@substrat-run/vertical-auth 0.6.0

package/dist/identity-do.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-do.js","sourceRoot":"","sources":["../src/identity-do.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,iBAAiB,EACjB,UAAU,IAAI,aAAa,EAC3B,SAAS,IAAI,YAAY,EACzB,gBAAgB,IAAI,mBAAmB,EACvC,UAAU,IAAI,aAAa,GAG5B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,iBAAiB,GAAa;IAClC;;;;0FAIwF;IACxF;;;;iEAI+D;IAC/D,oEAAoE;IACpE;;;;;;iCAM+B;IAC/B,oEAAoE;IACpE;;;0FAGwF;IACxF,qFAAqF;IACrF,sFAAsF;IACtF,uFAAuF;IACvF,mEAAmE;IACnE,uIAAuI;IACvI,uFAAuF;IACvF,+FAA+F;IAC/F,iGAAiG;IACjG,8FAA8F;IAC9F,6FAA6F;IAC7F,gGAAgG;IAChG,2FAA2F;IAC3F,mFAAmF;IACnF,iGAAiG;IACjG,0FAA0F;IAC1F,2FAA2F;IAC3F,2FAA2F;IAC3F;;;0FAGwF;IACxF,iEAAiE;IACjE,wFAAwF;IACxF,+EAA+E;IAC/E,+EAA+E;IAC/E,sFAAsF;IACtF,wFAAwF;IACxF,mDAAmD;IACnD,uIAAuI;IACvI,8FAA8F;IAC9F,yFAAyF;IACzF,wFAAwF;IACxF,yFAAyF;IACzF,mFAAmF;IACnF,GAAG,iBAAiB;CACrB,CAAC;AAMF,MAAM,OAAO,UAAW,SAAQ,aAA4B;IAC1D,6GAA6G;IACrG,UAAU,CAAU;IAE5B,YAAY,GAAuB,EAAE,GAAkB;QACrD,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,sFAAsF;YACtF,qFAAqF;YACrF,mFAAmF;YACnF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,CAAkC,CAAC;YAChI,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACtD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2DAA2D,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAA8C;QAClF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,6EAA6E,EAC7E,OAAO,EAAE,GAAG,EAAE,KAAK,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/G,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,KAAe,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,GAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC,CAAC,CAAC,CAAmC,EAAE,KAAK,CAAC;QAClJ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8DAA8D,EAAE,MAAM,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY,EAAE,IAAY;QAC1D,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,OAAO,mBAAmB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAA6B,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,SAAiB;QACtD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,0EAA0E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1H,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9H,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEpG,CAAC;QACd,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,OAAO,OAAO,KAAK,SAAS,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,GAAW;QACjD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAEhH,CAAC;QACd,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAEtG,CAAC;QACd,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1I,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,CAAC;QACnF,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB,EAAE,OAAe,EAAE,KAAoB,EAAE,SAAiB;QAC7G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACvB,8FAA8F,EAC9F,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAC9C,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAClC,uHAAuH,EACvH,OAAO,CACR,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,QAAkB,EAAE,KAAK,EAAG,CAAC,CAAC,KAAuB,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAoB,EAAE,CAAC,CAAC,CAAC;IACrK,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,4EAA4E,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,OAAO,CAAC,KAAK,SAAS,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,SAAiB;QACnD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,GAAW,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oFAAoF,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAEzI,CAAC;QACd,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6EAA6E,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACtI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qEAAqE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,kFAAkF;IAC1E,IAAI,CAAC,MAAc,EAAE,YAA4B;QACvD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAC5D,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE;YAC3E,qFAAqF;YACrF,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,iFAAiF;YACjF,oFAAoF;YACpF,sFAAsF;YACtF,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACM,KAAK,CAAC,KAAK,CAAC,OAAgB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,mBAAmB,CACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,SAAS,EAC5D,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,MAAM,OAAO,GAAuB,OAAO,EAAE,IAAI;gBAC/C,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;gBAC9F,CAAC,CAAC,IAAI,CAAC;YACT,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAiC,EACjC,MAAc,EACd,IAAgC;IAEhC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAW,EAAE;QAC5C,IAAI,CAAC,IAAI,EAAE,YAAY;YAAE,OAAO,OAAO,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export type { AuthProvider, AuthSubject } from './provider.js';
+export { oidcAuthProvider, type OidcConfig } from './oidc.js';
+export { oidcRpAuthProvider, type OidcRpConfig } from './oidc-rp-provider.js';
+export { IdentityDO, doAuthProvider, type IdentityDoEnv, type IdentityStub } from './identity-do.js';
+export { resolveCookieDomain } from './cookie-domain.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { oidcAuthProvider } from './oidc.js';
+export { oidcRpAuthProvider } from './oidc-rp-provider.js';
+export { IdentityDO, doAuthProvider } from './identity-do.js';
+export { resolveCookieDomain } from './cookie-domain.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/oidc-rp-provider.d.ts

@@ -0,0 +1,34 @@
+import type { AuthProvider } from './provider.js';
+/**
+ * Standard OIDC as a full RELYING PARTY `AuthProvider` — the browser-login counterpart
+ * of `oidcAuthProvider` (which only verifies presented bearer tokens). `handle` owns the
+ * server-side Authorization-Code + PKCE round-trip on the same paths every provider uses
+ * (`/api/auth/login` → issuer → `/api/auth/callback` → session cookie → `/api/auth/logout`),
+ * and `resolve` verifies the session cookie — falling back to bearer verification so API
+ * clients keep working against the same instance.
+ *
+ * Config is a PLAIN OBJECT, not worker env: a hosted vertical builds it per request from
+ * the scope's delivered `substrat:auth` (vertical-auth-detach.md §2.2-§2.3) plus the
+ * tenant's DO-minted session secret — one script, many issuers. The `oidc-rp` internals
+ * already take their env as a parameter everywhere, so this is the same battle-tested
+ * flow the dashboard and console run, pointed at per-instance config.
+ */
+export interface OidcRpConfig {
+    /** The issuer origin — a team's Auth Server app, Supabase, Auth0, Keycloak, … */
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /** Signs the flow + session cookies. Per-instance (DO-minted), never a worker binding. */
+    sessionSecret: string;
+    /** Expected `aud` for PRESENTED bearer tokens (the API-client path), if the issuer sets one. */
+    audience?: string;
+    /**
+     * Share the login across every surface under this parent domain (`egeryds.se` covers
+     * `crm.` and `eka.` alike) — the session cookie is set with `Domain=…` instead of
+     * host-only. Delivered per scope (`substrat:auth`), validated against the request host
+     * where the cookie is set (cookie-domain.ts); invalid ⇒ host-only, never broken sign-in.
+     */
+    cookieDomain?: string;
+}
+export declare function oidcRpAuthProvider(cfg: OidcRpConfig): AuthProvider;
+//# sourceMappingURL=oidc-rp-provider.d.ts.map

package/dist/oidc-rp-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-rp-provider.d.ts","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAI/D;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAsDD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,YAAY,CA2DlE"}

package/dist/oidc-rp-provider.js

@@ -0,0 +1,107 @@
+import { beginLogin, completeLogin, verifySession, readCookie, safePath, SESSION_COOKIE, FLOW_COOKIE, SESSION_MAXAGE, FLOW_MAXAGE, } from '@substrat-run/oidc-rp';
+import { oidcAuthProvider } from './oidc.js';
+import { resolveCookieDomain } from './cookie-domain.js';
+const envOf = (cfg) => ({
+    OIDC_ISSUER: cfg.issuer,
+    OIDC_CLIENT_ID: cfg.clientId,
+    OIDC_CLIENT_SECRET: cfg.clientSecret,
+    SESSION_SECRET: cfg.sessionSecret,
+});
+/** Serialize one Set-Cookie value — HttpOnly, Lax, path=/ (the oidc-rp mount's flags). */
+function cookie(name, value, origin, maxAge, domain) {
+    const parts = [
+        `${name}=${encodeURIComponent(value)}`,
+        'Path=/',
+        `Max-Age=${maxAge}`,
+        'HttpOnly',
+        'SameSite=Lax',
+    ];
+    if (domain)
+        parts.push(`Domain=${domain}`);
+    if (origin.startsWith('https:'))
+        parts.push('Secure');
+    return parts.join('; ');
+}
+/**
+ * Set the session cookie, host-only or domain-wide. A domain cookie and a host-only
+ * cookie with the same name are DISTINCT cookies to the browser, and a stale host-only
+ * one (from before `cookieDomain` was configured) would shadow the shared session on
+ * this hostname — so setting the domain variant also clears the host-only one, and
+ * clearing (logout) always clears both.
+ */
+function sessionCookies(value, origin, maxAge, domain) {
+    if (!domain)
+        return [cookie(SESSION_COOKIE, value, origin, maxAge)];
+    return [cookie(SESSION_COOKIE, value, origin, maxAge, domain), cookie(SESSION_COOKIE, '', origin, 0)];
+}
+function redirectWith(location, cookies) {
+    const headers = new Headers({ location });
+    for (const c of cookies)
+        headers.append('set-cookie', c);
+    return new Response(null, { status: 302, headers });
+}
+// Bearer verifiers cached per issuer+audience so the JWKS fetch survives across
+// requests in an isolate even though the provider object itself is per-request.
+const bearerCache = new Map();
+function bearerVerifier(cfg) {
+    const key = `${cfg.issuer}|${cfg.audience ?? ''}`;
+    let p = bearerCache.get(key);
+    if (!p) {
+        p = oidcAuthProvider({ issuer: cfg.issuer, ...(cfg.audience ? { audience: cfg.audience } : {}) });
+        bearerCache.set(key, p);
+    }
+    return p;
+}
+export function oidcRpAuthProvider(cfg) {
+    const env = envOf(cfg);
+    async function handle(request) {
+        const url = new URL(request.url);
+        const origin = url.origin;
+        // The flow cookie stays HOST-ONLY even with a cookieDomain: the code flow begins and
+        // completes on one hostname (redirect_uri is this origin's callback), and a domain-wide
+        // flow cookie would only let two surfaces' concurrent logins clobber each other.
+        const domain = resolveCookieDomain(cfg.cookieDomain, url.hostname);
+        if (url.pathname === '/api/auth/login') {
+            const screen = url.searchParams.get('screen_hint');
+            const { location, flow } = await beginLogin(env, origin, {
+                returnTo: safePath(url.searchParams.get('returnTo')),
+                loginHint: url.searchParams.get('login_hint') || undefined,
+                screenHint: screen === 'signup' || screen === 'login' ? screen : undefined,
+            });
+            return redirectWith(location, [cookie(FLOW_COOKIE, flow, origin, FLOW_MAXAGE)]);
+        }
+        if (url.pathname === '/api/auth/callback') {
+            const flow = readCookie(request.headers.get('cookie'), FLOW_COOKIE);
+            const clearFlow = cookie(FLOW_COOKIE, '', origin, 0);
+            try {
+                const { session, returnTo } = await completeLogin(env, origin, url, flow);
+                return redirectWith(safePath(returnTo) ?? '/', [
+                    clearFlow,
+                    ...sessionCookies(session, origin, SESSION_MAXAGE, domain),
+                ]);
+            }
+            catch (err) {
+                // Loud in the logs, opaque to the browser — same stance as the oidc-rp mount.
+                console.error('oidc.callback.failed', { reason: err instanceof Error ? err.message : String(err) });
+                return redirectWith('/?error=auth', [clearFlow]);
+            }
+        }
+        if (url.pathname === '/api/auth/logout') {
+            return redirectWith(safePath(url.searchParams.get('returnTo')) ?? '/', [
+                ...sessionCookies('', origin, 0, domain),
+            ]);
+        }
+        // Anything else under /api/auth/* (sign-up, password endpoints, …) has no server
+        // here — accounts live at the issuer. JSON, never a fall-through to the SPA.
+        return Response.json({ error: 'this instance authenticates at its OIDC issuer', issuer: cfg.issuer }, { status: 404 });
+    }
+    async function resolve(headers) {
+        const session = await verifySession(env, readCookie(headers.get('cookie'), SESSION_COOKIE));
+        if (session)
+            return { sub: session.id, email: session.email ?? null, name: session.name ?? null };
+        // No cookie session — an API client presenting the issuer's own token directly.
+        return bearerVerifier(cfg).resolve(headers);
+    }
+    return { handle, resolve };
+}
+//# sourceMappingURL=oidc-rp-provider.js.map

package/dist/oidc-rp-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-rp-provider.js","sourceRoot":"","sources":["../src/oidc-rp-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,aAAa,EACb,aAAa,EACb,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,cAAc,EACd,WAAW,GAEZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkCzD,MAAM,KAAK,GAAG,CAAC,GAAiB,EAAW,EAAE,CAAC,CAAC;IAC7C,WAAW,EAAE,GAAG,CAAC,MAAM;IACvB,cAAc,EAAE,GAAG,CAAC,QAAQ;IAC5B,kBAAkB,EAAE,GAAG,CAAC,YAAY;IACpC,cAAc,EAAE,GAAG,CAAC,aAAa;CAClC,CAAC,CAAC;AAEH,0FAA0F;AAC1F,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAsB;IACjG,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACtC,QAAQ;QACR,WAAW,MAAM,EAAE;QACnB,UAAU;QACV,cAAc;KACf,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,MAAqB;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAiB;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,SAAS,cAAc,CAAC,GAAiB;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAiB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAEvB,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,qFAAqF;QACrF,wFAAwF;QACxF,iFAAiF;QACjF,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE;gBACvD,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC1D,UAAU,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;YACpE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC1E,OAAO,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE;oBAC7C,SAAS;oBACT,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8EAA8E;gBAC9E,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE;gBACrE,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;QAED,iFAAiF;QACjF,6EAA6E;QAC7E,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAgB;QACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,IAAI,OAAO;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QAClG,gFAAgF;QAChF,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/oidc.d.ts

@@ -0,0 +1,23 @@
+import { type JWTVerifyGetKey } from 'jose';
+import type { AuthProvider } from './provider.js';
+/**
+ * Standard OIDC as an `AuthProvider` — token-based, so it covers Supabase (now an OIDC
+ * issuer), Auth0, AuthHero, Keycloak, Zitadel, … all the same way. Login happens at the
+ * issuer (the SPA redirects / uses the issuer's client and gets a token); the app just
+ * VERIFIES the presented JWT against the issuer's JWKS and reads the subject. There are no
+ * server-side auth endpoints to run, so `handle` is informational.
+ *
+ * workerd-safe: `jose` + Web Crypto only (the same stack `@substrat-run/oidc-rp` uses).
+ */
+export interface OidcConfig {
+    /** The issuer URL (`iss`) — its `/.well-known/openid-configuration` gives the JWKS. */
+    issuer: string;
+    /** Expected audience (`aud`), if the issuer sets one for this app. */
+    audience?: string;
+    /** Override the JWKS URI (skip discovery) — e.g. a self-hosted issuer. */
+    jwksUri?: string;
+    /** Inject the key resolver directly — tests / a static JWKS. Defaults to the issuer's remote JWKS. */
+    keys?: JWTVerifyGetKey;
+}
+export declare function oidcAuthProvider(cfg: OidcConfig): AuthProvider;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,MAAM,CAAC;AAC3E,OAAO,KAAK,EAAE,YAAY,EAAe,MAAM,eAAe,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AA0BD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,YAAY,CAiD9D"}

package/dist/oidc.js

@@ -0,0 +1,77 @@
+import { jwtVerify, createRemoteJWKSet } from 'jose';
+/** Discover the JWKS URI from the issuer's OIDC metadata, cached per issuer for the isolate. */
+const discoveryCache = new Map();
+function discoverJwksUri(issuer) {
+    let p = discoveryCache.get(issuer);
+    if (!p) {
+        p = (async () => {
+            const url = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+            const res = await fetch(url);
+            if (!res.ok)
+                throw new Error(`OIDC discovery failed for ${issuer}: ${res.status}`);
+            const meta = (await res.json());
+            if (!meta.jwks_uri)
+                throw new Error(`OIDC discovery for ${issuer} has no jwks_uri`);
+            return meta.jwks_uri;
+        })();
+        discoveryCache.set(issuer, p);
+    }
+    return p;
+}
+function bearerFrom(headers) {
+    const auth = headers.get('authorization');
+    if (auth?.toLowerCase().startsWith('bearer '))
+        return auth.slice(7).trim() || null;
+    return null;
+}
+export function oidcAuthProvider(cfg) {
+    let keysPromise;
+    const getKeys = async () => {
+        if (cfg.keys)
+            return cfg.keys;
+        if (!keysPromise) {
+            keysPromise = (async () => {
+                const jwksUri = cfg.jwksUri ?? (await discoverJwksUri(cfg.issuer));
+                return createRemoteJWKSet(new URL(jwksUri));
+            })();
+        }
+        return keysPromise;
+    };
+    async function verify(token) {
+        try {
+            const { payload } = await jwtVerify(token, await getKeys(), {
+                issuer: cfg.issuer,
+                ...(cfg.audience ? { audience: cfg.audience } : {}),
+            });
+            if (!payload.sub)
+                return null;
+            const meta = payload;
+            return {
+                sub: String(payload.sub),
+                email: typeof meta['email'] === 'string' ? meta['email'] : null,
+                name: typeof meta['name'] === 'string'
+                    ? meta['name']
+                    : typeof meta['user_metadata']?.name === 'string'
+                        ? (meta['user_metadata'].name)
+                        : null,
+            };
+        }
+        catch {
+            return null; // bad signature / expired / wrong issuer — resolve to nobody, fail closed
+        }
+    }
+    return {
+        async handle() {
+            return Response.json({
+                provider: 'oidc',
+                issuer: cfg.issuer,
+                note: 'authenticate at the issuer, then present the token as `Authorization: Bearer`',
+            });
+        },
+        async resolve(headers) {
+            const token = bearerFrom(headers);
+            return token ? verify(token) : null;
+        },
+    };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAwB,MAAM,MAAM,CAAC;AAuB3E,gGAAgG;AAChG,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC1D,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACd,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC;YAC5E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,kBAAkB,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC,CAAC,EAAE,CAAC;QACL,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,IAAI,WAAiD,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,IAA8B,EAAE;QACnD,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnE,OAAO,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,UAAU,MAAM,CAAC,KAAa;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,IAAI;gBAC3E,IAAI,EACF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAC9B,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY;oBAC1B,CAAC,CAAC,OAAQ,IAAI,CAAC,eAAe,CAAwB,EAAE,IAAI,KAAK,QAAQ;wBACvE,CAAC,CAAC,CAAE,IAAI,CAAC,eAAe,CAAsB,CAAC,IAAI,CAAC;wBACpD,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,0EAA0E;QACzF,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM;YACV,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,+EAA+E;aACtF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/provider.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The `AuthProvider` contract — the ONLY thing a vertical's app depends on for identity.
+ *
+ * The application codes to this interface and does not care WHICH auth is behind it: Better
+ * Auth running in a per-tenant Durable Object (`identity-do.ts`), an OIDC issuer (`oidc.ts`),
+ * or a test mock all satisfy it. Swapping the implementation never touches the app.
+ *
+ *   - `handle` — the credential/session endpoints (`/api/auth/*`): sign-up, login, logout,
+ *     callbacks. The worker forwards the raw request; the provider owns what's behind it.
+ *   - `resolve` — turn the current request into a verified subject, or null. `sub` is the
+ *     provider's stable subject id; mapping it to a Substrat `PrincipalId` is a SEPARATE,
+ *     per-scope concern (the identity directory), not the provider's job.
+ */
+export interface AuthSubject {
+    /** The provider's stable subject id — a Better Auth user id, an OIDC `sub`, … */
+    sub: string;
+    email: string | null;
+    name: string | null;
+}
+export interface AuthProvider {
+    handle(request: Request): Promise<Response>;
+    resolve(headers: Headers): Promise<AuthSubject | null>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACxD"}

package/dist/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":""}

package/dist/site-registry.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The per-tenant SITE REGISTRY (M2 of multi-scope-manyfold.md) — the vertical's own memory of
+ * its sites (each site IS a scope), so it can list and switch between them CP-lessly. Kept as
+ * plain functions over a minimal SQLite `exec` seam rather than methods on the IdentityDO, so
+ * the logic is unit-testable against a plain SQLite without standing up a Durable Object (the
+ * DO module pulls in Better Auth, which the workers test pool cannot load). The IdentityDO's
+ * `recordSite`/`listSites`/`resolveSiteScope` delegate here.
+ */
+/**
+ * The slice of `SqlStorage` the registry uses: `exec(query, ...params)` returning an iterable
+ * of row objects. Both the DO's `ctx.storage.sql` and a plain SQLite driver satisfy it.
+ */
+export interface RegistrySql {
+    exec(query: string, ...params: unknown[]): Iterable<Record<string, unknown>>;
+}
+/** The `site` table (+ slug index), folded into the IdentityDO's schema statements. */
+export declare const SITE_REGISTRY_DDL: readonly string[];
+export interface SiteRow {
+    scopeId: string;
+    slug: string;
+    name: string;
+}
+/**
+ * Record a site at provision. Idempotent: a re-provision (K-31) updates the slug/name in place
+ * but keeps `created_at`, so the switcher's ordering stays stable.
+ */
+export declare function recordSite(sql: RegistrySql, scopeId: string, slug: string, name: string): void;
+/** The tenant's sites, oldest first — the in-app site switcher's list. */
+export declare function listSites(sql: RegistrySql): SiteRow[];
+/** Drop a site from the registry — the vertical's half of archiving a scope (it no longer lists or
+ *  resolves to the archived site). Idempotent. The platform archives the scope directory-side. */
+export declare function forgetSite(sql: RegistrySql, scopeId: string): void;
+/**
+ * Resolve a site SLUG to its scope id — how the worker turns the app's `x-site` selection into
+ * the scope to open. Null ⇒ no such site. Tenant-scoped by construction: the registry lives in
+ * a per-tenant DO, so a slug can only resolve to a scope of that tenant.
+ */
+export declare function resolveSiteScope(sql: RegistrySql, slug: string): string | null;
+//# sourceMappingURL=site-registry.d.ts.map

package/dist/site-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-registry.d.ts","sourceRoot":"","sources":["../src/site-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9E;AAED,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAI9C,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQ9F;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,EAAE,CAMrD;AAED;kGACkG;AAClG,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAElE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9E"}

package/dist/site-registry.js

@@ -0,0 +1,45 @@
+/**
+ * The per-tenant SITE REGISTRY (M2 of multi-scope-manyfold.md) — the vertical's own memory of
+ * its sites (each site IS a scope), so it can list and switch between them CP-lessly. Kept as
+ * plain functions over a minimal SQLite `exec` seam rather than methods on the IdentityDO, so
+ * the logic is unit-testable against a plain SQLite without standing up a Durable Object (the
+ * DO module pulls in Better Auth, which the workers test pool cannot load). The IdentityDO's
+ * `recordSite`/`listSites`/`resolveSiteScope` delegate here.
+ */
+/** The `site` table (+ slug index), folded into the IdentityDO's schema statements. */
+export const SITE_REGISTRY_DDL = [
+    `CREATE TABLE IF NOT EXISTS site (scope_id TEXT PRIMARY KEY, slug TEXT NOT NULL, name TEXT NOT NULL,
+    created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)))`,
+    `CREATE INDEX IF NOT EXISTS site_by_slug ON site (slug)`,
+];
+/**
+ * Record a site at provision. Idempotent: a re-provision (K-31) updates the slug/name in place
+ * but keeps `created_at`, so the switcher's ordering stays stable.
+ */
+export function recordSite(sql, scopeId, slug, name) {
+    sql.exec(`INSERT INTO site (scope_id, slug, name) VALUES (?, ?, ?)
+     ON CONFLICT(scope_id) DO UPDATE SET slug = excluded.slug, name = excluded.name`, scopeId, slug, name);
+}
+/** The tenant's sites, oldest first — the in-app site switcher's list. */
+export function listSites(sql) {
+    return [...sql.exec('SELECT scope_id, slug, name FROM site ORDER BY created_at')].map((r) => ({
+        scopeId: r.scope_id,
+        slug: r.slug,
+        name: r.name,
+    }));
+}
+/** Drop a site from the registry — the vertical's half of archiving a scope (it no longer lists or
+ *  resolves to the archived site). Idempotent. The platform archives the scope directory-side. */
+export function forgetSite(sql, scopeId) {
+    sql.exec('DELETE FROM site WHERE scope_id = ?', scopeId);
+}
+/**
+ * Resolve a site SLUG to its scope id — how the worker turns the app's `x-site` selection into
+ * the scope to open. Null ⇒ no such site. Tenant-scoped by construction: the registry lives in
+ * a per-tenant DO, so a slug can only resolve to a scope of that tenant.
+ */
+export function resolveSiteScope(sql, slug) {
+    const row = [...sql.exec('SELECT scope_id FROM site WHERE slug = ?', slug)][0];
+    return row ? row.scope_id : null;
+}
+//# sourceMappingURL=site-registry.js.map

package/dist/site-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-registry.js","sourceRoot":"","sources":["../src/site-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD;0FACwF;IACxF,wDAAwD;CACzD,CAAC;AAQF;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe,EAAE,IAAY,EAAE,IAAY;IACtF,GAAG,CAAC,IAAI,CACN;oFACgF,EAChF,OAAO,EACP,IAAI,EACJ,IAAI,CACL,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,GAAgB;IACxC,OAAO,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC,CAAC,QAAkB;QAC7B,IAAI,EAAE,CAAC,CAAC,IAAc;QACtB,IAAI,EAAE,CAAC,CAAC,IAAc;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;kGACkG;AAClG,MAAM,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IAC1D,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAgB,EAAE,IAAY;IAC7D,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAEhE,CAAC;IACd,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@substrat-run/vertical-auth",
+  "version": "0.6.0",
+  "description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
+  "license": "AGPL-3.0-only",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./provider": {
+      "types": "./dist/provider.d.ts",
+      "default": "./dist/provider.js"
+    },
+    "./oidc": {
+      "types": "./dist/oidc.d.ts",
+      "default": "./dist/oidc.js"
+    },
+    "./oidc-rp-provider": {
+      "types": "./dist/oidc-rp-provider.d.ts",
+      "default": "./dist/oidc-rp-provider.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@substrat-run/oidc-rp": "workspace:^",
+    "@substrat-run/psl": "workspace:^",
+    "better-auth": "^1.6.23",
+    "drizzle-orm": "^0.45.2",
+    "jose": "^6.2.3"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20250109.0",
+    "@types/better-sqlite3": "^9.6.0",
+    "better-sqlite3": "^13.0.3",
+    "typescript": "^7.0.0",
+    "vitest": "^3.0.0"
+  }
+}