@aotter/mantle-cloudflare 0.0.11-alpha.11

package/dist/bindings/R2MediaStorage.d.ts

@@ -0,0 +1,80 @@
+import { AwsClient } from "aws4fetch";
+import { type CommitUploadArgs, type CreateUploadArgs, type CreateUploadResult, type DeleteAssetArgs, type GetPublicUrlArgs, type IdGenerator, type MediaAsset, type MediaStorage } from "@aotter/mantle-runtime";
+/**
+ * `R2MediaStorage` — `MediaStorage` adapter backed by Cloudflare R2,
+ * **public bucket only**.
+ *
+ * The bound R2 bucket is expected to have public access enabled and
+ * (typically) a custom domain or `pub-<hash>.r2.dev` URL pointing at
+ * it. Reads bypass the Worker entirely. CORS on the bucket should be
+ * scoped to the admin SPA origin so browser direct PUTs work without
+ * exposing other origins.
+ *
+ * Two access modes — both required:
+ *   - `bucket` (`R2Bucket` binding) — server-side `get` / `put` /
+ *     `delete`. Used at commit-time to read uploaded-object metadata
+ *     and rewrite it with `committedAt`, and to clean up failed
+ *     uploads.
+ *   - `s3` (`AwsClient` from `aws4fetch`) — SigV4 presigned PUT URL
+ *     generation. The R2 binding cannot issue presigned URLs.
+ *
+ * Public URL resolution is fully consumer-supplied via `publicBase`.
+ * The hash in `pub-<hash>.r2.dev` is opaque (assigned only after the
+ * user enables public access on the bucket); custom domains are
+ * configured separately. Adapters never derive the public URL from
+ * account / bucket — the consumer must wire it through the `cmsConfig`
+ * env (typically `MEDIA_PUBLIC_URL_BASE`).
+ *
+ * # Future: private bucket adapter
+ *
+ * A v0.2 `R2PrivateMediaStorage` will live alongside this class and
+ * implement a separate `PrivateMediaStorage` port. It binds a
+ * different R2 bucket — public access disabled — and routes every
+ * read through a Worker policy gate (staff / subscription check)
+ * before streaming via `bucket.get()` or 302-ing to a short-lived
+ * signed GET. **Two buckets, two ports**, by design — see ADR-0011
+ * § "Public vs private media — two buckets, two ports". Don't bolt
+ * a `visibility` flag onto this class to handle private content.
+ */
+export declare class R2MediaStorage implements MediaStorage {
+    private readonly bucket;
+    private readonly s3;
+    /** S3 endpoint for THIS bucket — must include the bucket as the
+     *  subdomain, e.g. `https://<bucket>.<account>.r2.cloudflarestorage.com`.
+     *  Used as the host for presigned PUT URLs. */
+    private readonly s3Endpoint;
+    /** ID source for `uploadId` and the random portion of `storageKey`.
+     *  Defaults to `RandomUuidGenerator`; tests inject a deterministic
+     *  fake to assert exact key strings. **Production must use a
+     *  CSPRNG-backed generator** — `uploadId` is bearer-token-equivalent
+     *  and a predictable storageKey leaks pre-commit object locations.
+     *  See `IdGenerator`'s "Security invariant". */
+    private readonly idgen;
+    constructor(bucket: R2Bucket, s3: AwsClient, 
+    /** S3 endpoint for THIS bucket — must include the bucket as the
+     *  subdomain, e.g. `https://<bucket>.<account>.r2.cloudflarestorage.com`.
+     *  Used as the host for presigned PUT URLs. */
+    s3Endpoint: string, 
+    /** Public read-base URL — `https://media.example.com` (custom
+     *  domain) or `https://pub-<hash>.r2.dev` (R2 public dev domain).
+     *  Trailing slash is normalised away. */
+    publicBase: string, 
+    /** ID source for `uploadId` and the random portion of `storageKey`.
+     *  Defaults to `RandomUuidGenerator`; tests inject a deterministic
+     *  fake to assert exact key strings. **Production must use a
+     *  CSPRNG-backed generator** — `uploadId` is bearer-token-equivalent
+     *  and a predictable storageKey leaks pre-commit object locations.
+     *  See `IdGenerator`'s "Security invariant". */
+    idgen?: IdGenerator);
+    private readonly publicBase;
+    createUpload(args: CreateUploadArgs): Promise<CreateUploadResult>;
+    commitUpload(args: CommitUploadArgs): Promise<MediaAsset>;
+    getPublicUrl(args: GetPublicUrlArgs): Promise<string>;
+    deleteAsset(args: DeleteAssetArgs): Promise<void>;
+    /** Object keys are server-generated. The mime-derived extension is
+     *  purely cosmetic — server-side serving never infers content-type
+     *  from the key. Purpose, when supplied, becomes a dir-prefix so an
+     *  operator can eyeball "post-cover/abc123.jpg" in R2 dashboards. */
+    private buildStorageKey;
+}
+//# sourceMappingURL=R2MediaStorage.d.ts.map

package/dist/bindings/R2MediaStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"R2MediaStorage.d.ts","sourceRoot":"","sources":["../../src/bindings/R2MediaStorage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAAa,cAAe,YAAW,YAAY;IAE/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB;;mDAE+C;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAK3B;;;;;oDAKgD;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAhBL,MAAM,EAAE,QAAQ,EAChB,EAAE,EAAE,SAAS;IAC9B;;mDAE+C;IAC9B,UAAU,EAAE,MAAM;IACnC;;6CAEyC;IACzC,UAAU,EAAE,MAAM;IAClB;;;;;oDAKgD;IAC/B,KAAK,GAAE,WAAiC;IAgB3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAE9B,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiCjE,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IA2DzD,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrD,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD;;;yEAGqE;IACrE,OAAO,CAAC,eAAe;CAMxB"}

package/dist/bindings/R2MediaStorage.js

@@ -0,0 +1,189 @@
+import { DiagnosticError, makeDiagnostic } from "@aotter/mantle-spec";
+import { RandomUuidGenerator, extensionForMime, } from "@aotter/mantle-runtime";
+/**
+ * `R2MediaStorage` — `MediaStorage` adapter backed by Cloudflare R2,
+ * **public bucket only**.
+ *
+ * The bound R2 bucket is expected to have public access enabled and
+ * (typically) a custom domain or `pub-<hash>.r2.dev` URL pointing at
+ * it. Reads bypass the Worker entirely. CORS on the bucket should be
+ * scoped to the admin SPA origin so browser direct PUTs work without
+ * exposing other origins.
+ *
+ * Two access modes — both required:
+ *   - `bucket` (`R2Bucket` binding) — server-side `get` / `put` /
+ *     `delete`. Used at commit-time to read uploaded-object metadata
+ *     and rewrite it with `committedAt`, and to clean up failed
+ *     uploads.
+ *   - `s3` (`AwsClient` from `aws4fetch`) — SigV4 presigned PUT URL
+ *     generation. The R2 binding cannot issue presigned URLs.
+ *
+ * Public URL resolution is fully consumer-supplied via `publicBase`.
+ * The hash in `pub-<hash>.r2.dev` is opaque (assigned only after the
+ * user enables public access on the bucket); custom domains are
+ * configured separately. Adapters never derive the public URL from
+ * account / bucket — the consumer must wire it through the `cmsConfig`
+ * env (typically `MEDIA_PUBLIC_URL_BASE`).
+ *
+ * # Future: private bucket adapter
+ *
+ * A v0.2 `R2PrivateMediaStorage` will live alongside this class and
+ * implement a separate `PrivateMediaStorage` port. It binds a
+ * different R2 bucket — public access disabled — and routes every
+ * read through a Worker policy gate (staff / subscription check)
+ * before streaming via `bucket.get()` or 302-ing to a short-lived
+ * signed GET. **Two buckets, two ports**, by design — see ADR-0011
+ * § "Public vs private media — two buckets, two ports". Don't bolt
+ * a `visibility` flag onto this class to handle private content.
+ */
+export class R2MediaStorage {
+    bucket;
+    s3;
+    s3Endpoint;
+    idgen;
+    constructor(bucket, s3, 
+    /** S3 endpoint for THIS bucket — must include the bucket as the
+     *  subdomain, e.g. `https://<bucket>.<account>.r2.cloudflarestorage.com`.
+     *  Used as the host for presigned PUT URLs. */
+    s3Endpoint, 
+    /** Public read-base URL — `https://media.example.com` (custom
+     *  domain) or `https://pub-<hash>.r2.dev` (R2 public dev domain).
+     *  Trailing slash is normalised away. */
+    publicBase, 
+    /** ID source for `uploadId` and the random portion of `storageKey`.
+     *  Defaults to `RandomUuidGenerator`; tests inject a deterministic
+     *  fake to assert exact key strings. **Production must use a
+     *  CSPRNG-backed generator** — `uploadId` is bearer-token-equivalent
+     *  and a predictable storageKey leaks pre-commit object locations.
+     *  See `IdGenerator`'s "Security invariant". */
+    idgen = RandomUuidGenerator) {
+        this.bucket = bucket;
+        this.s3 = s3;
+        this.s3Endpoint = s3Endpoint;
+        this.idgen = idgen;
+        if (!publicBase) {
+            throw new DiagnosticError(makeDiagnostic({
+                code: "MEDIA_NOT_CONFIGURED",
+                phase: "runtime",
+                severity: "error",
+                path: "adapter/R2MediaStorage",
+                expected: "publicBase URL (set MEDIA_PUBLIC_URL_BASE)",
+            }));
+        }
+        this.publicBase = publicBase.replace(/\/+$/, "");
+    }
+    publicBase;
+    async createUpload(args) {
+        const uploadId = this.idgen.next();
+        const storageKey = this.buildStorageKey(args.mimeType, args.purpose);
+        const ttlSeconds = Math.max(60, Math.floor((args.expiresAt - args.now) / 1000));
+        // Sign-as-query: PUT URL with the SigV4 signature in the query
+        // string. Browsers / agents PUT to this URL and we don't ask
+        // them to mint signing headers.
+        //
+        // Why sign nothing else: pinning Content-Type into the signature
+        // forces clients to send EXACTLY that header — browsers will
+        // strip mismatches and produce 403s. Pinning Content-Length is
+        // pointless because it's a forbidden header. The signature
+        // already constrains key + method + expiry; mime + size + etag
+        // are re-verified at commit-time via `bucket.get`.
+        const target = new URL(`${this.s3Endpoint.replace(/\/+$/, "")}/${storageKey}`);
+        target.searchParams.set("X-Amz-Expires", String(ttlSeconds));
+        const signed = await this.s3.sign(target.toString(), {
+            method: "PUT",
+            aws: { signQuery: true, service: "s3" },
+        });
+        return {
+            uploadId,
+            method: "PUT",
+            uploadUrl: signed.url,
+            storageKey,
+            expiresAt: args.expiresAt,
+            requiredHeaders: { "Content-Type": args.mimeType },
+            publicUrl: `${this.publicBase}/${storageKey}`,
+        };
+    }
+    async commitUpload(args) {
+        // Single `get` covers existence + metadata + body stream for the
+        // metadata-rewrite PUT. R2 has no metadata-only patch; the PUT
+        // streams `existing.body` (a ReadableStream) back without
+        // materialising bytes in Worker memory.
+        const existing = await this.bucket.get(args.storageKey);
+        if (!existing)
+            throw mediaDiagnostic("MEDIA_OBJECT_NOT_FOUND", { value: args.uploadId });
+        const actualMime = existing.httpMetadata?.contentType ?? "application/octet-stream";
+        if (args.checksum) {
+            // R2 always returns an etag for stored objects, but fail closed
+            // if it's missing for any reason — a supplied checksum that
+            // can't be verified must not silently no-op.
+            const etag = existing.etag?.replace(/^"|"$/g, "") ?? "";
+            if (etag !== args.checksum) {
+                throw mediaDiagnostic("MEDIA_CHECKSUM_MISMATCH", {
+                    value: existing.etag ?? "(no etag returned)",
+                    expected: args.checksum,
+                });
+            }
+        }
+        if (actualMime !== args.expectedMimeType) {
+            throw mediaDiagnostic("MEDIA_MIME_REJECTED", {
+                value: actualMime,
+                expected: args.expectedMimeType,
+            });
+        }
+        if (existing.size > args.maxBytes) {
+            throw mediaDiagnostic("MEDIA_SIZE_EXCEEDED", {
+                value: existing.size,
+                expected: `<= ${args.maxBytes}`,
+            });
+        }
+        const customMetadata = {
+            ...existing.customMetadata,
+            committedAt: String(args.now),
+        };
+        if (args.alt)
+            customMetadata["alt"] = args.alt;
+        if (args.caption)
+            customMetadata["caption"] = args.caption;
+        await this.bucket.put(args.storageKey, existing.body, {
+            httpMetadata: { contentType: actualMime },
+            customMetadata,
+        });
+        return {
+            id: args.uploadId,
+            storageKey: args.storageKey,
+            publicUrl: `${this.publicBase}/${args.storageKey}`,
+            mimeType: actualMime,
+            byteSize: existing.size,
+            alt: args.alt,
+            caption: args.caption,
+            createdAt: args.now,
+            metadata: customMetadata,
+        };
+    }
+    async getPublicUrl(args) {
+        return `${this.publicBase}/${args.storageKey}`;
+    }
+    async deleteAsset(args) {
+        await this.bucket.delete(args.storageKey);
+    }
+    /** Object keys are server-generated. The mime-derived extension is
+     *  purely cosmetic — server-side serving never infers content-type
+     *  from the key. Purpose, when supplied, becomes a dir-prefix so an
+     *  operator can eyeball "post-cover/abc123.jpg" in R2 dashboards. */
+    buildStorageKey(mimeType, purpose) {
+        const id = this.idgen.next();
+        const ext = extensionForMime(mimeType);
+        const prefix = purpose && /^[a-z0-9-]+$/.test(purpose) ? `${purpose}/` : "";
+        return `${prefix}${id}.${ext}`;
+    }
+}
+function mediaDiagnostic(code, fields) {
+    return new DiagnosticError(makeDiagnostic({
+        code,
+        phase: "runtime",
+        severity: "error",
+        path: "adapter/R2MediaStorage/commitUpload",
+        ...fields,
+    }));
+}
+//# sourceMappingURL=R2MediaStorage.js.map

package/dist/bindings/R2MediaStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"R2MediaStorage.js","sourceRoot":"","sources":["../../src/bindings/R2MediaStorage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GASjB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,OAAO,cAAc;IAEN;IACA;IAIA;IAWA;IAjBnB,YACmB,MAAgB,EAChB,EAAa;IAC9B;;mDAE+C;IAC9B,UAAkB;IACnC;;6CAEyC;IACzC,UAAkB;IAClB;;;;;oDAKgD;IAC/B,QAAqB,mBAAmB;QAhBxC,WAAM,GAAN,MAAM,CAAU;QAChB,OAAE,GAAF,EAAE,CAAW;QAIb,eAAU,GAAV,UAAU,CAAQ;QAWlB,UAAK,GAAL,KAAK,CAAmC;QAEzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,cAAc,CAAC;gBACb,IAAI,EAAE,sBAAsB;gBAC5B,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,4CAA4C;aACvD,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAEgB,UAAU,CAAS;IAEpC,KAAK,CAAC,YAAY,CAAC,IAAsB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAEhF,+DAA+D;QAC/D,6DAA6D;QAC7D,gCAAgC;QAChC,EAAE;QACF,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,2DAA2D;QAC3D,+DAA+D;QAC/D,mDAAmD;QACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;YACnD,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;SACxC,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE;YAClD,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,UAAU,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAsB;QACvC,iEAAiE;QACjE,+DAA+D;QAC/D,0DAA0D;QAC1D,wCAAwC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ;YAAE,MAAM,eAAe,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEzF,MAAM,UAAU,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,IAAI,0BAA0B,CAAC;QACpF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,gEAAgE;YAChE,4DAA4D;YAC5D,6CAA6C;YAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YACxD,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,eAAe,CAAC,yBAAyB,EAAE;oBAC/C,KAAK,EAAE,QAAQ,CAAC,IAAI,IAAI,oBAAoB;oBAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzC,MAAM,eAAe,CAAC,qBAAqB,EAAE;gBAC3C,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,IAAI,CAAC,gBAAgB;aAChC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,eAAe,CAAC,qBAAqB,EAAE;gBAC3C,KAAK,EAAE,QAAQ,CAAC,IAAI;gBACpB,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAA2B;YAC7C,GAAG,QAAQ,CAAC,cAAc;YAC1B,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC9B,CAAC;QACF,IAAI,IAAI,CAAC,GAAG;YAAE,cAAc,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QAC/C,IAAI,IAAI,CAAC,OAAO;YAAE,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QAE3D,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;YACpD,YAAY,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;YACzC,cAAc;SACf,CAAC,CAAC;QAEH,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,QAAQ;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE;YAClD,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,QAAQ,EAAE,cAAc;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAsB;QACvC,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAqB;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;;yEAGqE;IAC7D,eAAe,CAAC,QAAgB,EAAE,OAAgB;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,GAAG,MAAM,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC;IACjC,CAAC;CACF;AAED,SAAS,eAAe,CACtB,IAI6B,EAC7B,MAA6C;IAE7C,OAAO,IAAI,eAAe,CACxB,cAAc,CAAC;QACb,IAAI;QACJ,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,qCAAqC;QAC3C,GAAG,MAAM;KACV,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/bindings/WorkersQueueHookDispatcher.d.ts

@@ -0,0 +1,38 @@
+import type { CmsRuntime, DeferredHookDispatcher, DeferredHookEnvelope } from "@aotter/mantle-runtime";
+/**
+ * `DeferredHookDispatcher` impl backed by a Cloudflare Workers Queue
+ * binding. Producer side: serialises each `DeferredHookEnvelope` and
+ * sends it via `queue.send`. The runtime decorator handles fallback
+ * on rejection (its three-rung ladder downgrades to `ctx.waitUntil`
+ * → inline-await), so this dispatcher does not retry — it lets the
+ * caller decide.
+ *
+ * Per ADR-0011 only this adapter package may import the CF binding
+ * type. The runtime sees only the `DeferredHookDispatcher` port.
+ */
+export declare class WorkersQueueHookDispatcher implements DeferredHookDispatcher {
+    private readonly queue;
+    constructor(queue: Queue<DeferredHookEnvelope>);
+    enqueue(envelope: DeferredHookEnvelope): Promise<void>;
+}
+/**
+ * Build the `queue(batch, env, ctx)` Workers handler that consumes
+ * `clam_internal` messages and re-fires each `after_*` hook through
+ * the runtime. Consumers wire this alongside `fetch` in their default
+ * Worker export:
+ *
+ * ```ts
+ * export default {
+ *   fetch: app.fetch,
+ *   queue: createQueueHandler(cms),
+ * } satisfies ExportedHandler<Env>;
+ * ```
+ *
+ * Per-message ack / retry: a thrown handler error retries the
+ * message; success acks. CF Queues then handles backoff and the
+ * dead-letter queue per the binding's wrangler config.
+ */
+export declare function createQueueHandler<Env>(cmsRef: {
+    get(): Promise<CmsRuntime>;
+}): (batch: MessageBatch<DeferredHookEnvelope>, env: Env) => Promise<void>;
+//# sourceMappingURL=WorkersQueueHookDispatcher.d.ts.map

package/dist/bindings/WorkersQueueHookDispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkersQueueHookDispatcher.d.ts","sourceRoot":"","sources":["../../src/bindings/WorkersQueueHookDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,sBAAsB,EACtB,oBAAoB,EACrB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;GAUG;AACH,qBAAa,0BAA2B,YAAW,sBAAsB;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC;IAEzD,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EACpC,MAAM,EAAE;IAAE,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,GACrC,CAAC,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAgCxE"}

package/dist/bindings/WorkersQueueHookDispatcher.js

@@ -0,0 +1,68 @@
+/**
+ * `DeferredHookDispatcher` impl backed by a Cloudflare Workers Queue
+ * binding. Producer side: serialises each `DeferredHookEnvelope` and
+ * sends it via `queue.send`. The runtime decorator handles fallback
+ * on rejection (its three-rung ladder downgrades to `ctx.waitUntil`
+ * → inline-await), so this dispatcher does not retry — it lets the
+ * caller decide.
+ *
+ * Per ADR-0011 only this adapter package may import the CF binding
+ * type. The runtime sees only the `DeferredHookDispatcher` port.
+ */
+export class WorkersQueueHookDispatcher {
+    queue;
+    constructor(queue) {
+        this.queue = queue;
+    }
+    async enqueue(envelope) {
+        await this.queue.send(envelope);
+    }
+}
+/**
+ * Build the `queue(batch, env, ctx)` Workers handler that consumes
+ * `clam_internal` messages and re-fires each `after_*` hook through
+ * the runtime. Consumers wire this alongside `fetch` in their default
+ * Worker export:
+ *
+ * ```ts
+ * export default {
+ *   fetch: app.fetch,
+ *   queue: createQueueHandler(cms),
+ * } satisfies ExportedHandler<Env>;
+ * ```
+ *
+ * Per-message ack / retry: a thrown handler error retries the
+ * message; success acks. CF Queues then handles backoff and the
+ * dead-letter queue per the binding's wrangler config.
+ */
+export function createQueueHandler(cmsRef) {
+    return async (batch, env) => {
+        let cms;
+        try {
+            cms = await cmsRef.get();
+        }
+        catch (err) {
+            // Boot failed (D1 unreachable, manifest invalid, …). Use
+            // batch.retryAll so each message's per-message attempt counter
+            // increments — letting wrangler's max_retries / DLQ rules
+            // engage instead of looping forever at the batch level.
+            console.error("[clam-internal] runtime boot failed; retrying batch", err);
+            batch.retryAll();
+            return;
+        }
+        // Drain in parallel — after-hooks are independent and CF Queues
+        // ack/retry is per-message, so serial processing only burns the
+        // 30s consumer wall clock on larger batches.
+        await Promise.allSettled(batch.messages.map(async (message) => {
+            try {
+                await cms.runDeferredHook.execute({ envelope: message.body, env });
+                message.ack();
+            }
+            catch (err) {
+                console.error(`[clam-internal] consume failed for ${message.body.hook} on ${message.body.schema}/${message.body.entry.id}`, err);
+                message.retry();
+            }
+        }));
+    };
+}
+//# sourceMappingURL=WorkersQueueHookDispatcher.js.map

package/dist/bindings/WorkersQueueHookDispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkersQueueHookDispatcher.js","sourceRoot":"","sources":["../../src/bindings/WorkersQueueHookDispatcher.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,KAAkC;QAAlC,UAAK,GAAL,KAAK,CAA6B;IAAG,CAAC;IAEnE,KAAK,CAAC,OAAO,CAAC,QAA8B;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAsC;IAEtC,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yDAAyD;YACzD,+DAA+D;YAC/D,0DAA0D;YAC1D,wDAAwD;YACxD,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;YAC1E,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,gEAAgE;QAChE,gEAAgE;QAChE,6CAA6C;QAC7C,MAAM,OAAO,CAAC,UAAU,CACtB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnE,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAC5G,GAAG,CACJ,CAAC;gBACF,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/bindings/index.d.ts

@@ -0,0 +1,6 @@
+export { D1DatabaseDriver } from "./D1DatabaseDriver.js";
+export { KvCacheBinding } from "./KvCacheBinding.js";
+export { AssetsAssetServer } from "./AssetsAssetServer.js";
+export { R2MediaStorage } from "./R2MediaStorage.js";
+export { WorkersQueueHookDispatcher, createQueueHandler, } from "./WorkersQueueHookDispatcher.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/bindings/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bindings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,iCAAiC,CAAC"}

package/dist/bindings/index.js

@@ -0,0 +1,6 @@
+export { D1DatabaseDriver } from "./D1DatabaseDriver.js";
+export { KvCacheBinding } from "./KvCacheBinding.js";
+export { AssetsAssetServer } from "./AssetsAssetServer.js";
+export { R2MediaStorage } from "./R2MediaStorage.js";
+export { WorkersQueueHookDispatcher, createQueueHandler, } from "./WorkersQueueHookDispatcher.js";
+//# sourceMappingURL=index.js.map

package/dist/bindings/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bindings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,iCAAiC,CAAC"}

package/dist/handlers/index.d.ts

@@ -0,0 +1,2 @@
+export { cloudflareTurnstileCheck, type CloudflareTurnstileCheckOptions, } from "./turnstile.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,gBAAgB,CAAC"}

package/dist/handlers/index.js

@@ -0,0 +1,2 @@
+export { cloudflareTurnstileCheck, } from "./turnstile.js";
+//# sourceMappingURL=index.js.map

package/dist/handlers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,GAEzB,MAAM,gBAAgB,CAAC"}

package/dist/handlers/turnstile.d.ts

@@ -0,0 +1,43 @@
+import { type HandlerContext } from "@aotter/mantle-runtime";
+export interface CloudflareTurnstileCheckOptions {
+    /** Server-side secret. Pulled from `env.TURNSTILE_SECRET_KEY` by the
+     *  factory. The literal string `"dev-stub"` short-circuits to a
+     *  local check (`token === "fail"` is rejected, anything else
+     *  passes) — useful for integration smokes that run with no
+     *  network. Any other value triggers real `siteverify`. */
+    readonly secret: string;
+    /** Field name on the procedure input carrying the client-side
+     *  widget token. Defaults to `"turnstileToken"` (matches the
+     *  starter's contact-messages Schema). */
+    readonly tokenField?: string;
+}
+/**
+ * `before_create` (or any pre-mutation) hook that verifies a
+ * Cloudflare Turnstile token. Builtin handler factory — register
+ * with:
+ *
+ *     register("captchaCheck", cloudflareTurnstileCheck({
+ *       secret: env.TURNSTILE_SECRET_KEY ?? "dev-stub",
+ *     }));
+ *
+ * Behavior:
+ *
+ *   - Authenticated callers (`ctx.user` non-null) bypass — the gate
+ *     guards anonymous public-form abuse, not signed-in writes
+ *     (admin UI, MCP agents).
+ *   - `secret === "dev-stub"`: short-circuit. `token === "fail"`
+ *     rejects; anything else passes. Tests assert on this token
+ *     shape; integration runs need no network.
+ *   - Otherwise: POSTs to `siteverify`, fails on `{ success: false }`
+ *     or any HTTP error.
+ *
+ * Throws `InvokeFailure(AUTH_DENIED)` on rejection so the procedure
+ * mount maps it to HTTP 403, the right code for "your form
+ * submission was rejected by abuse-prevention." A plain `Error`
+ * surfaces as INTERNAL_ERROR (500) and falsely implies a server
+ * bug.
+ */
+export declare function cloudflareTurnstileCheck(options: CloudflareTurnstileCheckOptions): (input: Record<string, unknown>, ctx: HandlerContext) => Promise<{
+    ok: true;
+}>;
+//# sourceMappingURL=turnstile.d.ts.map

package/dist/handlers/turnstile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.d.ts","sourceRoot":"","sources":["../../src/handlers/turnstile.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAUhC,MAAM,WAAW,+BAA+B;IAC9C;;;;+DAI2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;8CAE0C;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,+BAA+B,IAG7E,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,cAAc,KAClB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAiBzB"}

package/dist/handlers/turnstile.js

@@ -0,0 +1,71 @@
+import { InvokeFailure, } from "@aotter/mantle-runtime";
+import { runtimeDiagnostic } from "@aotter/mantle-spec";
+const TURNSTILE_VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/**
+ * `before_create` (or any pre-mutation) hook that verifies a
+ * Cloudflare Turnstile token. Builtin handler factory — register
+ * with:
+ *
+ *     register("captchaCheck", cloudflareTurnstileCheck({
+ *       secret: env.TURNSTILE_SECRET_KEY ?? "dev-stub",
+ *     }));
+ *
+ * Behavior:
+ *
+ *   - Authenticated callers (`ctx.user` non-null) bypass — the gate
+ *     guards anonymous public-form abuse, not signed-in writes
+ *     (admin UI, MCP agents).
+ *   - `secret === "dev-stub"`: short-circuit. `token === "fail"`
+ *     rejects; anything else passes. Tests assert on this token
+ *     shape; integration runs need no network.
+ *   - Otherwise: POSTs to `siteverify`, fails on `{ success: false }`
+ *     or any HTTP error.
+ *
+ * Throws `InvokeFailure(AUTH_DENIED)` on rejection so the procedure
+ * mount maps it to HTTP 403, the right code for "your form
+ * submission was rejected by abuse-prevention." A plain `Error`
+ * surfaces as INTERNAL_ERROR (500) and falsely implies a server
+ * bug.
+ */
+export function cloudflareTurnstileCheck(options) {
+    const { secret, tokenField = "turnstileToken" } = options;
+    return async function turnstileCheck(input, ctx) {
+        if (ctx.user)
+            return { ok: true };
+        const tokenRaw = input[tokenField];
+        const token = typeof tokenRaw === "string" ? tokenRaw : "";
+        if (!token)
+            reject("missing turnstile token");
+        if (secret === "dev-stub") {
+            if (token === "fail")
+                reject("dev-stub rejected literal 'fail' token");
+            return { ok: true };
+        }
+        const verified = await verifyWithTurnstile(secret, token);
+        if (!verified.success) {
+            reject(`Turnstile siteverify rejected: ${(verified["error-codes"] ?? ["unknown"]).join(", ")}`);
+        }
+        return { ok: true };
+    };
+}
+async function verifyWithTurnstile(secret, token) {
+    const body = new URLSearchParams({ secret, response: token });
+    const res = await fetch(TURNSTILE_VERIFY_URL, {
+        method: "POST",
+        body,
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+    });
+    if (!res.ok)
+        reject(`Turnstile siteverify HTTP ${res.status}`);
+    return (await res.json());
+}
+function reject(detail) {
+    throw new InvokeFailure(runtimeDiagnostic({
+        code: "AUTH_DENIED",
+        severity: "error",
+        path: "captcha-check",
+        expected: "valid Turnstile token verified by siteverify",
+        message: `CAPTCHA verification failed: ${detail}.`,
+    }));
+}
+//# sourceMappingURL=turnstile.js.map

package/dist/handlers/turnstile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.js","sourceRoot":"","sources":["../../src/handlers/turnstile.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,oBAAoB,GAAG,2DAA2D,CAAC;AAoBzF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAwC;IAC/E,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC1D,OAAO,KAAK,UAAU,cAAc,CAClC,KAA8B,EAC9B,GAAmB;QAEnB,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,MAAM;gBAAE,MAAM,CAAC,wCAAwC,CAAC,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,CACJ,kCAAkC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,KAAa;IAC9D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,IAAI;QACJ,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;KACjE,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;AACvD,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,IAAI,aAAa,CACrB,iBAAiB,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,8CAA8C;QACxD,OAAO,EAAE,gCAAgC,MAAM,GAAG;KACnD,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@aotter/mantle-cloudflare` — Cloudflare Workers adapter for
+ * mantle. The only place in the codebase that may import D1Database
+ * / KVNamespace / Fetcher; runtime stays portable per ADR-0011.
+ */
+export * from "./bindings/index.js";
+export * from "./mount/index.js";
+export * from "./handlers/index.js";
+export * from "./oauth/index.js";
+export * from "./auth/createAuth.js";
+export { ConsoleEmailSender } from "./auth/ConsoleEmailSender.js";
+export { appleClientSecret, type AppleClientSecretArgs, } from "./auth/appleClientSecret.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+/**
+ * `@aotter/mantle-cloudflare` — Cloudflare Workers adapter for
+ * mantle. The only place in the codebase that may import D1Database
+ * / KVNamespace / Fetcher; runtime stays portable per ADR-0011.
+ */
+export * from "./bindings/index.js";
+export * from "./mount/index.js";
+export * from "./handlers/index.js";
+export * from "./oauth/index.js";
+export * from "./auth/createAuth.js";
+export { ConsoleEmailSender } from "./auth/ConsoleEmailSender.js";
+export { appleClientSecret, } from "./auth/appleClientSecret.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC"}

package/dist/mount/bootRuntimeOnce.d.ts

@@ -0,0 +1,17 @@
+import { type CmsRuntime } from "@aotter/mantle-runtime";
+import type { Manifest } from "@aotter/mantle-spec";
+import type { Auth } from "../auth/createAuth.js";
+import type { CmsConfig } from "./cmsConfig.js";
+/**
+ * Per-isolate runtime singleton. The cached promise MUST reset on
+ * rejection (PR #29 carry-forward) — otherwise a transient D1 error
+ * during boot poisons the isolate permanently and every subsequent
+ * request re-throws the same rejected promise.
+ */
+export interface CmsRuntimeRef {
+    get(): Promise<CmsRuntime>;
+    readonly manifests: readonly Manifest[];
+    readonly auth: Auth;
+}
+export declare function createCmsRef(config: CmsConfig): CmsRuntimeRef;
+//# sourceMappingURL=bootRuntimeOnce.d.ts.map

package/dist/mount/bootRuntimeOnce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootRuntimeOnce.d.ts","sourceRoot":"","sources":["../../src/mount/bootRuntimeOnce.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,UAAU,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,aAAa,CAgC7D"}