@substrat-run/vertical-auth 0.21.0 → 0.22.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/become-link.d.ts +17 -0
- package/dist/become-link.d.ts.map +1 -0
- package/dist/become-link.js +12 -0
- package/dist/become-link.js.map +1 -0
- package/dist/identity-do.d.ts +13 -10
- package/dist/identity-do.d.ts.map +1 -1
- package/dist/identity-do.js +22 -16
- package/dist/identity-do.js.map +1 -1
- package/dist/invite-routes.d.ts +80 -12
- package/dist/invite-routes.d.ts.map +1 -1
- package/dist/invite-routes.js +121 -20
- package/dist/invite-routes.js.map +1 -1
- package/dist/member-directory.d.ts +64 -10
- package/dist/member-directory.d.ts.map +1 -1
- package/dist/member-directory.js +77 -18
- package/dist/member-directory.js.map +1 -1
- package/dist/owner-claim-routes.d.ts +4 -6
- package/dist/owner-claim-routes.d.ts.map +1 -1
- package/dist/owner-claim-routes.js +9 -23
- package/dist/owner-claim-routes.js.map +1 -1
- package/dist/owner-seat.d.ts +9 -17
- package/dist/owner-seat.d.ts.map +1 -1
- package/dist/owner-seat.js +12 -38
- package/dist/owner-seat.js.map +1 -1
- package/package.json +6 -6
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-claim-routes.js","sourceRoot":"","sources":["../src/owner-claim-routes.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"owner-claim-routes.js","sourceRoot":"","sources":["../src/owner-claim-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAwD,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAe3C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AA+BrE,gFAAgF;AAChF,MAAM,OAAO,GAAG,sDAAsD,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA0B,EAC1B,IAA+B;IAE/B,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,gCAAgC,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC;YACE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;YAClE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAClH,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC;SAC5F,EACD,KAAK,CACN,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}
|
package/dist/owner-seat.d.ts
CHANGED
|
@@ -47,9 +47,11 @@ export declare const OWNER_CLAIM_TTL_MS: number;
|
|
|
47
47
|
*/
|
|
48
48
|
export declare const OWNER_SEAT_DDL: readonly string[];
|
|
49
49
|
/**
|
|
50
|
-
* Bring
|
|
51
|
-
*
|
|
52
|
-
* one `
|
|
50
|
+
* Bring an owner seat from before today's DDL up to date. `CREATE TABLE IF NOT EXISTS` leaves an
|
|
51
|
+
* existing table alone, so a DO whose storage predates `claim_until` needs the one `ALTER`; and
|
|
52
|
+
* one that still carries #925's hash-only `owner_claim` table drops it — nothing has redeemed a
|
|
53
|
+
* row there since the release after #1686, and every row in it expired `OWNER_CLAIM_TTL_MS` after
|
|
54
|
+
* it was minted. Idempotent — run it after the DDL on every construction.
|
|
53
55
|
*/
|
|
54
56
|
export declare function migrateOwnerSeat(sql: RegistrySql): void;
|
|
55
57
|
/** What the platform (and the vertical's own first-run screen) can see of the seat. */
|
|
@@ -108,7 +110,7 @@ export type OwnerTransferAbandon = z.infer<typeof ownerTransferAbandon>;
|
|
|
108
110
|
* - the seat is still UNCLAIMED (`unclaimed`). `pending_owner` names the principal a claim binds
|
|
109
111
|
* to, so moving the record under it would leave a claim link that seats a stranger as a
|
|
110
112
|
* principal that is no longer the owner. Claim the seat first. A claimed seat stays claimed:
|
|
111
|
-
* this never writes `pending_owner` or `
|
|
113
|
+
* this never writes `pending_owner` or `owner_claim_capability`.
|
|
112
114
|
* - `from` is not the current record (`not-owner`) — a caller working from a stale view, or one
|
|
113
115
|
* naming a `from` other than the one this scope's record was handed over from;
|
|
114
116
|
* - ANOTHER hand-over is still open (`in-flight`): its seat and revoke have not both run, and
|
|
@@ -194,7 +196,7 @@ export interface OwnerClaimLinkRow {
|
|
|
194
196
|
}
|
|
195
197
|
/**
|
|
196
198
|
* Record a freshly minted `become` capability as the scope's ONE claim link (#1686), replacing
|
|
197
|
-
* whatever link was current
|
|
199
|
+
* whatever link was current. Returns the previous
|
|
198
200
|
* capability id, which the caller revokes in the scope DO: "a new mint retires the old link"
|
|
199
201
|
* holds here first, since a redemption must name the recorded capability, and the revoke makes it
|
|
200
202
|
* hold in the scope's directory too.
|
|
@@ -216,18 +218,8 @@ export declare function ownerClaimMatches(sql: RegistrySql, scopeId: string, tok
|
|
|
216
218
|
* Claim the seat with an exchanged `become` capability (#1686): the scope's directory has taken
|
|
217
219
|
* the capability's one use and answered the principal it becomes. Binds the subject when the seat
|
|
218
220
|
* is still pending, the capability is the recorded live link, and it names the pending principal.
|
|
219
|
-
* Consumes the seat and the link. Null otherwise — one answer,
|
|
221
|
+
* Consumes the seat and the link. Null otherwise — one answer for every refusal, so a probe
|
|
222
|
+
* learns nothing.
|
|
220
223
|
*/
|
|
221
224
|
export declare function claimOwnerByCapability(sql: RegistrySql, scopeId: string, sub: string, capabilityId: string, principal: string, now: number): string | null;
|
|
222
|
-
/**
|
|
223
|
-
* LEGACY — claim the seat with a link minted before #1686, by its token's hash. Nothing mints
|
|
224
|
-
* such a link any more, so this serves only rows an older deployment wrote, each of which dies
|
|
225
|
-
* `OWNER_CLAIM_TTL_MS` after it was minted, and any capability-era mint deletes it first.
|
|
226
|
-
* REMOVE in the release after the one that ships #1686 (written 2026-10-04): by then every
|
|
227
|
-
* deployment has run the new code for longer than a legacy link can live.
|
|
228
|
-
*
|
|
229
|
-
* Binds the subject, consumes the seat and the link. Null ⇒ invalid, expired, already used, or
|
|
230
|
-
* nothing to claim — one answer, so a probe learns nothing.
|
|
231
|
-
*/
|
|
232
|
-
export declare function claimOwner(sql: RegistrySql, scopeId: string, sub: string, tokenHash: string, now: number): string | null;
|
|
233
225
|
//# sourceMappingURL=owner-seat.d.ts.map
|
package/dist/owner-seat.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,
|
|
1
|
+
{"version":3,"file":"owner-seat.d.ts","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,QAAc,CAAC;AACnD,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAuB3C,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAMvD;AAED,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,gFAAgF;IAChF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,4FAA4F;IAC5F,WAAW,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5D,6FAA6F;IAC7F,SAAS,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzC;AAID;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAgC,GACzC,IAAI,CASN;AAED,gGAAgG;AAChG,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9E;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,+EAA+E;AAC/E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,aAAa,CAoCf;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAK1G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,OAAO,GACnB,oBAAoB,CAMtB;AAgBD,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAErE;AA4BD,wCAAwC;AACxC,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAenF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS3G;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;2FAE2F;AAC3F,wBAAgB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAQ9F;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAIrF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEjF;AAED,yGAAyG;AACzG,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,iBAAiB,GACtB;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAapC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAG5G;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAKf"}
|
package/dist/owner-seat.js
CHANGED
|
@@ -54,11 +54,6 @@ export const OWNER_SEAT_DDL = [
|
|
|
54
54
|
// is gone the moment the owner claims, so it can't answer "who owns this scope" after that.
|
|
55
55
|
// This can — it survives a scope-DO storage wipe, and the reconcile path re-grants from it.
|
|
56
56
|
`CREATE TABLE IF NOT EXISTS owner_of_record (scope_id TEXT PRIMARY KEY, principal TEXT NOT NULL)`,
|
|
57
|
-
// LEGACY (#925, redeem-only since #1686): a claim link minted before links became `become`
|
|
58
|
-
// capabilities — the hash of its token and when it stops working. Nothing writes a row here
|
|
59
|
-
// any more; a row an older deployment wrote is still redeemed until it expires (at most
|
|
60
|
-
// `OWNER_CLAIM_TTL_MS` after the deploy), and a capability mint deletes it.
|
|
61
|
-
`CREATE TABLE IF NOT EXISTS owner_claim (scope_id TEXT PRIMARY KEY, token_hash TEXT NOT NULL, expires_at INTEGER NOT NULL)`,
|
|
62
57
|
// The scope's CURRENT claim link (#1686): a `become` capability in the scope's own DO, which
|
|
63
58
|
// holds its secret's hash, expiry, single use and revocation. This row says which capability
|
|
64
59
|
// is the live link — so a re-mint, which replaces it, retires the previous one here even if
|
|
@@ -73,15 +68,18 @@ export const OWNER_SEAT_DDL = [
|
|
|
73
68
|
`CREATE TABLE IF NOT EXISTS owner_transfer (scope_id TEXT PRIMARY KEY, prev_principal TEXT NOT NULL, principal TEXT NOT NULL, state TEXT NOT NULL)`,
|
|
74
69
|
];
|
|
75
70
|
/**
|
|
76
|
-
* Bring
|
|
77
|
-
*
|
|
78
|
-
* one `
|
|
71
|
+
* Bring an owner seat from before today's DDL up to date. `CREATE TABLE IF NOT EXISTS` leaves an
|
|
72
|
+
* existing table alone, so a DO whose storage predates `claim_until` needs the one `ALTER`; and
|
|
73
|
+
* one that still carries #925's hash-only `owner_claim` table drops it — nothing has redeemed a
|
|
74
|
+
* row there since the release after #1686, and every row in it expired `OWNER_CLAIM_TTL_MS` after
|
|
75
|
+
* it was minted. Idempotent — run it after the DDL on every construction.
|
|
79
76
|
*/
|
|
80
77
|
export function migrateOwnerSeat(sql) {
|
|
81
78
|
const columns = [...sql.exec('PRAGMA table_info(pending_owner)')].map((r) => r.name);
|
|
82
79
|
if (!columns.includes('claim_until')) {
|
|
83
80
|
sql.exec('ALTER TABLE pending_owner ADD COLUMN claim_until INTEGER');
|
|
84
81
|
}
|
|
82
|
+
sql.exec('DROP TABLE IF EXISTS owner_claim');
|
|
85
83
|
}
|
|
86
84
|
const iso = (ms) => new Date(ms).toISOString();
|
|
87
85
|
/**
|
|
@@ -123,7 +121,7 @@ export function ownerOfRecord(sql, scopeId) {
|
|
|
123
121
|
* - the seat is still UNCLAIMED (`unclaimed`). `pending_owner` names the principal a claim binds
|
|
124
122
|
* to, so moving the record under it would leave a claim link that seats a stranger as a
|
|
125
123
|
* principal that is no longer the owner. Claim the seat first. A claimed seat stays claimed:
|
|
126
|
-
* this never writes `pending_owner` or `
|
|
124
|
+
* this never writes `pending_owner` or `owner_claim_capability`.
|
|
127
125
|
* - `from` is not the current record (`not-owner`) — a caller working from a stale view, or one
|
|
128
126
|
* naming a `from` other than the one this scope's record was handed over from;
|
|
129
127
|
* - ANOTHER hand-over is still open (`in-flight`): its seat and revoke have not both run, and
|
|
@@ -228,19 +226,14 @@ export function needsSetup(sql, scopeId) {
|
|
|
228
226
|
function pendingRow(sql, scopeId) {
|
|
229
227
|
return [...sql.exec('SELECT principal, claim_until FROM pending_owner WHERE scope_id = ?', scopeId)][0];
|
|
230
228
|
}
|
|
231
|
-
function liveClaim(sql, scopeId, now) {
|
|
232
|
-
const row = [...sql.exec('SELECT token_hash, expires_at FROM owner_claim WHERE scope_id = ?', scopeId)][0];
|
|
233
|
-
return row && row.expires_at > now ? row : undefined;
|
|
234
|
-
}
|
|
235
229
|
/** Bind a subject to the pending seat and consume it — the one write every claim path shares. */
|
|
236
230
|
function bindSeat(sql, scopeId, sub, principal) {
|
|
237
231
|
sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, principal);
|
|
238
232
|
sql.exec('DELETE FROM pending_owner WHERE scope_id = ?', scopeId);
|
|
239
|
-
sql.exec('DELETE FROM owner_claim WHERE scope_id = ?', scopeId);
|
|
240
233
|
sql.exec('DELETE FROM owner_claim_capability WHERE scope_id = ?', scopeId);
|
|
241
234
|
return principal;
|
|
242
235
|
}
|
|
243
|
-
/** The
|
|
236
|
+
/** The scope's claim link (#1686), while it lives. */
|
|
244
237
|
function liveCapabilityClaim(sql, scopeId, now) {
|
|
245
238
|
const row = [
|
|
246
239
|
...sql.exec('SELECT capability_id, token_hash, expires_at FROM owner_claim_capability WHERE scope_id = ?', scopeId),
|
|
@@ -255,7 +248,7 @@ export function ownerSeat(sql, scopeId, now) {
|
|
|
255
248
|
const pending = pendingRow(sql, scopeId);
|
|
256
249
|
if (!pending)
|
|
257
250
|
return { state: 'claimed', owner, firstSignIn: null, claimLink: null };
|
|
258
|
-
const claim = liveCapabilityClaim(sql, scopeId, now)
|
|
251
|
+
const claim = liveCapabilityClaim(sql, scopeId, now);
|
|
259
252
|
return {
|
|
260
253
|
state: 'unclaimed',
|
|
261
254
|
owner,
|
|
@@ -324,7 +317,7 @@ export function ownerClaimTarget(sql, scopeId) {
|
|
|
324
317
|
}
|
|
325
318
|
/**
|
|
326
319
|
* Record a freshly minted `become` capability as the scope's ONE claim link (#1686), replacing
|
|
327
|
-
* whatever link was current
|
|
320
|
+
* whatever link was current. Returns the previous
|
|
328
321
|
* capability id, which the caller revokes in the scope DO: "a new mint retires the old link"
|
|
329
322
|
* holds here first, since a redemption must name the recorded capability, and the revoke makes it
|
|
330
323
|
* hold in the scope's directory too.
|
|
@@ -336,7 +329,6 @@ export function recordOwnerClaim(sql, scopeId, principal, link) {
|
|
|
336
329
|
if (ownerClaimTarget(sql, scopeId) !== principal)
|
|
337
330
|
return null;
|
|
338
331
|
const prior = [...sql.exec('SELECT capability_id FROM owner_claim_capability WHERE scope_id = ?', scopeId)][0];
|
|
339
|
-
sql.exec('DELETE FROM owner_claim WHERE scope_id = ?', scopeId);
|
|
340
332
|
sql.exec('INSERT OR REPLACE INTO owner_claim_capability (scope_id, capability_id, token_hash, expires_at) VALUES (?, ?, ?, ?)', scopeId, link.capabilityId, link.tokenHash, link.expiresAt);
|
|
341
333
|
return { previous: prior?.capability_id ?? null };
|
|
342
334
|
}
|
|
@@ -355,7 +347,8 @@ export function ownerClaimMatches(sql, scopeId, tokenHash, now) {
|
|
|
355
347
|
* Claim the seat with an exchanged `become` capability (#1686): the scope's directory has taken
|
|
356
348
|
* the capability's one use and answered the principal it becomes. Binds the subject when the seat
|
|
357
349
|
* is still pending, the capability is the recorded live link, and it names the pending principal.
|
|
358
|
-
* Consumes the seat and the link. Null otherwise — one answer,
|
|
350
|
+
* Consumes the seat and the link. Null otherwise — one answer for every refusal, so a probe
|
|
351
|
+
* learns nothing.
|
|
359
352
|
*/
|
|
360
353
|
export function claimOwnerByCapability(sql, scopeId, sub, capabilityId, principal, now) {
|
|
361
354
|
const pending = pendingRow(sql, scopeId);
|
|
@@ -365,23 +358,4 @@ export function claimOwnerByCapability(sql, scopeId, sub, capabilityId, principa
|
|
|
365
358
|
return null;
|
|
366
359
|
return bindSeat(sql, scopeId, sub, pending.principal);
|
|
367
360
|
}
|
|
368
|
-
/**
|
|
369
|
-
* LEGACY — claim the seat with a link minted before #1686, by its token's hash. Nothing mints
|
|
370
|
-
* such a link any more, so this serves only rows an older deployment wrote, each of which dies
|
|
371
|
-
* `OWNER_CLAIM_TTL_MS` after it was minted, and any capability-era mint deletes it first.
|
|
372
|
-
* REMOVE in the release after the one that ships #1686 (written 2026-10-04): by then every
|
|
373
|
-
* deployment has run the new code for longer than a legacy link can live.
|
|
374
|
-
*
|
|
375
|
-
* Binds the subject, consumes the seat and the link. Null ⇒ invalid, expired, already used, or
|
|
376
|
-
* nothing to claim — one answer, so a probe learns nothing.
|
|
377
|
-
*/
|
|
378
|
-
export function claimOwner(sql, scopeId, sub, tokenHash, now) {
|
|
379
|
-
const pending = pendingRow(sql, scopeId);
|
|
380
|
-
if (!pending)
|
|
381
|
-
return null;
|
|
382
|
-
const claim = liveClaim(sql, scopeId, now);
|
|
383
|
-
if (!claim || claim.token_hash !== tokenHash)
|
|
384
|
-
return null;
|
|
385
|
-
return bindSeat(sql, scopeId, sub, pending.principal);
|
|
386
|
-
}
|
|
387
361
|
//# sourceMappingURL=owner-seat.js.map
|
package/dist/owner-seat.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,uIAAuI;IACvI,yFAAyF;IACzF,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,oHAAoH;IACpH,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,
|
|
1
|
+
{"version":3,"file":"owner-seat.js","sourceRoot":"","sources":["../src/owner-seat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,uIAAuI;IACvI,yFAAyF;IACzF,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,oHAAoH;IACpH,iGAAiG;IACjG,4FAA4F;IAC5F,4FAA4F;IAC5F,iGAAiG;IACjG,6FAA6F;IAC7F,6FAA6F;IAC7F,4FAA4F;IAC5F,4FAA4F;IAC5F,iFAAiF;IACjF,mKAAmK;IACnK,4FAA4F;IAC5F,sFAAsF;IACtF,wDAAwD;IACxD,8FAA8F;IAC9F,uCAAuC;IACvC,mJAAmJ;CACpJ,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC/F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;AAC/C,CAAC;AAcD,MAAM,GAAG,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,GAAW,EACX,QAAQ,GAAW,uBAAuB;IAE1C,IAAI,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO;IACjD,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAChG,GAAG,CAAC,IAAI,CACN,+EAA+E,EAC/E,OAAO,EACP,SAAS,EACT,GAAG,GAAG,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEnF,CAAC;IACd,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;AAChC,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChF,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,IAAI,WAAW,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,0FAA0F;IAC1F,yDAAyD;IACzD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACvE,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1E,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,yFAAyF;QACzF,IAAI,IAAI,EAAE,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,+EAA+E,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7G,GAAG,CAAC,IAAI,CACN,gHAAgH,EAChH,OAAO,EACP,IAAI,EACJ,EAAE,CACH,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,EAAU;IAC/F,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACrG,GAAG,CAAC,IAAI,CAAC,6DAA6D,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAgB,EAChB,OAAe,EACf,IAAY,EACZ,EAAU,EACV,WAAoB;IAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IAC1G,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,CAAC,CAAC;IACtF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,GAAgB,EAChB,OAAe;IAEf,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gFAAgF,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEpG,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IACnE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7H,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IAC1D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,GAAgB,EAAE,OAAe;IACnD,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEzF,CAAC;AAChB,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IACjF,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjH,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;IAClE,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sDAAsD;AACtD,SAAS,mBAAmB,CAC1B,GAAgB,EAChB,OAAe,EACf,GAAW;IAEX,MAAM,GAAG,GAAG;QACV,GAAG,GAAG,CAAC,IAAI,CAAC,6FAA6F,EAAE,OAAO,CAAC;KACpH,CAAC,CAAC,CAAkF,CAAC;IACtF,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO;QACL,KAAK,EAAE,WAAW;QAClB,KAAK;QACL,WAAW,EAAE;YACX,IAAI,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,GAAG;YAC/D,KAAK,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;SACtE;QACD,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAE/F,CAAC;IACd,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5G,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,eAAe,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAClF,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACvB,4EAA4E,EAC5E,OAAO,EACP,SAAS,CACV,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CAAC,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,KAAa;IACzE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAC1G,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAa,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,OAAe;IAChE,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;AACrD,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,IAAuB;IAEvB,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEhG,CAAC;IACd,GAAG,CAAC,IAAI,CACN,qHAAqH,EACrH,OAAO,EACP,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB,EAAE,GAAW;IACjG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,KAAK,SAAS,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAgB,EAChB,OAAe,EACf,GAAW,EACX,YAAoB,EACpB,SAAiB,EACjB,GAAW;IAEX,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,aAAa,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@substrat-run/vertical-auth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.22.0",
|
|
4
4
|
"description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
|
|
5
5
|
"license": "AGPL-3.0-only",
|
|
6
6
|
"repository": {
|
|
@@ -52,21 +52,21 @@
|
|
|
52
52
|
"better-auth": "^1.7.1",
|
|
53
53
|
"drizzle-orm": "^0.45.2",
|
|
54
54
|
"jose": "^6.2.3",
|
|
55
|
-
"@substrat-run/contracts": "^0.
|
|
56
|
-
"@substrat-run/kernel": "^0.140.0",
|
|
55
|
+
"@substrat-run/contracts": "^0.142.0",
|
|
57
56
|
"@substrat-run/oidc-rp": "^0.11.0",
|
|
57
|
+
"@substrat-run/kernel": "^0.142.0",
|
|
58
58
|
"@substrat-run/psl": "^0.2.5"
|
|
59
59
|
},
|
|
60
60
|
"peerDependencies": {
|
|
61
|
-
"hono": "^4.13.
|
|
61
|
+
"hono": "^4.13.13"
|
|
62
62
|
},
|
|
63
63
|
"devDependencies": {
|
|
64
64
|
"@cloudflare/workers-types": "^4.20250109.0",
|
|
65
65
|
"@types/better-sqlite3": "^9.6.0",
|
|
66
66
|
"better-sqlite3": "^13.0.3",
|
|
67
|
-
"hono": "^4.13.
|
|
67
|
+
"hono": "^4.13.13",
|
|
68
68
|
"typescript": "^7.0.0",
|
|
69
|
-
"vitest": "^
|
|
69
|
+
"vitest": "^5.0.3"
|
|
70
70
|
},
|
|
71
71
|
"scripts": {
|
|
72
72
|
"build": "tsc -p tsconfig.json",
|