@aotter/mantle-cloudflare 0.0.11-alpha.11

package/dist/auth/createAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../../src/auth/createAuth.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,eAAO,MAAM,WAAW,6CAA8C,CAAC;AACvE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAAwB,CAAC;AAExE;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,oBAAoB,GACpB,UAAU,GACV,SAAS,GACT,SAAS,GACT,UAAU,GACV,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,IAAI,GACJ,OAAO,GACP,OAAO,GACP,MAAM,GACN,OAAO,GACP,WAAW,GACX,MAAM,GACN,QAAQ,GACR,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,SAAS,GACT,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;kDAE8C;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;2CAEuC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;;;;;;kEAa8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;iEAC6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;2EACuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;8DAC0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;iDAE6C;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD;sCACkC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C;qCACiC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AA2YD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAMrE,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QACjD,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAA;SAAE,CAAC;QACzD,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SAC7B,CAAC;KACH,GAAG,IAAI,CAAC,CAAC;IACV;;mDAE+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjE;;;;kCAI8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACjD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAqBzD"}

package/dist/auth/createAuth.js

@@ -0,0 +1,360 @@
+import { betterAuth } from "better-auth";
+import { admin, emailOTP, magicLink } from "better-auth/plugins";
+import { createAccessControl } from "better-auth/plugins/access";
+import { defaultStatements } from "better-auth/plugins/admin/access";
+export const ADMIN_ROLES = ["contributor", "editor", "owner"];
+export const ADMIN_ROLE_SET = new Set(ADMIN_ROLES);
+const ac = createAccessControl(defaultStatements);
+const ownerAc = ac.newRole({
+    user: defaultStatements.user,
+    session: defaultStatements.session,
+});
+const editorAc = ac.newRole({
+    user: ["list", "ban", "get", "update"],
+    session: ["list", "revoke"],
+});
+const contributorAc = ac.newRole({
+    user: ["list", "get"],
+    session: [],
+});
+const userAc = ac.newRole({
+    user: [],
+    session: [],
+});
+/**
+ * Keys that `extras` MUST NOT contain — they have first-class fields
+ * on `AuthMethodConfig` and / or are managed by this adapter (the
+ * github `mapProfileToUser` shim). Allowing them through would let a
+ * stray entry shadow credentials or break bootstrap promotion.
+ */
+const SOCIAL_EXTRAS_RESERVED_KEYS = new Set([
+    "clientId",
+    "clientSecret",
+    "redirectURI",
+    "scope",
+    "mapProfileToUser",
+]);
+/** @internal exported for unit tests; not part of the public API. */
+export function buildSocialProviders(methods) {
+    // Better Auth's typed `socialProviders` shape names every provider
+    // key individually; assigning by computed string requires an index
+    // signature, so we build through a plain map and cast once at the
+    // return. The runtime shape matches Better Auth's expectations.
+    const out = {};
+    for (const method of methods) {
+        if (method.kind !== "social")
+            continue;
+        if (method.extras) {
+            for (const key of Object.keys(method.extras)) {
+                if (SOCIAL_EXTRAS_RESERVED_KEYS.has(key)) {
+                    throw new Error(`createAuth: social method '${method.provider}' has reserved key '${key}' in \`extras\`. ` +
+                        `Use the first-class field instead — \`extras\` is for provider-specific options only.`);
+                }
+            }
+        }
+        // GitHub-specific: stash the github login on `user.githubLogin`
+        // so `bootstrapOwner: { match: "github-login" }` keeps working.
+        // Other providers don't need an analogous shim because bootstrap
+        // matches on email for them.
+        const githubProfileMapper = method.provider === "github"
+            ? {
+                mapProfileToUser: (profile) => ({
+                    githubLogin: profile.login,
+                }),
+            }
+            : {};
+        out[method.provider] = {
+            clientId: method.clientId,
+            clientSecret: method.clientSecret,
+            ...(method.redirectURI ? { redirectURI: method.redirectURI } : {}),
+            ...(method.scope ? { scope: [...method.scope] } : {}),
+            ...(method.extras ?? {}),
+            ...githubProfileMapper,
+        };
+    }
+    return out;
+}
+/**
+ * First tag off `Accept-Language`, quality values ignored. Locale
+ * contract lives in `EmailSender.ts`.
+ */
+/** @internal exported for unit tests; not part of the public API. */
+export function pickLocale(req, fallback) {
+    const header = req?.headers.get("accept-language");
+    if (!header)
+        return fallback;
+    const first = header.split(",")[0]?.split(";")[0]?.trim();
+    return first && first.length > 0 ? first : fallback;
+}
+// Magic-link defaults override Better Auth's tighter built-ins:
+//   - 900s (15 min) link TTL — corporate mail (Outlook + Exchange,
+//     Mimecast, Proofpoint URL Defense) often has 30-60s delivery
+//     lag and users batch-check; 300s shipped too many "expired"
+//     receipts. Industry baseline: Slack 60min, Notion / Vercel
+//     24h. We split the difference and let adopters override.
+//   - 3 allowed verification attempts — mail prefetchers (Outlook
+//     Safe Links, Mimecast URL Protect, Proofpoint URL Defense)
+//     routinely consume URLs once before the user opens the email.
+//     1 attempt is genuinely broken on those inboxes.
+const MAGIC_LINK_DEFAULT_EXPIRES_SECONDS = 900;
+const MAGIC_LINK_DEFAULT_ALLOWED_ATTEMPTS = 3;
+function buildMagicLinkPlugin(method) {
+    const fallback = method.fallbackLocale ?? "en";
+    return magicLink({
+        expiresIn: method.expiresInSeconds ?? MAGIC_LINK_DEFAULT_EXPIRES_SECONDS,
+        allowedAttempts: method.allowedAttempts ?? MAGIC_LINK_DEFAULT_ALLOWED_ATTEMPTS,
+        // Returned synchronously — same fire-and-forget contract as
+        // email-otp via `advanced.backgroundTasks.handler`. The body
+        // carries the click-URL; SDK doesn't ship a template, the
+        // sender can render plain text or richer HTML.
+        sendMagicLink: (data, ctx) => {
+            const locale = pickLocale(ctx?.request, fallback);
+            return method.sender.send({
+                to: data.email,
+                subject: "Your sign-in link",
+                text: `Click to sign in: ${data.url}\nThe link expires shortly. If you didn't request this, ignore this email.`,
+                locale,
+                category: "auth.magic-link.sign-in",
+            });
+        },
+    });
+}
+function buildEmailOTPPlugin(method) {
+    const fallback = method.fallbackLocale ?? "en";
+    return emailOTP({
+        ...(method.otpLength !== undefined ? { otpLength: method.otpLength } : {}),
+        ...(method.expiresInSeconds !== undefined
+            ? { expiresIn: method.expiresInSeconds }
+            : {}),
+        ...(method.allowedAttempts !== undefined
+            ? { allowedAttempts: method.allowedAttempts }
+            : {}),
+        // Return synchronously — the promise is fire-and-forget via the
+        // `advanced.backgroundTasks.handler` we wire in `buildAuth`. For
+        // `email-verification` / `forget-password` types Better Auth only
+        // calls this when the user exists, so awaiting would leak account
+        // existence through response latency. See Better Auth's own
+        // sendVerificationOTP docstring + reviewer finding in PR #161.
+        sendVerificationOTP: (data, ctx) => {
+            const locale = pickLocale(ctx?.request, fallback);
+            return method.sender.send({
+                to: data.email,
+                subject: `Your sign-in code: ${data.otp}`,
+                text: `Your one-time code is ${data.otp}. It expires shortly. If you didn't request this, ignore this email.`,
+                locale,
+                category: `auth.email-otp.${data.type}`,
+            });
+        },
+    });
+}
+/**
+ * Cross-check bootstrap rule against registered methods. Catches the
+ * silent-no-op case where the rule's discriminator can never match
+ * any signal a registered method actually produces — e.g.
+ * `match: "github-login"` with no `github` method registered. Throws
+ * at construction so vibe-coders see the mistake before the first
+ * sign-in attempt.
+ *
+ * `match: "email"` is permissive — every Better Auth method that
+ * creates a user populates `email`, including GitHub (via the
+ * upstream profile). No registration constraint to enforce.
+ */
+/** @internal exported for unit tests; not part of the public API. */
+export function validateBootstrap(rule, methods) {
+    if (rule.match === "github-login") {
+        const hasGithub = methods.some((m) => m.kind === "social" && m.provider === "github");
+        if (!hasGithub) {
+            throw new Error("createAuth: bootstrapOwner.match='github-login' but no `social` method with provider='github' is registered. " +
+                "Either register a github social method or switch to `bootstrapOwner: { match: 'email', value: '…' }`.");
+        }
+    }
+}
+/** @internal exported for unit tests; not part of the public API. */
+export function shouldPromoteToOwner(rule, user) {
+    const target = rule.value.trim().toLowerCase();
+    switch (rule.match) {
+        case "github-login":
+            return !!user.githubLogin && user.githubLogin.toLowerCase() === target;
+        case "email":
+            return !!user.email && user.email.toLowerCase() === target;
+    }
+}
+/**
+ * Find the at-most-one method of `kind`. Throws when adopters register
+ * the same kind twice — Better Auth's plugin layer accepts duplicates
+ * silently, which would mask the intent at boot. One helper covers
+ * every singleton-shaped method (email-otp, magic-link, future ones).
+ */
+function pickSingleton(methods, kind) {
+    const matches = methods.filter((m) => m.kind === kind);
+    if (matches.length > 1) {
+        throw new Error(`createAuth: more than one \`${kind}\` method registered. Combine into one.`);
+    }
+    return matches[0];
+}
+/**
+ * Origins each registered social provider needs in
+ * `trustedOrigins`. Adding a provider that demands an extra
+ * `trustedOrigins` entry = adding a row here. Apple is the only one
+ * in 1.6.9 that hard-requires this; if Better Auth ever drops the
+ * requirement, the entry stays harmless (Better Auth dedupes).
+ */
+const SOCIAL_PROVIDER_TRUSTED_ORIGINS = {
+    apple: ["https://appleid.apple.com"],
+};
+function autoTrustedOriginsFor(methods) {
+    const origins = methods.flatMap((m) => m.kind === "social" ? SOCIAL_PROVIDER_TRUSTED_ORIGINS[m.provider] ?? [] : []);
+    return [...new Set(origins)];
+}
+/**
+ * Apple uses `response_mode=form_post` — Apple POSTs cross-site to
+ * our callback. The OAuth state cookie must have `sameSite: "none"`
+ * (and `secure: true`, which browsers require alongside) or the
+ * cookie won't ride the POST and Better Auth raises a state mismatch.
+ * Other providers don't need this. We only auto-set when Apple is
+ * registered AND the adopter hasn't already specified
+ * `defaultCookieAttributes.sameSite` themselves.
+ */
+function methodsRequireSameSiteNone(methods) {
+    return methods.some((m) => m.kind === "social" && m.provider === "apple");
+}
+function buildAuth(config) {
+    if (config.methods.length === 0) {
+        throw new Error("createAuth: methods[] is empty — register at least one AuthMethodConfig so staff can sign in.");
+    }
+    if (config.bootstrapOwner) {
+        validateBootstrap(config.bootstrapOwner, config.methods);
+    }
+    const socialProviders = buildSocialProviders(config.methods);
+    const bootstrap = config.bootstrapOwner;
+    const emailOtpMethod = pickSingleton(config.methods, "email-otp");
+    const magicLinkMethod = pickSingleton(config.methods, "magic-link");
+    // Rate limit: Better Auth's per-route limits gate on
+    // `process.env.NODE_ENV === "production"`, which is unset on
+    // Cloudflare Workers — leaving the limits silently off. When any
+    // email-shaped method is wired (free email-send-to-any-address
+    // surface) we ALWAYS turn limits on; adopter can override
+    // window/max via `config.rateLimit`.
+    const hasEmailMethod = !!(emailOtpMethod || magicLinkMethod);
+    const rateLimitDefault = hasEmailMethod
+        ? { window: 60, max: 10, enabled: true }
+        : null;
+    const rateLimit = config.rateLimit
+        ? { ...config.rateLimit, enabled: true }
+        : rateLimitDefault;
+    // `trustedOrigins`: per-provider auto-origins (Apple needs
+    // `https://appleid.apple.com`). No adopter override — Better Auth
+    // configuration is fully owned by the SDK (no escape hatch).
+    const trustedOrigins = autoTrustedOriginsFor(config.methods);
+    const sdkPlugins = [
+        admin({
+            defaultRole: "user",
+            adminRoles: [...ADMIN_ROLES],
+            ac,
+            roles: {
+                owner: ownerAc,
+                editor: editorAc,
+                contributor: contributorAc,
+                user: userAc,
+            },
+        }),
+        ...(emailOtpMethod ? [buildEmailOTPPlugin(emailOtpMethod)] : []),
+        ...(magicLinkMethod ? [buildMagicLinkPlugin(magicLinkMethod)] : []),
+    ];
+    // `user.additionalFields`: SDK owns `githubLogin` only.
+    const userConfig = {
+        additionalFields: {
+            githubLogin: {
+                type: "string",
+                required: false,
+                input: false,
+            },
+        },
+    };
+    // `advanced`: SDK owns `backgroundTasks`. Apple auto-injects
+    // `defaultCookieAttributes.sameSite: "none"` because Apple's
+    // `form_post` callback is cross-site and a `lax` cookie won't ride
+    // it (Better Auth's default raises a state-mismatch).
+    const appleNeedsCrossSite = methodsRequireSameSiteNone(config.methods);
+    const advancedConfig = {
+        ...(appleNeedsCrossSite
+            ? {
+                // Browsers require `secure: true` whenever `sameSite: "none"`.
+                defaultCookieAttributes: { secure: true, sameSite: "none" },
+            }
+            : {}),
+        // Fire-and-forget hook closes the user-existence timing oracle
+        // on OTP send — see § "Auth as contract" notes in ADR-0014.
+        backgroundTasks: {
+            handler: (p) => {
+                p.catch((err) => {
+                    // eslint-disable-next-line no-console
+                    console.error("[better-auth backgroundTask]", err);
+                });
+            },
+        },
+    };
+    // `databaseHooks`: SDK owns `user.create.after` for bootstrap-owner
+    // promotion (when `bootstrapOwner` is configured).
+    const sdkUserCreateAfter = async (user) => {
+        if (!bootstrap)
+            return;
+        const u = user;
+        if (!shouldPromoteToOwner(bootstrap, u))
+            return;
+        // Atomic check-then-promote: the `NOT EXISTS` is a GLOBAL guard —
+        // it asks "does any user already hold an admin role?". The whole
+        // statement runs as one D1 op, so two concurrent first signups
+        // can't both win: the loser's UPDATE finds an admin in the
+        // subquery and silently writes zero rows.
+        const placeholders = ADMIN_ROLES.map(() => "?").join(",");
+        const result = await config.database
+            .prepare(`UPDATE user SET role = ? WHERE id = ? AND NOT EXISTS (SELECT 1 FROM user WHERE role IN (${placeholders}))`)
+            .bind("owner", u.id, ...ADMIN_ROLES)
+            .run();
+        if ((result.meta?.changes ?? 0) === 0) {
+            // Operator-visible signal that the rule matched but a prior
+            // admin already exists — otherwise the silent no-op makes a
+            // misconfigured bootstrap rule indistinguishable from a working
+            // first-promotion.
+            console.warn(`[bootstrap] user ${u.id} matched bootstrapOwner rule but promotion was blocked — an admin user already exists.`);
+        }
+    };
+    const databaseHooks = {
+        user: {
+            create: { after: sdkUserCreateAfter },
+        },
+    };
+    return betterAuth({
+        database: config.database,
+        secret: config.secret,
+        baseURL: config.baseURL,
+        socialProviders,
+        user: userConfig,
+        ...(rateLimit ? { rateLimit } : {}),
+        trustedOrigins,
+        advanced: advancedConfig,
+        plugins: sdkPlugins,
+        databaseHooks,
+    });
+}
+export function createAuth(config) {
+    const auth = buildAuth(config);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const api = auth.api;
+    return {
+        handler: (request) => auth.handler(request),
+        getSession: (request) => api.getSession({ headers: request.headers }).then((r) => r ?? null),
+        getUserRole: async (userId) => {
+            const row = await config.database
+                .prepare("SELECT role FROM user WHERE id = ? LIMIT 1")
+                .bind(userId)
+                .first();
+            return row?.role ?? null;
+        },
+        methods: config.methods.map((m) => m.kind === "social"
+            ? { kind: "social", provider: m.provider }
+            : { kind: m.kind }),
+    };
+}
+//# sourceMappingURL=createAuth.js.map

package/dist/auth/createAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuth.js","sourceRoot":"","sources":["../../src/auth/createAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAEvE,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;AA8JxE,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAElD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC,IAAI;IAC5B,OAAO,EAAE,iBAAiB,CAAC,OAAO;CACnC,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IACtC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC5B,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;IACxB,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,UAAU;IACV,cAAc;IACd,aAAa;IACb,OAAO;IACP,kBAAkB;CACnB,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,OAAwC;IAExC,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,CAAC,QAAQ,uBAAuB,GAAG,mBAAmB;wBACxF,uFAAuF,CAC1F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,gEAAgE;QAChE,gEAAgE;QAChE,iEAAiE;QACjE,6BAA6B;QAC7B,MAAM,mBAAmB,GACvB,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC1B,CAAC,CAAC;gBACE,gBAAgB,EAAE,CAAC,OAA2B,EAAE,EAAE,CAAC,CAAC;oBAClD,WAAW,EAAE,OAAO,CAAC,KAAK;iBAC3B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YACxB,GAAG,mBAAmB;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,GAA2C,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,GAAwB,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,gEAAgE;AAChE,mEAAmE;AACnE,kEAAkE;AAClE,iEAAiE;AACjE,gEAAgE;AAChE,8DAA8D;AAC9D,kEAAkE;AAClE,gEAAgE;AAChE,mEAAmE;AACnE,sDAAsD;AACtD,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAC/C,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAE9C,SAAS,oBAAoB,CAAC,MAAyD;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,OAAO,SAAS,CAAC;QACf,SAAS,EAAE,MAAM,CAAC,gBAAgB,IAAI,kCAAkC;QACxE,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,mCAAmC;QAC9E,4DAA4D;QAC5D,6DAA6D;QAC7D,0DAA0D;QAC1D,+CAA+C;QAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE,mBAAmB;gBAC5B,IAAI,EAAE,qBAAqB,IAAI,CAAC,GAAG,4EAA4E;gBAC/G,MAAM;gBACN,QAAQ,EAAE,yBAAyB;aACpC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAwD;IACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,OAAO,QAAQ,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACP,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,mBAAmB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE,sBAAsB,IAAI,CAAC,GAAG,EAAE;gBACzC,IAAI,EAAE,yBAAyB,IAAI,CAAC,GAAG,sEAAsE;gBAC7G,MAAM;gBACN,QAAQ,EAAE,kBAAkB,IAAI,CAAC,IAAI,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAC/B,IAAwB,EACxB,OAAwC;IAExC,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACtD,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,+GAA+G;gBAC7G,uGAAuG,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,IAA8E;IAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,cAAc;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACzE,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,OAAwC,EACxC,IAAO;IAEP,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,CAAC,CAAC,EAA+C,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CACpE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,yCAAyC,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,+BAA+B,GAEjC;IACF,KAAK,EAAE,CAAC,2BAA2B,CAAC;CACrC,CAAC;AAEF,SAAS,qBAAqB,CAC5B,OAAwC;IAExC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7E,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,OAAwC;IAExC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,MAAwB;IACzC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEpE,qDAAqD;IACrD,6DAA6D;IAC7D,iEAAiE;IACjE,+DAA+D;IAC/D,0DAA0D;IAC1D,qCAAqC;IACrC,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,cAAc,IAAI,eAAe,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,cAAc;QACrC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAa,EAAE;QACjD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS;QAChC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAa,EAAE;QACjD,CAAC,CAAC,gBAAgB,CAAC;IAErB,2DAA2D;IAC3D,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC;YACJ,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC;YAC5B,EAAE;YACF,KAAK,EAAE;gBACL,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,aAAa;gBAC1B,IAAI,EAAE,MAAM;aACb;SACF,CAAC;QACF,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IAEF,wDAAwD;IACxD,MAAM,UAAU,GAAG;QACjB,gBAAgB,EAAE;YAChB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,KAAK;aACb;SACF;KACF,CAAC;IAEF,6DAA6D;IAC7D,6DAA6D;IAC7D,mEAAmE;IACnE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG;QACrB,GAAG,CAAC,mBAAmB;YACrB,CAAC,CAAC;gBACE,+DAA+D;gBAC/D,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,4DAA4D;QAC5D,eAAe,EAAE;YACf,OAAO,EAAE,CAAC,CAAmB,EAAE,EAAE;gBAC/B,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;oBACd,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAa,EAAiB,EAAE;QAChE,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,CAAC,GAAG,IAIT,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC;YAAE,OAAO;QAEhD,kEAAkE;QAClE,iEAAiE;QACjE,+DAA+D;QAC/D,2DAA2D;QAC3D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ;aACjC,OAAO,CACN,2FAA2F,YAAY,IAAI,CAC5G;aACA,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC;aACnC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,4DAA4D;YAC5D,4DAA4D;YAC5D,gEAAgE;YAChE,mBAAmB;YACnB,OAAO,CAAC,IAAI,CACV,oBAAoB,CAAC,CAAC,EAAE,wFAAwF,CACjH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,IAAI,EAAE;YACJ,MAAM,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;SACtC;KACF,CAAC;IAEF,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe;QACf,IAAI,EAAE,UAAU;QAChB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,cAAc;QACd,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,UAAU;QACnB,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAkDD,MAAM,UAAU,UAAU,CAAC,MAAwB;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,8DAA8D;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAU,CAAC;IAC5B,OAAO;QACL,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CACtB,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QAC9E,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ;iBAC9B,OAAO,CAAC,4CAA4C,CAAC;iBACrD,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,EAA2B,CAAC;YACpC,OAAO,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAiB,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;YAC1C,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/bindings/AssetsAssetServer.d.ts

@@ -0,0 +1,14 @@
+import type { AssetServer } from "@aotter/mantle-runtime";
+/**
+ * `AssetServer` impl wrapping Cloudflare's `ASSETS` binding (a
+ * `Fetcher` that serves the worker's bundled static assets). Returns
+ * the asset Response, or `null` when the asset is not found so the
+ * runtime's HTTP layer can fall back to the SPA's `index.html`
+ * catchall (React Router model).
+ */
+export declare class AssetsAssetServer implements AssetServer {
+    private readonly assets;
+    constructor(assets: Fetcher);
+    fetch(req: Request): Promise<Response | null>;
+}
+//# sourceMappingURL=AssetsAssetServer.d.ts.map

package/dist/bindings/AssetsAssetServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssetsAssetServer.d.ts","sourceRoot":"","sources":["../../src/bindings/AssetsAssetServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,WAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,OAAO;IAEtC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAKpD"}

package/dist/bindings/AssetsAssetServer.js

@@ -0,0 +1,20 @@
+/**
+ * `AssetServer` impl wrapping Cloudflare's `ASSETS` binding (a
+ * `Fetcher` that serves the worker's bundled static assets). Returns
+ * the asset Response, or `null` when the asset is not found so the
+ * runtime's HTTP layer can fall back to the SPA's `index.html`
+ * catchall (React Router model).
+ */
+export class AssetsAssetServer {
+    assets;
+    constructor(assets) {
+        this.assets = assets;
+    }
+    async fetch(req) {
+        const res = await this.assets.fetch(req);
+        if (res.status === 404)
+            return null;
+        return res;
+    }
+}
+//# sourceMappingURL=AssetsAssetServer.js.map

package/dist/bindings/AssetsAssetServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssetsAssetServer.js","sourceRoot":"","sources":["../../src/bindings/AssetsAssetServer.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,MAAe;QAAf,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAEhD,KAAK,CAAC,KAAK,CAAC,GAAY;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/bindings/D1DatabaseDriver.d.ts

@@ -0,0 +1,21 @@
+import type { BatchResult, DatabaseDriver, MigrationRunner, PreparedStatement } from "@aotter/mantle-runtime";
+/**
+ * `DatabaseDriver` impl wrapping Cloudflare's `D1Database` binding.
+ *
+ * The runtime port shape is intentionally close to D1's API (which is
+ * itself close to the SQLite C API), so this wrapper is mostly a
+ * type-narrowing pass-through. The notable behaviour is the
+ * `D1Migrations` runner: it records applied migrations in a
+ * `_clam_migrations` table so subsequent boots are idempotent.
+ *
+ * Per ADR-0011 the runtime never imports `D1Database` itself — this
+ * file is the only place in the codebase that does.
+ */
+export declare class D1DatabaseDriver implements DatabaseDriver {
+    private readonly db;
+    readonly migrations: MigrationRunner;
+    constructor(db: D1Database);
+    prepare(sql: string): PreparedStatement;
+    batch(stmts: ReadonlyArray<PreparedStatement>): Promise<readonly BatchResult[]>;
+}
+//# sourceMappingURL=D1DatabaseDriver.d.ts.map

package/dist/bindings/D1DatabaseDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1DatabaseDriver.d.ts","sourceRoot":"","sources":["../../src/bindings/D1DatabaseDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EAEd,eAAe,EACf,iBAAiB,EAElB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAiB,YAAW,cAAc;IAGzC,OAAO,CAAC,QAAQ,CAAC,EAAE;IAF/B,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;gBAER,EAAE,EAAE,UAAU;IAI3C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB;IAIjC,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC;CAStF"}

package/dist/bindings/D1DatabaseDriver.js

@@ -0,0 +1,126 @@
+/**
+ * `DatabaseDriver` impl wrapping Cloudflare's `D1Database` binding.
+ *
+ * The runtime port shape is intentionally close to D1's API (which is
+ * itself close to the SQLite C API), so this wrapper is mostly a
+ * type-narrowing pass-through. The notable behaviour is the
+ * `D1Migrations` runner: it records applied migrations in a
+ * `_clam_migrations` table so subsequent boots are idempotent.
+ *
+ * Per ADR-0011 the runtime never imports `D1Database` itself — this
+ * file is the only place in the codebase that does.
+ */
+export class D1DatabaseDriver {
+    db;
+    migrations;
+    constructor(db) {
+        this.db = db;
+        this.migrations = new D1Migrations(db);
+    }
+    prepare(sql) {
+        return wrap(this.db.prepare(sql));
+    }
+    async batch(stmts) {
+        const native = stmts.map((s) => unwrap(s));
+        const results = await this.db.batch(native);
+        return results.map((r) => ({
+            success: r.success,
+            meta: { changes: r.meta.changes ?? 0 },
+            results: r.results,
+        }));
+    }
+}
+const NATIVE = new WeakMap();
+function wrap(native) {
+    const stmt = {
+        bind: (...params) => wrap(native.bind(...params)),
+        first: () => native.first().then((v) => v ?? null),
+        all: async () => {
+            const r = await native.all();
+            return (r.results ?? []);
+        },
+        run: async () => {
+            const r = await native.run();
+            return {
+                success: r.success,
+                meta: { changes: r.meta.changes ?? 0, lastRowId: r.meta.last_row_id },
+            };
+        },
+    };
+    NATIVE.set(stmt, native);
+    return stmt;
+}
+function unwrap(stmt) {
+    const native = NATIVE.get(stmt);
+    if (!native) {
+        throw new Error("D1DatabaseDriver.batch received a statement not produced by this driver. " +
+            "Build statements via `db.prepare(...)` on the same DatabaseDriver instance.");
+    }
+    return native;
+}
+/**
+ * Migration runner. Each migration runs in its own batch — the batch
+ * includes the migration's SQL plus the `_clam_migrations` row insert,
+ * so a single migration is all-or-nothing. Migrations across boots are
+ * NOT transactional: a worker restart between migration N and N+1
+ * leaves N applied, N+1 retried on the next boot. Authors must keep
+ * each migration's SQL idempotent on retry (use `IF NOT EXISTS`,
+ * `INSERT … ON CONFLICT DO NOTHING`, etc.).
+ */
+class D1Migrations {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async runAll(migrations) {
+        await this.db
+            .prepare(`CREATE TABLE IF NOT EXISTS _migrations (id TEXT PRIMARY KEY, applied_at INTEGER NOT NULL)`)
+            .run();
+        // One-time copy from pre-rename `_clam_migrations`: idempotent
+        // via `INSERT OR IGNORE` + `IF EXISTS`, so re-running on every
+        // boot is harmless after the rows have landed. We deliberately
+        // DON'T drop the legacy table — codex CX1 showed that any
+        // copy-then-drop ordering races between concurrent boots
+        // (Worker B's INSERT runs after Worker A's DROP succeeds and
+        // crashes with `no such table`). Leaving the legacy table
+        // around costs a few KB; eliminating it isn't worth the race
+        // class. A standalone op (`mantle migrate drop-legacy`) can
+        // remove it later under operator control if desired.
+        const legacy = await this.db
+            .prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name='_clam_migrations'`)
+            .first();
+        if (legacy) {
+            await this.db
+                .prepare(`INSERT OR IGNORE INTO _migrations (id, applied_at) SELECT id, applied_at FROM _clam_migrations`)
+                .run();
+        }
+        const applied = await this.db
+            .prepare(`SELECT id FROM _migrations`)
+            .all();
+        const seen = new Set((applied.results ?? []).map((r) => r.id));
+        for (const m of migrations) {
+            if (seen.has(m.id))
+                continue;
+            const statements = splitSql(m.sql);
+            const ops = statements.map((s) => this.db.prepare(s));
+            ops.push(this.db
+                .prepare(`INSERT INTO _migrations (id, applied_at) VALUES (?, ?)`)
+                .bind(m.id, Date.now()));
+            await this.db.batch(ops);
+        }
+    }
+}
+/**
+ * D1 / SQLite accept multi-statement SQL on the wire, but `.batch`
+ * expects each statement separately. Splitting on `;` is correct for
+ * our migration corpus (DDL + INSERT seeds, no string literals
+ * containing `;`). When that ever stops being true, switch to a
+ * lexer-aware split.
+ */
+function splitSql(sql) {
+    return sql
+        .split(";")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+//# sourceMappingURL=D1DatabaseDriver.js.map

package/dist/bindings/D1DatabaseDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"D1DatabaseDriver.js","sourceRoot":"","sources":["../../src/bindings/D1DatabaseDriver.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAGE;IAFpB,UAAU,CAAkB;IAErC,YAA6B,EAAc;QAAd,OAAE,GAAF,EAAE,CAAY;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAuC;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YACtC,OAAO,EAAE,CAAC,CAAC,OAA6D;SACzE,CAAC,CAAC,CAAC;IACN,CAAC;CACF;AAED,MAAM,MAAM,GAAoD,IAAI,OAAO,EAAE,CAAC;AAE9E,SAAS,IAAI,CAAC,MAA2B;IACvC,MAAM,IAAI,GAAsB;QAC9B,IAAI,EAAE,CAAC,GAAG,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACjD,KAAK,EAAE,GAAgC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QAClF,GAAG,EAAE,KAAK,IAAiC,EAAE;YAC3C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAK,CAAC;YAChC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAiB,CAAC;QAC3C,CAAC;QACD,GAAG,EAAE,KAAK,IAAwB,EAAE;YAClC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;aACtE,CAAC;QACJ,CAAC;KACF,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,IAAuB;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY;IACa;IAA7B,YAA6B,EAAc;QAAd,OAAE,GAAF,EAAE,CAAY;IAAG,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,UAAoC;QAC/C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN,2FAA2F,CAC5F;aACA,GAAG,EAAE,CAAC;QACT,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,0DAA0D;QAC1D,yDAAyD;QACzD,6DAA6D;QAC7D,0DAA0D;QAC1D,6DAA6D;QAC7D,4DAA4D;QAC5D,qDAAqD;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,OAAO,CAAC,+EAA+E,CAAC;aACxF,KAAK,EAAoB,CAAC;QAC7B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,EAAE;iBACV,OAAO,CACN,gGAAgG,CACjG;iBACA,GAAG,EAAE,CAAC;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE;aAC1B,OAAO,CAAC,4BAA4B,CAAC;aACrC,GAAG,EAAkB,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC7B,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAA0B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAC,wDAAwD,CAAC;iBACjE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAC1B,CAAC;YACF,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/bindings/KvCacheBinding.d.ts

@@ -0,0 +1,14 @@
+import type { KvCache, KvListResult, KvPutOptions } from "@aotter/mantle-runtime";
+/**
+ * `KvCache` impl wrapping Cloudflare Workers KV. Pure pass-through —
+ * the port shape is a strict subset of the KV namespace API.
+ */
+export declare class KvCacheBinding implements KvCache {
+    private readonly kv;
+    constructor(kv: KVNamespace);
+    get(key: string): Promise<string | null>;
+    put(key: string, value: string, opts?: KvPutOptions): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(prefix: string, cursor?: string | null): Promise<KvListResult>;
+}
+//# sourceMappingURL=KvCacheBinding.d.ts.map

package/dist/bindings/KvCacheBinding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KvCacheBinding.d.ts","sourceRoot":"","sources":["../../src/bindings/KvCacheBinding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAElF;;;GAGG;AACH,qBAAa,cAAe,YAAW,OAAO;IAChC,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,WAAW;IAE5C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;CAO1E"}

package/dist/bindings/KvCacheBinding.js

@@ -0,0 +1,27 @@
+/**
+ * `KvCache` impl wrapping Cloudflare Workers KV. Pure pass-through —
+ * the port shape is a strict subset of the KV namespace API.
+ */
+export class KvCacheBinding {
+    kv;
+    constructor(kv) {
+        this.kv = kv;
+    }
+    get(key) {
+        return this.kv.get(key, "text");
+    }
+    put(key, value, opts) {
+        return this.kv.put(key, value, opts ? { expirationTtl: opts.expirationTtl } : undefined);
+    }
+    delete(key) {
+        return this.kv.delete(key);
+    }
+    async list(prefix, cursor) {
+        const r = await this.kv.list({ prefix, cursor: cursor ?? undefined });
+        return {
+            keys: r.keys.map((k) => k.name),
+            cursor: r.list_complete ? null : r.cursor ?? null,
+        };
+    }
+}
+//# sourceMappingURL=KvCacheBinding.js.map

package/dist/bindings/KvCacheBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KvCacheBinding.js","sourceRoot":"","sources":["../../src/bindings/KvCacheBinding.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,EAAe;QAAf,OAAE,GAAF,EAAE,CAAa;IAAG,CAAC;IAEhD,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,IAAmB;QACjD,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,MAAsB;QAC/C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/B,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;CACF"}