@substrat-run/vertical-auth 0.6.0

package/dist/auth-schema.js

@@ -0,0 +1,73 @@
+import { sqliteTable, text, integer, index } from 'drizzle-orm/sqlite-core';
+import { sql } from 'drizzle-orm';
+/**
+ * Better Auth's standard tables (user/session/account/verification) as a Drizzle schema,
+ * for the per-tenant identity DO's own SQLite. Timestamps are integer epoch-ms; the
+ * sub→principal binding is NOT here — it lives in the identity DO's own `identity` table,
+ * provider-agnostic (a login authenticated by OIDC has no Better Auth `user` row).
+ */
+export const user = sqliteTable('user', {
+    id: text('id').primaryKey(),
+    name: text('name').notNull(),
+    email: text('email').notNull().unique(),
+    emailVerified: integer('email_verified', { mode: 'boolean' }).default(false).notNull(),
+    image: text('image'),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' })
+        .default(sql `(cast(unixepoch('subsecond') * 1000 as integer))`)
+        .notNull(),
+    updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+        .default(sql `(cast(unixepoch('subsecond') * 1000 as integer))`)
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+});
+export const session = sqliteTable('session', {
+    id: text('id').primaryKey(),
+    expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+    token: text('token').notNull().unique(),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' })
+        .default(sql `(cast(unixepoch('subsecond') * 1000 as integer))`)
+        .notNull(),
+    updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+    ipAddress: text('ip_address'),
+    userAgent: text('user_agent'),
+    userId: text('user_id')
+        .notNull()
+        .references(() => user.id, { onDelete: 'cascade' }),
+}, (table) => [index('session_userId_idx').on(table.userId)]);
+export const account = sqliteTable('account', {
+    id: text('id').primaryKey(),
+    accountId: text('account_id').notNull(),
+    providerId: text('provider_id').notNull(),
+    userId: text('user_id')
+        .notNull()
+        .references(() => user.id, { onDelete: 'cascade' }),
+    accessToken: text('access_token'),
+    refreshToken: text('refresh_token'),
+    idToken: text('id_token'),
+    accessTokenExpiresAt: integer('access_token_expires_at', { mode: 'timestamp_ms' }),
+    refreshTokenExpiresAt: integer('refresh_token_expires_at', { mode: 'timestamp_ms' }),
+    scope: text('scope'),
+    password: text('password'),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' })
+        .default(sql `(cast(unixepoch('subsecond') * 1000 as integer))`)
+        .notNull(),
+    updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+}, (table) => [index('account_userId_idx').on(table.userId)]);
+export const verification = sqliteTable('verification', {
+    id: text('id').primaryKey(),
+    identifier: text('identifier').notNull(),
+    value: text('value').notNull(),
+    expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(),
+    createdAt: integer('created_at', { mode: 'timestamp_ms' })
+        .default(sql `(cast(unixepoch('subsecond') * 1000 as integer))`)
+        .notNull(),
+    updatedAt: integer('updated_at', { mode: 'timestamp_ms' })
+        .default(sql `(cast(unixepoch('subsecond') * 1000 as integer))`)
+        .$onUpdate(() => /* @__PURE__ */ new Date())
+        .notNull(),
+}, (table) => [index('verification_identifier_idx').on(table.identifier)]);
+//# sourceMappingURL=auth-schema.js.map

package/dist/auth-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../src/auth-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE;IACtC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,aAAa,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IACtF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,OAAO,CAAC,GAAG,CAAA,kDAAkD,CAAC;SAC9D,OAAO,EAAE;IACZ,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,OAAO,CAAC,GAAG,CAAA,kDAAkD,CAAC;SAC9D,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAChC,SAAS,EACT;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,OAAO,CAAC,GAAG,CAAA,kDAAkD,CAAC;SAC9D,OAAO,EAAE;IACZ,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;IACZ,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC1D,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAChC,SAAS,EACT;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAClF,qBAAqB,EAAE,OAAO,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACpF,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,OAAO,CAAC,GAAG,CAAA,kDAAkD,CAAC;SAC9D,OAAO,EAAE;IACZ,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;CACb,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAC1D,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CACrC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IACpE,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,OAAO,CAAC,GAAG,CAAA,kDAAkD,CAAC;SAC9D,OAAO,EAAE;IACZ,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;SACvD,OAAO,CAAC,GAAG,CAAA,kDAAkD,CAAC;SAC9D,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;SAC3C,OAAO,EAAE;CACb,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CACvE,CAAC"}

package/dist/cookie-domain.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveCookieDomain(configured: string | undefined, host: string): string | null;
+//# sourceMappingURL=cookie-domain.d.ts.map

package/dist/cookie-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-domain.d.ts","sourceRoot":"","sources":["../src/cookie-domain.ts"],"names":[],"mappings":"AAuBA,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW/F"}

package/dist/cookie-domain.js

@@ -0,0 +1,39 @@
+/**
+ * The shared-session cookie domain (vertical-auth-detach.md; the multi-surface case,
+ * K-26): a scope whose surfaces are sibling hostnames — `crm.egeryds.se`,
+ * `eka.egeryds.se`, … — shares ONE login by setting the session cookie with
+ * `Domain=egeryds.se`. The signing secret is already per-tenant (DO-minted), so the
+ * cookie verifies on every surface; the Domain attribute is the only missing piece.
+ *
+ * The domain is per-scope DELIVERED config (`substrat:auth`), never code, and it is
+ * validated HERE, where the cookie is set: it must cover the request host (equal, or a
+ * proper suffix at a label boundary) and must not be a bare TLD. A domain that fails
+ * validation degrades to a host-only cookie — sessions simply don't share — because a
+ * misdelivered config must never break sign-in.
+ *
+ * The registrable-suffix half is now enforced HERE too, not only upstream (#305, D-35):
+ * a configured domain that is itself a public suffix — `co.uk`, `pages.dev`, or any
+ * multi-level registry suffix a label-count check would miss — is rejected via the
+ * vendored Public Suffix List (`@substrat-run/psl`). A cookie on a public suffix spans
+ * every tenant registered under it, so it must never be honoured. The platform's own
+ * apex (`substrat.run`) is an ordinary registrable domain, NOT a public suffix, so it is
+ * additionally guarded upstream (the platform refuses to deliver it as a cookie-domain).
+ */
+import { isPublicSuffix } from '@substrat-run/psl';
+export function resolveCookieDomain(configured, host) {
+    if (!configured)
+        return null;
+    const domain = configured.trim().toLowerCase().replace(/^\./, '');
+    if (!domain.includes('.'))
+        return null; // a bare TLD is never a session boundary
+    const h = host.toLowerCase();
+    if (h !== domain && !h.endsWith(`.${domain}`))
+        return null; // browser would reject it anyway
+    // Registrable-suffix guard (D-35): a cookie whose Domain is a public suffix — `co.uk`,
+    // `pages.dev`, any multi-level registry suffix a label-count check misses — spans every
+    // tenant under it. Reject it; the session degrades to host-only rather than leaking.
+    if (isPublicSuffix(domain))
+        return null;
+    return domain;
+}
+//# sourceMappingURL=cookie-domain.js.map

package/dist/cookie-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-domain.js","sourceRoot":"","sources":["../src/cookie-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,UAAU,mBAAmB,CAAC,UAA8B,EAAE,IAAY;IAC9E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACjF,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IAC7F,uFAAuF;IACvF,wFAAwF;IACxF,qFAAqF;IACrF,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/identity-do.d.ts

@@ -0,0 +1,161 @@
+import { DurableObject } from 'cloudflare:workers';
+import type { AuthProvider } from './provider.js';
+import { type SiteRow } from './site-registry.js';
+export type IdentityDoEnv = Record<string, never>;
+export declare class IdentityDO extends DurableObject<IdentityDoEnv> {
+    /** This tenant's Better Auth signing secret — generated in this DO, never shared, never a worker binding. */
+    private authSecret;
+    constructor(ctx: DurableObjectState, env: IdentityDoEnv);
+    /**
+     * Upsert per-scope config delivered by the platform (vertical-auth-detach.md §2.2).
+     * Key-by-key, never a replace, so partial deliveries compose; idempotent so the
+     * reconciliation sweep can re-run it.
+     */
+    setScopeConfig(scopeId: string, entries: Array<{
+        key: string;
+        value: string;
+    }>): Promise<void>;
+    /**
+     * The config DELIVERED to one scope (dashboard Env tab → `/internal/configure` →
+     * `setScopeConfig`), as a plain map — the `delivered` argument of the contracts helper
+     * `resolveScopedEnvSpec(spec, env, delivered)`. This is the blessed read for a
+     * vertical's ORDINARY env-spec keys (issue #398): overlay these values on worker env,
+     * per-scope wins. `authWiring` below is the auth-specific composite (config + session
+     * secret in one hop); use that when you also need the secret, this when you don't.
+     */
+    getScopeConfig(scopeId: string): Promise<Record<string, string>>;
+    /**
+     * Everything the worker needs to build the scope's `AuthProvider`, in ONE round-trip:
+     * the scope's delivered config (notably `substrat:auth`) plus this tenant's
+     * session-signing secret (minted here on first use, never a worker binding — the same
+     * per-tenant-secret move as `auth_secret`). One method rather than two keeps the
+     * per-request cost at a single DO hop.
+     */
+    authWiring(scopeId: string): Promise<{
+        config: Record<string, string>;
+        sessionSecret: string;
+    }>;
+    /**
+     * Record a SITE (scope) at provision — the vertical's own memory of its sites (K-26
+     * multi-scope), used to enumerate and switch between them without reaching the control-plane
+     * directory. Idempotent: a re-provision (K-31) updates the slug/name but keeps `created_at`,
+     * so the switcher's ordering is stable.
+     */
+    recordSite(scopeId: string, slug: string, name: string): Promise<void>;
+    /** Drop a site from the registry (the vertical's half of archiving it). Idempotent. */
+    forgetSite(scopeId: string): Promise<void>;
+    /** The tenant's sites, oldest first — the in-app site switcher's list. */
+    listSites(): Promise<SiteRow[]>;
+    /**
+     * Resolve a site SLUG to its scope id within this tenant — how the worker turns the app's
+     * `x-site` selection into the scope to open. Null ⇒ no such site (the caller falls back to the
+     * routed home scope). Tenant-scoped by construction: this DO is per-tenant, so a slug can only
+     * ever resolve to a scope of THIS tenant.
+     */
+    resolveSiteScope(slug: string): Promise<string | null>;
+    /** The DO's SQLite as the registry's minimal `exec` seam (see site-registry.ts). */
+    private get registrySql();
+    /**
+     * Record the owner seat at provision. Writes BOTH the transient `pending_owner` (claimed +
+     * consumed by the first login) and the durable `owner_of_record` (#332, never consumed) in one
+     * call, so the vertical always retains who the owner is even after the seat has been claimed.
+     * Idempotent — the reconciliation sweep re-runs it.
+     */
+    setPendingOwner(scopeId: string, principal: string): Promise<void>;
+    /**
+     * The scope's durable owner of record, or null if this scope was never provisioned through this
+     * DO (a legacy scope predating #332, or a slug typo). Read by the reconcile path to re-grant the
+     * owner their role after a scope-DO wipe left the scope enforcing against an empty tuple table.
+     */
+    getOwnerOfRecord(scopeId: string): Promise<string | null>;
+    /**
+     * Is this scope awaiting first-run setup? True while its owner seat is unclaimed — the
+     * instance is provisioned but no admin has signed in yet. The worker uses this to show a
+     * "create the admin account" setup screen instead of a plain sign-in, and to keep open
+     * sign-up allowed only during this window (after the owner claims, sign-up is invite-only).
+     */
+    needsSetup(scopeId: string): Promise<boolean>;
+    /**
+     * Map a verified subject to a PrincipalId in this scope. If already bound, return it. If
+     * not, and the scope's owner seat is unclaimed, CLAIM it: bind this subject to the owner
+     * principal and consume the pending seat. Otherwise null — a valid login with no seat has
+     * no access. Provider-agnostic: the subject may come from Better Auth or an OIDC issuer.
+     */
+    resolvePrincipal(scopeId: string, sub: string): Promise<string | null>;
+    /**
+     * Record a member invite: a pre-minted `principal` + `roleKey` the caller has already
+     * granted at scope level, claimable by whoever presents the token whose hash is `tokenHash`.
+     * The plaintext token never reaches the DO — only its hash, so a DB read can't mint access.
+     */
+    createInvite(scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string): Promise<void>;
+    /** The scope's outstanding (unclaimed) invites — for the admin's pending-invites list. No token. */
+    listInvites(scopeId: string): Promise<Array<{
+        principal: string;
+        roleKey: string;
+        email: string | null;
+        createdAt: number;
+    }>>;
+    /** Is there an unclaimed invite for this token hash? (the sign-up gate consults this post-setup). */
+    inviteExists(scopeId: string, tokenHash: string): Promise<boolean>;
+    /** Withdraw an unclaimed invite by its (pre-minted) principal — the id the admin sees. */
+    revokeInvite(scopeId: string, principal: string): Promise<void>;
+    /**
+     * Claim an invite: bind this verified subject to the invite's pre-minted principal and
+     * consume the invite. Returns the principal, or null if no unclaimed invite matches the
+     * token hash. The role was granted at scope level when the invite was created, so the
+     * bound principal resolves its permissions immediately.
+     */
+    claimInvite(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
+    /** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
+    private auth;
+    /**
+     * The DO's HTTP surface (used only when Better Auth is the chosen provider). `/__session`
+     * resolves the request to an `AuthSubject`; everything else is a Better Auth request. The
+     * worker forwards requests here; Better Auth never runs in the worker.
+     *
+     * `x-substrat-cookie-domain` is the worker relaying the scope's delivered `substrat:auth`
+     * cookie-domain choice (the DO can't look it up itself — this fetch carries no scope id).
+     * The stub is reachable only from the worker, so the header is as trusted as the config;
+     * it is still re-validated against the request host before it touches a Set-Cookie.
+     */
+    fetch(request: Request): Promise<Response>;
+}
+/** A minimal stub shape — the identity DO's callable surface (avoids leaking the full class type). */
+export type IdentityStub = {
+    fetch(request: Request): Promise<Response>;
+    setScopeConfig(scopeId: string, entries: Array<{
+        key: string;
+        value: string;
+    }>): Promise<void>;
+    getScopeConfig(scopeId: string): Promise<Record<string, string>>;
+    authWiring(scopeId: string): Promise<{
+        config: Record<string, string>;
+        sessionSecret: string;
+    }>;
+    setPendingOwner(scopeId: string, principal: string): Promise<void>;
+    getOwnerOfRecord(scopeId: string): Promise<string | null>;
+    needsSetup(scopeId: string): Promise<boolean>;
+    resolvePrincipal(scopeId: string, sub: string): Promise<string | null>;
+    createInvite(scopeId: string, principal: string, roleKey: string, email: string | null, tokenHash: string): Promise<void>;
+    listInvites(scopeId: string): Promise<Array<{
+        principal: string;
+        roleKey: string;
+        email: string | null;
+        createdAt: number;
+    }>>;
+    inviteExists(scopeId: string, tokenHash: string): Promise<boolean>;
+    revokeInvite(scopeId: string, principal: string): Promise<void>;
+    claimInvite(scopeId: string, sub: string, tokenHash: string): Promise<string | null>;
+};
+/**
+ * The `AuthProvider` backed by a tenant's identity-DO stub (the `better-auth-do` config).
+ * `handle` forwards the raw request; `resolve` asks the DO's `/__session` probe, carrying
+ * the request's cookies. The worker holds only this — never Better Auth itself.
+ *
+ * `cookieDomain` (the scope's delivered `substrat:auth` choice) rides to the DO as a
+ * header because the worker holds the config and the DO holds Better Auth — see fetch().
+ */
+export declare function doAuthProvider(stub: Pick<IdentityStub, 'fetch'>, origin: string, opts?: {
+    cookieDomain?: string;
+}): AuthProvider;
+//# sourceMappingURL=identity-do.d.ts.map

package/dist/identity-do.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-do.d.ts","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAKnD,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D,OAAO,EAOL,KAAK,OAAO,EACb,MAAM,oBAAoB,CAAC;AAkF5B,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAElD,qBAAa,UAAW,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC1D,6GAA6G;IAC7G,OAAO,CAAC,UAAU,CAAU;IAE5B,YAAY,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa,EAiBtD;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnG;IAED;;;;;;;OAOG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMrE;IAED;;;;;;OAMG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CASpG;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAED,uFAAuF;IACjF,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAED,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAEpC;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;IAED,oFAAoF;IACpF,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;OAKG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvE;IAED;;;;OAIG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK9D;IAED;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlD;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY3E;IAED;;;;OAIG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9H;IAED,oGAAoG;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAKlI;IAED,qGAAqG;IAC/F,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;IAED,0FAA0F;IACpF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpE;IAED;;;;;OAKG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQzF;IAED,kFAAkF;IAClF,OAAO,CAAC,IAAI;IAkBZ;;;;;;;;;OASG;IACY,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAexD;CACF;AAED,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC9H,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtF,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,YAAY,CAcd"}

package/dist/identity-do.js

@@ -0,0 +1,326 @@
+import { DurableObject } from 'cloudflare:workers';
+import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from 'better-auth/adapters/drizzle';
+import { drizzle } from 'drizzle-orm/durable-sqlite';
+import * as schema from './auth-schema.js';
+import { resolveCookieDomain } from './cookie-domain.js';
+import { SITE_REGISTRY_DDL, recordSite as recordSiteRow, listSites as listSiteRows, resolveSiteScope as resolveSiteScopeRow, forgetSite as forgetSiteRow, } from './site-registry.js';
+/**
+ * The per-tenant IDENTITY Durable Object — one per tenant, running its OWN Better Auth
+ * over its OWN SQLite (Drizzle's Durable-Object driver, not a shared D1), and holding the
+ * provider-agnostic `sub → principal` directory. A tenant's users/sessions/credentials are
+ * isolated in its DO; there is NO per-worker `AUTH_DB` to leak across tenants.
+ *
+ * It runs in its own isolate (separate process + storage from the vertical's business-data
+ * DO), and is one of the vertical's OWN DO classes — a legal sandbox-clean binding (the
+ * contract refuses only cross-script / platform bindings).
+ *
+ * Two roles, either or both used per deployment:
+ *   - `doAuthProvider` (below) exposes Better Auth here as an `AuthProvider` (the
+ *     `better-auth-do` config). With an OIDC provider instead, Better Auth stays dormant.
+ *   - `setPendingOwner` / `resolvePrincipal` are the identity directory — used under EVERY
+ *     provider, since the subject → principal mapping is provider-independent.
+ */
+const SCHEMA_STATEMENTS = [
+    `CREATE TABLE IF NOT EXISTS user (
+    id TEXT PRIMARY KEY NOT NULL, name TEXT NOT NULL, email TEXT NOT NULL UNIQUE,
+    email_verified INTEGER NOT NULL DEFAULT 0, image TEXT,
+    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)),
+    updated_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)))`,
+    `CREATE TABLE IF NOT EXISTS session (
+    id TEXT PRIMARY KEY NOT NULL, expires_at INTEGER NOT NULL, token TEXT NOT NULL UNIQUE,
+    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)),
+    updated_at INTEGER NOT NULL, ip_address TEXT, user_agent TEXT,
+    user_id TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE)`,
+    `CREATE INDEX IF NOT EXISTS session_userId_idx ON session (user_id)`,
+    `CREATE TABLE IF NOT EXISTS account (
+    id TEXT PRIMARY KEY NOT NULL, account_id TEXT NOT NULL, provider_id TEXT NOT NULL,
+    user_id TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE,
+    access_token TEXT, refresh_token TEXT, id_token TEXT,
+    access_token_expires_at INTEGER, refresh_token_expires_at INTEGER, scope TEXT, password TEXT,
+    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)),
+    updated_at INTEGER NOT NULL)`,
+    `CREATE INDEX IF NOT EXISTS account_userId_idx ON account (user_id)`,
+    `CREATE TABLE IF NOT EXISTS verification (
+    id TEXT PRIMARY KEY NOT NULL, identifier TEXT NOT NULL, value TEXT NOT NULL, expires_at INTEGER NOT NULL,
+    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)),
+    updated_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)))`,
+    `CREATE INDEX IF NOT EXISTS verification_identifier_idx ON verification (identifier)`,
+    // The PROVIDER-AGNOSTIC identity directory: a verified subject (`sub`) → the Substrat
+    // PrincipalId it maps to, per scope (K-22 — the same login is a different principal in
+    // each scope). Independent of WHICH provider verified the subject.
+    `CREATE TABLE IF NOT EXISTS identity (scope_id TEXT NOT NULL, sub TEXT NOT NULL, principal TEXT NOT NULL, PRIMARY KEY (scope_id, sub))`,
+    // The owner seat waiting to be claimed: set at provision, consumed by the first login.
+    `CREATE TABLE IF NOT EXISTS pending_owner (scope_id TEXT PRIMARY KEY, principal TEXT NOT NULL)`,
+    // The DURABLE owner of record: also set at provision, but NEVER consumed (#332). `pending_owner`
+    // is gone the moment the owner first signs in, so it can't answer "who owns this scope" after
+    // that. This can — it's the vertical's own memory of the owner, in the per-tenant IdentityDO
+    // (a different DO from the scope's data DO), so it survives a scope-DO storage wipe. A builder-
+    // triggered reconcile reads it to re-establish the owner's role grant without the platform
+    // secret and without the CP having to persist an owner it doesn't otherwise track.
+    `CREATE TABLE IF NOT EXISTS owner_of_record (scope_id TEXT PRIMARY KEY, principal TEXT NOT NULL)`,
+    // Outstanding member invites (the post-setup join path). Each is a pre-minted principal +
+    // role the admin already granted at scope level, waiting for a login to claim it by token.
+    // Only the token's HASH is stored — the token itself lives in the accept link, never here.
+    `CREATE TABLE IF NOT EXISTS invite (
+    token_hash TEXT PRIMARY KEY, scope_id TEXT NOT NULL, principal TEXT NOT NULL,
+    role_key TEXT NOT NULL, email TEXT, claimed INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)))`,
+    `CREATE INDEX IF NOT EXISTS invite_by_scope ON invite (scope_id)`,
+    // This DO's own config — notably its session-signing secret, generated here per tenant.
+    `CREATE TABLE IF NOT EXISTS config (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,
+    // PER-SCOPE instance config, delivered by the platform via /internal/configure
+    // (vertical-auth-detach.md §2.2) — notably the scope's `substrat:auth` issuer choice.
+    // Lives here because this DO is the vertical's per-tenant harness store and the scope's
+    // own data DO exposes no harness-writable surface.
+    `CREATE TABLE IF NOT EXISTS scope_config (scope_id TEXT NOT NULL, key TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (scope_id, key))`,
+    // The tenant's SITES (K-26 multi-scope) — each site IS a scope. Recorded here at provision so
+    // the vertical can enumerate its own sites CP-lessly: the control-plane directory is the
+    // platform's list, this is the vertical's own, in the per-tenant IdentityDO (survives a
+    // scope-DO wipe). Powers the in-app switcher + the worker's slug → scope resolution. The
+    // table/queries live in `site-registry.ts` so they are unit-testable without a DO.
+    ...SITE_REGISTRY_DDL,
+];
+export class IdentityDO extends DurableObject {
+    /** This tenant's Better Auth signing secret — generated in this DO, never shared, never a worker binding. */
+    authSecret;
+    constructor(ctx, env) {
+        super(ctx, env);
+        ctx.blockConcurrencyWhile(async () => {
+            for (const stmt of SCHEMA_STATEMENTS)
+                ctx.storage.sql.exec(stmt);
+            // Load-or-generate this tenant's OWN signing secret. Each IdentityDO mints its own on
+            // first init and persists it here, so the secret is per-tenant, never leaves the DO,
+            // and needs no `wrangler secret put` (which would be one value shared across every
+            // tenant on the deployed script — the multi-tenant hazard we're avoiding).
+            const row = [...ctx.storage.sql.exec("SELECT value FROM config WHERE key = 'auth_secret'")][0];
+            if (row) {
+                this.authSecret = row.value;
+            }
+            else {
+                const bytes = crypto.getRandomValues(new Uint8Array(32));
+                this.authSecret = btoa(String.fromCharCode(...bytes));
+                ctx.storage.sql.exec("INSERT INTO config (key, value) VALUES ('auth_secret', ?)", this.authSecret);
+            }
+        });
+    }
+    /**
+     * Upsert per-scope config delivered by the platform (vertical-auth-detach.md §2.2).
+     * Key-by-key, never a replace, so partial deliveries compose; idempotent so the
+     * reconciliation sweep can re-run it.
+     */
+    async setScopeConfig(scopeId, entries) {
+        for (const { key, value } of entries) {
+            this.ctx.storage.sql.exec('INSERT OR REPLACE INTO scope_config (scope_id, key, value) VALUES (?, ?, ?)', scopeId, key, value);
+        }
+    }
+    /**
+     * The config DELIVERED to one scope (dashboard Env tab → `/internal/configure` →
+     * `setScopeConfig`), as a plain map — the `delivered` argument of the contracts helper
+     * `resolveScopedEnvSpec(spec, env, delivered)`. This is the blessed read for a
+     * vertical's ORDINARY env-spec keys (issue #398): overlay these values on worker env,
+     * per-scope wins. `authWiring` below is the auth-specific composite (config + session
+     * secret in one hop); use that when you also need the secret, this when you don't.
+     */
+    async getScopeConfig(scopeId) {
+        const config = {};
+        for (const row of this.ctx.storage.sql.exec('SELECT key, value FROM scope_config WHERE scope_id = ?', scopeId)) {
+            config[row.key] = row.value;
+        }
+        return config;
+    }
+    /**
+     * Everything the worker needs to build the scope's `AuthProvider`, in ONE round-trip:
+     * the scope's delivered config (notably `substrat:auth`) plus this tenant's
+     * session-signing secret (minted here on first use, never a worker binding — the same
+     * per-tenant-secret move as `auth_secret`). One method rather than two keeps the
+     * per-request cost at a single DO hop.
+     */
+    async authWiring(scopeId) {
+        const config = await this.getScopeConfig(scopeId);
+        let secret = [...this.ctx.storage.sql.exec("SELECT value FROM config WHERE key = 'session_secret'")][0]?.value;
+        if (!secret) {
+            const bytes = crypto.getRandomValues(new Uint8Array(32));
+            secret = btoa(String.fromCharCode(...bytes));
+            this.ctx.storage.sql.exec("INSERT INTO config (key, value) VALUES ('session_secret', ?)", secret);
+        }
+        return { config, sessionSecret: secret };
+    }
+    /**
+     * Record a SITE (scope) at provision — the vertical's own memory of its sites (K-26
+     * multi-scope), used to enumerate and switch between them without reaching the control-plane
+     * directory. Idempotent: a re-provision (K-31) updates the slug/name but keeps `created_at`,
+     * so the switcher's ordering is stable.
+     */
+    async recordSite(scopeId, slug, name) {
+        recordSiteRow(this.registrySql, scopeId, slug, name);
+    }
+    /** Drop a site from the registry (the vertical's half of archiving it). Idempotent. */
+    async forgetSite(scopeId) {
+        forgetSiteRow(this.registrySql, scopeId);
+    }
+    /** The tenant's sites, oldest first — the in-app site switcher's list. */
+    async listSites() {
+        return listSiteRows(this.registrySql);
+    }
+    /**
+     * Resolve a site SLUG to its scope id within this tenant — how the worker turns the app's
+     * `x-site` selection into the scope to open. Null ⇒ no such site (the caller falls back to the
+     * routed home scope). Tenant-scoped by construction: this DO is per-tenant, so a slug can only
+     * ever resolve to a scope of THIS tenant.
+     */
+    async resolveSiteScope(slug) {
+        return resolveSiteScopeRow(this.registrySql, slug);
+    }
+    /** The DO's SQLite as the registry's minimal `exec` seam (see site-registry.ts). */
+    get registrySql() {
+        return this.ctx.storage.sql;
+    }
+    /**
+     * Record the owner seat at provision. Writes BOTH the transient `pending_owner` (claimed +
+     * consumed by the first login) and the durable `owner_of_record` (#332, never consumed) in one
+     * call, so the vertical always retains who the owner is even after the seat has been claimed.
+     * Idempotent — the reconciliation sweep re-runs it.
+     */
+    async setPendingOwner(scopeId, principal) {
+        this.ctx.storage.sql.exec('INSERT OR REPLACE INTO pending_owner (scope_id, principal) VALUES (?, ?)', scopeId, principal);
+        this.ctx.storage.sql.exec('INSERT OR REPLACE INTO owner_of_record (scope_id, principal) VALUES (?, ?)', scopeId, principal);
+    }
+    /**
+     * The scope's durable owner of record, or null if this scope was never provisioned through this
+     * DO (a legacy scope predating #332, or a slug typo). Read by the reconcile path to re-grant the
+     * owner their role after a scope-DO wipe left the scope enforcing against an empty tuple table.
+     */
+    async getOwnerOfRecord(scopeId) {
+        const row = [...this.ctx.storage.sql.exec('SELECT principal FROM owner_of_record WHERE scope_id = ?', scopeId)][0];
+        return row?.principal ?? null;
+    }
+    /**
+     * Is this scope awaiting first-run setup? True while its owner seat is unclaimed — the
+     * instance is provisioned but no admin has signed in yet. The worker uses this to show a
+     * "create the admin account" setup screen instead of a plain sign-in, and to keep open
+     * sign-up allowed only during this window (after the owner claims, sign-up is invite-only).
+     */
+    async needsSetup(scopeId) {
+        const pending = [...this.ctx.storage.sql.exec('SELECT 1 FROM pending_owner WHERE scope_id = ?', scopeId)][0];
+        return pending !== undefined;
+    }
+    /**
+     * Map a verified subject to a PrincipalId in this scope. If already bound, return it. If
+     * not, and the scope's owner seat is unclaimed, CLAIM it: bind this subject to the owner
+     * principal and consume the pending seat. Otherwise null — a valid login with no seat has
+     * no access. Provider-agnostic: the subject may come from Better Auth or an OIDC issuer.
+     */
+    async resolvePrincipal(scopeId, sub) {
+        const bound = [...this.ctx.storage.sql.exec('SELECT principal FROM identity WHERE scope_id = ? AND sub = ?', scopeId, sub)][0];
+        if (bound)
+            return bound.principal;
+        const pending = [...this.ctx.storage.sql.exec('SELECT principal FROM pending_owner WHERE scope_id = ?', scopeId)][0];
+        if (!pending)
+            return null;
+        this.ctx.storage.sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, pending.principal);
+        this.ctx.storage.sql.exec('DELETE FROM pending_owner WHERE scope_id = ?', scopeId);
+        return pending.principal;
+    }
+    /**
+     * Record a member invite: a pre-minted `principal` + `roleKey` the caller has already
+     * granted at scope level, claimable by whoever presents the token whose hash is `tokenHash`.
+     * The plaintext token never reaches the DO — only its hash, so a DB read can't mint access.
+     */
+    async createInvite(scopeId, principal, roleKey, email, tokenHash) {
+        this.ctx.storage.sql.exec('INSERT INTO invite (token_hash, scope_id, principal, role_key, email) VALUES (?, ?, ?, ?, ?)', tokenHash, scopeId, principal, roleKey, email);
+    }
+    /** The scope's outstanding (unclaimed) invites — for the admin's pending-invites list. No token. */
+    async listInvites(scopeId) {
+        return [...this.ctx.storage.sql.exec('SELECT principal, role_key, email, created_at FROM invite WHERE scope_id = ? AND claimed = 0 ORDER BY created_at DESC', scopeId)].map((r) => ({ principal: r.principal, roleKey: r.role_key, email: r.email ?? null, createdAt: r.created_at }));
+    }
+    /** Is there an unclaimed invite for this token hash? (the sign-up gate consults this post-setup). */
+    async inviteExists(scopeId, tokenHash) {
+        const r = [...this.ctx.storage.sql.exec('SELECT 1 FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0', scopeId, tokenHash)][0];
+        return r !== undefined;
+    }
+    /** Withdraw an unclaimed invite by its (pre-minted) principal — the id the admin sees. */
+    async revokeInvite(scopeId, principal) {
+        this.ctx.storage.sql.exec('DELETE FROM invite WHERE scope_id = ? AND principal = ? AND claimed = 0', scopeId, principal);
+    }
+    /**
+     * Claim an invite: bind this verified subject to the invite's pre-minted principal and
+     * consume the invite. Returns the principal, or null if no unclaimed invite matches the
+     * token hash. The role was granted at scope level when the invite was created, so the
+     * bound principal resolves its permissions immediately.
+     */
+    async claimInvite(scopeId, sub, tokenHash) {
+        const inv = [...this.ctx.storage.sql.exec('SELECT principal FROM invite WHERE scope_id = ? AND token_hash = ? AND claimed = 0', scopeId, tokenHash)][0];
+        if (!inv)
+            return null;
+        this.ctx.storage.sql.exec('INSERT OR REPLACE INTO identity (scope_id, sub, principal) VALUES (?, ?, ?)', scopeId, sub, inv.principal);
+        this.ctx.storage.sql.exec('UPDATE invite SET claimed = 1 WHERE scope_id = ? AND token_hash = ?', scopeId, tokenHash);
+        return inv.principal;
+    }
+    /** A Better Auth instance over THIS DO's SQLite, trusting the caller's origin. */
+    auth(origin, cookieDomain) {
+        const db = drizzle(this.ctx.storage, { schema });
+        return betterAuth({
+            database: drizzleAdapter(db, { provider: 'sqlite', schema }),
+            emailAndPassword: { enabled: true, autoSignIn: true, minPasswordLength: 8 },
+            // Per-tenant, generated + persisted in THIS DO (see the constructor) — never shared.
+            secret: this.authSecret,
+            baseURL: origin,
+            trustedOrigins: [origin],
+            // Shared login across a scope's surfaces (crm.…, eka.… — one parent domain): the
+            // session cookie rides `Domain=…` instead of host-only. Verified everywhere already
+            // (one per-tenant secret, this DO); the attribute is the only thing that was missing.
+            ...(cookieDomain
+                ? { advanced: { crossSubDomainCookies: { enabled: true, domain: cookieDomain } } }
+                : {}),
+        });
+    }
+    /**
+     * The DO's HTTP surface (used only when Better Auth is the chosen provider). `/__session`
+     * resolves the request to an `AuthSubject`; everything else is a Better Auth request. The
+     * worker forwards requests here; Better Auth never runs in the worker.
+     *
+     * `x-substrat-cookie-domain` is the worker relaying the scope's delivered `substrat:auth`
+     * cookie-domain choice (the DO can't look it up itself — this fetch carries no scope id).
+     * The stub is reachable only from the worker, so the header is as trusted as the config;
+     * it is still re-validated against the request host before it touches a Set-Cookie.
+     */
+    async fetch(request) {
+        const url = new URL(request.url);
+        const cookieDomain = resolveCookieDomain(request.headers.get('x-substrat-cookie-domain') ?? undefined, url.hostname);
+        const auth = this.auth(url.origin, cookieDomain);
+        if (url.pathname === '/__session') {
+            const session = await auth.api.getSession({ headers: request.headers });
+            const subject = session?.user
+                ? { sub: session.user.id, email: session.user.email ?? null, name: session.user.name ?? null }
+                : null;
+            return Response.json(subject);
+        }
+        return auth.handler(request);
+    }
+}
+/**
+ * The `AuthProvider` backed by a tenant's identity-DO stub (the `better-auth-do` config).
+ * `handle` forwards the raw request; `resolve` asks the DO's `/__session` probe, carrying
+ * the request's cookies. The worker holds only this — never Better Auth itself.
+ *
+ * `cookieDomain` (the scope's delivered `substrat:auth` choice) rides to the DO as a
+ * header because the worker holds the config and the DO holds Better Auth — see fetch().
+ */
+export function doAuthProvider(stub, origin, opts) {
+    const forward = (request) => {
+        if (!opts?.cookieDomain)
+            return request;
+        const relayed = new Request(request);
+        relayed.headers.set('x-substrat-cookie-domain', opts.cookieDomain);
+        return relayed;
+    };
+    return {
+        handle: (request) => stub.fetch(forward(request)),
+        async resolve(headers) {
+            const res = await stub.fetch(new Request(`${origin}/__session`, { headers }));
+            return (await res.json());
+        },
+    };
+}
+//# sourceMappingURL=identity-do.js.map