@substrat-run/vertical-auth 0.25.3 → 0.26.1

package/dist/provider.d.ts

@@ -1,9 +1,8 @@
 /**
  * The `AuthProvider` contract — the ONLY thing a vertical's app depends on for identity.
  *
- * The application codes to this interface and does not care WHICH auth is behind it: Better
- * Auth running in a per-tenant Durable Object (`identity-do.ts`), an OIDC issuer (`oidc.ts`),
- * or a test mock all satisfy it. Swapping the implementation never touches the app.
+ * The application codes to this interface: OIDC bearer verification, the browser
+ * relying-party flow, or a test mock all satisfy it. Swapping the implementation never touches the app.
  *
  *   - `handle` — the credential/session endpoints (`/api/auth/*`): sign-up, login, logout,
  *     callbacks. The worker forwards the raw request; the provider owns what's behind it.
@@ -12,7 +11,7 @@
  *     per-scope concern (the identity directory), not the provider's job.
  */
 export interface AuthSubject {
-    /** The provider's stable subject id — a Better Auth user id, an OIDC `sub`, … */
+    /** The provider's stable subject id — an OIDC `sub` */
     sub: string;
     email: string | null;
     name: string | null;

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjD;AAED,wGAAwG;AACxG,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAClD;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAChG"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjD;AAED,wGAAwG;AACxG,MAAM,WAAW,cAAc;IAC7B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAClD;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CAChG"}

package/dist/site-registry.d.ts

@@ -3,7 +3,7 @@
  * its sites (each site IS a scope), so it can list and switch between them CP-lessly. Kept as
  * plain functions over a minimal SQLite `exec` seam rather than methods on the IdentityDO, so
  * the logic is unit-testable against a plain SQLite without standing up a Durable Object (the
- * DO module pulls in Better Auth, which the workers test pool cannot load). The IdentityDO's
+ * DO module imports cloudflare:workers, which a Node test pool cannot load). The IdentityDO's
  * `recordSite`/`listSites`/`resolveSiteScope` delegate here.
  */
 /**

package/dist/site-registry.js

@@ -3,7 +3,7 @@
  * its sites (each site IS a scope), so it can list and switch between them CP-lessly. Kept as
  * plain functions over a minimal SQLite `exec` seam rather than methods on the IdentityDO, so
  * the logic is unit-testable against a plain SQLite without standing up a Durable Object (the
- * DO module pulls in Better Auth, which the workers test pool cannot load). The IdentityDO's
+ * DO module imports cloudflare:workers, which a Node test pool cannot load). The IdentityDO's
  * `recordSite`/`listSites`/`resolveSiteScope` delegate here.
  */
 /** The `site` table (+ slug index), folded into the IdentityDO's schema statements. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@substrat-run/vertical-auth",
-  "version": "0.25.3",
-  "description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
+  "version": "0.26.1",
+  "description": "OIDC authentication for Substrat verticals — token verification, a full relying-party login flow, and a per-tenant identity directory Durable Object. Workers-targeted; the vertical worker bundles it.",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -49,13 +49,11 @@
     "dist"
   ],
   "dependencies": {
-    "better-auth": "^1.7.1",
-    "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",
-    "@substrat-run/contracts": "^0.154.0",
+    "@substrat-run/contracts": "^0.156.0",
+    "@substrat-run/kernel": "^0.156.0",
     "@substrat-run/oidc-rp": "^0.13.0",
-    "@substrat-run/psl": "^0.2.5",
-    "@substrat-run/kernel": "^0.154.0"
+    "@substrat-run/psl": "^0.2.5"
   },
   "peerDependencies": {
     "hono": "^4.13.13"
@@ -64,7 +62,9 @@
     "@cloudflare/workers-types": "^4.20250109.0",
     "@types/better-sqlite3": "^9.6.0",
     "better-sqlite3": "^13.0.3",
+    "esbuild": "^0.28.2",
     "hono": "^4.13.13",
+    "miniflare": "^4.20260310.0",
     "typescript": "^7.0.0",
     "vitest": "^5.0.5"
   },