@aotter/mantle-cloudflare 0.0.11-alpha.11

package/dist/mount/bootRuntimeOnce.js

@@ -0,0 +1,35 @@
+import { createCmsRuntime, } from "@aotter/mantle-runtime";
+export function createCmsRef(config) {
+    const runtime = createCmsRuntime({
+        manifests: config.manifests,
+        handlers: config.handlers,
+        templates: config.templates,
+        siteDefaults: config.siteDefaults,
+        publicPathResolver: config.publicPathResolver,
+        mediaAllowSvg: config.mediaAllowSvg,
+        mediaMaxBytes: config.mediaMaxBytes,
+        db: config.bindings.db,
+        kv: config.bindings.kv,
+        assets: config.bindings.assets,
+        mediaStorage: config.bindings.mediaStorage,
+        deferredHookDispatcher: config.bindings.deferredHookDispatcher,
+    });
+    let booted = null;
+    return {
+        manifests: config.manifests,
+        auth: config.auth,
+        get() {
+            if (booted)
+                return booted;
+            booted = runtime
+                .bootInit()
+                .then(() => runtime)
+                .catch((err) => {
+                booted = null;
+                throw err;
+            });
+            return booted;
+        },
+    };
+}
+//# sourceMappingURL=bootRuntimeOnce.js.map

package/dist/mount/bootRuntimeOnce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootRuntimeOnce.js","sourceRoot":"","sources":["../../src/mount/bootRuntimeOnce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAiBhC,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACtB,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAC1C,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;KAC/D,CAAC,CAAC;IAEH,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG;YACD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,GAAG,OAAO;iBACb,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;iBACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;YACL,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mount/cmsConfig.d.ts

@@ -0,0 +1,33 @@
+import type { AnyHandler, CreateCmsRuntimeArgs, PublicPathResolver, TemplateRegistry } from "@aotter/mantle-runtime";
+import type { Manifest, SiteDefaults } from "@aotter/mantle-spec";
+import type { Auth } from "../auth/createAuth.js";
+/**
+ * Consumer-supplied config for the Cloudflare adapter mounts. `auth`
+ * (Better Auth) gates `/admin/api/*` + MCP bearers. `bindings` carries
+ * the three runtime-port adapters (db / kv / assets).
+ */
+export interface CmsConfig {
+    readonly manifests: readonly Manifest[];
+    readonly handlers?: Readonly<Record<string, AnyHandler>>;
+    readonly templates?: TemplateRegistry;
+    readonly siteDefaults?: SiteDefaults;
+    readonly publicPathResolver?: PublicPathResolver;
+    readonly bindings: Pick<CreateCmsRuntimeArgs, "db" | "kv" | "assets"> & {
+        /** Optional media storage adapter. When set, media MCP tools and
+         *  `/admin/api/media/*` endpoints are registered. Forwarded to the
+         *  runtime as `mediaStorage`. */
+        readonly mediaStorage?: CreateCmsRuntimeArgs["mediaStorage"];
+        /** Optional deferred-delivery dispatcher. When set, `after_*`
+         *  lifecycle hooks fire through this instead of riding
+         *  `ctx.waitUntil`. The Cloudflare adapter expects a
+         *  `WorkersQueueHookDispatcher` bound to the `clam_internal` queue
+         *  here. */
+        readonly deferredHookDispatcher?: CreateCmsRuntimeArgs["deferredHookDispatcher"];
+    };
+    /** Pass-through to runtime: SVG opt-in flag (default false). */
+    readonly mediaAllowSvg?: boolean;
+    /** Pass-through to runtime: byte ceiling for uploads (default 25MB). */
+    readonly mediaMaxBytes?: number;
+    readonly auth: Auth;
+}
+//# sourceMappingURL=cmsConfig.d.ts.map

package/dist/mount/cmsConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmsConfig.d.ts","sourceRoot":"","sources":["../../src/mount/cmsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,GAAG,IAAI,GAAG,QAAQ,CAAC,GAAG;QACtE;;yCAEiC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC7D;;;;oBAIY;QACZ,QAAQ,CAAC,sBAAsB,CAAC,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;KAClF,CAAC;IACF,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB"}

package/dist/mount/cmsConfig.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cmsConfig.js.map

package/dist/mount/cmsConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmsConfig.js","sourceRoot":"","sources":["../../src/mount/cmsConfig.ts"],"names":[],"mappings":""}

package/dist/mount/index.d.ts

@@ -0,0 +1,6 @@
+export { mountServerEndpoints } from "./mountServerEndpoints.js";
+export { type CmsRuntimeRef, createCmsRef } from "./bootRuntimeOnce.js";
+export { createMcpApiHandler, protectedResourceMetadataPath, type CreateMcpApiHandlerOptions, } from "./mountMcp.js";
+export { mountPublicRoutes, type CollectionRouteConfig, type MountPublicRoutesOptions, type PublicRouteContext, type SlugOverride, } from "./mountPublicRoutes.js";
+export type { CmsConfig } from "./cmsConfig.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/mount/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mount/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/mount/index.js

@@ -0,0 +1,5 @@
+export { mountServerEndpoints } from "./mountServerEndpoints.js";
+export { createCmsRef } from "./bootRuntimeOnce.js";
+export { createMcpApiHandler, protectedResourceMetadataPath, } from "./mountMcp.js";
+export { mountPublicRoutes, } from "./mountPublicRoutes.js";
+//# sourceMappingURL=index.js.map

package/dist/mount/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mount/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAsB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,6BAA6B,GAE9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,GAKlB,MAAM,wBAAwB,CAAC"}

package/dist/mount/mountMcp.d.ts

@@ -0,0 +1,32 @@
+import type { CmsRuntimeRef } from "./bootRuntimeOnce.js";
+/**
+ * RFC 9728 §3.1: the OAuth Protected Resource Metadata document for a
+ * resource at `<origin><path>` is served at
+ * `<origin>/.well-known/oauth-protected-resource<path>`. The OAuth
+ * provider lib handles this automatically when it sits at top level
+ * (`export default new OAuthProvider(...)`); kept exported for
+ * consumers who want to inspect the path shape.
+ */
+export declare function protectedResourceMetadataPath(resourcePath: string): string;
+export interface CreateMcpApiHandlerOptions {
+    readonly ref: CmsRuntimeRef;
+    readonly surface: "staff" | "public";
+}
+/**
+ * Build a Cloudflare Worker `ExportedHandler` that serves one MCP
+ * resource path. Plug into `createOAuthProvider({ apiHandlers })`
+ * keyed by the resource path (e.g. `/mcp/staff` or `/mcp`).
+ *
+ * The OAuthProvider lib verifies the bearer token, decrypts grant
+ * props, and sets `ctx.props` BEFORE calling this handler. We read
+ * `ctx.props.{userId, role}` (stashed at consent time by
+ * `mountAuthorize`) and gate staff surfaces on the D1 admin role.
+ *
+ * Note: OAuth scope distinction (`mcp:read` vs `mcp:staff`) used to
+ * differentiate surfaces here. Removed because claude.ai's MCP client
+ * silently omits `scope=` from /authorize when scopes contain colons,
+ * which broke the consent flow. Staff vs public is now purely D1-role
+ * driven.
+ */
+export declare function createMcpApiHandler(options: CreateMcpApiHandlerOptions): ExportedHandler<Record<string, unknown>>;
+//# sourceMappingURL=mountMcp.d.ts.map

package/dist/mount/mountMcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountMcp.d.ts","sourceRoot":"","sources":["../../src/mount/mountMcp.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK1E;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;CACtC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,GAClC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsE1C"}

package/dist/mount/mountMcp.js

@@ -0,0 +1,107 @@
+import { McpJsonRpcDispatcher } from "@aotter/mantle-runtime";
+import { ADMIN_ROLE_SET } from "../auth/createAuth.js";
+/**
+ * RFC 9728 §3.1: the OAuth Protected Resource Metadata document for a
+ * resource at `<origin><path>` is served at
+ * `<origin>/.well-known/oauth-protected-resource<path>`. The OAuth
+ * provider lib handles this automatically when it sits at top level
+ * (`export default new OAuthProvider(...)`); kept exported for
+ * consumers who want to inspect the path shape.
+ */
+export function protectedResourceMetadataPath(resourcePath) {
+    const trimmed = resourcePath.replace(/\/+$/, "");
+    if (!trimmed || trimmed === "/")
+        return "/.well-known/oauth-protected-resource";
+    const normalized = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+    return `/.well-known/oauth-protected-resource${normalized}`;
+}
+/**
+ * Build a Cloudflare Worker `ExportedHandler` that serves one MCP
+ * resource path. Plug into `createOAuthProvider({ apiHandlers })`
+ * keyed by the resource path (e.g. `/mcp/staff` or `/mcp`).
+ *
+ * The OAuthProvider lib verifies the bearer token, decrypts grant
+ * props, and sets `ctx.props` BEFORE calling this handler. We read
+ * `ctx.props.{userId, role}` (stashed at consent time by
+ * `mountAuthorize`) and gate staff surfaces on the D1 admin role.
+ *
+ * Note: OAuth scope distinction (`mcp:read` vs `mcp:staff`) used to
+ * differentiate surfaces here. Removed because claude.ai's MCP client
+ * silently omits `scope=` from /authorize when scopes contain colons,
+ * which broke the consent flow. Staff vs public is now purely D1-role
+ * driven.
+ */
+export function createMcpApiHandler(options) {
+    const { ref, surface } = options;
+    // Key the cached dispatcher to the runtime identity. Without this,
+    // if `ref.get()` rejects + resets and the next call returns a new
+    // runtime instance, the cached dispatcher would silently keep
+    // pointing at the pre-reset use-cases. A WeakMap also lets the GC
+    // reclaim the dispatcher if the runtime is replaced.
+    const dispatcherCache = new WeakMap();
+    return {
+        async fetch(request, _env, ctx) {
+            const props = ctx.props;
+            if (!props?.userId)
+                return forbidden();
+            const role = props.role;
+            if (surface === "staff" && (!role || !ADMIN_ROLE_SET.has(role))) {
+                return forbidden();
+            }
+            const runtime = await ref.get();
+            // Media tools require BOTH a storage adapter AND a declared
+            // `media.purposes` taxonomy (#262). Empty purposes →
+            // create_media_upload would always fail-closed, so don't surface
+            // the tools in tools/list at all. Read this before consulting the
+            // dispatcher cache so operator edits to site_config update the
+            // MCP catalog without a redeploy/runtime reset.
+            const mediaPurposes = runtime.media
+                ? await runtime.siteConfig.readMediaPurposes()
+                : [];
+            const mediaPurposesKey = mediaPurposes.join("\u0000");
+            let cached = dispatcherCache.get(runtime);
+            if (!cached || cached.mediaPurposesKey !== mediaPurposesKey) {
+                const mediaEnabled = runtime.media !== null && mediaPurposes.length > 0;
+                const dispatcher = new McpJsonRpcDispatcher({
+                    listEntries: runtime.listEntries,
+                    getEntry: runtime.getEntry,
+                    createDraft: runtime.createDraft,
+                    updateDraft: runtime.updateDraft,
+                    requestPublish: runtime.requestPublish,
+                    unpublish: runtime.unpublish,
+                    archive: runtime.archive,
+                    deleteEntry: runtime.deleteEntry,
+                    executeView: runtime.executeView,
+                    media: mediaEnabled && runtime.media
+                        ? {
+                            createUpload: runtime.media.createUpload,
+                            commitUpload: runtime.media.commitUpload,
+                            purposes: mediaPurposes,
+                        }
+                        : undefined,
+                }, [...runtime.schemasByName.values()], {
+                    surface,
+                    views: ref.manifests.filter((m) => m.kind === "View"),
+                });
+                cached = { mediaPurposesKey, dispatcher };
+                dispatcherCache.set(runtime, cached);
+            }
+            return cached.dispatcher.dispatch(request, {
+                userId: props.userId,
+                staff: role && ADMIN_ROLE_SET.has(role)
+                    ? { userId: props.userId, role: role }
+                    : null,
+            });
+        },
+    };
+}
+function forbidden() {
+    return new Response("forbidden", {
+        status: 403,
+        headers: {
+            "www-authenticate": `Bearer realm="mcp", error="insufficient_scope"`,
+            "access-control-expose-headers": "WWW-Authenticate",
+        },
+    });
+}
+//# sourceMappingURL=mountMcp.js.map

package/dist/mount/mountMcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountMcp.js","sourceRoot":"","sources":["../../src/mount/mountMcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,YAAoB;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,uCAAuC,CAAC;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACrE,OAAO,wCAAwC,UAAU,EAAE,CAAC;AAC9D,CAAC;AAOD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACjC,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,qDAAqD;IACrD,MAAM,eAAe,GAAG,IAAI,OAAO,EAG/B,CAAC;IAEL,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAI,GAA4C,CAAC,KAAK,CAAC;YAClE,IAAI,CAAC,KAAK,EAAE,MAAM;gBAAE,OAAO,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,SAAS,EAAE,CAAC;YACrB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,4DAA4D;YAC5D,qDAAqD;YACrD,iEAAiE;YACjE,kEAAkE;YAClE,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK;gBACjC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,gBAAgB,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;gBAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;gBACxE,MAAM,UAAU,GAAG,IAAI,oBAAoB,CACzC;oBACE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,KAAK,EAAE,YAAY,IAAI,OAAO,CAAC,KAAK;wBAClC,CAAC,CAAC;4BACE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;4BACxC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;4BACxC,QAAQ,EAAE,aAAa;yBACxB;wBACH,CAAC,CAAC,SAAS;iBACd,EACD,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,EACnC;oBACE,OAAO;oBACP,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;iBACzE,CACF,CAAC;gBACF,MAAM,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;gBAC1C,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE;gBACzC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;oBACrC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAiB,EAAE;oBACnD,CAAC,CAAC,IAAI;aACT,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;QAC/B,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,kBAAkB,EAAE,gDAAgD;YACpE,+BAA+B,EAAE,kBAAkB;SACpD;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/mount/mountPublicRoutes.d.ts

@@ -0,0 +1,82 @@
+import type { Context, Hono } from "hono";
+import type { ContentState, SiteConfig } from "@aotter/mantle-spec";
+import { type CmsRuntime } from "@aotter/mantle-runtime";
+import type { CmsRuntimeRef } from "./bootRuntimeOnce.js";
+/**
+ * `mountPublicRoutes` — mounts the SDK-managed public surface on the
+ * consumer's Hono app. Replaces ~140 lines of route-stitching every
+ * starter would otherwise hand-roll.
+ *
+ * Routes (per `collectionRoutes` config):
+ *
+ *   - `GET /`                                  → 302 to `/{canonicalLocale}` (skipped if `homeRenderer` not set)
+ *   - `GET /{locale}`                          → `homeRenderer` (composed; cross-collection)
+ *   - `GET /{locale}/{segment}`                → KV-cached collection list
+ *   - `GET /{locale}/{segment}/{slug}`         → KV-cached entry HTML
+ *   - `GET /{locale}/{segment}/{slug}.md`      → KV-cached entry markdown mirror (AEO)
+ *   - `GET /{locale}/{segment}/{slug}?preview=1` → live render via `previewEntry` use case
+ *   - `GET /{locale}/llms.txt`                 → KV-cached llms.txt
+ *   - `GET /llms.txt`                          → KV-cached root llms.txt
+ *   - `GET /sitemap.xml`                       → composed sitemap
+ *
+ * Slug overrides intercept `(collection, slug)` pairs the consumer
+ * wants to serve from a hand-rolled template (e.g. a contact form
+ * page that needs `<TURNSTILE_SITE_KEY>` injected) rather than a
+ * pre-rendered KV blob. Overrides take precedence over preview /
+ * live-dev / KV.
+ *
+ * `liveDev: true` (typically `env.CLAM_LOCAL_DEV === "1"`) bypasses
+ * KV for entry / list HTML — every request live-renders against
+ * current D1 state via the `RenderEntryLiveUseCase` /
+ * `RenderListLiveUseCase`. `.md` mirrors and `llms.txt` still come
+ * from KV (those are cheap to rebuild via `pnpm fixture`). Don't set
+ * in production — defeats the publish pipeline cache.
+ */
+export interface CollectionRouteConfig {
+    /** Schema name (e.g. `"post-translations"`). */
+    readonly collection: string;
+    /** URL segment beneath `/{locale}/`. Empty string puts entries
+     *  directly under `/{locale}/{slug}` (rare; useful when a single
+     *  collection owns the whole locale tree). */
+    readonly segment: string;
+    /** When true, expose `GET /{locale}/{segment}` for the collection
+     *  list. Default false (most starters use a hand-rolled list page). */
+    readonly listRoute?: boolean;
+    /** When true, expose `GET /{locale}/{segment}/{slug}.md` for the
+     *  AEO markdown mirror. Default true — the publish pipeline already
+     *  writes the mirror to KV; not exposing it would be silent waste. */
+    readonly markdownMirror?: boolean;
+    /** Slug to collapse to `/{locale}` (no trailing segment + slug).
+     *  Used for the home page when it lives in a translations
+     *  collection. */
+    readonly homeSlug?: string;
+}
+export interface PublicRouteContext {
+    readonly c: Context;
+    readonly runtime: CmsRuntime;
+    readonly site: SiteConfig;
+    readonly locale: string;
+}
+export interface SlugOverride {
+    readonly collection: string;
+    readonly slug: string;
+    readonly render: (ctx: PublicRouteContext) => Promise<Response>;
+}
+export interface MountPublicRoutesOptions {
+    readonly collectionRoutes: ReadonlyArray<CollectionRouteConfig>;
+    /** Renderer for `/{locale}` — typically composes home page +
+     *  recent posts across collections. Optional; without it `/` and
+     *  `/{locale}` are not registered. */
+    readonly homeRenderer?: (ctx: PublicRouteContext) => Promise<Response>;
+    /** Renderer for the locale 404 fallback. Required — every miss
+     *  falls through here. */
+    readonly notFoundRenderer: (ctx: PublicRouteContext) => Promise<Response>;
+    /** Per-(collection, slug) override taking precedence over KV. */
+    readonly slugOverrides?: ReadonlyArray<SlugOverride>;
+    /** Live-dev flag — bypasses KV for entry / list HTML. Default
+     *  false. */
+    readonly liveDev?: boolean;
+}
+export declare function mountPublicRoutes(app: Hono, ref: CmsRuntimeRef, options: MountPublicRoutesOptions): void;
+export type { ContentState };
+//# sourceMappingURL=mountPublicRoutes.d.ts.map

package/dist/mount/mountPublicRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountPublicRoutes.d.ts","sourceRoot":"","sources":["../../src/mount/mountPublicRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAUL,KAAK,UAAU,EAEhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,qBAAqB;IACpC,gDAAgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;kDAE8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;2EACuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;0EAEsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;sBAEkB;IAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAChE;;0CAEsC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE;8BAC0B;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1E,iEAAiE;IACjE,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACrD;iBACa;IACb,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAwBD,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,wBAAwB,GAChC,IAAI,CA8DN;AAwMD,YAAY,EAAE,YAAY,EAAE,CAAC"}

package/dist/mount/mountPublicRoutes.js

@@ -0,0 +1,243 @@
+import { entryHtmlKeyFromParts, entryMarkdownKeyFromParts, inferLocaleFromPath, isKnownLocale, listHtmlKey, llmsTxtKey, readEntryBySlug, serializeEntryAsMarkdown, toUrlLocale, } from "@aotter/mantle-runtime";
+import { ADMIN_ROLE_SET } from "../auth/createAuth.js";
+const HTML_NO_STORE = {
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+};
+const HTML_PUBLIC = {
+    "content-type": "text/html; charset=utf-8",
+};
+const MD_PUBLIC = {
+    "content-type": "text/markdown; charset=utf-8",
+};
+const TEXT_PUBLIC = {
+    "content-type": "text/plain; charset=utf-8",
+};
+const SITEMAP_HEADERS = {
+    "content-type": "application/xml; charset=utf-8",
+    "cache-control": "public, max-age=300, s-maxage=300",
+};
+export function mountPublicRoutes(app, ref, options) {
+    const liveDev = options.liveDev === true;
+    const overrideIndex = buildOverrideIndex(options.slugOverrides ?? []);
+    // Literal root paths register BEFORE any param-catch-all routes —
+    // Hono's trie matches `/llms.txt` against `/:locale` with
+    // `:locale = "llms.txt"` if the literal route registers later.
+    app.get("/llms.txt", async () => {
+        const runtime = await ref.get();
+        return readKvText(runtime.kv, llmsTxtKey(""), TEXT_PUBLIC);
+    });
+    app.get("/sitemap.xml", async (c) => {
+        const runtime = await ref.get();
+        const site = await runtime.siteConfig.load();
+        if (!runtime.publicPathResolver) {
+            return new Response("sitemap unavailable: no publicPathResolver configured", {
+                status: 500,
+            });
+        }
+        const xml = await runtime.composeSitemap.execute({
+            site,
+            pathFor: (e) => runtime.publicPathResolver.forEntry(e),
+        });
+        return new Response(xml, { status: 200, headers: SITEMAP_HEADERS });
+    });
+    if (options.homeRenderer) {
+        app.get("/", async (c) => {
+            const runtime = await ref.get();
+            const site = await runtime.siteConfig.load();
+            const canonical = site.canonicalLocale ?? site.locales[0] ?? "en";
+            return c.redirect(`/${toUrlLocale(canonical)}`);
+        });
+        app.get("/:locale", async (c) => {
+            const runtime = await ref.get();
+            const site = await runtime.siteConfig.load();
+            const locale = canonicalLocaleParam(c.req.param("locale"), site);
+            const ctx = buildCtx(c, runtime, site, locale ?? inferLocaleFromPath(c.req.path, site));
+            if (locale === null)
+                return options.notFoundRenderer(ctx);
+            return options.homeRenderer(ctx);
+        });
+    }
+    app.get("/:locale/llms.txt", async (c) => {
+        const runtime = await ref.get();
+        const site = await runtime.siteConfig.load();
+        const locale = canonicalLocaleParam(c.req.param("locale"), site);
+        if (locale === null)
+            return new Response("not found", { status: 404, headers: TEXT_PUBLIC });
+        return readKvText(runtime.kv, llmsTxtKey(locale), TEXT_PUBLIC);
+    });
+    for (const route of options.collectionRoutes) {
+        mountCollection(app, ref, options, route, liveDev, overrideIndex);
+    }
+    app.notFound(async (c) => {
+        const runtime = await ref.get();
+        const site = await runtime.siteConfig.load();
+        const locale = inferLocaleFromPath(c.req.path, site);
+        return options.notFoundRenderer(buildCtx(c, runtime, site, locale));
+    });
+}
+function mountCollection(app, ref, options, route, liveDev, overrides) {
+    const segPath = route.segment ? `/${route.segment}` : "";
+    if (route.listRoute) {
+        app.get(`/:locale${segPath}`, async (c) => {
+            const runtime = await ref.get();
+            const site = await runtime.siteConfig.load();
+            const locale = canonicalLocaleParam(c.req.param("locale"), site);
+            const ctx = buildCtx(c, runtime, site, locale ?? inferLocaleFromPath(c.req.path, site));
+            const notFound = () => options.notFoundRenderer(ctx);
+            if (locale === null)
+                return notFound();
+            if (liveDev) {
+                const html = await runtime.renderListLive.execute({
+                    collection: route.collection,
+                    locale,
+                    site,
+                });
+                if (html === null)
+                    return notFound();
+                return new Response(html, { status: 200, headers: HTML_NO_STORE });
+            }
+            return readThroughCache(runtime.kv, listHtmlKey(route.collection, locale), HTML_PUBLIC, async () => runtime.renderListLive.execute({
+                collection: route.collection,
+                locale,
+                site,
+            }), notFound);
+        });
+    }
+    // Register the `.md` mirror BEFORE the bare `:slug` entry route —
+    // Hono matches in registration order, so without this the entry
+    // route swallows `slug = "foo.md"` and 404s on KV lookup.
+    if (route.markdownMirror !== false) {
+        // `[^/]+\\.md` (not `.+\\.md`) so a malicious crawler can't
+        // squat sub-paths like `/en/posts/long/random.md` and burn KV
+        // reads — the `:slug` group stays single-segment.
+        app.get(`/:locale${segPath}/:slug{[^/]+\\.md}`, async (c) => {
+            const runtime = await ref.get();
+            const site = await runtime.siteConfig.load();
+            const locale = canonicalLocaleParam(c.req.param("locale"), site);
+            const slugParam = c.req.param("slug") ?? "";
+            const slug = slugParam.endsWith(".md") ? slugParam.slice(0, -3) : slugParam;
+            const notFound = () => new Response("not found", { status: 404, headers: TEXT_PUBLIC });
+            if (locale === null)
+                return notFound();
+            const key = entryMarkdownKeyFromParts(route.collection, locale, slug);
+            return readThroughCache(runtime.kv, key, MD_PUBLIC, async () => {
+                const entry = await readEntryBySlug(runtime.db, {
+                    collection: route.collection,
+                    slug,
+                    locale,
+                    status: "published",
+                });
+                if (!entry)
+                    return null;
+                return serializeEntryAsMarkdown(entry);
+            }, notFound);
+        });
+    }
+    app.get(`/:locale${segPath}/:slug`, async (c) => {
+        const runtime = await ref.get();
+        const site = await runtime.siteConfig.load();
+        const locale = canonicalLocaleParam(c.req.param("locale"), site);
+        const slug = c.req.param("slug");
+        const ctx = buildCtx(c, runtime, site, locale ?? inferLocaleFromPath(c.req.path, site));
+        const notFound = () => options.notFoundRenderer(ctx);
+        if (locale === null)
+            return notFound();
+        const override = overrides.get(overrideKey(route.collection, slug));
+        if (override)
+            return override.render(ctx);
+        if (c.req.query("preview") === "1") {
+            const denied = await assertStaffSession(ref, c.req.raw);
+            if (denied)
+                return denied;
+            const html = await runtime.previewEntry.execute({
+                collection: route.collection,
+                slug,
+                locale,
+                site,
+            });
+            if (html === null)
+                return notFound();
+            return new Response(html, { status: 200, headers: HTML_NO_STORE });
+        }
+        if (liveDev) {
+            const html = await runtime.renderEntryLive.execute({
+                collection: route.collection,
+                slug,
+                locale,
+                site,
+            });
+            if (html === null)
+                return notFound();
+            return new Response(html, { status: 200, headers: HTML_NO_STORE });
+        }
+        const key = entryHtmlKeyFromParts(route.collection, locale, slug);
+        return readThroughCache(runtime.kv, key, HTML_PUBLIC, async () => {
+            const html = await runtime.renderEntryLive.execute({
+                collection: route.collection,
+                slug,
+                locale,
+                site,
+            });
+            return html;
+        }, notFound);
+    });
+    if (route.homeSlug && options.homeRenderer == null) {
+        // Without a homeRenderer the `homeSlug` collapse is a noop —
+        // there's no `/{locale}` route to serve. Surface as a console
+        // warning at boot rather than silently misconfiguring.
+        console.warn(`[mantle] collectionRoute "${route.collection}" declares homeSlug="${route.homeSlug}" ` +
+            `but no homeRenderer was passed to mountPublicRoutes — /{locale} will 404.`);
+    }
+}
+/**
+ * Gate `?preview=1` behind a staff session so anonymous visitors can't
+ * enumerate draft slugs. Returns the denial `Response` on failure (401
+ * for no session, 403 for non-staff), or `null` when the caller may
+ * proceed.
+ */
+async function assertStaffSession(ref, req) {
+    const session = await ref.auth.getSession(req);
+    if (!session)
+        return new Response("unauthorized", { status: 401 });
+    const role = await ref.auth.getUserRole(session.user.id);
+    if (!role || !ADMIN_ROLE_SET.has(role)) {
+        return new Response("forbidden", { status: 403 });
+    }
+    return null;
+}
+async function readKvText(kv, key, headers) {
+    const body = await kv.get(key);
+    if (body === null) {
+        return new Response("not found", { status: 404, headers: TEXT_PUBLIC });
+    }
+    return new Response(body, { status: 200, headers });
+}
+async function readThroughCache(kv, key, headers, populate, fallback) {
+    const cached = await kv.get(key);
+    if (cached !== null)
+        return new Response(cached, { status: 200, headers });
+    const rendered = await populate();
+    if (rendered === null)
+        return fallback();
+    await kv.put(key, rendered);
+    return new Response(rendered, { status: 200, headers });
+}
+function buildCtx(c, runtime, site, locale) {
+    return { c, runtime, site, locale };
+}
+function canonicalLocaleParam(locale, site) {
+    if (!isKnownLocale(locale, site))
+        return null;
+    return inferLocaleFromPath(`/${locale}`, site);
+}
+function buildOverrideIndex(overrides) {
+    const map = new Map();
+    for (const o of overrides)
+        map.set(overrideKey(o.collection, o.slug), o);
+    return map;
+}
+function overrideKey(collection, slug) {
+    return `${collection}\u0000${slug}`;
+}
+//# sourceMappingURL=mountPublicRoutes.js.map

package/dist/mount/mountPublicRoutes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountPublicRoutes.js","sourceRoot":"","sources":["../../src/mount/mountPublicRoutes.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,UAAU,EACV,eAAe,EACf,wBAAwB,EACxB,WAAW,GAGZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAiFvD,MAAM,aAAa,GAAG;IACpB,cAAc,EAAE,0BAA0B;IAC1C,eAAe,EAAE,UAAU;CACnB,CAAC;AAEX,MAAM,WAAW,GAAG;IAClB,cAAc,EAAE,0BAA0B;CAClC,CAAC;AAEX,MAAM,SAAS,GAAG;IAChB,cAAc,EAAE,8BAA8B;CACtC,CAAC;AAEX,MAAM,WAAW,GAAG;IAClB,cAAc,EAAE,2BAA2B;CACnC,CAAC;AAEX,MAAM,eAAe,GAAG;IACtB,cAAc,EAAE,gCAAgC;IAChD,eAAe,EAAE,mCAAmC;CAC5C,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAC/B,GAAS,EACT,GAAkB,EAClB,OAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;IACzC,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAEtE,kEAAkE;IAClE,0DAA0D;IAC1D,+DAA+D;IAC/D,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,uDAAuD,EAAE;gBAC3E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC;YAC/C,IAAI;YACJ,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAClE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACxF,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC,YAAa,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7F,OAAO,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7C,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACtB,GAAS,EACT,GAAkB,EAClB,OAAiC,EACjC,KAA4B,EAC5B,OAAgB,EAChB,SAA4C;IAE5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,GAAiC,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACnF,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,QAAQ,EAAE,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC;oBAChD,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM;oBACN,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,QAAQ,EAAE,CAAC;gBACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CACjG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC;gBAC7B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM;gBACN,IAAI;aACL,CAAC,EAAE,QAAQ,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,gEAAgE;IAChE,0DAA0D;IAC1D,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACnC,4DAA4D;QAC5D,8DAA8D;QAC9D,kDAAkD;QAClD,GAAG,CAAC,GAAG,CAAC,WAAW,OAAO,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC1D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,MAAM,QAAQ,GAAG,GAAa,EAAE,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAClG,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,QAAQ,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,yBAAyB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACtE,OAAO,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE;gBAC7D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;oBAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,IAAI;oBACJ,MAAM;oBACN,MAAM,EAAE,WAAW;iBACpB,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC;gBACxB,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,WAAW,OAAO,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,GAAiC,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnF,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,QAAQ,EAAE,CAAC;QAEvC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACpE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;gBAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI;gBACJ,MAAM;gBACN,IAAI;aACL,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;gBACjD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI;gBACJ,MAAM;gBACN,IAAI;aACL,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClE,OAAO,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;gBACjD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI;gBACJ,MAAM;gBACN,IAAI;aACL,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,EAAE,QAAQ,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QACnD,6DAA6D;QAC7D,8DAA8D;QAC9D,uDAAuD;QACvD,OAAO,CAAC,IAAI,CACV,6BAA6B,KAAK,CAAC,UAAU,wBAAwB,KAAK,CAAC,QAAQ,IAAI;YACrF,2EAA2E,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAkB,EAClB,GAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,EAAW,EACX,GAAW,EACX,OAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,EAAW,EACX,GAAW,EACX,OAA+B,EAC/B,QAAsC,EACtC,QAA4C;IAE5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;IAClC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,EAAE,CAAC;IAEzC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CACf,CAAU,EACV,OAAmB,EACnB,IAAgB,EAChB,MAAc;IAEd,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,IAAgB;IAC5D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,mBAAmB,CAAC,IAAI,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,IAAY;IACnD,OAAO,GAAG,UAAU,SAAS,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/mount/mountServerEndpoints.d.ts

@@ -0,0 +1,10 @@
+import type { Hono } from "hono";
+import type { CmsRuntimeRef } from "./bootRuntimeOnce.js";
+/** Mount HTTP Triggers + Views + the Better Auth admin surface.
+ *  HTTP Trigger bearer-token authentication is delegated to the OAuth
+ *  provider lib (via `createMcpApiHandler`) — if a Trigger needs
+ *  identity, route it under an MCP `apiHandler` instead of a Hono
+ *  catch-all. */
+export declare function mountServerEndpoints(app: Hono, ref: CmsRuntimeRef): void;
+export type { CmsRuntimeRef };
+//# sourceMappingURL=mountServerEndpoints.d.ts.map

package/dist/mount/mountServerEndpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountServerEndpoints.d.ts","sourceRoot":"","sources":["../../src/mount/mountServerEndpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAsB1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D;;;;iBAIiB;AACjB,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,aAAa,GACjB,IAAI,CAwBN;AAgjBD,YAAY,EAAE,aAAa,EAAE,CAAC"}