@aotter/mantle-cloudflare 0.0.11-alpha.11

package/dist/oauth/index.js

@@ -0,0 +1,4 @@
+export { OAUTH_AUTHORIZE_PATH, OAUTH_TOKEN_PATH, OAUTH_REGISTER_PATH, } from "./oauthConstants.js";
+export { createOAuthProvider, } from "./oauthSingleton.js";
+export { mountAuthorize, } from "./mountOAuth.js";
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,GAGf,MAAM,iBAAiB,CAAC"}

package/dist/oauth/mountOAuth.d.ts

@@ -0,0 +1,29 @@
+import type { Hono } from "hono";
+import type { Auth } from "../auth/createAuth.js";
+export interface MountAuthorizeOptions {
+    /** Better Auth-backed identity used to gate the consent UI. */
+    readonly auth: Auth;
+    /** Path that anonymous /authorize visitors get redirected to.
+     *  Defaults to `/admin/sign-in`. The original `/authorize?...` URL
+     *  is appended as `?return_to=...` so the sign-in page can bounce
+     *  back after Better Auth completes. */
+    readonly loginPath?: string;
+}
+/**
+ * Mount the `/authorize` consent UI on the consumer's Hono app. The
+ * Hono app must be passed to `createOAuthProvider({ defaultHandler })`;
+ * the lib injects `OAUTH_PROVIDER` helpers onto env BEFORE forwarding
+ * the request here, so we read `c.env.OAUTH_PROVIDER` directly.
+ *
+ * `/token` + `/register` + `/.well-known/oauth-*` are intercepted by
+ * the OAuthProvider itself and never reach defaultHandler — do not
+ * mount them here.
+ */
+export declare function mountAuthorize(app: Hono, options: MountAuthorizeOptions): void;
+/** Props that mountAuthorize stashes during completeAuthorization and
+ *  that `createMcpApiHandler` reads from `ctx.props`. */
+export interface OAuthApiProps {
+    readonly userId: string;
+    readonly role: string | null;
+}
+//# sourceMappingURL=mountOAuth.d.ts.map

package/dist/oauth/mountOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountOAuth.d.ts","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAOlD,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;4CAGwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAsG9E;AA4BD;yDACyD;AACzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B"}

package/dist/oauth/mountOAuth.js

@@ -0,0 +1,105 @@
+import { detectConsentLocale, renderConsentHtml, } from "./consentHtml.js";
+/**
+ * Mount the `/authorize` consent UI on the consumer's Hono app. The
+ * Hono app must be passed to `createOAuthProvider({ defaultHandler })`;
+ * the lib injects `OAUTH_PROVIDER` helpers onto env BEFORE forwarding
+ * the request here, so we read `c.env.OAUTH_PROVIDER` directly.
+ *
+ * `/token` + `/register` + `/.well-known/oauth-*` are intercepted by
+ * the OAuthProvider itself and never reach defaultHandler — do not
+ * mount them here.
+ */
+export function mountAuthorize(app, options) {
+    const { auth, loginPath = "/admin/sign-in" } = options;
+    const consentHandler = async (c) => {
+        const locale = detectConsentLocale(c.req.header("accept-language") ?? null);
+        const helpers = c.env.OAUTH_PROVIDER;
+        if (!helpers) {
+            return new Response("OAUTH_PROVIDER missing on env — is the worker exported via createOAuthProvider()?", { status: 500 });
+        }
+        const session = await auth.getSession(c.req.raw);
+        if (!session) {
+            if (c.req.method !== "GET") {
+                return new Response("unauthenticated", { status: 401 });
+            }
+            const u = new URL(c.req.url);
+            const returnTo = encodeURIComponent(u.pathname + u.search);
+            return new Response(null, {
+                status: 302,
+                headers: { location: `${loginPath}?return_to=${returnTo}` },
+            });
+        }
+        if (c.req.method === "POST") {
+            const form = await c.req.raw.formData();
+            const oauthRequestJson = form.get("oauth_request");
+            if (typeof oauthRequestJson !== "string") {
+                return new Response("missing oauth_request", { status: 400 });
+            }
+            if (form.get("decision") !== "approve") {
+                return new Response("authorization denied", { status: 400 });
+            }
+            let reqInfo;
+            try {
+                reqInfo = JSON.parse(oauthRequestJson);
+            }
+            catch {
+                return new Response("invalid oauth_request json", { status: 400 });
+            }
+            // The form-field oauth_request is caller-editable — a malicious
+            // submit could swap redirectUri / scope post-consent. Re-validate
+            // clientId + redirectUri against the registered client record;
+            // refuse if either drifted. Fail closed when no registered URIs
+            // exist — a misconfigured client with no allowlist must not get
+            // a free pass.
+            const registered = await helpers.lookupClient(reqInfo.clientId);
+            if (!registered) {
+                return new Response("unknown client", { status: 400 });
+            }
+            if (!Array.isArray(registered.redirectUris) ||
+                registered.redirectUris.length === 0 ||
+                !registered.redirectUris.includes(reqInfo.redirectUri)) {
+                return new Response("redirect_uri mismatch", { status: 400 });
+            }
+            const role = await auth.getUserRole(session.user.id);
+            // If claude.ai forgets to request a scope, default to ["mcp"]
+            // so the token grant is non-empty (claude.ai post-token
+            // verification rejects empty-scope tokens in some flows).
+            const grantedScope = reqInfo.scope && reqInfo.scope.length > 0 ? reqInfo.scope : ["mcp"];
+            const { redirectTo } = await helpers.completeAuthorization({
+                request: reqInfo,
+                userId: session.user.id,
+                metadata: {},
+                scope: grantedScope,
+                // Stash role on props so apiHandler can enforce staff gating
+                // via D1 lookup. ctx.props is what the lib hands to
+                // apiHandler.fetch after token verification.
+                props: {
+                    userId: session.user.id,
+                    role: role ?? null,
+                },
+            });
+            return new Response(null, { status: 302, headers: { location: redirectTo } });
+        }
+        let model = null;
+        try {
+            const reqInfo = await helpers.parseAuthRequest(c.req.raw);
+            const clientInfo = await helpers.lookupClient(reqInfo.clientId);
+            model = {
+                clientName: clientInfo?.clientName ?? "(unknown client)",
+                redirectUri: reqInfo.redirectUri,
+                scopes: reqInfo.scope ?? [],
+                oauthRequestJson: JSON.stringify(reqInfo),
+            };
+        }
+        catch {
+            // parseAuthRequest throws on malformed requests; fall through to
+            // the "invalid authorization request" branch in renderConsentHtml.
+        }
+        return new Response(renderConsentHtml(locale, model), {
+            headers: { "content-type": "text/html; charset=utf-8" },
+        });
+    };
+    app.get("/oauth/authorize", consentHandler);
+    app.post("/oauth/authorize", consentHandler);
+}
+//# sourceMappingURL=mountOAuth.js.map

package/dist/oauth/mountOAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mountOAuth.js","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,kBAAkB,CAAC;AAY1B;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAS,EAAE,OAA8B;IACtE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAEvD,MAAM,cAAc,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAI,CAAC,CAAC,GAAyC,CAAC,cAAc,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CACjB,mFAAmF,EACnF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,cAAc,QAAQ,EAAE,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACnD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAgB,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,gEAAgE;YAChE,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,eAAe;YACf,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACpC,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EACtD,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrD,8DAA8D;YAC9D,wDAAwD;YACxD,0DAA0D;YAC1D,MAAM,YAAY,GAChB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC;gBACzD,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,YAAY;gBACnB,6DAA6D;gBAC7D,oDAAoD;gBACpD,6CAA6C;gBAC7C,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACvB,IAAI,EAAE,IAAI,IAAI,IAAI;iBACnB;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,KAAK,GAAwB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,KAAK,GAAG;gBACN,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,kBAAkB;gBACxD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC1C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,mEAAmE;QACrE,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC"}

package/dist/oauth/oauthConstants.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Path constants shared between `oauthSingleton.ts` (which constructs
+ * `OAuthProvider`) and `mountOAuth.ts` (which mounts the `/authorize`
+ * consent handler against the consumer's Hono app).
+ *
+ * Namespaced under `/oauth/*` to avoid squatting on generic root
+ * paths (consumers might want `/register`, `/token`, `/authorize` for
+ * their own routes). claude.ai's MCP OAuth client reads AS metadata
+ * (RFC 8414) and follows whatever endpoints we advertise — verified
+ * 2026-05-15 against `cms.aotterclam.ai` with the namespaced paths.
+ */
+export declare const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export declare const OAUTH_TOKEN_PATH = "/oauth/token";
+export declare const OAUTH_REGISTER_PATH = "/oauth/register";
+//# sourceMappingURL=oauthConstants.d.ts.map

package/dist/oauth/oauthConstants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthConstants.d.ts","sourceRoot":"","sources":["../../src/oauth/oauthConstants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC"}

package/dist/oauth/oauthConstants.js

@@ -0,0 +1,15 @@
+/**
+ * Path constants shared between `oauthSingleton.ts` (which constructs
+ * `OAuthProvider`) and `mountOAuth.ts` (which mounts the `/authorize`
+ * consent handler against the consumer's Hono app).
+ *
+ * Namespaced under `/oauth/*` to avoid squatting on generic root
+ * paths (consumers might want `/register`, `/token`, `/authorize` for
+ * their own routes). claude.ai's MCP OAuth client reads AS metadata
+ * (RFC 8414) and follows whatever endpoints we advertise — verified
+ * 2026-05-15 against `cms.aotterclam.ai` with the namespaced paths.
+ */
+export const OAUTH_AUTHORIZE_PATH = "/oauth/authorize";
+export const OAUTH_TOKEN_PATH = "/oauth/token";
+export const OAUTH_REGISTER_PATH = "/oauth/register";
+//# sourceMappingURL=oauthConstants.js.map

package/dist/oauth/oauthConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthConstants.js","sourceRoot":"","sources":["../../src/oauth/oauthConstants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC"}

package/dist/oauth/oauthSingleton.d.ts

@@ -0,0 +1,34 @@
+import { OAuthProvider } from "@cloudflare/workers-oauth-provider";
+export interface CreateOAuthProviderArgs {
+    /** Worker module shape for non-OAuth requests. Typically the
+     *  consumer's Hono app: `{ fetch: app.fetch }`. The lib injects
+     *  `OAUTH_PROVIDER` onto env BEFORE calling this, so the consumer's
+     *  `/authorize` route can pull helpers via `c.env.OAUTH_PROVIDER`. */
+    readonly defaultHandler: ExportedHandler<Record<string, unknown>>;
+    /** Map of MCP resource path → worker handler. Lib verifies the
+     *  bearer token, then dispatches to the matching handler with
+     *  `ctx.props` set to whatever was passed to
+     *  `completeAuthorization({ props })`. Use `createMcpApiHandler`
+     *  to build the handler value for each entry. */
+    readonly apiHandlers: Record<string, ExportedHandler<Record<string, unknown>>>;
+    /** Scopes advertised in `scopes_supported` for both AS metadata
+     *  (RFC 8414) and PRM (RFC 9728). Defaults to `["mcp"]` — a single
+     *  non-colon-namespaced scope, which is what claude.ai's MCP OAuth
+     *  client actually understands. Verified 2026-05-15: colon-shaped
+     *  scopes (e.g. `mcp:read`, `mcp:staff`) cause claude.ai to omit
+     *  `scope=` from /authorize, ending the flow with `ofid_*` post-token.
+     *  Staff vs public differentiation should be enforced server-side
+     *  in the apiHandler (D1 role lookup), not through OAuth scope. */
+    readonly scopesSupported?: readonly string[];
+}
+/**
+ * Build the top-level OAuthProvider. **Export the result as the
+ * worker's `default`** so the lib gets every request first and can
+ * route OAuth endpoints internally, fan MCP requests to apiHandlers,
+ * and inject helpers onto env before forwarding to defaultHandler.
+ *
+ * Endpoint paths default to `/oauth/{authorize,token,register}` —
+ * see `oauthConstants.ts`.
+ */
+export declare function createOAuthProvider(args: CreateOAuthProviderArgs): OAuthProvider;
+//# sourceMappingURL=oauthSingleton.d.ts.map

package/dist/oauth/oauthSingleton.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthSingleton.d.ts","sourceRoot":"","sources":["../../src/oauth/oauthSingleton.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAOnE,MAAM,WAAW,uBAAuB;IACtC;;;0EAGsE;IACtE,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE;;;;qDAIiD;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/E;;;;;;;uEAOmE;IACnE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,aAAa,CAShF"}

package/dist/oauth/oauthSingleton.js

@@ -0,0 +1,22 @@
+import { OAuthProvider } from "@cloudflare/workers-oauth-provider";
+import { OAUTH_AUTHORIZE_PATH, OAUTH_REGISTER_PATH, OAUTH_TOKEN_PATH, } from "./oauthConstants.js";
+/**
+ * Build the top-level OAuthProvider. **Export the result as the
+ * worker's `default`** so the lib gets every request first and can
+ * route OAuth endpoints internally, fan MCP requests to apiHandlers,
+ * and inject helpers onto env before forwarding to defaultHandler.
+ *
+ * Endpoint paths default to `/oauth/{authorize,token,register}` —
+ * see `oauthConstants.ts`.
+ */
+export function createOAuthProvider(args) {
+    return new OAuthProvider({
+        apiHandlers: args.apiHandlers,
+        defaultHandler: args.defaultHandler,
+        authorizeEndpoint: OAUTH_AUTHORIZE_PATH,
+        tokenEndpoint: OAUTH_TOKEN_PATH,
+        clientRegistrationEndpoint: OAUTH_REGISTER_PATH,
+        scopesSupported: [...(args.scopesSupported ?? ["mcp"])],
+    });
+}
+//# sourceMappingURL=oauthSingleton.js.map

package/dist/oauth/oauthSingleton.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthSingleton.js","sourceRoot":"","sources":["../../src/oauth/oauthSingleton.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAyB7B;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,OAAO,IAAI,aAAa,CAAC;QACvB,WAAW,EAAE,IAAI,CAAC,WAAoB;QACtC,cAAc,EAAE,IAAI,CAAC,cAAuB;QAC5C,iBAAiB,EAAE,oBAAoB;QACvC,aAAa,EAAE,gBAAgB;QAC/B,0BAA0B,EAAE,mBAAmB;QAC/C,eAAe,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@aotter/mantle-cloudflare",
+  "version": "0.0.11-alpha.11",
+  "description": "Cloudflare Workers adapter for mantle. Hono-based mountServerEndpoints / createMcpApiHandler / mountAuthorize / mountPublicRoutes. Better Auth for staff sign-in; @cloudflare/workers-oauth-provider for the MCP OAuth AS surface.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/aotter/mantle/tree/develop/packages/adapters/cloudflare",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aotter/mantle.git",
+    "directory": "packages/adapters/cloudflare"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "tag": "alpha",
+    "registry": "https://registry.npmjs.org"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@aotter/mantle-admin-ui": "0.0.11-alpha.11",
+    "@aotter/mantle-runtime": "0.0.11-alpha.11",
+    "@aotter/mantle-spec": "0.0.11-alpha.11"
+  },
+  "peerDependencies": {
+    "@cloudflare/workers-oauth-provider": "^0.6.0",
+    "aws4fetch": "^1.0.20",
+    "better-auth": "^1.6.0",
+    "hono": "^4.12.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-oauth-provider": "^0.6.0",
+    "@cloudflare/workers-types": "^4.20260518.1",
+    "@types/node": "^25",
+    "aws4fetch": "^1.0.20",
+    "better-auth": "^1.6.11",
+    "hono": "^4.12.19",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.6",
+    "wrangler": "^4.92.0",
+    "zod": "^4.4.2"
+  },
+  "scripts": {
+    "prebuild": "rm -rf dist .tsbuildinfo",
+    "build": "tsc -b tsconfig.lib.json",
+    "typecheck": "tsc --noEmit -p tsconfig.lib.json",
+    "test": "vitest run"
+  }
+}