@substrat-run/vertical-auth 0.21.1 → 0.22.1

package/dist/invite-routes.js

@@ -17,6 +17,14 @@
  * and the directory then resolves them as that member. Revoking takes the principal's scope
  * roles back and then removes the invite row.
  *
+ * Since #1686 the token is the secret of a `become` capability in the scope's own Durable
+ * Object, minted by the inviter under a bound (they must hold everything the invited
+ * principal holds): single use, revocable, and on the spine — its mint as
+ * `capability.become-minted` with the inviter as actor, its accept as `capability.exercised`.
+ * It has no expiry, as an invite never had, and the inviter is not re-checked at accept:
+ * the role was bounded when it was granted, and withdrawing the invite is the lever. An
+ * invite minted before #1686 is redeemed the old way, by hash (`claimInvite`).
+ *
  * Who may invite, and at which role, are two questions (#1931). The vertical's admin gate
  * answers the first — may this caller manage members at all. The second is the kernel's
  * assignment bound (`ctx.canAssign`): a caller may confer a role only if they already hold
@@ -32,10 +40,13 @@
  * than this one with more fields.
  */
 import { HTTPException } from 'hono/http-exception';
-import { coverage, coverageRefusal, principalId, z } from '@substrat-run/contracts';
-import { ulid } from '@substrat-run/kernel';
-import { claimToken, invitePath, sha256Hex } from './owner-claim-link.js';
+import { BECOME_LINK_STATES_MAX_IDS, boundedBecomeMint, boundedBecomeRevoke, becomeLinkState, capabilityId, coverage, coverageRefusal, principalId, z, } from '@substrat-run/contracts';
+import { capabilityTokenHash, plausibleCapabilitySecret, ulid } from '@substrat-run/kernel';
+import { redeemBecomeLink } from './become-link.js';
+import { invitePath, sha256Hex } from './owner-claim-link.js';
 import { bodyOf } from './request-body.js';
+/** The label every member invite's capability carries — what an operator's capability read shows. */
+export const MEMBER_INVITE_LABEL = 'member invite';
 const inviteCaller = z.object({ principal: principalId });
 /** The body `POST /api/invites` takes. */
 export const inviteBody = z.object({
@@ -52,34 +63,117 @@ export const uncovered = (missing, roleKey, act) => new HTTPException(403, { mes
  * own `POST /api/invites` and the platform's `/internal/members/invite` (vertical-host), so the
  * two doors cannot drift on the token, the hash, or the order.
  *
- * Pre-mint a principal; grant it the role through `grant`, which MUST be the bounded grant
- * (check and write in one scope task) — a refusal returns its coverage and nothing else is
- * written; then record the invite under the token's SHA-256. The grant comes first: a row whose
- * principal holds nothing is a link to no access, while a grant with no row is inert — nobody
- * can bind to it. The two writes are two Durable Objects with no transaction between them, so a
- * failed record takes the grant back (`rollback`) before the failure is rethrown: inert is not
- * harmless when every retry would mint another orphan. If the rollback fails too, the ORIGINAL
- * failure is what the caller hears.
+ * Pre-mint a principal, then three writes, each failing closed:
+ *   1. grant it the role through `grant`, which MUST be the bounded grant (check and write in one
+ *      scope task) — a refusal returns its coverage and nothing else is written;
+ *   2. mint its link (#1686): a `become` capability for that principal, single use and with no
+ *      expiry (an invite has never had one), bounded by what the inviter holds — the scope's own
+ *      record, on the spine as `capability.become-minted`. A refusal takes the grant back;
+ *   3. record the invite under the secret's hash, naming the capability.
+ * The grant comes first: a row whose principal holds nothing is a link to no access, while a
+ * grant with no row is inert — nobody can bind to it, and a capability with no row is refused
+ * before its exchange. The writes are two Durable Objects with no transaction between them, so a
+ * failed record revokes the capability and takes the grant back (`rollback`) before the failure
+ * is rethrown: inert is not harmless when every retry would mint another orphan. If a rollback
+ * step fails too, the ORIGINAL failure is what the caller hears.
  */
 export async function mintMemberInvite(steps, input) {
     const principal = principalId.parse(ulid());
-    // A long, URL-safe token; only its hash is stored. Two UUIDs = 256 bits of entropy.
-    const token = claimToken();
     const bound = coverage.safeParse(await steps.grant(principal));
     if (!bound.success) {
         throw new HTTPException(500, { message: 'the canAssign bound did not answer with a coverage — refusing' });
     }
     if (!bound.data.covered)
         return { ok: false, coverage: bound.data };
+    const ungrant = () => steps.rollback(principal).catch(() => undefined);
+    let minted;
     try {
-        await steps.record(principal, await sha256Hex(token));
+        minted = boundedBecomeMint.parse(await steps.mint({ principal, maxUses: 1, label: MEMBER_INVITE_LABEL }));
     }
     catch (err) {
-        await steps.rollback(principal).catch(() => undefined);
+        await ungrant();
+        throw err;
+    }
+    if (!minted.ok) {
+        await ungrant();
+        // The grant just made is what the principal holds; it holds nothing only when the role
+        // carries no permission at all — nothing to invite anyone into. The principal was minted
+        // just now, so no link to it can have been exchanged; that refusal is answered all the same.
+        if (!('coverage' in minted)) {
+            throw new HTTPException(409, {
+                message: minted.refused === 'target-holds-nothing'
+                    ? `'${input.roleKey}' confers nothing here — there is nothing to invite anyone into`
+                    : 'this invite\'s principal is already claimed — refusing a second link to it',
+            });
+        }
+        return { ok: false, coverage: minted.coverage };
+    }
+    const link = minted.minted;
+    try {
+        await steps.record(principal, await capabilityTokenHash(link.secret), link.id);
+    }
+    catch (err) {
+        await steps.revokeCapability(link.id).catch(() => undefined);
+        await ungrant();
         throw err;
     }
     const origin = input.origin.replace(/\/$/, '');
-    return { ok: true, invite: { principal, roleKey: input.roleKey, email: input.email, acceptUrl: `${origin}${invitePath(token)}` } };
+    return { ok: true, invite: { principal, roleKey: input.roleKey, email: input.email, acceptUrl: `${origin}${invitePath(link.secret)}` } };
+}
+/**
+ * Join each invite to where its link stands (#1686), in ONE read of the scope — the list every
+ * pending-invite door shows, so a link the scope revoked (its principal's holdings changed) or that
+ * expired is never listed as open. A legacy hash-only invite has no link to read: `link: null`.
+ */
+export async function withLinkStates(rows, states) {
+    const ids = rows.flatMap((r) => (r.capabilityId ? [capabilityId.parse(r.capabilityId)] : []));
+    // In pages of the read's cap (`BECOME_LINK_STATES_MAX_IDS`), which refuses rather than truncates.
+    const read = [];
+    for (let at = 0; at < ids.length; at += BECOME_LINK_STATES_MAX_IDS) {
+        const page = ids.slice(at, at + BECOME_LINK_STATES_MAX_IDS);
+        const answer = (await states(page)).map((s) => becomeLinkState.parse(s));
+        if (answer.length !== page.length)
+            break;
+        read.push(...answer);
+    }
+    if (read.length !== ids.length)
+        throw new HTTPException(500, { message: 'the scope answered a link state per id it was not asked for — refusing' });
+    const byId = new Map(ids.map((id, i) => [id, read[i]]));
+    return rows.map(({ capabilityId: id, ...row }) => ({ ...row, link: id ? byId.get(id) : null }));
+}
+/**
+ * Accept an invite (#1150, #1686) — the one copy every accept door runs. A capability secret is
+ * redeemed as every `become` link is (`redeemBecomeLink`): checked against the directory before
+ * the scope spends its use, exchanged, then bound only while the row still names that capability
+ * and principal. A token that is not a capability secret is a LEGACY hash-only invite, redeemed by
+ * hash (`claimInvite`). Null for every refusal, one answer.
+ */
+export async function acceptMemberInvite(deps, scopeId, sub, token) {
+    if (!plausibleCapabilitySecret(token)) {
+        // LEGACY — a hash-only invite (see `claimInvite`).
+        return deps.directory.claimInvite(scopeId, sub, await sha256Hex(token));
+    }
+    return redeemBecomeLink({
+        matches: (hash) => deps.directory.inviteMatches(scopeId, hash),
+        exchange: deps.exchange,
+        bind: (capabilityId, principal) => deps.directory.claimInviteByCapability(scopeId, sub, capabilityId, principal),
+    }, token);
+}
+/**
+ * Withdraw an invite's link and then its row (#1686), once the caller's bound has taken the
+ * roles. The link goes first, named by the row: a revoke that fails leaves the row in place, so
+ * the withdrawal fails as a whole and its retry finds the link again — the scope's own record
+ * and the directory never part company. Revoking is idempotent, so a retry after a revoke that
+ * landed and a delete that did not is the same call. Then the row goes, which stops an accept.
+ */
+export async function withdrawMemberInvite(steps, scopeId, principal) {
+    const link = await steps.directory.inviteLink(scopeId, principal);
+    if (link) {
+        const revoke = boundedBecomeRevoke.parse(await steps.revokeCapability(capabilityId.parse(link)));
+        if (!revoke.ok)
+            throw uncovered(revoke.coverage.missing, principal, 'withdraw the link of');
+    }
+    await steps.directory.revokeInvite(scopeId, principal);
 }
 /**
  * Mount the four invite routes on a vertical's Hono app:
@@ -106,6 +200,9 @@ export function mountInviteRoutes(app, deps) {
         if (typeof deps.assignScopeRoleBounded !== 'function') {
             throw new HTTPException(500, { message: 'invites are mounted without the bounded grant — refusing to confer an unbounded role' });
         }
+        if (typeof deps.mintBecomeCapabilityBounded !== 'function' || typeof deps.revokeBecomeCapability !== 'function') {
+            throw new HTTPException(500, { message: 'invites are mounted without the capability verbs — refusing to mint a link nothing can revoke' });
+        }
         const parsed = inviteCaller.safeParse(caller);
         if (!parsed.success) {
             throw new HTTPException(500, { message: 'the admin gate named no caller — refusing to confer a role the bound cannot be asked about' });
@@ -124,7 +221,9 @@ export function mountInviteRoutes(app, deps) {
     app.get('/api/invites', async (c) => {
         const node = await deps.nodeFor(c.req.raw, c.env);
         await deps.requireAdmin(c);
-        return c.json({ roles: [...deps.roles], invites: await deps.directory(c.env, node).listInvites(node.scopeId) });
+        const rows = await deps.directory(c.env, node).listInvites(node.scopeId);
+        const invites = await withLinkStates(rows, (ids) => deps.becomeLinkStates(c.env, node, ids));
+        return c.json({ roles: [...deps.roles], invites });
     });
     app.post('/api/invites', async (c) => {
         const node = await deps.nodeFor(c.req.raw, c.env);
@@ -135,7 +234,9 @@ export function mountInviteRoutes(app, deps) {
             throw new HTTPException(400, { message: `unknown role '${roleKey}'` });
         const minted = await mintMemberInvite({
             grant: (assignee) => deps.assignScopeRoleBounded(c.env, node, caller.principal, assignee, roleKey),
-            record: (principal, tokenHash) => deps.directory(c.env, node).createInvite(node.scopeId, principal, roleKey, email ?? null, tokenHash),
+            mint: (link) => deps.mintBecomeCapabilityBounded(c.env, node, caller.principal, link),
+            record: (principal, tokenHash, link) => deps.directory(c.env, node).createInvite(node.scopeId, principal, roleKey, email ?? null, tokenHash, link),
+            revokeCapability: (link) => deps.revokeBecomeCapability(c.env, node, link, caller.principal),
             rollback: (principal) => deps.revokeScopeRole(c.env, node.scopeId, principal, roleKey),
         }, { roleKey, email: email ?? null, origin: originOf(c.req.raw) });
         if (!minted.ok)
@@ -160,7 +261,7 @@ export function mountInviteRoutes(app, deps) {
             // principal holding nothing.
             const taken = await deps.revokeScopeRolesBounded(c.env, node, caller.principal, principal.data);
             assertCoverage(taken.coverage, principal.data, 'withdraw the invite of');
-            await directory.revokeInvite(node.scopeId, principal.data);
+            await withdrawMemberInvite({ directory, revokeCapability: (link) => deps.revokeBecomeCapability(c.env, node, link, caller.principal) }, node.scopeId, principal.data);
         }
         return c.body(null, 204);
     });
@@ -176,7 +277,7 @@ export function mountInviteRoutes(app, deps) {
         if (!subject)
             throw new HTTPException(401, { message: 'sign in before accepting an invite' });
         const { token } = await bodyOf(c, acceptInviteBody);
-        const principal = await deps.directory(c.env, node).claimInvite(node.scopeId, subject.sub, await sha256Hex(token));
+        const principal = await acceptMemberInvite({ directory: deps.directory(c.env, node), exchange: (secret) => deps.exchangeCapability(c.env, node, secret) }, node.scopeId, subject.sub, token);
         if (!principal)
             throw new HTTPException(400, { message: 'this invite is invalid or already used' });
         return c.json({ ok: true, principal });

package/dist/invite-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"invite-routes.js","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,EAAuF,MAAM,yBAAyB,CAAC;AACzK,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAM3C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAK1D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAkDvE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAE,OAAe,EAAE,GAAW,EAAiB,EAAE,CACnG,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAG9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAIC,EACD,KAAgE;IAEhE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,oFAAoF;IACpF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;AACrI,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA0B,EAC1B,IAA2B;IAE3B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9G,uFAAuF;IACvF,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAgB,EAAE;QACjD,IAAI,OAAO,IAAI,CAAC,uBAAuB,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yFAAyF,EAAE,CAAC,CAAC;QACvI,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sFAAsF,EAAE,CAAC,CAAC;QACpI,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4FAA4F,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,cAAc,GAAG,CAAC,MAAe,EAAE,OAAe,EAAE,GAAW,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,+FAA+F;QAC/F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,OAAO,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;YAClG,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAC/B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,SAAS,CAAC;YACtG,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;SACvF,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAClE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,IAAI,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;YAChC,8FAA8F;YAC9F,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,mFAAmF;YACnF,6BAA6B;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAChG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;YACzE,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,6FAA6F;IAC7F,8FAA8F;IAC9F,6EAA6E;IAC7E,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAA8F,IAGxH;IACC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"invite-routes.js","sourceRoot":"","sources":["../src/invite-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,WAAW,EACX,CAAC,GAYF,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAU3C,qGAAqG;AACrG,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;AAK1D,0CAA0C;AAC1C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAuEvE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAE,OAAe,EAAE,GAAW,EAAiB,EAAE,CACnG,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAG9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAMC,EACD,KAAgE;IAEhE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,MAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,OAAO,EAAE,CAAC;QAChB,uFAAuF;QACvF,yFAAyF;QACzF,6FAA6F;QAC7F,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,sBAAsB;oBAChD,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,iEAAiE;oBACpF,CAAC,CAAC,4EAA4E;aACjF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;AAC3I,CAAC;AAKD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA0B,EAC1B,MAAqE;IAErE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,kGAAkG;IAClG,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,0BAA0B,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,0BAA0B,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC,CAAC;IACpJ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAY,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAGC,EACD,OAAe,EACf,GAAW,EACX,KAAa;IAEb,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,mDAAmD;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,gBAAgB,CACrB;QACE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC;QAC9D,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC;KACjH,EACD,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAGC,EACD,OAAe,EACf,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA0B,EAC1B,IAA2B;IAE3B,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE9G,uFAAuF;IACvF,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAgB,EAAE;QACjD,IAAI,OAAO,IAAI,CAAC,uBAAuB,KAAK,UAAU,EAAE,CAAC;YACvD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yFAAyF,EAAE,CAAC,CAAC;QACvI,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sFAAsF,EAAE,CAAC,CAAC;QACpI,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,2BAA2B,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;YAChH,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;QAC7I,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4FAA4F,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,cAAc,GAAG,CAAC,MAAe,EAAE,OAAe,EAAE,GAAW,EAAQ,EAAE;QAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,+FAA+F;QAC/F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,iBAAiB,OAAO,GAAG,EAAE,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC;YACE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;YAClG,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;YACrF,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CACrC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;YAC5G,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC;YAC5F,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;SACvF,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAC/D,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAClE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,IAAI,SAAS,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;YAChC,8FAA8F;YAC9F,4FAA4F;YAC5F,6FAA6F;YAC7F,0FAA0F;YAC1F,2FAA2F;YAC3F,0FAA0F;YAC1F,mFAAmF;YACnF,6BAA6B;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAChG,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;YACzE,MAAM,oBAAoB,CACxB,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAC3G,IAAI,CAAC,OAAO,EACZ,SAAS,CAAC,IAAI,CACf,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,2FAA2F;IAC3F,8FAA8F;IAC9F,6FAA6F;IAC7F,8FAA8F;IAC9F,6EAA6E;IAC7E,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAC9G,IAAI,CAAC,OAAO,EACZ,OAAO,CAAC,GAAG,EACX,KAAK,CACN,CAAC;QACF,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAA8F,IAGxH;IACC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AAClF,CAAC"}

package/dist/member-directory.d.ts

@@ -7,6 +7,13 @@
  * An invite is a pre-minted principal + a role the inviter already granted at scope level,
  * waiting for a login to claim it by token. Only the token's HASH is stored — the token itself
  * lives in the accept link, never here, so a read of this table cannot mint access.
+ *
+ * Since #1686 the token is the secret of a `become` capability in the scope's own Durable
+ * Object (single use, revocable, on the spine), and `capability_id` names it: the scope judges
+ * the secret, this row says which capability IS the invite and which principal it seats. A row
+ * with no `capability_id` is LEGACY — hash alone, as every invite was before #1686 and as
+ * ticket0's own desk-invite flow still writes them — and is still redeemed the old way, by hash;
+ * an invite has no expiry, so nothing ages those out (see `claimInvite`).
  */
 import type { RegistrySql } from './site-registry.js';
 export { migrateOwnerSeat, unbindPrincipal } from './owner-seat.js';
@@ -14,12 +21,23 @@ export type { RegistrySql } from './site-registry.js';
 export declare const INVITE_DDL: string[];
 /** The whole directory an invite touches: the identity (and owner-seat) tables, then the invites. */
 export declare const MEMBER_DIRECTORY_DDL: readonly string[];
-/** An outstanding invite as the directory returns it — never its token. */
+/**
+ * Bring an `invite` table from before #1686 up to date: `CREATE TABLE IF NOT EXISTS` leaves an
+ * existing table alone, so a directory whose storage predates `capability_id` needs the one
+ * `ALTER`, and every row it had reads as legacy (NULL). Idempotent — run it after the DDL.
+ */
+export declare function migrateInvites(sql: RegistrySql): void;
+/**
+ * An outstanding invite as the directory returns it — never its token. `capabilityId` names the
+ * `become` capability its link is (#1686), so a list can ask the scope where that link stands;
+ * null for a legacy hash-only invite.
+ */
 export type InviteRow = {
     principal: string;
     roleKey: string;
     email: string | null;
     createdAt: number;
+    capabilityId: string | null;
 };
 /** One principal as the identity directory knows it at a scope (#1150). */
 export type MemberBinding = {
@@ -27,20 +45,56 @@ export type MemberBinding = {
     logins: number;
     email: string | null;
 };
-export declare function createInvite(sql: RegistrySql, scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string): void;
+/**
+ * Record an invite under its token's hash. `capabilityId` names the `become` capability whose
+ * secret the token is (#1686); null writes a legacy hash-only row, which this package's own
+ * invite routes no longer mint.
+ */
+export declare function createInvite(sql: RegistrySql, scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string, capabilityId?: string | null): void;
 /** The scope's outstanding (unclaimed) invites, newest first. No token. */
 export declare function listInvites(sql: RegistrySql, scopeId: string): InviteRow[];
 /** One outstanding invite by its pre-minted principal, or null (#1931). */
 export declare function getInvite(sql: RegistrySql, scopeId: string, principal: string): InviteRow | null;
 export declare function inviteExists(sql: RegistrySql, scopeId: string, tokenHash: string): boolean;
-/** Withdraw an unclaimed invite by its pre-minted principal. */
-export declare function revokeInvite(sql: RegistrySql, scopeId: string, principal: string): void;
-/**
- * Claim an invite: bind the verified subject to the invite's pre-minted principal and consume
- * the invite, with no await between the read and the writes — so in the Durable Object a
- * withdrawal (`revokeInvite`) and a claim are serialized, and a claim after a withdrawal finds
- * nothing. Returns the principal, or null when no unclaimed invite matches. It writes nothing
- * to the scope: the role was granted when the invite was minted.
+/**
+ * Withdraw an unclaimed invite by its pre-minted principal. Returns the `become` capability its
+ * link was (#1686), or null for a legacy invite, or none. Deleting the row is what stops an
+ * accept here; a withdrawal revokes the link in the scope BEFORE this (`inviteLink`).
+ */
+export declare function revokeInvite(sql: RegistrySql, scopeId: string, principal: string): string | null;
+/**
+ * The `become` capability an open invite's link is (#1686), or null — a legacy invite, or none.
+ * What a withdrawal revokes FIRST, while the row is still there to name it: a revoke that fails
+ * leaves the row, and the retry finds the link again.
+ */
+export declare function inviteLink(sql: RegistrySql, scopeId: string, principal: string): string | null;
+/**
+ * Is `tokenHash` an open capability-era invite here (#1686)? Asked BEFORE the secret is
+ * exchanged, so a secret that is no open invite — withdrawn, already accepted, or a `become`
+ * capability minted for something else — is refused without spending its use. The exchange is
+ * still the authority: this only decides whether to ask it.
+ */
+export declare function inviteMatches(sql: RegistrySql, scopeId: string, tokenHash: string): boolean;
+/**
+ * Accept an invite with an exchanged `become` capability (#1686): the scope has taken the
+ * capability's one use and answered the principal it becomes. Binds the subject when an open
+ * invite here names that capability AND that principal, and consumes it — so a withdrawal
+ * landing between the exchange and this finds nothing to bind. Null otherwise, one answer.
+ */
+export declare function claimInviteByCapability(sql: RegistrySql, scopeId: string, sub: string, capabilityId: string, principal: string): string | null;
+/**
+ * LEGACY (#1686) — claim an invite minted before invites became `become` capabilities, by its
+ * token's hash: bind the verified subject to the invite's pre-minted principal and consume the
+ * invite, with no await between the read and the writes — so in the Durable Object a withdrawal
+ * (`revokeInvite`) and a claim are serialized, and a claim after a withdrawal finds nothing.
+ * Returns the principal, or null when no unclaimed legacy invite matches. It writes nothing to
+ * the scope: the role was granted when the invite was minted.
+ *
+ * A capability-era row is NEVER claimed here, whatever hash is presented: its secret goes
+ * through the scope's exchange (`claimInviteByCapability`), which is what spends its one use
+ * and puts it on the spine. Unlike an owner claim link, a legacy invite never expires, so this
+ * path cannot age out on a timer: it stays until every legacy row is accepted or withdrawn, or
+ * a cut-off is decided.
  */
 export declare function claimInvite(sql: RegistrySql, scopeId: string, sub: string, tokenHash: string): string | null;
 /**

package/dist/member-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"member-directory.d.ts","sourceRoot":"","sources":["../src/member-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,eAAO,MAAM,UAAU,EAAE,MAAM,EAM9B,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAuC,CAAC;AAE1F,2EAA2E;AAC3E,MAAM,MAAM,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAExG,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AASxF,wBAAgB,YAAY,CAC1B,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAC7G,IAAI,CAKN;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAK1E;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMhG;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1F;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5G;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAarF"}
+{"version":3,"file":"member-directory.d.ts","sourceRoot":"","sources":["../src/member-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,eAAO,MAAM,UAAU,EAAE,MAAM,EAO9B,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAuC,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAGrD;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAErI,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAUxF;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,EAC9G,YAAY,GAAE,MAAM,GAAG,IAAW,GACjC,IAAI,CAKN;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,CAK1E;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAMhG;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMhG;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAK3F;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GACtF,MAAM,GAAG,IAAI,CAMf;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM5G;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAarF"}

package/dist/member-directory.js

@@ -5,50 +5,109 @@ export const INVITE_DDL = [
     `CREATE TABLE IF NOT EXISTS invite (
     token_hash TEXT PRIMARY KEY, scope_id TEXT NOT NULL, principal TEXT NOT NULL,
     role_key TEXT NOT NULL, email TEXT, claimed INTEGER NOT NULL DEFAULT 0,
-    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)))`,
+    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)),
+    capability_id TEXT)`,
     `CREATE INDEX IF NOT EXISTS invite_by_scope ON invite (scope_id)`,
 ];
 /** The whole directory an invite touches: the identity (and owner-seat) tables, then the invites. */
 export const MEMBER_DIRECTORY_DDL = [...OWNER_SEAT_DDL, ...INVITE_DDL];
+/**
+ * Bring an `invite` table from before #1686 up to date: `CREATE TABLE IF NOT EXISTS` leaves an
+ * existing table alone, so a directory whose storage predates `capability_id` needs the one
+ * `ALTER`, and every row it had reads as legacy (NULL). Idempotent — run it after the DDL.
+ */
+export function migrateInvites(sql) {
+    const columns = [...sql.exec('PRAGMA table_info(invite)')].map((r) => r.name);
+    if (!columns.includes('capability_id'))
+        sql.exec('ALTER TABLE invite ADD COLUMN capability_id TEXT');
+}
 const inviteRowOf = (r) => ({
     principal: r.principal,
     roleKey: r.role_key,
     email: r.email ?? null,
     createdAt: Number(r.created_at),
+    capabilityId: r.capability_id ?? null,
 });
-export function createInvite(sql, scopeId, principal, roleKey, email, tokenHash) {
-    sql.exec('INSERT INTO invite (token_hash, scope_id, principal, role_key, email) VALUES (?, ?, ?, ?, ?)', tokenHash, scopeId, principal, roleKey, email);
+/**
+ * Record an invite under its token's hash. `capabilityId` names the `become` capability whose
+ * secret the token is (#1686); null writes a legacy hash-only row, which this package's own
+ * invite routes no longer mint.
+ */
+export function createInvite(sql, scopeId, principal, roleKey, email, tokenHash, capabilityId = null) {
+    sql.exec('INSERT INTO invite (token_hash, scope_id, principal, role_key, email, capability_id) VALUES (?, ?, ?, ?, ?, ?)', tokenHash, scopeId, principal, roleKey, email, capabilityId);
 }
 /** The scope's outstanding (unclaimed) invites, newest first. No token. */
 export function listInvites(sql, scopeId) {
-    return [...sql.exec('SELECT principal, role_key, email, created_at FROM invite WHERE scope_id = ? AND claimed = 0 ORDER BY created_at DESC', scopeId)].map(inviteRowOf);
+    return [...sql.exec('SELECT principal, role_key, email, created_at, capability_id FROM invite WHERE scope_id = ? AND claimed = 0 ORDER BY created_at DESC', scopeId)].map(inviteRowOf);
 }
 /** One outstanding invite by its pre-minted principal, or null (#1931). */
 export function getInvite(sql, scopeId, principal) {
-    const r = [...sql.exec('SELECT principal, role_key, email, created_at FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0', scopeId, principal)][0];
+    const r = [...sql.exec('SELECT principal, role_key, email, created_at, capability_id FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0', scopeId, principal)][0];
     return r ? inviteRowOf(r) : null;
 }
 export function inviteExists(sql, scopeId, tokenHash) {
     return [...sql.exec('SELECT 1 FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0', scopeId, tokenHash)].length > 0;
 }
-/** Withdraw an unclaimed invite by its pre-minted principal. */
+/**
+ * Withdraw an unclaimed invite by its pre-minted principal. Returns the `become` capability its
+ * link was (#1686), or null for a legacy invite, or none. Deleting the row is what stops an
+ * accept here; a withdrawal revokes the link in the scope BEFORE this (`inviteLink`).
+ */
 export function revokeInvite(sql, scopeId, principal) {
-    sql.exec('DELETE FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0', scopeId, principal);
+    const gone = [...sql.exec('DELETE FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0 RETURNING capability_id', scopeId, principal)][0];
+    return gone?.capability_id ?? null;
 }
 /**
- * Claim an invite: bind the verified subject to the invite's pre-minted principal and consume
- * the invite, with no await between the read and the writes — so in the Durable Object a
- * withdrawal (`revokeInvite`) and a claim are serialized, and a claim after a withdrawal finds
- * nothing. Returns the principal, or null when no unclaimed invite matches. It writes nothing
- * to the scope: the role was granted when the invite was minted.
+ * The `become` capability an open invite's link is (#1686), or null — a legacy invite, or none.
+ * What a withdrawal revokes FIRST, while the row is still there to name it: a revoke that fails
+ * leaves the row, and the retry finds the link again.
  */
-export function claimInvite(sql, scopeId, sub, tokenHash) {
-    const inv = [...sql.exec('SELECT principal FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0', scopeId, tokenHash)][0];
-    if (!inv)
-        return null;
-    sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, inv.principal);
+export function inviteLink(sql, scopeId, principal) {
+    const open = [...sql.exec('SELECT capability_id FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0', scopeId, principal)][0];
+    return open?.capability_id ?? null;
+}
+/**
+ * Is `tokenHash` an open capability-era invite here (#1686)? Asked BEFORE the secret is
+ * exchanged, so a secret that is no open invite — withdrawn, already accepted, or a `become`
+ * capability minted for something else — is refused without spending its use. The exchange is
+ * still the authority: this only decides whether to ask it.
+ */
+export function inviteMatches(sql, scopeId, tokenHash) {
+    return [...sql.exec('SELECT 1 FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0 AND capability_id IS NOT NULL', scopeId, tokenHash)].length > 0;
+}
+/**
+ * Accept an invite with an exchanged `become` capability (#1686): the scope has taken the
+ * capability's one use and answered the principal it becomes. Binds the subject when an open
+ * invite here names that capability AND that principal, and consumes it — so a withdrawal
+ * landing between the exchange and this finds nothing to bind. Null otherwise, one answer.
+ */
+export function claimInviteByCapability(sql, scopeId, sub, capabilityId, principal) {
+    const inv = [...sql.exec('SELECT token_hash FROM invite WHERE scope_id = ? AND capability_id = ? AND principal = ? AND claimed = 0', scopeId, capabilityId, principal)][0];
+    return inv ? bindInvite(sql, scopeId, sub, principal, inv.token_hash) : null;
+}
+/** Bind the subject to the invite's principal and consume the invite — the write both claims share. */
+function bindInvite(sql, scopeId, sub, principal, tokenHash) {
+    sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, principal);
     sql.exec('UPDATE invite SET claimed = 1 WHERE scope_id = ? AND token_hash = ?', scopeId, tokenHash);
-    return inv.principal;
+    return principal;
+}
+/**
+ * LEGACY (#1686) — claim an invite minted before invites became `become` capabilities, by its
+ * token's hash: bind the verified subject to the invite's pre-minted principal and consume the
+ * invite, with no await between the read and the writes — so in the Durable Object a withdrawal
+ * (`revokeInvite`) and a claim are serialized, and a claim after a withdrawal finds nothing.
+ * Returns the principal, or null when no unclaimed legacy invite matches. It writes nothing to
+ * the scope: the role was granted when the invite was minted.
+ *
+ * A capability-era row is NEVER claimed here, whatever hash is presented: its secret goes
+ * through the scope's exchange (`claimInviteByCapability`), which is what spends its one use
+ * and puts it on the spine. Unlike an owner claim link, a legacy invite never expires, so this
+ * path cannot age out on a timer: it stays until every legacy row is accepted or withdrawn, or
+ * a cut-off is decided.
+ */
+export function claimInvite(sql, scopeId, sub, tokenHash) {
+    const inv = [...sql.exec('SELECT principal FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0 AND capability_id IS NULL', scopeId, tokenHash)][0];
+    return inv ? bindInvite(sql, scopeId, sub, inv.principal, tokenHash) : null;
 }
 /**
  * Who this directory knows at the scope, by principal (#1150): how many subjects are bound to

package/dist/member-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"member-directory.js","sourceRoot":"","sources":["../src/member-directory.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,6FAA6F;AAC7F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGpE,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC;;;0FAGwF;IACxF,iEAAiE;CAClE,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,CAAC;AAQ1F,MAAM,WAAW,GAAG,CAAC,CAA0B,EAAa,EAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAC1B,GAAgB,EAAE,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;IAE9G,GAAG,CAAC,IAAI,CACN,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,OAAe;IAC3D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CACjB,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACpB,gHAAgH,EAChH,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC/E,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACpI,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC/E,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IAC3F,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrH,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpG,OAAO,GAAG,CAAC,SAAmB,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAgB,EAAE,OAAe;IAClE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CACjB;;;;6CAIyC,EACzC,OAAO,EAAE,OAAO,CACjB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,SAAmB;QAChC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"member-directory.js","sourceRoot":"","sources":["../src/member-directory.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,6FAA6F;AAC7F,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGpE,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC;;;;wBAIsB;IACtB,iEAAiE;CAClE,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,GAAG,cAAc,EAAE,GAAG,UAAU,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAgB;IAC7C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;AACvG,CAAC;AAYD,MAAM,WAAW,GAAG,CAAC,CAA0B,EAAa,EAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,SAAmB;IAChC,OAAO,EAAE,CAAC,CAAC,QAAkB;IAC7B,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;IACzC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/B,YAAY,EAAG,CAAC,CAAC,aAA+B,IAAI,IAAI;CACzD,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAgB,EAAE,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB,EAC9G,YAAY,GAAkB,IAAI;IAElC,GAAG,CAAC,IAAI,CACN,gHAAgH,EAChH,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAC5D,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,OAAe;IAC3D,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CACjB,sIAAsI,EACtI,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACpB,+HAA+H,EAC/H,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC/E,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACpI,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC/E,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACvB,iGAAiG,EACjG,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;IACN,OAAQ,IAAI,EAAE,aAA2C,IAAI,IAAI,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAC7E,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACvB,uFAAuF,EACvF,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;IACN,OAAQ,IAAI,EAAE,aAA2C,IAAI,IAAI,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAe,EAAE,SAAiB;IAChF,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CACjB,0GAA0G,EAC1G,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,YAAoB,EAAE,SAAiB;IAEvF,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACtB,0GAA0G,EAC1G,OAAO,EAAE,YAAY,EAAE,SAAS,CACjC,CAAC,CAAC,CAAC,CAAC,CAAC;IACN,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,UAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAED,uGAAuG;AACvG,SAAS,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB,EAAE,SAAiB;IACtG,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjH,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACpG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,SAAiB;IAC3F,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CACtB,8GAA8G,EAC9G,OAAO,EAAE,SAAS,CACnB,CAAC,CAAC,CAAC,CAAC,CAAC;IACN,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAgB,EAAE,OAAe;IAClE,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CACjB;;;;6CAIyC,EACzC,OAAO,EAAE,OAAO,CACjB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,SAAmB;QAChC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/owner-claim-link.d.ts

@@ -30,7 +30,7 @@ export declare const UNATTRIBUTED_PLATFORM_ACTOR: PlatformActorId;
  */
 export interface OwnerClaimMintHost {
     mintCapabilityLocal(tenantId: TenantId, scopeId: ScopeId, input: BecomeCapabilityInput, actor: PlatformActorId): Promise<MintedCapability>;
-    revokeCapabilityLocal(scopeId: ScopeId, capabilityId: CapabilityId, actor: PlatformActorId): Promise<boolean>;
+    revokeCapabilityLocal(scopeId: ScopeId, capabilityId: CapabilityId, actor: PlatformActorId): Promise<unknown>;
 }
 /** The slice of the identity directory a mint touches. */
 export type OwnerClaimMintDirectory = Pick<IdentityStub, 'ownerClaimTarget' | 'recordOwnerClaim'>;

package/dist/owner-claim-routes.d.ts

@@ -21,18 +21,16 @@
  *      only if that capability is still the recorded link and names the pending owner.
  *
  * Every refusal after step 1 is the same 400, so a probe learns nothing about which step said no.
- *
- * LEGACY: a token that is not a capability secret is a link minted before #1686, and is redeemed
- * the old way (`claimOwner`, by hash) until it expires — at most `OWNER_CLAIM_TTL_MS` after the
- * deploy that ships this. REMOVE that branch in the release after the one that ships #1686
- * (written 2026-10-04), with `claimOwner` in owner-seat.ts.
+ * A token that is not a capability secret at all gets it too: the hash-only links #925 minted
+ * before #1686 are no longer redeemed — every one of them expired `OWNER_CLAIM_TTL_MS` after it
+ * was minted, and the release after #1686 has long shipped.
  */
 import type { Context, Hono } from 'hono';
 import { z, type CapabilityExchange, type ScopeId, type TenantId } from '@substrat-run/contracts';
 import type { IdentityStub } from './identity-do.js';
 import type { AuthProvider, AuthSubject } from './provider.js';
 /** The slice of the identity directory the redemption touches. */
-export type OwnerClaimDirectory = Pick<IdentityStub, 'ownerClaimMatches' | 'claimOwnerByCapability' | 'claimOwner'>;
+export type OwnerClaimDirectory = Pick<IdentityStub, 'ownerClaimMatches' | 'claimOwnerByCapability'>;
 /** What the redemption needs of the scope host: the exchange, asked for a `become` capability only. */
 export interface OwnerClaimExchangeHost {
     exchangeCapability(tenantId: TenantId, scopeId: ScopeId, secret: string, options?: {

package/dist/owner-claim-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-claim-routes.d.ts","sourceRoot":"","sources":["../src/owner-claim-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,CAAC,EAAE,KAAK,kBAAkB,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAElG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG/D,kEAAkE;AAClE,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,YAAY,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,YAAY,CAAC,CAAC;AAEpH,uGAAuG;AACvG,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvC;AAED,8CAA8C;AAC9C,eAAO,MAAM,cAAc;;iBAAyC,CAAC;AAErE,uDAAuD;AACvD,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,gGAAgG;AAChG,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;IACvG,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,mGAAmG;IACnG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,wFAAwF;IACxF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,mBAAmB,CAAC;IACpD,gEAAgE;IAChE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,sBAAsB,CAAC;IACzC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAKD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAClG,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GAC9B,IAAI,CA4BN"}
+{"version":3,"file":"owner-claim-routes.d.ts","sourceRoot":"","sources":["../src/owner-claim-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,CAAC,EAAE,KAAK,kBAAkB,EAAE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAElG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG/D,kEAAkE;AAClE,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,YAAY,EAAE,mBAAmB,GAAG,wBAAwB,CAAC,CAAC;AAErG,uGAAuG;AACvG,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;KAAE,GACpC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvC;AAED,8CAA8C;AAC9C,eAAO,MAAM,cAAc;;iBAAyC,CAAC;AAErE,uDAAuD;AACvD,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,gGAAgG;AAChG,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE;IACvG,0FAA0F;IAC1F,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,mGAAmG;IACnG,YAAY,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,wFAAwF;IACxF,SAAS,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,mBAAmB,CAAC;IACpD,gEAAgE;IAChE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,sBAAsB,CAAC;IACzC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAA;KAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAKD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAClG,GAAG,EAAE,IAAI,CAAC;IAAE,QAAQ,EAAE,CAAC,CAAA;CAAE,CAAC,EAC1B,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,GAC9B,IAAI,CAqBN"}