@substrat-run/vertical-auth 0.9.0 → 0.10.0

package/dist/index.d.ts

@@ -5,4 +5,5 @@ export { IdentityDO, doAuthProvider, type IdentityDoEnv, type IdentityStub } fro
 export { resolveCookieDomain } from './cookie-domain.js';
 export { FIRST_SIGN_IN_WINDOW_MS, OWNER_CLAIM_TTL_MS, type OwnerSeat } from './owner-seat.js';
 export { mintOwnerClaimLink, ownerClaimPath, sha256Hex } from './owner-claim-link.js';
+export { AUTH_CONFIG_KEY, AuthConfigError, authChoice, instanceAuthFor, parseAuthChoice, selectAuthProvider, type AuthChoice, type InstanceAuth, } from './instance-auth.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -4,4 +4,5 @@ export { IdentityDO, doAuthProvider } from './identity-do.js';
 export { resolveCookieDomain } from './cookie-domain.js';
 export { FIRST_SIGN_IN_WINDOW_MS, OWNER_CLAIM_TTL_MS } from './owner-seat.js';
 export { mintOwnerClaimLink, ownerClaimPath, sha256Hex } from './owner-claim-link.js';
+export { AUTH_CONFIG_KEY, AuthConfigError, authChoice, instanceAuthFor, parseAuthChoice, selectAuthProvider, } from './instance-auth.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAkB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EACL,eAAe,EACf,eAAe,EACf,UAAU,EACV,eAAe,EACf,eAAe,EACf,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}

package/dist/instance-auth.d.ts

@@ -0,0 +1,102 @@
+import { z, type EnvVarSpec } from '@substrat-run/contracts';
+import type { IdentityStub } from './identity-do.js';
+import type { AuthProvider } from './provider.js';
+/**
+ * ONE instance's auth wiring — the composition every OIDC-only vertical was writing
+ * for itself (#972).
+ *
+ * Four demos carried a near-identical forty-line copy of "read the delivered config,
+ * parse `substrat:auth`, resolve the declared settings, pick a provider", and they had
+ * already drifted: manyfold's copy skipped `resolveScopedEnvSpec` entirely and read
+ * `env.OIDC_ISSUER`, so a per-instance issuer saved in the dashboard never reached it
+ * (the silent-defaults bug, #374/#398); meridian's fail-closed check on an unset issuer
+ * existed only in meridian. A rule that lives in four places is four chances to be
+ * wrong about it once. It lives here now.
+ */
+/**
+ * The scope's DELIVERED auth choice (vertical-auth-detach.md §2.2/§2.3) — the
+ * `substrat:auth` entry the dashboard configured at install or in Settings.
+ *
+ * OIDC-only (oidc-only-demos.md): `oidc` is the only supported mode, so a `builtin` or
+ * malformed entry fails this parse and reads as "nothing delivered". That leniency is
+ * deliberate — a bad delivery falls back to the deployment default rather than locking
+ * an instance out of its own login.
+ */
+export declare const authChoice: z.ZodObject<{
+    mode: z.ZodLiteral<"oidc">;
+    issuer: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodOptional<z.ZodString>;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    audience: z.ZodOptional<z.ZodString>;
+    cookieDomain: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthChoice = z.infer<typeof authChoice>;
+/** The delivered-config key the dashboard writes the identity choice to. */
+export declare const AUTH_CONFIG_KEY = "substrat:auth";
+/**
+ * An instance that cannot be given a provider, with the status to answer.
+ *
+ * A plain `Error` would arrive at a vertical's error envelope as a 500, which is the
+ * wrong answer for "nobody has configured this yet" — so the status travels with the
+ * throw and each worker re-raises it in its own framework's exception.
+ */
+export declare class AuthConfigError extends Error {
+    readonly status: 500 | 503;
+    constructor(status: 500 | 503, message: string);
+}
+export interface InstanceAuth {
+    /** The parsed `substrat:auth` choice, or null when nothing usable was delivered. */
+    identity: AuthChoice | null;
+    /** The tenant's DO-minted session-signing secret. */
+    sessionSecret: string;
+    /** The declared settings, resolved delivered > binding > manifest default (#398). */
+    settings: Record<string, string | undefined>;
+    /** The whole delivered map — for a vertical's own non-declared keys. */
+    config: Record<string, string>;
+    /**
+     * The `AuthProvider` this instance's configuration selects. A function, not a field:
+     * a route that only wants `settings` must not fail because nobody has configured a
+     * login yet. Throws `AuthConfigError` when there is nothing to select.
+     */
+    provider(): AuthProvider;
+}
+/**
+ * Everything an instance was configured with, in ONE DO hop.
+ *
+ * `settings` comes from `resolveScopedEnvSpec` over the SAME delivered map the auth
+ * choice rides in — no second round-trip, and per-scope Env-tab value > worker binding >
+ * manifest default. Reading `env` directly instead is the bug this replaces: a spec
+ * `default` rides as a binding shared by every install of one serving script, so
+ * `env.OIDC_ISSUER` is the same string for every tenant no matter what any of them saved.
+ */
+export declare function instanceAuthFor(opts: {
+    /** The tenant's identity DO stub. */
+    directory: Pick<IdentityStub, 'authWiring'>;
+    scopeId: string;
+    /** The vertical's declared env spec (`CALLOUT_ENV`, `TICKET0_ENV`, …). */
+    envSpec: EnvVarSpec[];
+    /** The worker's own environment — the binding layer under the delivered map. */
+    env: Record<string, unknown>;
+}): Promise<InstanceAuth>;
+/** The delivered `substrat:auth` entry, parsed leniently: anything unusable is null. */
+export declare function parseAuthChoice(raw: string | undefined): AuthChoice | null;
+/**
+ * The provider an instance's configuration selects — the whole point of the contract.
+ *
+ * Per-SCOPE first (hosted): a delivered `substrat:auth` builds the full relying-party
+ * provider (browser login at the issuer, cookie sessions signed with the tenant's
+ * DO-minted secret, bearer fallback for API clients) — one script, many issuers.
+ * Absent that, the DEPLOYMENT default: `AUTH_PROVIDER=oidc` verifies bearer tokens
+ * against a fixed issuer (standalone deploys). Anything else is unconfigured — fail
+ * closed. The app never learns which; it only ever holds an `AuthProvider`.
+ *
+ * `AUTH_PROVIDER=oidc` with no `OIDC_ISSUER` is a 500, not a 503: the deployment asked
+ * for a provider it did not finish configuring, which is an operator's mistake, not a
+ * tenant's missing choice.
+ */
+export declare function selectAuthProvider(opts: {
+    identity: AuthChoice | null;
+    sessionSecret: string;
+    settings: Record<string, string | undefined>;
+}): AuthProvider;
+//# sourceMappingURL=instance-auth.d.ts.map

package/dist/instance-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-auth.d.ts","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU;;;;;;;iBAQrB,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,eAAe,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IAD5B,YACW,MAAM,EAAE,GAAG,GAAG,GAAG,EAC1B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,MAAM,WAAW,YAAY;IAC3B,oFAAoF;IACpF,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,IAAI,YAAY,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,qCAAqC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,GAAG,OAAO,CAAC,YAAY,CAAC,CAWxB;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9C,GAAG,YAAY,CA+Bf"}

package/dist/instance-auth.js

@@ -0,0 +1,124 @@
+import { resolveScopedEnvSpec, z } from '@substrat-run/contracts';
+import { oidcAuthProvider } from './oidc.js';
+import { oidcRpAuthProvider } from './oidc-rp-provider.js';
+/**
+ * ONE instance's auth wiring — the composition every OIDC-only vertical was writing
+ * for itself (#972).
+ *
+ * Four demos carried a near-identical forty-line copy of "read the delivered config,
+ * parse `substrat:auth`, resolve the declared settings, pick a provider", and they had
+ * already drifted: manyfold's copy skipped `resolveScopedEnvSpec` entirely and read
+ * `env.OIDC_ISSUER`, so a per-instance issuer saved in the dashboard never reached it
+ * (the silent-defaults bug, #374/#398); meridian's fail-closed check on an unset issuer
+ * existed only in meridian. A rule that lives in four places is four chances to be
+ * wrong about it once. It lives here now.
+ */
+/**
+ * The scope's DELIVERED auth choice (vertical-auth-detach.md §2.2/§2.3) — the
+ * `substrat:auth` entry the dashboard configured at install or in Settings.
+ *
+ * OIDC-only (oidc-only-demos.md): `oidc` is the only supported mode, so a `builtin` or
+ * malformed entry fails this parse and reads as "nothing delivered". That leniency is
+ * deliberate — a bad delivery falls back to the deployment default rather than locking
+ * an instance out of its own login.
+ */
+export const authChoice = z.object({
+    mode: z.literal('oidc'),
+    issuer: z.string().url().optional(),
+    clientId: z.string().min(1).optional(),
+    clientSecret: z.string().optional(),
+    audience: z.string().optional(),
+    /** Share the login across every surface under this parent domain (K-26 multi-surface). */
+    cookieDomain: z.string().min(1).optional(),
+});
+/** The delivered-config key the dashboard writes the identity choice to. */
+export const AUTH_CONFIG_KEY = 'substrat:auth';
+/**
+ * An instance that cannot be given a provider, with the status to answer.
+ *
+ * A plain `Error` would arrive at a vertical's error envelope as a 500, which is the
+ * wrong answer for "nobody has configured this yet" — so the status travels with the
+ * throw and each worker re-raises it in its own framework's exception.
+ */
+export class AuthConfigError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'AuthConfigError';
+    }
+}
+/**
+ * Everything an instance was configured with, in ONE DO hop.
+ *
+ * `settings` comes from `resolveScopedEnvSpec` over the SAME delivered map the auth
+ * choice rides in — no second round-trip, and per-scope Env-tab value > worker binding >
+ * manifest default. Reading `env` directly instead is the bug this replaces: a spec
+ * `default` rides as a binding shared by every install of one serving script, so
+ * `env.OIDC_ISSUER` is the same string for every tenant no matter what any of them saved.
+ */
+export async function instanceAuthFor(opts) {
+    const wiring = await opts.directory.authWiring(opts.scopeId);
+    const identity = parseAuthChoice(wiring.config[AUTH_CONFIG_KEY]);
+    const settings = resolveScopedEnvSpec(opts.envSpec, opts.env, wiring.config).values;
+    return {
+        identity,
+        sessionSecret: wiring.sessionSecret,
+        settings,
+        config: wiring.config,
+        provider: () => selectAuthProvider({ identity, sessionSecret: wiring.sessionSecret, settings }),
+    };
+}
+/** The delivered `substrat:auth` entry, parsed leniently: anything unusable is null. */
+export function parseAuthChoice(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = authChoice.safeParse(JSON.parse(raw));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The provider an instance's configuration selects — the whole point of the contract.
+ *
+ * Per-SCOPE first (hosted): a delivered `substrat:auth` builds the full relying-party
+ * provider (browser login at the issuer, cookie sessions signed with the tenant's
+ * DO-minted secret, bearer fallback for API clients) — one script, many issuers.
+ * Absent that, the DEPLOYMENT default: `AUTH_PROVIDER=oidc` verifies bearer tokens
+ * against a fixed issuer (standalone deploys). Anything else is unconfigured — fail
+ * closed. The app never learns which; it only ever holds an `AuthProvider`.
+ *
+ * `AUTH_PROVIDER=oidc` with no `OIDC_ISSUER` is a 500, not a 503: the deployment asked
+ * for a provider it did not finish configuring, which is an operator's mistake, not a
+ * tenant's missing choice.
+ */
+export function selectAuthProvider(opts) {
+    const { identity, settings } = opts;
+    if (identity?.mode === 'oidc') {
+        if (!identity.issuer || !identity.clientId) {
+            throw new AuthConfigError(503, "this instance's OIDC configuration is incomplete — set issuer and clientId");
+        }
+        return oidcRpAuthProvider({
+            issuer: identity.issuer,
+            clientId: identity.clientId,
+            clientSecret: identity.clientSecret ?? '',
+            sessionSecret: opts.sessionSecret,
+            ...(identity.audience ? { audience: identity.audience } : {}),
+            ...(identity.cookieDomain ? { cookieDomain: identity.cookieDomain } : {}),
+        });
+    }
+    if (settings.AUTH_PROVIDER === 'oidc') {
+        if (!settings.OIDC_ISSUER) {
+            throw new AuthConfigError(500, 'AUTH_PROVIDER=oidc but OIDC_ISSUER is unset');
+        }
+        return oidcAuthProvider({
+            issuer: settings.OIDC_ISSUER,
+            ...(settings.OIDC_AUDIENCE ? { audience: settings.OIDC_AUDIENCE } : {}),
+        });
+    }
+    throw new AuthConfigError(503, "this instance has no identity provider configured — deliver substrat:auth with mode 'oidc', or set AUTH_PROVIDER=oidc and OIDC_ISSUER");
+}
+//# sourceMappingURL=instance-auth.js.map

package/dist/instance-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-auth.js","sourceRoot":"","sources":["../src/instance-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAmB,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,0FAA0F;IAC1F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,MAAM;IADjB,YACW,MAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;sBAHN,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAQrC;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACpF,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAIlC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;YACzC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,GAAG,EACH,uIAAuI,CACxI,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/vertical-auth",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Pluggable auth for Substrat verticals — the AuthProvider contract, an OIDC provider (Supabase/Auth0/AuthHero/Keycloak), a full relying-party login flow, and a per-tenant identity Durable Object (Better Auth + sub→principal directory). Workers-targeted; the vertical worker bundles it.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -37,7 +37,8 @@
     "drizzle-orm": "^0.45.2",
     "jose": "^6.2.3",
     "@substrat-run/oidc-rp": "^0.5.1",
-    "@substrat-run/psl": "^0.2.2"
+    "@substrat-run/contracts": "^0.94.0",
+    "@substrat-run/psl": "^0.2.4"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250109.0",