@aotter/mantle-cloudflare 0.0.11-alpha.73 → 0.1.0-alpha.10

package/README.md

@@ -3,21 +3,60 @@
 Cloudflare Workers adapter for mantle.
 
 This package mounts the runtime on Hono, implements the runtime ports against
-Cloudflare D1 / KV / Workers assets, and owns curated identity/session wiring
-plus MCP OAuth/DCR.
+Cloudflare D1 / Workers assets, and owns curated identity/session wiring
+plus MCP OAuth/CIMD. Legacy DCR remains a bounded compatibility path.
 
 This package is prerelease software. Its `package.json` is the exact version
 authority; the API surface may change until `v0.1.0`.
 
 ## Conventional Worker Facade
 
-`createMantleWorker({ manifest })` is the normal assembly path. It composes the
+`createMantleWorker({ plan })` is the normal assembly path. It composes the
 adapter's existing Auth, binding, Hono, OAuth and MCP primitives once per
 isolate; `extend` may add application routes but cannot replace Core-owned
 paths. The canonical contract and reserved path list live in the umbrella
 package's [Conventional Cloudflare Worker](../../mantle/README.md#conventional-cloudflare-worker)
 section.
 
+The returned facade also exposes `getRuntime(env)`. Site-owned Queue and
+scheduled handlers use it with generated `bindMantle(...)` Procedures so
+they reuse the fetch path's assembled runtime instead of writing directly to
+Mantle tables. Queue handlers still own per-message acknowledgement, retry,
+and idempotency.
+
+### Conventional Auth
+
+Without an `auth` option, `createMantleWorker` requires one explicit mode:
+
+| Mode | Non-secret bindings | Worker secrets | Must be absent |
+|---|---|---|---|
+| `self-managed` | `MANTLE_AUTH_MODE=self-managed`, `PUBLIC_ORIGIN`, `GITHUB_CLIENT_ID`, `ADMIN_GITHUB_LOGIN` | `GITHUB_CLIENT_SECRET`, `BETTER_AUTH_SECRET` | `MANTLE_HOSTED_AUTH_ISSUER`, `MANTLE_HOSTED_AUTH_CLIENT_ID` |
+| `hosted` | `MANTLE_AUTH_MODE=hosted`, `PUBLIC_ORIGIN`, `MANTLE_HOSTED_AUTH_ISSUER`, `MANTLE_HOSTED_AUTH_CLIENT_ID`, `ADMIN_GITHUB_LOGIN` | `BETTER_AUTH_SECRET` | `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET` |
+
+Hosted Auth is a public PKCE client with no client secret. Its issuer must be
+an HTTPS root origin (HTTP is accepted only for loopback development), and the
+client id must be a URL at the same origin with the shape `/clients/<id>`.
+Invalid, partial, or mixed-mode configuration fails closed: public site routes
+remain available, while Admin, Auth, OAuth, and MCP routes return
+`503 setup_incomplete`.
+
+MCP client metadata is fetched through the public Internet boundary. Keep both
+flags in `wrangler.jsonc`:
+
+```jsonc
+"compatibility_flags": ["nodejs_compat", "global_fetch_strictly_public"]
+```
+
+Sites with a different identity design may preserve Core's route ownership
+while replacing only construction:
+
+```ts
+createMantleWorker({
+  plan,
+  auth: (env) => createAuth({ /* curated site-specific methods */ }),
+});
+```
+
 When the conventional lifecycle really does not fit, copy the
 [low-level composition fixture](../../../docs/cloudflare-low-level-composition.md).
 It uses the same public bindings, Auth, runtime, OAuth/MCP, cache and error
@@ -54,8 +93,8 @@ participating subdomain. For a customer-owned domain such as
 
 ## API and MCP Authorization
 
-`createCmsRef()` accepts an optional `credentialResolver` for site-owned API
-keys and personal tokens, plus optional `oauthBearer` JWT verification for
+`createMantleRuntimeRef()` accepts an optional `credentialResolver` for site-owned API
+keys and personal tokens, plus optional `jwtBearer` verification for
 manifest REST routes. The adapter normalizes those callers, cookie sessions,
 and MCP OAuth callers into the same runtime auth context. Manifest
 `ctx.auth`/scope predicates and `guard.procedure` then enforce the target on
@@ -85,17 +124,20 @@ usually dominate the total request time.
 
 ## HTTP Cache Boundary
 
-The conventional facade owns the top-level OAuth provider. In low-level
-composition, export `createOAuthProvider(...)` as the Worker's top-level
-handler. It marks
+The conventional facade applies the final cache policy after Better Auth,
+MCP, Admin, manifest, and application routing. Low-level composition must call
+the exported `applyCachePolicy(...)` at the same final boundary. It marks
 admin, auth, API, OAuth, MCP, redirects, and errors `private, no-store` and
 removes Cloudflare CDN cache overrides. Only anonymous 200 `GET`/`HEAD`
 responses that explicitly declare `public` plus shared freshness remain
 cacheable; they vary on `Cookie` and `Authorization`.
 
-`mountPublicRoutes(...)` applies that explicit public contract to pre-rendered
-HTML, markdown, `llms.txt`, and sitemap responses. A consumer Workers Cache may
-store only responses that still satisfy the contract. See the
+`mountPublicRoutes(...)` renders D1-backed HTML, markdown, `llms.txt`, and
+sitemap responses with that explicit public contract and one `mantle-public`
+Cache-Tag. Publishing-content and site-setting mutations purge that tag through
+the native Workers cache API; immutable assets and operational records stay
+outside the purge boundary. Workers Cache stores only responses that still
+satisfy the anonymous policy, and remains version-local. See the
 [adapter implementation guide](../../../docs/adapter-guide.md#http-cache-contract).
 
 ## Optional R2 Media Uploads

package/dist/auth/conventionalAuth.d.ts

@@ -3,12 +3,18 @@ export interface ConventionalAuthEnv {
     readonly DB: D1Database;
     readonly PUBLIC_ORIGIN?: string;
     readonly BETTER_AUTH_SECRET?: string;
+    readonly MANTLE_AUTH_MODE?: string;
+    readonly MANTLE_HOSTED_AUTH_ISSUER?: string;
+    readonly MANTLE_HOSTED_AUTH_CLIENT_ID?: string;
     readonly GITHUB_CLIENT_ID?: string;
     readonly GITHUB_CLIENT_SECRET?: string;
     readonly ADMIN_GITHUB_LOGIN?: string;
 }
-/** Choose self-managed GitHub OAuth or a fail-closed facade. */
+/** Choose hosted or self-managed GitHub Auth, otherwise fail closed. */
 export declare function createConventionalAuth(env: ConventionalAuthEnv): Auth;
+/** Canonical origin shared by Better Auth and the MCP resource verifier. */
+export declare function conventionalAuthBaseURL(env: ConventionalAuthEnv): string;
+export declare function conventionalMcpResource(env: ConventionalAuthEnv): string;
 /** Return the setup response only for Auth-owned private surfaces. */
 export declare function setupIncompleteAuthResponse(request: Request, auth: Auth): Promise<Response | null>;
 //# sourceMappingURL=conventionalAuth.d.ts.map

package/dist/auth/conventionalAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conventionalAuth.d.ts","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EAEV,MAAM,iBAAiB,CAAC;AAWzB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA4BrE;AAED,sEAAsE;AACtE,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAG1B"}
+{"version":3,"file":"conventionalAuth.d.ts","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAyFrE;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAExE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAExE;AAED,sEAAsE;AACtE,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAG1B"}

package/dist/auth/conventionalAuth.js

@@ -1,31 +1,99 @@
 import { createAuth, createSetupIncompleteAuth, isSetupIncompleteAuth, } from "./createAuth.js";
-import { OAUTH_AUTHORIZE_PATH, OAUTH_REGISTER_PATH, OAUTH_TOKEN_PATH, } from "../oauth/oauthConstants.js";
 import { applyCachePolicy } from "../oauth/cachePolicy.js";
-const AUTH_NOT_CONFIGURED = "Admin auth is not configured yet. Configure self-managed GitHub OAuth or provide an explicit Auth factory.";
-/** Choose self-managed GitHub OAuth or a fail-closed facade. */
+/** Choose hosted or self-managed GitHub Auth, otherwise fail closed. */
 export function createConventionalAuth(env) {
-    const baseURL = value(env.PUBLIC_ORIGIN)?.replace(/\/+$/, "") ?? "http://localhost:8787";
+    const mode = value(env.MANTLE_AUTH_MODE);
     const secret = value(env.BETTER_AUTH_SECRET);
+    const owner = githubLogin(env.ADMIN_GITHUB_LOGIN);
+    const hostedIssuerRaw = value(env.MANTLE_HOSTED_AUTH_ISSUER);
+    const hostedClientIdRaw = value(env.MANTLE_HOSTED_AUTH_CLIENT_ID);
+    const hostedIssuer = hostedOrigin(hostedIssuerRaw);
+    const hostedClientId = hostedClient(hostedClientIdRaw, hostedIssuer);
     const githubClientId = value(env.GITHUB_CLIENT_ID);
     const githubClientSecret = value(env.GITHUB_CLIENT_SECRET);
-    const adminGithubLogin = value(env.ADMIN_GITHUB_LOGIN);
-    const githubReady = Boolean(secret && githubClientId && githubClientSecret && adminGithubLogin);
-    if (!githubReady) {
-        return createSetupIncompleteAuth({ message: AUTH_NOT_CONFIGURED });
+    const baseURL = conventionalAuthBaseURL(env);
+    const oauthProvider = {
+        loginPage: "/admin/sign-in",
+        consentPage: "/oauth/consent",
+        scopes: ["mcp"],
+        allowDynamicClientRegistration: true,
+        allowUnauthenticatedClientRegistration: true,
+        clientRegistrationDefaultScopes: ["mcp"],
+        clientRegistrationAllowedScopes: ["mcp"],
+        mcpResource: conventionalMcpResource(env),
+    };
+    if (mode === "hosted") {
+        if (!secret || !owner || !hostedIssuer || !hostedClientId || githubClientId || githubClientSecret) {
+            return incomplete(`Hosted Auth configuration errors: ${[
+                !secret ? "BETTER_AUTH_SECRET is not set" : null,
+                !owner ? "ADMIN_GITHUB_LOGIN is not set or invalid" : null,
+                !hostedIssuer
+                    ? `MANTLE_HOSTED_AUTH_ISSUER is ${hostedIssuerRaw ? "invalid" : "not set"}`
+                    : null,
+                !hostedClientId
+                    ? `MANTLE_HOSTED_AUTH_CLIENT_ID is ${hostedClientIdRaw ? "invalid" : "not set"}`
+                    : null,
+                githubClientId ? "GITHUB_CLIENT_ID is set" : null,
+                githubClientSecret ? "GITHUB_CLIENT_SECRET is set" : null,
+            ].filter(Boolean).join("; ")}.`);
+        }
+        return createAuth({
+            database: env.DB,
+            baseURL,
+            secret,
+            methods: [{
+                    kind: "oauth",
+                    providerId: "github",
+                    displayName: "GitHub",
+                    clientId: hostedClientId,
+                    authorizationUrl: `${hostedIssuer}/authorize`,
+                    tokenUrl: `${hostedIssuer}/token`,
+                    userInfoUrl: `${hostedIssuer}/userinfo`,
+                    scopes: ["profile", "email"],
+                    redirectURI: `${baseURL}/api/auth/callback/github`,
+                    pkce: true,
+                    mapProfileToUser: (profile) => {
+                        const login = githubLogin(profile.github_login);
+                        return login ? { githubLogin: login } : {};
+                    },
+                }],
+            bootstrapOwner: { match: "github-login", value: owner },
+            oauthProvider,
+        });
     }
-    const methods = [{
-            kind: "social",
-            provider: "github",
-            clientId: githubClientId,
-            clientSecret: githubClientSecret,
-        }];
-    return createAuth({
-        database: env.DB,
-        baseURL,
-        secret: secret,
-        methods,
-        bootstrapOwner: { match: "github-login", value: adminGithubLogin },
-    });
+    if (mode === "self-managed") {
+        if (!secret || !owner || !githubClientId || !githubClientSecret || hostedIssuerRaw || hostedClientIdRaw) {
+            return incomplete(`Self-managed Auth configuration errors: ${[
+                !secret ? "BETTER_AUTH_SECRET is not set" : null,
+                !owner ? "ADMIN_GITHUB_LOGIN is not set or invalid" : null,
+                !githubClientId ? "GITHUB_CLIENT_ID is not set" : null,
+                !githubClientSecret ? "GITHUB_CLIENT_SECRET is not set" : null,
+                hostedIssuerRaw ? "MANTLE_HOSTED_AUTH_ISSUER is set" : null,
+                hostedClientIdRaw ? "MANTLE_HOSTED_AUTH_CLIENT_ID is set" : null,
+            ].filter(Boolean).join("; ")}.`);
+        }
+        return createAuth({
+            database: env.DB,
+            baseURL,
+            secret,
+            methods: [{
+                    kind: "social",
+                    provider: "github",
+                    clientId: githubClientId,
+                    clientSecret: githubClientSecret,
+                }],
+            bootstrapOwner: { match: "github-login", value: owner },
+            oauthProvider,
+        });
+    }
+    return incomplete("MANTLE_AUTH_MODE must be hosted or self-managed.");
+}
+/** Canonical origin shared by Better Auth and the MCP resource verifier. */
+export function conventionalAuthBaseURL(env) {
+    return value(env.PUBLIC_ORIGIN)?.replace(/\/+$/, "") ?? "http://localhost:8787";
+}
+export function conventionalMcpResource(env) {
+    return `${conventionalAuthBaseURL(env)}/mcp`;
 }
 /** Return the setup response only for Auth-owned private surfaces. */
 export async function setupIncompleteAuthResponse(request, auth) {
@@ -39,13 +107,46 @@ function isAuthProtectedPath(request, auth) {
         || pathname.startsWith("/admin/")
         || pathname === auth.basePath
         || pathname.startsWith(`${auth.basePath}/`)
-        || pathname === OAUTH_AUTHORIZE_PATH
-        || pathname === OAUTH_TOKEN_PATH
-        || pathname === OAUTH_REGISTER_PATH
+        || pathname === "/oauth"
+        || pathname.startsWith("/oauth/")
         || pathname.startsWith("/.well-known/oauth")
         || pathname === "/mcp"
         || pathname.startsWith("/mcp/");
 }
+function incomplete(message) {
+    return createSetupIncompleteAuth({ message });
+}
+function hostedOrigin(raw) {
+    try {
+        const url = new URL(value(raw) ?? "");
+        if (!secureOrLoopback(url) || url.pathname !== "/" || url.search || url.hash)
+            return null;
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+function hostedClient(raw, issuer) {
+    try {
+        const url = new URL(value(raw) ?? "");
+        return issuer && secureOrLoopback(url) && url.origin === issuer && /^\/clients\/[A-Za-z0-9_-]{1,128}$/u.test(url.pathname) && !url.search && !url.hash
+            ? url.toString()
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function secureOrLoopback(url) {
+    return !url.username && !url.password && (url.protocol === "https:" || (url.protocol === "http:" &&
+        (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]")));
+}
+function githubLogin(raw) {
+    return typeof raw === "string" && /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u.test(raw.trim())
+        ? raw.trim()
+        : null;
+}
 function value(raw) {
     return raw?.trim() || null;
 }

package/dist/auth/conventionalAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"conventionalAuth.js","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,qBAAqB,GAGtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,mBAAmB,GACvB,4GAA4G,CAAC;AAW/G,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,GAAwB;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,uBAAuB,CAAC;IACzF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,CACzB,MAAM,IAAI,cAAc,IAAI,kBAAkB,IAAI,gBAAgB,CACnE,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,yBAAyB,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAuB,CAAC;YACnC,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAe;YACzB,YAAY,EAAE,kBAAmB;SAClC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,GAAG,CAAC,EAAE;QAChB,OAAO;QACP,MAAM,EAAE,MAAO;QACf,OAAO;QACP,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAiB,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,IAAU;IAEV,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,IAAU;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/C,OAAO,QAAQ,KAAK,QAAQ;WACvB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,KAAK,IAAI,CAAC,QAAQ;WAC1B,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;WACxC,QAAQ,KAAK,oBAAoB;WACjC,QAAQ,KAAK,gBAAgB;WAC7B,QAAQ,KAAK,mBAAmB;WAChC,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;WACzC,QAAQ,KAAK,MAAM;WACnB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,KAAK,CAAC,GAAuB;IACpC,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"conventionalAuth.js","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAc3D,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,GAAwB;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG;QACpB,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,8BAA8B,EAAE,IAAI;QACpC,sCAAsC,EAAE,IAAI;QAC5C,+BAA+B,EAAE,CAAC,KAAK,CAAC;QACxC,+BAA+B,EAAE,CAAC,KAAK,CAAC;QACxC,WAAW,EAAE,uBAAuB,CAAC,GAAG,CAAC;KACjC,CAAC;IAEX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YAClG,OAAO,UAAU,CAAC,qCAAqC;gBACrD,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI;gBAChD,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI;gBAC1D,CAAC,YAAY;oBACX,CAAC,CAAC,gCAAgC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;oBAC3E,CAAC,CAAC,IAAI;gBACR,CAAC,cAAc;oBACb,CAAC,CAAC,mCAAmC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;oBAChF,CAAC,CAAC,IAAI;gBACR,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI;gBACjD,kBAAkB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI;aAC1D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,OAAO;YACP,MAAM;YACN,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,OAAO;oBACb,UAAU,EAAE,QAAQ;oBACpB,WAAW,EAAE,QAAQ;oBACrB,QAAQ,EAAE,cAAc;oBACxB,gBAAgB,EAAE,GAAG,YAAY,YAAY;oBAC7C,QAAQ,EAAE,GAAG,YAAY,QAAQ;oBACjC,WAAW,EAAE,GAAG,YAAY,WAAW;oBACvC,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;oBAC5B,WAAW,EAAE,GAAG,OAAO,2BAA2B;oBAClD,IAAI,EAAE,IAAI;oBACV,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;wBAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;wBAChD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,CAAC;iBACF,CAAC;YACF,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE;YACvD,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;YACxG,OAAO,UAAU,CAAC,2CAA2C;gBAC3D,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI;gBAChD,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI;gBAC1D,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI;gBACtD,CAAC,kBAAkB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI;gBAC9D,eAAe,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI;gBAC3D,iBAAiB,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,IAAI;aACjE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,OAAO;YACP,MAAM;YACN,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,cAAc;oBACxB,YAAY,EAAE,kBAAkB;iBACjC,CAAC;YACF,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE;YACvD,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC,kDAAkD,CAAC,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,uBAAuB,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,IAAU;IAEV,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,IAAU;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/C,OAAO,QAAQ,KAAK,QAAQ;WACvB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,KAAK,IAAI,CAAC,QAAQ;WAC1B,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;WACxC,QAAQ,KAAK,QAAQ;WACrB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;WACzC,QAAQ,KAAK,MAAM;WACnB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,yBAAyB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB,EAAE,MAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI;YACpJ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;YAChB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CACrE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC3F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAA8B;IAC3C,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}

package/dist/auth/createAuth.d.ts

@@ -1,7 +1,9 @@
 import type { SocialProvider } from "better-auth/social-providers";
 import { type Scope } from "@better-auth/oauth-provider";
+import { decodeMemberCursor, encodeMemberCursor } from "@aotter/mantle-admin";
 import type { EmailSender } from "@aotter/mantle-runtime";
 import { STAFF_ROLES, type StaffRole } from "@aotter/mantle-spec";
+export { decodeMemberCursor, encodeMemberCursor };
 export { STAFF_ROLES, type StaffRole };
 /**
  * Set lookup for "is this role string a staff role?" — handlers/MCP
@@ -66,9 +68,8 @@ export type AuthMethodConfig = {
     readonly extras?: Readonly<Record<string, unknown>>;
 } | {
     readonly kind: "oauth";
-    /** Better Auth generic OAuth provider id. Stable across sign-in
-     *  start (`/sign-in/oauth2`) and callback
-     *  (`/oauth2/callback/:providerId`). */
+    /** Better Auth generic OAuth provider id. In 1.7 generic providers use
+     *  the standard social sign-in and `/callback/:id` routes. */
     readonly providerId: string;
     /** Human label surfaced by `/api/auth/methods` so the admin SPA
      *  can render "Continue with Mantle Platform" without knowing
@@ -79,8 +80,6 @@ export type AuthMethodConfig = {
     /** OIDC discovery document URL. Prefer this over hand-wiring
      *  authorization/token/userinfo URLs. */
     readonly discoveryUrl?: string;
-    readonly issuer?: string;
-    readonly requireIssuerValidation?: boolean;
     readonly authorizationUrl?: string;
     readonly tokenUrl?: string;
     readonly userInfoUrl?: string;
@@ -169,11 +168,15 @@ export interface OAuthProviderConfig {
     readonly clientRegistrationDefaultScopes?: ReadonlyArray<Scope>;
     readonly clientRegistrationAllowedScopes?: ReadonlyArray<Scope>;
     readonly cachedTrustedClients?: ReadonlySet<string>;
-    /** Explicit JWT audiences this authorization server may mint. */
-    readonly validAudiences?: ReadonlyArray<string>;
+    /** Protected resources this authorization server may issue tokens for. */
+    readonly resources?: ReadonlyArray<string>;
+    /** Turn this provider into the MCP authorization server for one canonical
+     *  resource. Cloudflare deployments must enable
+     *  `global_fetch_strictly_public` for CIMD fetches. */
+    readonly mcpResource?: string;
     readonly clientPrivileges?: (context: {
         readonly headers: Headers;
-        readonly action: "create" | "read" | "update" | "delete" | "list" | "rotate";
+        readonly action: "create" | "read" | "update" | "delete" | "list" | "rotate" | "configure-client-credentials-scopes";
         readonly user?: {
             readonly id: string;
             readonly email: string;
@@ -200,7 +203,7 @@ export interface RegisterOAuthClientInput {
     readonly tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post";
     readonly grantTypes?: ReadonlyArray<"authorization_code" | "client_credentials" | "refresh_token">;
     readonly responseTypes?: ReadonlyArray<"code">;
-    readonly type?: "web" | "native" | "user-agent-based";
+    readonly applicationType?: "web" | "native";
     readonly skipConsent?: boolean;
     readonly enableEndSession?: boolean;
     readonly requirePKCE?: boolean;
@@ -215,8 +218,7 @@ export interface RegisteredOAuthClient {
     readonly clientName?: string;
     readonly clientUri?: string;
     readonly tokenEndpointAuthMethod?: string;
-    readonly type?: string;
-    readonly public?: boolean;
+    readonly applicationType?: "web" | "native";
 }
 export interface CreateAuthConfig {
     readonly database: D1Database;
@@ -225,6 +227,8 @@ export interface CreateAuthConfig {
      *  multiple auth instances live in one Worker, e.g. hosted platform
      *  provider + site staff auth + launch GitHub auth. */
     readonly basePath?: string;
+    /** Same-origin destination for auth failures. Defaults to `/`. */
+    readonly errorURL?: string;
     readonly secret: string;
     /** Registered auth methods. Boot fails fast if empty. */
     readonly methods: ReadonlyArray<AuthMethodConfig>;
@@ -289,9 +293,8 @@ export interface LinkedAccountInfo {
  * `user` table's identity columns; password hashes, ban metadata, and
  * other secret-shaped columns are intentionally excluded.
  *
- * `emailVerified: false` + a `null` role is the resting state of an
- * *invitation* (a row pre-created by `inviteUser` that nobody has
- * signed in to yet) — the admin SPA renders those as "invited".
+ * `emailVerified: false` + no linked account identifies a pending
+ * invitation; invited rows already carry their requested staff role.
  */
 export interface StaffUserInfo {
     readonly id: string;
@@ -302,6 +305,18 @@ export interface StaffUserInfo {
     readonly emailVerified: boolean;
     readonly createdAt: Date;
 }
+export type MemberUserInfo = Pick<StaffUserInfo, "id" | "email" | "name" | "emailVerified" | "createdAt">;
+export interface MemberListResult {
+    readonly items: readonly MemberUserInfo[];
+    readonly previousCursor: string | null;
+    readonly nextCursor: string | null;
+}
+export interface ListMembersArgs {
+    readonly search?: string;
+    readonly cursor?: string;
+    readonly cursorDirection?: "forward" | "backward";
+    readonly limit: number;
+}
 /** Stable, secret-free user projection for consumer-owned services. */
 export interface AuthUserInfo extends StaffUserInfo {
     readonly image: string | null;
@@ -330,11 +345,21 @@ export type OAuthAccessTokenVerification = {
 } | {
     readonly ok: false;
     readonly status: 401 | 403;
-    readonly reason: "invalid-token" | "insufficient-scope";
+    readonly reason: "invalid-token" | "invalid-dpop-proof" | "insufficient-scope";
     readonly missingScopes?: readonly string[];
 };
+export interface OAuthConsentRequest {
+    readonly clientName: string;
+    readonly redirectUri: string;
+    readonly scopes: readonly string[];
+    /** Better Auth-signed authorization query. Return it unchanged with the
+     *  consent decision so Better Auth can verify the flow. */
+    readonly oauthQuery: string;
+}
 export interface Auth {
     readonly basePath: string;
+    /** Canonical MCP protected resource when this Auth owns one. */
+    readonly mcpResource?: string;
     readonly handler: (request: Request) => Promise<Response>;
     readonly getSession: (request: Request) => Promise<{
         session: {
@@ -351,9 +376,9 @@ export interface Auth {
             githubLogin?: string | null;
         };
     } | null>;
-    /** Read `user.role` directly from D1. Bearer-token auth surfaces
-     *  (MCP, HTTP Triggers) need this because OAuth access tokens carry
-     *  userId + scopes but not the user's role. */
+    /** Authoritative `user.role` lookup. Protected Admin, MCP, preview,
+     *  and HTTP Trigger calls use this on every request so custom Auth
+     *  session snapshots cannot retain revoked staff access. */
     readonly getUserRole: (userId: string) => Promise<string | null>;
     /** Read one Better Auth-owned user without coupling consumers to its SQL schema.
      *  Optional so existing custom Auth implementations remain source-compatible. */
@@ -363,12 +388,17 @@ export interface Auth {
      *  tokens and account rows are never returned. */
     readonly getProviderAccessToken: (request: Request, providerId: string) => Promise<ProviderAccessToken>;
     /** Verify a JWT access token against this Auth instance's issuer and
-     *  JWKS. Opaque tokens and remote introspection are intentionally not
+     *  JWKS. Passing a Request also enforces DPoP proof binding and persistent
+     *  replay protection. Opaque tokens and remote introspection are not
      *  supported. */
     readonly verifyOAuthAccessToken: (tokenOrRequest: string | Request, options: {
         readonly audience: string;
         readonly scopes?: readonly string[];
     }) => Promise<OAuthAccessTokenVerification>;
+    /** Secret-free client projection for the current consent redirect. */
+    readonly getOAuthConsentRequest: (request: Request) => Promise<OAuthConsentRequest | null>;
+    /** Submit the original signed query and return the validated client redirect. */
+    readonly completeOAuthConsent: (request: Request, accept: boolean) => Promise<string>;
     /** Methods the consumer registered, in declaration order. The admin
      *  SPA renders sign-in sections per this list. Secrets, senders, and
      *  per-provider extras are intentionally excluded — UI doesn't need
@@ -388,11 +418,12 @@ export interface Auth {
      *  email-OTP / magic-link sign-ins do not write to the `account`
      *  table at all, so "rows left" is not a reliable indicator. */
     readonly unlinkAccount: (userId: string, providerId: string) => Promise<boolean>;
-    /** List every user row for the staff-management surface, ordered by
-     *  `createdAt` ascending. Read-only — uses the underlying D1 binding
-     *  directly. Owner-only enforcement is the mount layer's job
-     *  (`/admin/api/staff`); this method does not gate. */
+    /** List only users with a staff role, ordered by `createdAt`
+     *  ascending. End-user identities stay outside the team-management
+     *  surface. Owner-only enforcement is the mount layer's job. */
     readonly listUsers: () => Promise<readonly StaffUserInfo[]>;
+    /** List non-staff identities for the member-management surface. */
+    readonly listMembers: (args: ListMembersArgs) => Promise<MemberListResult>;
     /** Assign or clear a user's staff role. `null` revokes staff access
      *  (the row keeps existing — the user can still sign in, but every
      *  staff-gated surface 403s). Returns false when no row matched.

package/dist/auth/createAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../../src/auth/createAuth.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AASnE,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAAwB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE9C,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACvC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC;IAChD,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;kDAE8C;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;2CAEuC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;;;;;;kEAa8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;4CAEwC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;yCAEqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;6CACyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EACZ,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,gBAAgB,GAChB,wBAAwB,GACxB,eAAe,CAAC;IACpB;qEACiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;CAChD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;iEAC6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;2EACuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;8DAC0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;iDAE6C;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC;6CACyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpD,iEAAiE;IACjE,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAC1E,MAAM,EACN,OAAO,CACR,CAAC;KACH,KAAK,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC;yEACqE;IACrE,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,uBAAuB,CAAC,EAC7B,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CACjC,oBAAoB,GAAG,oBAAoB,GAAG,eAAe,CAC9D,CAAC;IACF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,kBAAkB,CAAC;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD;sCACkC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C;qCACiC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;iEAC6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;yDACqD;IACrD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D;uEACmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;0CAEsC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CAC9C;AA+YD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,UAAU,GAAE,aAAa,CAAC,MAAM,CAAM,GACrC,MAAM,EAAE,CAKV;AAiVD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAChE;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;gCAEgC;AAChC,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,oBAAoB,CAAC;IACxD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C,CAAC;AAMN,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QACjD,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAA;SAAE,CAAC;QACzD,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SAC7B,CAAC;KACH,GAAG,IAAI,CAAC,CAAC;IACV;;mDAE+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjE;qFACiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACpE;;sDAEkD;IAClD,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC;;qBAEiB;IACjB,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,cAAc,EAAE,MAAM,GAAG,OAAO,EAChC,OAAO,EAAE;QACP,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,KACE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C;;;;kCAI8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAChD;;;qDAGiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IAC3C;;;;;;oEAMgE;IAChE,QAAQ,CAAC,aAAa,EAAE,CACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;2DAGuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC5D;;;;;;iBAMa;IACb,QAAQ,CAAC,WAAW,EAAE,CACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GAAG,IAAI,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;;;;wDAQoD;IACpD,QAAQ,CAAC,UAAU,EAAE,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,KACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B;;;wEAGoE;IACpE,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D;;;6EAGyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,KAAK,EAAE,wBAAwB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC;AAID,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAEzD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA6NzD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,IAAI,CAuCN"}
+{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../../src/auth/createAuth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AASnE,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAGxE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAAwB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE9C,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KACvC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC;IAChD,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;kDAE8C;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;2CAEuC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC;;;;;;;;;;;;;kEAa8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;kEAC8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;yCAEqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;6CACyC;IACzC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EACZ,MAAM,GACN,OAAO,GACP,QAAQ,GACR,SAAS,GACT,gBAAgB,GAChB,wBAAwB,GACxB,eAAe,CAAC;IACpB;qEACiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;CAChD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;iEAC6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;2EACuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;8DAC0D;IAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;iDAE6C;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC;6CACyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C;;2DAEuD;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,MAAM,EACX,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,qCAAqC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAC1E,MAAM,EACN,OAAO,CACR,CAAC;KACH,KAAK,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC;yEACqE;IACrE,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,uBAAuB,CAAC,EAC7B,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CACjC,oBAAoB,GAAG,oBAAoB,GAAG,eAAe,CAC9D,CAAC;IACF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD;sCACkC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C;qCACiC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;iEAC6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;yDACqD;IACrD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D;uEACmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;0CAEsC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CAC9C;AA8YD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,UAAU,GAAE,aAAa,CAAC,MAAM,CAAM,GACrC,MAAM,EAAE,CAKV;AA8PD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAChE;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,aAAa,EACb,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,eAAe,GAAG,WAAW,CACxD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;gCAEgC;AAChC,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,MAAM,EACX,eAAe,GACf,oBAAoB,GACpB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEN,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;+DAC2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAMD,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QACjD,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAA;SAAE,CAAC;QACzD,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SAC7B,CAAC;KACH,GAAG,IAAI,CAAC,CAAC;IACV;;gEAE4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjE;qFACiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACpE;;sDAEkD;IAClD,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC;;;qBAGiB;IACjB,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,cAAc,EAAE,MAAM,GAAG,OAAO,EAChC,OAAO,EAAE;QACP,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,KACE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB;;;;kCAI8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAChD;;;qDAGiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IAC3C;;;;;;oEAMgE;IAChE,QAAQ,CAAC,aAAa,EAAE,CACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;oEAEgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC5D,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E;;;;;;iBAMa;IACb,QAAQ,CAAC,WAAW,EAAE,CACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GAAG,IAAI,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;;;;wDAQoD;IACpD,QAAQ,CAAC,UAAU,EAAE,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,KACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B;;;wEAGoE;IACpE,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D;;;6EAGyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,KAAK,EAAE,wBAAwB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC;AAID,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAEzD;AAKD,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CA6XzD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,IAAI,CA4CN"}