokeInviteRow(this.registrySql, scopeId, principal);
     }
     /**
      * Claim an invite: bind this verified subject to the invite's pre-minted principal and
@@ -300,6 +294,18 @@ export class IdentityDO extends DurableObject {
     async claimInvite(scopeId, sub, tokenHash) {
         return claimInviteRow(this.registrySql, scopeId, sub, tokenHash);
     }
+    /** The `become` capability an open invite's link is (#1686), or null — what a withdrawal revokes first. */
+    async inviteLink(scopeId, principal) {
+        return inviteLinkRow(this.registrySql, scopeId, principal);
+    }
+    /** Is this hash an open capability-era invite (#1686)? Asked before the scope spends its use. */
+    async inviteMatches(scopeId, tokenHash) {
+        return inviteMatchesRow(this.registrySql, scopeId, tokenHash);
+    }
+    /** Accept an invite with an exchanged `become` capability (#1686) — `claimInviteByCapability`. */
+    async claimInviteByCapability(scopeId, sub, capabilityId, principal) {
+        return claimInviteByCapabilityRow(this.registrySql, scopeId, sub, capabilityId, principal);
+    }
     /**
      * Unbind a subject from this scope — the removal half of the directory (#1670). True when a
      * binding was there. `unbindMember` in `places.ts` pairs it with telling the identity pool.

package/dist/identity-do.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,iBAAiB,IAAI,oBAAoB,EACzC,sBAAsB,IAAI,yBAAyB,EACnD,UAAU,IAAI,aAAa,EAE3B,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,EACrC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,YAAY,IAAI,eAAe,EAC/B,WAAW,IAAI,cAAc,EAC7B,SAAS,IAAI,YAAY,EACzB,YAAY,IAAI,eAAe,EAC/B,YAAY,IAAI,eAAe,EAC/B,WAAW,IAAI,cAAc,EAC7B,kBAAkB,IAAI,qBAAqB,GAG5C,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,4FAA4F;IAC5F,4FAA4F;IAC5F,wFAAwF;IACxF,gCAAgC;IAChC,GAAG,cAAc;IACjB,wFAAwF;IACxF,oDAAoD;IACpD,GAAG,UAAU;IACb,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,oFAAoF;YACpF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAuB;QAChF,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,SAAiB;QACxD,OAAO,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB,EAAE,SAAiB;QAChG,OAAO,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC9D,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnF,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,OAAO,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B,EAAE,sBAAsB,GAAG,KAAK;QACvF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YAC/F,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,EACZ,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAClF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,8EAA8E;YAC9E,8EAA8E;YAC9E,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAC1C,+DAA+D,CAChE,CAAC,CAAC,CAAC,CAAkC,CAAC;YACvC,IAAI,MAAM,EAAE,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,iFAAiF,EAAE,aAAa,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAY,EAAE,CACnD,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AA0CD,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,IAAI,mBAAmB,EACvC,iBAAiB,IAAI,oBAAoB,EACzC,sBAAsB,IAAI,yBAAyB,EAEnD,aAAa,IAAI,gBAAgB,EACjC,eAAe,IAAI,kBAAkB,EACrC,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,gBAAgB,EACjC,qBAAqB,IAAI,wBAAwB,EACjD,oBAAoB,IAAI,uBAAuB,GAIhD,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,UAAU,EACV,YAAY,IAAI,eAAe,EAC/B,WAAW,IAAI,cAAc,EAC7B,SAAS,IAAI,YAAY,EACzB,YAAY,IAAI,eAAe,EAC/B,YAAY,IAAI,eAAe,EAC/B,WAAW,IAAI,cAAc,EAC7B,uBAAuB,IAAI,0BAA0B,EACrD,aAAa,IAAI,gBAAgB,EACjC,UAAU,IAAI,aAAa,EAC3B,cAAc,EACd,kBAAkB,IAAI,qBAAqB,GAG5C,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,wFAAwF;IACxF,4FAA4F;IAC5F,mFAAmF;IACnF,uFAAuF;IACvF,4FAA4F;IAC5F,oFAAoF;IACpF,wGAAwG;IACxG,wFAAwF;IACxF,gCAAgC;IAChC,GAAG,cAAc;IACjB,wFAAwF;IACxF,oDAAoD;IACpD,GAAG,UAAU;IACb,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,mFAAmF;YACnF,mCAAmC;YACnC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC5D,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC,CAAC;YAC1D,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACjF,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,qBAAqB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,oBAAoB,CAAC,OAAe,EAAE,IAAY,EAAE,EAAU,EAAE,WAAoB;QACxF,OAAO,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAuB;QAChF,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,SAAiB;QACxD,OAAO,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,sBAAsB,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB,EAAE,SAAiB;QAChG,OAAO,yBAAyB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB,EAAE,YAAY,GAAkB,IAAI;QAEhI,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACjG,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,SAAiB;QAChD,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,2GAA2G;IAC3G,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,SAAiB;QACjD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,SAAiB;QACpD,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,uBAAuB,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB,EAAE,SAAiB;QACjG,OAAO,0BAA0B,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC7F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAW;QACvC,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAAa;QAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,OAAO,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B,EAAE,sBAAsB,GAAG,KAAK;QACvF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YAC/F,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAClE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,EACZ,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAClF,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,8EAA8E;YAC9E,8EAA8E;YAC9E,uDAAuD;YACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAC1C,+DAA+D,CAChE,CAAC,CAAC,CAAC,CAAkC,CAAC;YACvC,IAAI,MAAM,EAAE,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBACjD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,iFAAiF,EAAE,aAAa,CACjG,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,QAAkB,EAAY,EAAE,CACnD,6BAA6B,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC;oBACE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACpB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI;oBAC/B,oEAAoE;oBACpE,6EAA6E;oBAC7E,sCAAsC;oBACtC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;iBAC1C;gBACH,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;CACF;AA8CD,MAAM,CAAC,MAAM,gBAAgB,GAA2F,IAAI,CAAC;AAE7H;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/invite-routes.d.ts

@@ -17,6 +17,14 @@
  * and the directory then resolves them as that member. Revoking takes the principal's scope
  * roles back and then removes the invite row.
  *
+ * Since #1686 the token is the secret of a `become` capability in the scope's own Durable
+ * Object, minted by the inviter under a bound (they must hold everything the invited
+ * principal holds): single use, revocable, and on the spine — its mint as
+ * `capability.become-minted` with the inviter as actor, its accept as `capability.exercised`.
+ * It has no expiry, as an invite never had, and the inviter is not re-checked at accept:
+ * the role was bounded when it was granted, and withdrawing the invite is the lever. An
+ * invite minted before #1686 is redeemed the old way, by hash (`claimInvite`).
+ *
  * Who may invite, and at which role, are two questions (#1931). The vertical's admin gate
  * answers the first — may this caller manage members at all. The second is the kernel's
  * assignment bound (`ctx.canAssign`): a caller may confer a role only if they already hold
@@ -33,11 +41,13 @@
  */
 import type { Context, Hono } from 'hono';
 import { HTTPException } from 'hono/http-exception';
-import { z, type Coverage, type MemberInviteLink, type PrincipalId, type ScopeId, type TenantId } from '@substrat-run/contracts';
-import type { IdentityStub } from './identity-do.js';
+import { z, type BoundedBecomeMint, type BoundedBecomeRevoke, type BecomeLinkState, type CapabilityExchange, type CapabilityId, type Coverage, type MemberInviteLink, type PrincipalBecomeCapabilityInput, type PrincipalId, type ScopeId, type TenantId } from '@substrat-run/contracts';
+import type { IdentityStub, InviteRow } from './identity-do.js';
 import type { AuthProvider } from './provider.js';
 /** The slice of the identity directory the invite routes touch. */
-export type InviteDirectory = Pick<IdentityStub, 'listInvites' | 'getInvite' | 'createInvite' | 'revokeInvite' | 'claimInvite'>;
+export type InviteDirectory = Pick<IdentityStub, 'listInvites' | 'getInvite' | 'createInvite' | 'revokeInvite' | 'claimInvite' | 'inviteMatches' | 'claimInviteByCapability' | 'inviteLink'>;
+/** The label every member invite's capability carries — what an operator's capability read shows. */
+export declare const MEMBER_INVITE_LABEL = "member invite";
 declare const inviteCaller: z.ZodObject<{
     principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
 }, z.core.$strip>;
@@ -93,6 +103,25 @@ export interface InviteRouteDeps<E extends object, N extends {
      * where it was, rather than leaving a principal nobody can ever bind to holding a role.
      */
     revokeScopeRole: (env: E, scopeId: N['scopeId'], principal: PrincipalId, roleKey: string) => Promise<unknown>;
+    /**
+     * Mint the invite's link (#1686) — the host's `mintBecomeCapabilityBounded`: a `become`
+     * capability for the pre-minted principal, minted by `caller` and bounded by what `caller`
+     * holds, check and write in one scope task. Required: a mount without it refuses create.
+     */
+    mintBecomeCapabilityBounded: (env: E, node: N, caller: PrincipalId, input: PrincipalBecomeCapabilityInput) => Promise<BoundedBecomeMint>;
+    /**
+     * Revoke an invite's link (#1686) — the host's `revokeBecomeCapability`, recording `by`. What a
+     * withdrawal does to the capability once the row is gone, and what a failed create undoes.
+     */
+    revokeBecomeCapability: (env: E, node: N, capabilityId: CapabilityId, by: PrincipalId) => Promise<BoundedBecomeRevoke>;
+    /**
+     * Where each named link stands (#1686) — the host's `becomeLinkStates`, in the order asked. What
+     * `GET /api/invites` shows beside each invite, so a link the scope revoked or that expired is
+     * never listed as open.
+     */
+    becomeLinkStates: (env: E, node: N, capabilityIds: CapabilityId[]) => Promise<BecomeLinkState[]>;
+    /** Exchange an invite's secret in the scope (#1686) — the host's `exchangeCapability`, `become` only. */
+    exchangeCapability: (env: E, node: N, secret: string) => Promise<CapabilityExchange | null>;
     /** The configured `AuthProvider` — who is accepting. Resolved per request, as the vertical does. */
     authProvider: (env: E, req: Request) => Promise<AuthProvider>;
     /**
@@ -109,18 +138,25 @@ export declare const uncovered: (missing: readonly string[], roleKey: string, ac
  * own `POST /api/invites` and the platform's `/internal/members/invite` (vertical-host), so the
  * two doors cannot drift on the token, the hash, or the order.
  *
- * Pre-mint a principal; grant it the role through `grant`, which MUST be the bounded grant
- * (check and write in one scope task) — a refusal returns its coverage and nothing else is
- * written; then record the invite under the token's SHA-256. The grant comes first: a row whose
- * principal holds nothing is a link to no access, while a grant with no row is inert — nobody
- * can bind to it. The two writes are two Durable Objects with no transaction between them, so a
- * failed record takes the grant back (`rollback`) before the failure is rethrown: inert is not
- * harmless when every retry would mint another orphan. If the rollback fails too, the ORIGINAL
- * failure is what the caller hears.
+ * Pre-mint a principal, then three writes, each failing closed:
+ *   1. grant it the role through `grant`, which MUST be the bounded grant (check and write in one
+ *      scope task) — a refusal returns its coverage and nothing else is written;
+ *   2. mint its link (#1686): a `become` capability for that principal, single use and with no
+ *      expiry (an invite has never had one), bounded by what the inviter holds — the scope's own
+ *      record, on the spine as `capability.become-minted`. A refusal takes the grant back;
+ *   3. record the invite under the secret's hash, naming the capability.
+ * The grant comes first: a row whose principal holds nothing is a link to no access, while a
+ * grant with no row is inert — nobody can bind to it, and a capability with no row is refused
+ * before its exchange. The writes are two Durable Objects with no transaction between them, so a
+ * failed record revokes the capability and takes the grant back (`rollback`) before the failure
+ * is rethrown: inert is not harmless when every retry would mint another orphan. If a rollback
+ * step fails too, the ORIGINAL failure is what the caller hears.
  */
 export declare function mintMemberInvite(steps: {
     grant: (assignee: PrincipalId) => Promise<Coverage>;
-    record: (principal: PrincipalId, tokenHash: string) => Promise<void>;
+    mint: (input: PrincipalBecomeCapabilityInput) => Promise<BoundedBecomeMint>;
+    record: (principal: PrincipalId, tokenHash: string, capabilityId: CapabilityId) => Promise<void>;
+    revokeCapability: (capabilityId: CapabilityId) => Promise<unknown>;
     rollback: (principal: PrincipalId) => Promise<unknown>;
 }, input: {
     roleKey: string;
@@ -133,6 +169,38 @@ export declare function mintMemberInvite(steps: {
     ok: false;
     coverage: Coverage;
 }>;
+/** An open invite as a list shows it (#1686): the row, without its capability id, and where its link stands. */
+export type ListedInvite = Omit<InviteRow, 'capabilityId'> & {
+    link: BecomeLinkState | null;
+};
+/**
+ * Join each invite to where its link stands (#1686), in ONE read of the scope — the list every
+ * pending-invite door shows, so a link the scope revoked (its principal's holdings changed) or that
+ * expired is never listed as open. A legacy hash-only invite has no link to read: `link: null`.
+ */
+export declare function withLinkStates(rows: readonly InviteRow[], states: (capabilityIds: CapabilityId[]) => Promise<BecomeLinkState[]>): Promise<ListedInvite[]>;
+/**
+ * Accept an invite (#1150, #1686) — the one copy every accept door runs. A capability secret is
+ * redeemed as every `become` link is (`redeemBecomeLink`): checked against the directory before
+ * the scope spends its use, exchanged, then bound only while the row still names that capability
+ * and principal. A token that is not a capability secret is a LEGACY hash-only invite, redeemed by
+ * hash (`claimInvite`). Null for every refusal, one answer.
+ */
+export declare function acceptMemberInvite(deps: {
+    directory: Pick<InviteDirectory, 'claimInvite' | 'inviteMatches' | 'claimInviteByCapability'>;
+    exchange: (secret: string) => Promise<CapabilityExchange | null>;
+}, scopeId: string, sub: string, token: string): Promise<string | null>;
+/**
+ * Withdraw an invite's link and then its row (#1686), once the caller's bound has taken the
+ * roles. The link goes first, named by the row: a revoke that fails leaves the row in place, so
+ * the withdrawal fails as a whole and its retry finds the link again — the scope's own record
+ * and the directory never part company. Revoking is idempotent, so a retry after a revoke that
+ * landed and a delete that did not is the same call. Then the row goes, which stops an accept.
+ */
+export declare function withdrawMemberInvite(steps: {
+    directory: Pick<InviteDirectory, 'inviteLink' | 'revokeInvite'>;
+    revokeCapability: (capabilityId: CapabilityId) => Promise<BoundedBecomeRevoke>;
+}, scopeId: string, principal: string): Promise<void>;
 /**
  * Mount the four invite routes on a vertical's Hono app:
  *

package/dist/invite-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invite-routes.d.ts","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAA0C,CAAC,EAAE,KAAK,QAAQ,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEzK,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,aAAa,CAAC,CAAC;AAEhI,QAAA,MAAM,YAAY;;iBAAuC,CAAC;AAE1D,uFAAuF;AACvF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,0CAA0C;AAC1C,eAAO,MAAM,UAAU;;;iBAIrB,CAAC;AAEH,gDAAgD;AAChD,eAAO,MAAM,gBAAgB;;iBAAyC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;IAC9E,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE;;;;;OAKG;IACH,uBAAuB,EAAE,CACvB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,KACzD,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,kGAAkG;IAClG,sBAAsB,EAAE,CACtB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KACzE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yFAAyF;IACzF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC;IAChD;;;;;OAKG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oGAAoG;IACpG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACnC;AAED,0FAA0F;AAC1F,eAAO,MAAM,SAAS,YAAa,SAAS,MAAM,EAAE,WAAW,MAAM,OAAO,MAAM,KAAG,aACR,CAAC;AAG9E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE;IACL,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD,EACD,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAiBrF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC/E,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAC1B,IAAI,CA0FN;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,SAAS,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,oBAAoB,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE;IAC7H,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,CAAC,CAAC;CACzE;IACU,KAAK;IAAc,SAAS,QAFpB,CAAC,OAAO;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,CAAC;IAEhB,IAAI;EAC5D"}
+{"version":3,"file":"invite-routes.d.ts","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EASL,CAAC,EACD,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,8BAA8B,EACnC,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,YAAY,EACV,aAAa,GAAG,WAAW,GAAG,cAAc,GAAG,cAAc,GAAG,aAAa,GAAG,eAAe,GAAG,yBAAyB,GAC3H,YAAY,CACf,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,QAAA,MAAM,YAAY;;iBAAuC,CAAC;AAE1D,uFAAuF;AACvF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,0CAA0C;AAC1C,eAAO,MAAM,UAAU;;;iBAIrB,CAAC;AAEH,gDAAgD;AAChD,eAAO,MAAM,gBAAgB;;iBAAyC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;IAC9E,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE;;;;;OAKG;IACH,uBAAuB,EAAE,CACvB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,KACzD,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,kGAAkG;IAClG,sBAAsB,EAAE,CACtB,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KACzE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,yFAAyF;IACzF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC;IAChD;;;;;OAKG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G;;;;OAIG;IACH,2BAA2B,EAAE,CAC3B,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,8BAA8B,KACxE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChC;;;OAGG;IACH,sBAAsB,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvH;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACjG,yGAAyG;IACzG,kBAAkB,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC5F,oGAAoG;IACpG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACnC;AAED,0FAA0F;AAC1F,eAAO,MAAM,SAAS,YAAa,SAAS,MAAM,EAAE,WAAW,MAAM,OAAO,MAAM,KAAG,aACR,CAAC;AAG9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE;IACL,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,EAAE,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjG,gBAAgB,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD,EACD,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAuCrF;AAED,gHAAgH;AAChH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,GAAG;IAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAE9F;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,SAAS,EAAE,EAC1B,MAAM,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC,GACpE,OAAO,CAAC,YAAY,EAAE,CAAC,CAazB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IACJ,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,GAAG,eAAe,GAAG,yBAAyB,CAAC,CAAC;IAC9F,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CAClE,EACD,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE;IACL,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,cAAc,CAAC,CAAC;IAChE,gBAAgB,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAChF,EACD,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EAC/E,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAC1B,IAAI,CA0GN;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,CAAC,SAAS,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,oBAAoB,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE;IAC7H,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,CAAC,CAAC;CACzE;IACU,KAAK;IAAc,SAAS,QAFpB,CAAC,OAAO;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,CAAC;IAEhB,IAAI;EAC5D"}