- 'paskia init [rp-id] [rp-name]' and 'paskia migrate [rp-id]' are now
positional; comma separation and the --rp-id/--rp-name flags are gone.
- With an existing paskia.kantadb, init adds the rp-id as a new domain
(seeding its OIDC provider) or updates an existing domain's rp-name.
- Origin allow-list semantics clarified: the bare '*' entry allows
anything within the rp-id domain on any scheme and port (also the
empty-list default and its display in the admin UI, replacing the
synthetic '*.rp-id' row); '*.x' wildcards are https-only; exact entries
match scheme, host and port. Legacy '*.rp-id' wildcards migrate to '*'
to preserve their any-scheme meaning.
LeoVasanko
7ff8869e1d