@aotter/mantle-cloudflare 0.0.11-alpha.63 → 0.0.11-alpha.64

package/dist/oauth/cachePolicy.js

@@ -1,8 +1,11 @@
+import { OAUTH_AUTHORIZE_PATH, OAUTH_REGISTER_PATH, OAUTH_TOKEN_PATH, } from "./oauthConstants.js";
 /** Apply the Worker's final cache decision after OAuth/default dispatch. */
 export function applyCachePolicy(request, response) {
     const headers = new Headers(response.headers);
     const directives = parseCacheDirectives(headers.get("cache-control"));
-    const publicResponse = (request.method === "GET" || request.method === "HEAD") &&
+    const pathname = new URL(request.url).pathname;
+    const publicResponse = !isPrivateSurfacePath(pathname) &&
+        (request.method === "GET" || request.method === "HEAD") &&
         response.status === 200 &&
         request.headers.get("cookie") === null &&
         request.headers.get("authorization") === null &&
@@ -29,6 +32,18 @@ export function applyCachePolicy(request, response) {
         webSocket: response.webSocket,
     });
 }
+function isPrivateSurfacePath(pathname) {
+    return pathname === "/admin"
+        || pathname.startsWith("/admin/")
+        || pathname === "/api/auth"
+        || pathname.startsWith("/api/auth/")
+        || pathname === OAUTH_AUTHORIZE_PATH
+        || pathname === OAUTH_TOKEN_PATH
+        || pathname === OAUTH_REGISTER_PATH
+        || pathname.startsWith("/.well-known/oauth")
+        || pathname === "/mcp"
+        || pathname.startsWith("/mcp/");
+}
 function parseCacheDirectives(value) {
     const directives = new Map();
     for (const part of (value ?? "").split(",")) {

package/dist/oauth/cachePolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"cachePolicy.js","sourceRoot":"","sources":["../../src/oauth/cachePolicy.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,QAAkB;IACnE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,cAAc,GAClB,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QACvD,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI;QACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,IAAI;QAC7C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI;QAC3C,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAC1B,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3B,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3B,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEhC,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpC,OAAO,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAE/C,IAAI,cAAc,EAAE,CAAC;QACnB,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAoB;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC;QACpC,IAAI,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,UAA8C;IACvE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB,EAAE,GAAG,KAAe;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"cachePolicy.js","sourceRoot":"","sources":["../../src/oauth/cachePolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,QAAkB;IACnE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/C,MAAM,cAAc,GAClB,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAC/B,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QACvD,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI;QACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,IAAI;QAC7C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI;QAC3C,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAC1B,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3B,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QAC3B,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEhC,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpC,OAAO,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAE/C,IAAI,cAAc,EAAE,CAAC;QACnB,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,QAAQ,KAAK,QAAQ;WACvB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,KAAK,WAAW;WACxB,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;WACjC,QAAQ,KAAK,oBAAoB;WACjC,QAAQ,KAAK,gBAAgB;WAC7B,QAAQ,KAAK,mBAAmB;WAChC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;WACzC,QAAQ,KAAK,MAAM;WACnB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAoB;IAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC;QACpC,IAAI,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,UAA8C;IACvE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB,EAAE,GAAG,KAAe;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/oauth/index.d.ts

@@ -1,4 +1,5 @@
 export { OAUTH_AUTHORIZE_PATH, OAUTH_TOKEN_PATH, OAUTH_REGISTER_PATH, } from "./oauthConstants.js";
 export { createOAuthProvider, type CreateOAuthProviderArgs, } from "./oauthSingleton.js";
 export { mountAuthorize, type MountAuthorizeOptions, type OAuthApiProps, } from "./mountOAuth.js";
+export { applyCachePolicy } from "./cachePolicy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/oauth/index.js

@@ -1,4 +1,5 @@
 export { OAUTH_AUTHORIZE_PATH, OAUTH_TOKEN_PATH, OAUTH_REGISTER_PATH, } from "./oauthConstants.js";
 export { createOAuthProvider, } from "./oauthSingleton.js";
 export { mountAuthorize, } from "./mountOAuth.js";
+export { applyCachePolicy } from "./cachePolicy.js";
 //# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,GAGf,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/oauth/mountOAuth.d.ts

@@ -1,4 +1,4 @@
-import type { Hono } from "hono";
+import type { Env, Hono } from "hono";
 import type { Auth } from "../auth/createAuth.js";
 export interface MountAuthorizeOptions {
     /** Better Auth-backed identity used to gate the consent UI. */
@@ -19,7 +19,7 @@ export interface MountAuthorizeOptions {
  * the OAuthProvider itself and never reach defaultHandler — do not
  * mount them here.
  */
-export declare function mountAuthorize(app: Hono, options: MountAuthorizeOptions): void;
+export declare function mountAuthorize<E extends Env>(app: Hono<E>, options: MountAuthorizeOptions): void;
 /** Props that mountAuthorize stashes during completeAuthorization and
  *  that `createMcpApiHandler` reads from `ctx.props`. */
 export interface OAuthApiProps {

package/dist/oauth/mountOAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mountOAuth.d.ts","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAOlD,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;4CAGwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAqH9E;AA4BD;yDACyD;AACzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC"}
+{"version":3,"file":"mountOAuth.d.ts","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,GAAG,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAOlD,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;4CAGwC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAqHhG;AA4BD;yDACyD;AACzD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC"}

package/dist/oauth/mountOAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"mountOAuth.js","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,kBAAkB,CAAC;AAY1B;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAS,EAAE,OAA8B;IACtE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAEvD,MAAM,cAAc,GAAG,KAAK,EAAE,CAAU,EAAqB,EAAE;QAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAI,CAAC,CAAC,GAAyC,CAAC,cAAc,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CACjB,mFAAmF,EACnF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,WAAW,QAAQ,EAAE,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,4DAA4D;YAC5D,iEAAiE;YACjE,mEAAmE;YACnE,yDAAyD;YACzD,gEAAgE;YAChE,qEAAqE;YACrE,8DAA8D;YAC9D,iEAAiE;YACjE,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,YAAY,IAAI,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC9E,OAAO,IAAI,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBACnD,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACnD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAgB,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,gEAAgE;YAChE,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,eAAe;YACf,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACpC,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EACtD,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,8DAA8D;YAC9D,wDAAwD;YACxD,0DAA0D;YAC1D,MAAM,YAAY,GAChB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC;gBACzD,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,YAAY;gBACnB,6DAA6D;gBAC7D,gEAAgE;gBAChE,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,YAAY;iBACrB;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,KAAK,GAAwB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,KAAK,GAAG;gBACN,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,kBAAkB;gBACxD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC1C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,mEAAmE;QACrE,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"mountOAuth.js","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,kBAAkB,CAAC;AAY1B;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAgB,GAAY,EAAE,OAA8B;IACxF,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAEvD,MAAM,cAAc,GAAG,KAAK,EAAE,CAAa,EAAqB,EAAE;QAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAI,CAAC,CAAC,GAAyC,CAAC,cAAc,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CACjB,mFAAmF,EACnF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,WAAW,QAAQ,EAAE,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,4DAA4D;YAC5D,iEAAiE;YACjE,mEAAmE;YACnE,yDAAyD;YACzD,gEAAgE;YAChE,qEAAqE;YACrE,8DAA8D;YAC9D,iEAAiE;YACjE,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpD,IAAI,YAAY,IAAI,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC9E,OAAO,IAAI,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBACnD,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACnD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAgB,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,gEAAgE;YAChE,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,eAAe;YACf,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACpC,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EACtD,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,8DAA8D;YAC9D,wDAAwD;YACxD,0DAA0D;YAC1D,MAAM,YAAY,GAChB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC;gBACzD,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,YAAY;gBACnB,6DAA6D;gBAC7D,gEAAgE;gBAChE,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;oBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,YAAY;iBACrB;aACF,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,KAAK,GAAwB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,KAAK,GAAG;gBACN,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,kBAAkB;gBACxD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC1C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,mEAAmE;QACrE,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC"}

package/dist/oauth/oauthSingleton.d.ts

@@ -10,7 +10,7 @@ export interface CreateOAuthProviderArgs<Env = Record<string, unknown>> {
      *  `ctx.props` set to whatever was passed to
      *  `completeAuthorization({ props })`. Use `createMcpApiHandler`
      *  to build the handler value for each entry. */
-    readonly apiHandlers: Record<string, ExportedHandler<Record<string, unknown>>>;
+    readonly apiHandlers: Record<string, ExportedHandler<Env>>;
     /** Scopes advertised in `scopes_supported` for both AS metadata
      *  (RFC 8414) and PRM (RFC 9728). Defaults to `["mcp"]` — a single
      *  non-colon-namespaced scope, which is what claude.ai's MCP OAuth

package/dist/oauth/oauthSingleton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthSingleton.d.ts","sourceRoot":"","sources":["../../src/oauth/oauthSingleton.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAQnE,MAAM,WAAW,uBAAuB,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE;;;0EAGsE;IACtE,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9C;;;;qDAIiD;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/E;;;;;;;uEAOmE;IACnE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,IAAI,EAAE,uBAAuB,CAAC,GAAG,CAAC,GACjC,aAAa,CAAC,GAAG,CAAC,CASpB"}
+{"version":3,"file":"oauthSingleton.d.ts","sourceRoot":"","sources":["../../src/oauth/oauthSingleton.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAQnE,MAAM,WAAW,uBAAuB,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpE;;;0EAGsE;IACtE,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9C;;;;qDAIiD;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D;;;;;;;uEAOmE;IACnE,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/D,IAAI,EAAE,uBAAuB,CAAC,GAAG,CAAC,GACjC,aAAa,CAAC,GAAG,CAAC,CASpB"}

package/dist/worker/createMantleWorker.d.ts

@@ -0,0 +1,90 @@
+import { Hono, type Env as HonoEnv, type Handler, type MiddlewareHandler } from "hono";
+import type { AnyHandler, CmsRuntime, PublicPathResolver, TemplateRegistry } from "@aotter/mantle-runtime";
+import type { Manifest, SiteDefaults } from "@aotter/mantle-spec";
+import { type ConventionalAuthEnv } from "../auth/conventionalAuth.js";
+import type { Auth } from "../auth/createAuth.js";
+import { type MantleWorkerBindings } from "../bindings/conventionalBindings.js";
+import { type CmsRuntimeRef } from "../mount/bootRuntimeOnce.js";
+import type { CmsConfig } from "../mount/cmsConfig.js";
+import type { ConsumerCredentialResolver } from "../mount/resolveCaller.js";
+/** Fixed namespaces owned by Mantle's standard Worker surfaces. */
+export declare const MANTLE_RESERVED_PATH_PREFIXES: readonly ["/admin", "/api/auth", "/api/views", "/oauth", "/mcp"];
+/** OAuth discovery paths share this prefix but not a slash boundary. */
+export declare const MANTLE_RESERVED_WELL_KNOWN_PREFIX: "/.well-known/oauth";
+/** Exact registrations extensions may not claim. */
+export declare const MANTLE_RESERVED_EXACT_PATHS: readonly ["/favicon.svg", "*", "/*"];
+type ReservedPrefix = (typeof MANTLE_RESERVED_PATH_PREFIXES)[number];
+type ReservedExact = (typeof MANTLE_RESERVED_EXACT_PATHS)[number];
+type ReservedPath = ReservedExact | ReservedPrefix | `${ReservedPrefix}${"/" | "*" | "{"}${string}` | `${typeof MANTLE_RESERVED_WELL_KNOWN_PREFIX}${string}`;
+/** Static literals under Core-owned paths fail during consumer typecheck/build. */
+export type MantleExtensionPath<Path extends string> = string extends Path ? Path : Path extends ReservedPath ? never : Path;
+type WorkerHonoEnv<Bindings extends object> = {
+    Bindings: Bindings;
+};
+type ExtensionHandler<Bindings extends object, Path extends string> = Handler<WorkerHonoEnv<Bindings>, Path> | MiddlewareHandler<WorkerHonoEnv<Bindings>, Path>;
+type SafePath<Path extends string> = Path & MantleExtensionPath<Path>;
+type ExtensionRoute<Bindings extends object> = <const Path extends string>(path: SafePath<Path>, ...handlers: [ExtensionHandler<Bindings, Path>, ...ExtensionHandler<Bindings, Path>[]]) => MantleExtensionApp<Bindings>;
+/**
+ * A restricted view of the real Hono app. It keeps Hono handlers and routing,
+ * but omits global error/not-found hooks and rejects literal reserved paths.
+ */
+export interface MantleExtensionApp<Bindings extends object> {
+    readonly get: ExtensionRoute<Bindings>;
+    readonly post: ExtensionRoute<Bindings>;
+    readonly put: ExtensionRoute<Bindings>;
+    readonly patch: ExtensionRoute<Bindings>;
+    readonly delete: ExtensionRoute<Bindings>;
+    readonly options: ExtensionRoute<Bindings>;
+    readonly all: ExtensionRoute<Bindings>;
+    on<const Path extends string>(method: string | readonly string[], path: SafePath<Path>, ...handlers: [ExtensionHandler<Bindings, Path>, ...ExtensionHandler<Bindings, Path>[]]): MantleExtensionApp<Bindings>;
+    use<const Path extends string>(path: SafePath<Path>, ...handlers: [MiddlewareHandler<WorkerHonoEnv<Bindings>, Path>, ...MiddlewareHandler<WorkerHonoEnv<Bindings>, Path>[]]): MantleExtensionApp<Bindings>;
+    route<const Path extends string, SubEnv extends HonoEnv>(path: SafePath<Path>, app: Hono<SubEnv>): MantleExtensionApp<Bindings>;
+}
+export interface MantleCloudflareEnv extends ConventionalAuthEnv {
+    readonly KV: KVNamespace;
+    readonly OAUTH_KV: KVNamespace;
+    readonly ASSETS?: Fetcher;
+}
+export interface MantleWorkerBootstrapContext<Env extends MantleCloudflareEnv> {
+    readonly env: Env;
+    readonly auth: Auth;
+    readonly bindings: MantleWorkerBindings;
+    /** Safe to retain and call later; do not call synchronously inside `extend`. */
+    readonly getRuntime: () => Promise<CmsRuntime>;
+}
+export interface MantleWorkerMountContext<Env extends MantleCloudflareEnv> extends MantleWorkerBootstrapContext<Env> {
+    readonly app: MantleExtensionApp<Env>;
+    readonly ref: CmsRuntimeRef;
+}
+/** The one opt-in seam for application handlers, auth inputs and routes. */
+export interface MantleWorkerExtension<Env extends MantleCloudflareEnv> {
+    readonly handlers?: Readonly<Record<string, AnyHandler>>;
+    readonly credentialResolver?: ConsumerCredentialResolver;
+    readonly oauthBearer?: CmsConfig["oauthBearer"];
+    readonly scopesSupported?: readonly string[];
+    /** Standard routes mount first; extension routes may only add new paths. */
+    readonly mount?: (context: MantleWorkerMountContext<Env>) => void;
+}
+export interface CreateMantleWorkerOptions<Env extends MantleCloudflareEnv> {
+    /** Parsed manifests, normally imported from `.mantle/generated/site.js`. */
+    readonly manifest: readonly Manifest[];
+    readonly handlers?: Readonly<Record<string, AnyHandler>>;
+    readonly siteDefaults?: SiteDefaults | ((env: Env) => SiteDefaults);
+    readonly templates?: TemplateRegistry;
+    readonly publicPathResolver?: PublicPathResolver;
+    readonly mediaAllowSvg?: boolean | ((env: Env) => boolean);
+    /** Replace only Auth construction; standard Auth routes remain Core-owned. */
+    readonly auth?: (env: Env) => Auth;
+    /** Augment conventional adapters for a proven capability such as R2 media. */
+    readonly bindings?: (env: Env, conventional: MantleWorkerBindings) => MantleWorkerBindings;
+    readonly extend?: (context: MantleWorkerBootstrapContext<Env>) => MantleWorkerExtension<Env> | void;
+}
+export interface MantleWorkerHandler<Env extends MantleCloudflareEnv> {
+    fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response>;
+}
+/** Assemble Mantle's conventional Worker once per isolate. */
+export declare function createMantleWorker<Env extends MantleCloudflareEnv = MantleCloudflareEnv>(options: CreateMantleWorkerOptions<Env>): MantleWorkerHandler<Env>;
+/** Redacted fail-closed boundary for facade and low-level Worker assembly failures. */
+export declare function runMantleWorkerRequest(run: () => Response | Promise<Response>): Promise<Response>;
+export {};
+//# sourceMappingURL=createMantleWorker.d.ts.map

package/dist/worker/createMantleWorker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createMantleWorker.d.ts","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,KAAK,GAAG,IAAI,OAAO,EACnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACvB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAI5E,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,kEAMhC,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,EAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,sCAAuC,CAAC;AAEhF,KAAK,cAAc,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,KAAK,aAAa,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,KAAK,YAAY,GACb,aAAa,GACb,cAAc,GACd,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,GAC9C,GAAG,OAAO,iCAAiC,GAAG,MAAM,EAAE,CAAC;AAE3D,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,CAAC,IAAI,SAAS,MAAM,IAAI,MAAM,SAAS,IAAI,GACtE,IAAI,GACJ,IAAI,SAAS,YAAY,GACvB,KAAK,GACL,IAAI,CAAC;AAEX,KAAK,aAAa,CAAC,QAAQ,SAAS,MAAM,IAAI;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AACrE,KAAK,gBAAgB,CAAC,QAAQ,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAC9D,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GACtC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,KAAK,QAAQ,CAAC,IAAI,SAAS,MAAM,IAAI,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACtE,KAAK,cAAc,CAAC,QAAQ,SAAS,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EACvE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,KACnF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,GACrF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,GACrH,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,MAAM,SAAS,OAAO,EACrD,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAChB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B,CAAC,GAAG,SAAS,mBAAmB;IAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,wBAAwB,CAAC,GAAG,SAAS,mBAAmB,CACvE,SAAQ,4BAA4B,CAAC,GAAG,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,yBAAyB,CAAC,GAAG,SAAS,mBAAmB;IACxE,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,oBAAoB,KAC/B,oBAAoB,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,KACvC,qBAAqB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB,CAAC,GAAG,SAAS,mBAAmB;IAClE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAWD,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB,EACtF,OAAO,EAAE,yBAAyB,CAAC,GAAG,CAAC,GACtC,mBAAmB,CAAC,GAAG,CAAC,CAoE1B;AAED,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/worker/createMantleWorker.js

@@ -0,0 +1,141 @@
+import { Hono, } from "hono";
+import { createConventionalAuth, setupIncompleteAuthResponse, } from "../auth/conventionalAuth.js";
+import { createConventionalBindings, } from "../bindings/conventionalBindings.js";
+import { createCmsRef } from "../mount/bootRuntimeOnce.js";
+import { createMcpApiHandler } from "../mount/mountMcp.js";
+import { mountServerEndpoints } from "../mount/mountServerEndpoints.js";
+import { mountAuthorize } from "../oauth/mountOAuth.js";
+import { createOAuthProvider } from "../oauth/oauthSingleton.js";
+/** Fixed namespaces owned by Mantle's standard Worker surfaces. */
+export const MANTLE_RESERVED_PATH_PREFIXES = [
+    "/admin",
+    "/api/auth",
+    "/api/views",
+    "/oauth",
+    "/mcp",
+];
+/** OAuth discovery paths share this prefix but not a slash boundary. */
+export const MANTLE_RESERVED_WELL_KNOWN_PREFIX = "/.well-known/oauth";
+/** Exact registrations extensions may not claim. */
+export const MANTLE_RESERVED_EXACT_PATHS = ["/favicon.svg", "*", "/*"];
+/** Assemble Mantle's conventional Worker once per isolate. */
+export function createMantleWorker(options) {
+    let assembled = null;
+    const assemble = (env) => {
+        if (assembled)
+            return assembled;
+        const conventional = createConventionalBindings(env);
+        const bindings = options.bindings?.(env, conventional) ?? conventional;
+        const auth = options.auth?.(env) ?? createConventionalAuth(env);
+        let ref = null;
+        const getRuntime = () => ref
+            ? ref.get()
+            : Promise.reject(new Error("Mantle runtime is unavailable until `extend` returns."));
+        const bootstrap = { env, auth, bindings, getRuntime };
+        const extension = options.extend?.(bootstrap) ?? {};
+        ref = createCmsRef({
+            manifests: options.manifest,
+            handlers: mergeHandlers(options.handlers, extension.handlers),
+            siteDefaults: resolve(options.siteDefaults, env),
+            templates: options.templates,
+            publicPathResolver: options.publicPathResolver,
+            mediaAllowSvg: resolve(options.mediaAllowSvg, env),
+            bindings,
+            auth,
+            credentialResolver: extension.credentialResolver,
+            oauthBearer: extension.oauthBearer,
+        });
+        const app = new Hono();
+        mountServerEndpoints(app, ref);
+        mountAuthorize(app, { auth, loginPath: "/admin/sign-in" });
+        const standardRouteCount = app.routes.length;
+        extension.mount?.({
+            ...bootstrap,
+            app: app,
+            ref,
+        });
+        assertExtensionRoutes(app, standardRouteCount, auth.basePath);
+        const provider = createOAuthProvider({
+            defaultHandler: {
+                fetch: (request, workerEnv, ctx) => app.fetch(request, workerEnv, ctx),
+            },
+            apiHandlers: {
+                "/mcp/staff": createMcpApiHandler({ ref, surface: "staff" }),
+                "/mcp": createMcpApiHandler({ ref, surface: "public" }),
+            },
+            scopesSupported: [...new Set(["mcp", ...(extension.scopesSupported ?? [])])],
+        });
+        const next = {
+            auth,
+            fetch: (request, workerEnv, ctx) => provider.fetch(request, workerEnv, ctx),
+        };
+        assembled = next;
+        return next;
+    };
+    return {
+        async fetch(request, env, ctx) {
+            return runMantleWorkerRequest(async () => {
+                const worker = assemble(env);
+                const setupIncomplete = await setupIncompleteAuthResponse(request, worker.auth);
+                if (setupIncomplete)
+                    return setupIncomplete;
+                return worker.fetch(request, env, ctx);
+            });
+        },
+    };
+}
+/** Redacted fail-closed boundary for facade and low-level Worker assembly failures. */
+export async function runMantleWorkerRequest(run) {
+    try {
+        return await run();
+    }
+    catch (error) {
+        console.error("[mantle] Worker request failed", error);
+        return Response.json({ ok: false, error: "internal_error" }, { status: 500, headers: { "cache-control": "private, no-store" } });
+    }
+}
+function assertExtensionRoutes(app, standardRouteCount, authBasePath) {
+    const standard = app.routes.slice(0, standardRouteCount);
+    for (const route of app.routes.slice(standardRouteCount)) {
+        if (isReservedPath(route.path, authBasePath)) {
+            throw new Error(`Mantle extension route '${route.path}' is reserved by Core.`);
+        }
+        const duplicate = standard.some((owned) => owned.path === route.path && methodsOverlap(owned.method, route.method));
+        if (duplicate) {
+            throw new Error(`Mantle extension route '${route.method} ${route.path}' duplicates a Core route.`);
+        }
+    }
+}
+function isReservedPath(path, authBasePath) {
+    return MANTLE_RESERVED_EXACT_PATHS.some((owned) => path === owned)
+        || MANTLE_RESERVED_PATH_PREFIXES.some((owned) => hasOwnedPrefix(path, owned))
+        || path.startsWith(MANTLE_RESERVED_WELL_KNOWN_PREFIX)
+        || hasOwnedPrefix(path, authBasePath);
+}
+function hasOwnedPrefix(path, prefix) {
+    return path === prefix
+        || path.startsWith(`${prefix}/`)
+        || path.startsWith(`${prefix}*`)
+        || path.startsWith(`${prefix}{`);
+}
+function methodsOverlap(left, right) {
+    return left === "ALL" || right === "ALL" || left === right;
+}
+function mergeHandlers(base, extra) {
+    if (!base)
+        return extra;
+    if (!extra)
+        return base;
+    for (const key of Object.keys(extra)) {
+        if (Object.hasOwn(base, key)) {
+            throw new Error(`Mantle handler '${key}' is registered twice.`);
+        }
+    }
+    return { ...base, ...extra };
+}
+function resolve(value, env) {
+    return typeof value === "function"
+        ? value(env)
+        : value;
+}
+//# sourceMappingURL=createMantleWorker.js.map

package/dist/worker/createMantleWorker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createMantleWorker.js","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,GAIL,MAAM,MAAM,CAAC;AAQd,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAE5B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAsB,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,mEAAmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,MAAM;CACE,CAAC;AAEX,wEAAwE;AACxE,MAAM,CAAC,MAAM,iCAAiC,GAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAU,CAAC;AAqHhF,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAChC,OAAuC;IAEvC,IAAI,SAAS,GAAgC,IAAI,CAAC;IAElD,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAwB,EAAE;QAClD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,YAAY,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,YAAY,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,GAAyB,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,GAAwB,EAAE,CAAC,GAAG;YAC/C,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;YACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAEpD,GAAG,GAAG,YAAY,CAAC;YACjB,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC7D,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;YAClD,QAAQ;YACR,IAAI;YACJ,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;YAChD,WAAW,EAAE,SAAS,CAAC,WAAW;SACnC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAsB,CAAC;QAC3C,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7C,SAAS,CAAC,KAAK,EAAE,CAAC;YAChB,GAAG,SAAS;YACZ,GAAG,EAAE,GAAyC;YAC9C,GAAG;SACJ,CAAC,CAAC;QACH,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,mBAAmB,CAAM;YACxC,cAAc,EAAE;gBACd,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC;aACvE;YACD,WAAW,EAAE;gBACX,YAAY,EAAE,mBAAmB,CAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBACjE,MAAM,EAAE,mBAAmB,CAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;aAC7D;YACD,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAC7E,CAAC,CAAC;QACH,MAAM,IAAI,GAAyB;YACjC,IAAI;YACJ,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC;SAC5E,CAAC;QACF,SAAS,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YAC3B,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChF,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;gBAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAuC;IAEvC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,EAAE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAA6B,EAC7B,kBAA0B,EAC1B,YAAoB;IAEpB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzD,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,wBAAwB,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACnF,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,YAAoB;IACxD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC;WAC7D,6BAA6B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;WAC1E,IAAI,CAAC,UAAU,CAAC,iCAAiC,CAAC;WAClD,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,OAAO,IAAI,KAAK,MAAM;WACjB,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;WAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;WAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CACpB,IAAsD,EACtD,KAAuD;IAEvD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,wBAAwB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CACd,KAAgD,EAChD,GAAQ;IAER,OAAO,OAAO,KAAK,KAAK,UAAU;QAChC,CAAC,CAAE,KAA+B,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC"}

package/dist/worker/index.d.ts

@@ -0,0 +1,2 @@
+export { MANTLE_RESERVED_EXACT_PATHS, MANTLE_RESERVED_PATH_PREFIXES, MANTLE_RESERVED_WELL_KNOWN_PREFIX, createMantleWorker, runMantleWorkerRequest, type CreateMantleWorkerOptions, type MantleCloudflareEnv, type MantleExtensionApp, type MantleExtensionPath, type MantleWorkerBootstrapContext, type MantleWorkerExtension, type MantleWorkerHandler, type MantleWorkerMountContext, } from "./createMantleWorker.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/worker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC"}

package/dist/worker/index.js

@@ -0,0 +1,2 @@
+export { MANTLE_RESERVED_EXACT_PATHS, MANTLE_RESERVED_PATH_PREFIXES, MANTLE_RESERVED_WELL_KNOWN_PREFIX, createMantleWorker, runMantleWorkerRequest, } from "./createMantleWorker.js";
+//# sourceMappingURL=index.js.map

package/dist/worker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/worker/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,6BAA6B,EAC7B,iCAAiC,EACjC,kBAAkB,EAClB,sBAAsB,GASvB,MAAM,yBAAyB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aotter/mantle-cloudflare",
-  "version": "0.0.11-alpha.63",
+  "version": "0.0.11-alpha.64",
   "description": "Cloudflare Workers adapter for mantle. Hono-based mountServerEndpoints / createMcpApiHandler / mountAuthorize / mountPublicRoutes. Better Auth for staff sign-in; @cloudflare/workers-oauth-provider for the MCP OAuth AS surface.",
   "license": "Apache-2.0",
   "homepage": "https://mantle.tools/",
@@ -30,9 +30,9 @@
   ],
   "dependencies": {
     "@better-auth/oauth-provider": "^1.6.23",
-    "@aotter/mantle-admin-ui": "0.0.11-alpha.63",
-    "@aotter/mantle-spec": "0.0.11-alpha.63",
-    "@aotter/mantle-runtime": "0.0.11-alpha.63"
+    "@aotter/mantle-admin-ui": "0.0.11-alpha.64",
+    "@aotter/mantle-runtime": "0.0.11-alpha.64",
+    "@aotter/mantle-spec": "0.0.11-alpha.64"
   },
   "peerDependencies": {
     "@cloudflare/workers-oauth-provider": "^0.8.0",
@@ -57,7 +57,8 @@
     "prebuild": "rm -rf dist .tsbuildinfo",
     "build": "tsc -b tsconfig.lib.json",
     "typecheck": "tsc --noEmit -p tsconfig.lib.json",
-    "test": "vitest run",
+    "test": "pnpm test:facade-types && vitest run",
+    "test:facade-types": "tsc --ignoreConfig --noEmit --strict --target ES2022 --module NodeNext --moduleResolution NodeNext --skipLibCheck --types @cloudflare/workers-types,node test/createMantleWorker.typecheck.ts",
     "bench:http-dispatch": "vitest bench --run test/http-dispatch.bench.ts",
     "bench:wrangler": "pnpm --filter @aotter/mantle-runtime build && node ../../../scripts/run-wrangler-performance.mjs"
   }