@aotter/mantle-cloudflare 0.1.0-alpha.7 → 0.1.0-alpha.8

package/dist/oauth/mountOAuth.js

@@ -1,112 +1,37 @@
 import { rejectCrossOriginMutation } from "../auth/rejectCrossOriginMutation.js";
 import { detectConsentLocale, renderConsentHtml, } from "./consentHtml.js";
-/**
- * Mount the `/authorize` consent UI on the consumer's Hono app. The
- * Hono app must be passed to `createOAuthProvider({ defaultHandler })`;
- * the lib injects `OAUTH_PROVIDER` helpers onto env BEFORE forwarding
- * the request here, so we read `c.env.OAUTH_PROVIDER` directly.
- *
- * `/token` + `/register` + `/.well-known/oauth-*` are intercepted by
- * the OAuthProvider itself and never reach defaultHandler — do not
- * mount them here.
- */
+/** Mount Mantle's small server-rendered consent page. Better Auth owns the
+ * signed authorization query, client lookup, decision, and redirect. */
 export function mountAuthorize(app, options) {
-    const { auth, loginPath = "/admin/sign-in" } = options;
-    const consentHandler = async (c) => {
+    const { auth } = options;
+    app.get("/oauth/consent", async (c) => {
         const locale = detectConsentLocale(c.req.header("accept-language") ?? null);
-        const helpers = c.env.OAUTH_PROVIDER;
-        if (!helpers) {
-            return new Response("OAUTH_PROVIDER missing on env — is the worker exported via createOAuthProvider()?", { status: 500 });
+        let model = null;
+        try {
+            model = await auth.getOAuthConsentRequest(c.req.raw);
         }
-        const session = await auth.getSession(c.req.raw);
-        if (!session) {
-            if (c.req.method !== "GET") {
-                return new Response("unauthenticated", { status: 401 });
-            }
-            const u = new URL(c.req.url);
-            const returnTo = encodeURIComponent(u.pathname + u.search);
-            return new Response(null, {
-                status: 302,
-                headers: { location: `${loginPath}?return=${returnTo}` },
-            });
+        catch {
+            // Invalid, expired, or unauthenticated signed queries render the same
+            // non-sensitive failure page.
         }
-        if (c.req.method === "POST") {
-            // CSRF defense that does NOT depend on the session cookie's
-            // SameSite attribute (which is forced to `none` globally when an
-            // Apple social method is registered). A cross-site auto-submitting
-            // form would otherwise mint an authorization code for an
-            // attacker-registered client using the victim's session. Reject
-            // any request a browser flags as cross-site / cross-origin; browsers
-            // always send these on a real consent submit, and non-browser
-            // clients can't ride a victim's cookie cross-site anyway. (#389)
-            const rejected = rejectCrossOriginMutation(c.req.raw);
-            if (rejected)
-                return rejected;
-            const form = await c.req.raw.formData();
-            const oauthRequestJson = form.get("oauth_request");
-            if (typeof oauthRequestJson !== "string") {
-                return new Response("missing oauth_request", { status: 400 });
-            }
-            if (form.get("decision") !== "approve") {
-                return new Response("authorization denied", { status: 400 });
-            }
-            let reqInfo;
-            try {
-                reqInfo = JSON.parse(oauthRequestJson);
-            }
-            catch {
-                return new Response("invalid oauth_request json", { status: 400 });
-            }
-            // The form-field oauth_request is caller-editable — a malicious
-            // submit could swap redirectUri / scope post-consent. Re-validate
-            // clientId + redirectUri against the registered client record;
-            // refuse if either drifted. Fail closed when no registered URIs
-            // exist — a misconfigured client with no allowlist must not get
-            // a free pass.
-            const registered = await helpers.lookupClient(reqInfo.clientId);
-            if (!registered) {
-                return new Response("unknown client", { status: 400 });
-            }
-            if (!Array.isArray(registered.redirectUris) ||
-                registered.redirectUris.length === 0 ||
-                !registered.redirectUris.includes(reqInfo.redirectUri)) {
-                return new Response("redirect_uri mismatch", { status: 400 });
-            }
-            // If claude.ai forgets to request a scope, default to ["mcp"]
-            // so the token grant is non-empty (claude.ai post-token
-            // verification rejects empty-scope tokens in some flows).
-            const grantedScope = reqInfo.scope && reqInfo.scope.length > 0 ? reqInfo.scope : ["mcp"];
-            const { redirectTo } = await helpers.completeAuthorization({
-                request: reqInfo,
-                userId: session.user.id,
-                metadata: {},
-                scope: grantedScope,
-                // The provider's token-exchange callback derives token-specific API
-                // props from verified grant fields and the effective token scope.
-                props: {},
-            });
-            return new Response(null, { status: 302, headers: { location: redirectTo } });
+        return c.html(renderConsentHtml(locale, model), model ? 200 : 400);
+    });
+    app.post("/oauth/consent", async (c) => {
+        const rejected = rejectCrossOriginMutation(c.req.raw);
+        if (rejected)
+            return rejected;
+        const body = await c.req.text();
+        const decision = new URLSearchParams(body).get("decision");
+        if (decision !== "approve" && decision !== "deny") {
+            return new Response("invalid consent decision", { status: 400 });
         }
-        let model = null;
         try {
-            const reqInfo = await helpers.parseAuthRequest(c.req.raw);
-            const clientInfo = await helpers.lookupClient(reqInfo.clientId);
-            model = {
-                clientName: clientInfo?.clientName ?? "(unknown client)",
-                redirectUri: reqInfo.redirectUri,
-                scopes: reqInfo.scope ?? [],
-                oauthRequestJson: JSON.stringify(reqInfo),
-            };
+            const redirect = await auth.completeOAuthConsent(new Request(c.req.raw, { body }), decision === "approve");
+            return c.redirect(redirect, 302);
         }
         catch {
-            // parseAuthRequest throws on malformed requests; fall through to
-            // the "invalid authorization request" branch in renderConsentHtml.
+            return new Response("invalid authorization request", { status: 400 });
         }
-        return new Response(renderConsentHtml(locale, model), {
-            headers: { "content-type": "text/html; charset=utf-8" },
-        });
-    };
-    app.get("/oauth/authorize", consentHandler);
-    app.post("/oauth/authorize", consentHandler);
+    });
 }
 //# sourceMappingURL=mountOAuth.js.map

package/dist/oauth/mountOAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"mountOAuth.js","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,kBAAkB,CAAC;AAY1B;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAgB,GAAY,EAAE,OAA8B;IACxF,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAEvD,MAAM,cAAc,GAAG,KAAK,EAAE,CAAa,EAAqB,EAAE;QAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAI,CAAC,CAAC,GAAyC,CAAC,cAAc,CAAC;QAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CACjB,mFAAmF,EACnF,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC3B,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,WAAW,QAAQ,EAAE,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,4DAA4D;YAC5D,iEAAiE;YACjE,mEAAmE;YACnE,yDAAyD;YACzD,gEAAgE;YAChE,qEAAqE;YACrE,8DAA8D;YAC9D,iEAAiE;YACjE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACnD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAgB,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,QAAQ,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,gEAAgE;YAChE,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,eAAe;YACf,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBACpC,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EACtD,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,8DAA8D;YAC9D,wDAAwD;YACxD,0DAA0D;YAC1D,MAAM,YAAY,GAChB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC;gBACzD,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACvB,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,YAAY;gBACnB,oEAAoE;gBACpE,kEAAkE;gBAClE,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,KAAK,GAAwB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChE,KAAK,GAAG;gBACN,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,kBAAkB;gBACxD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC1C,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,mEAAmE;QACrE,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"mountOAuth.js","sourceRoot":"","sources":["../../src/oauth/mountOAuth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAM1B;wEACwE;AACxE,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAEzB,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC5E,IAAI,KAAK,GAA+B,IAAI,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,8BAA8B;QAChC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAC9C,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAChC,QAAQ,KAAK,SAAS,CACvB,CAAC;YACF,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/worker/createMantleWorker.d.ts

@@ -1,11 +1,12 @@
 import { Hono, type Env as HonoEnv, type Handler, type MiddlewareHandler } from "hono";
-import type { AnyHandler, CmsRuntime, PublicPathResolver, TemplateRegistry } from "@aotter/mantle-runtime";
-import type { Manifest, SiteDefaults } from "@aotter/mantle-spec";
+import type { AnyHandler, RuntimePlan } from "@aotter/mantle-runtime";
+import type { PublicPathResolver, TemplateRegistry } from "@aotter/mantle-web";
+import type { SiteDefaults } from "@aotter/mantle-spec";
 import { type ConventionalAuthEnv } from "../auth/conventionalAuth.js";
 import type { Auth } from "../auth/createAuth.js";
 import { type MantleWorkerBindings } from "../bindings/conventionalBindings.js";
-import { type CmsRuntimeRef } from "../mount/bootRuntimeOnce.js";
-import type { CmsConfig } from "../mount/cmsConfig.js";
+import { type CloudflareMantleRuntime, type MantleRuntimeRef } from "../mount/bootRuntimeOnce.js";
+import type { MantleCloudflareConfig } from "../mount/cmsConfig.js";
 import type { ConsumerCredentialResolver } from "../mount/resolveCaller.js";
 /** Fixed namespaces owned by Mantle's standard Worker surfaces. */
 export declare const MANTLE_RESERVED_PATH_PREFIXES: readonly ["/admin", "/_mantle", "/api/auth", "/api/views", "/oauth", "/mcp"];
@@ -41,32 +42,30 @@ export interface MantleExtensionApp<Bindings extends object> {
     route<const Path extends string, SubEnv extends HonoEnv>(path: SafePath<Path>, app: Hono<SubEnv>): MantleExtensionApp<Bindings>;
 }
 export interface MantleCloudflareEnv extends ConventionalAuthEnv {
-    readonly OAUTH_KV: KVNamespace;
-    readonly ASSETS: Fetcher;
+    readonly ASSETS?: Fetcher;
 }
 export interface MantleWorkerBootstrapContext<Env extends MantleCloudflareEnv> {
     readonly env: Env;
     readonly auth: Auth;
     readonly bindings: MantleWorkerBindings;
     /** Safe to retain and call later; do not call synchronously inside `extend`. */
-    readonly getRuntime: () => Promise<CmsRuntime>;
+    readonly getRuntime: () => Promise<CloudflareMantleRuntime>;
 }
 export interface MantleWorkerMountContext<Env extends MantleCloudflareEnv> extends MantleWorkerBootstrapContext<Env> {
     readonly app: MantleExtensionApp<Env>;
-    readonly ref: CmsRuntimeRef;
+    readonly ref: MantleRuntimeRef;
 }
 /** The one opt-in seam for application handlers, auth inputs and routes. */
 export interface MantleWorkerExtension<Env extends MantleCloudflareEnv> {
     readonly handlers?: Readonly<Record<string, AnyHandler>>;
     readonly credentialResolver?: ConsumerCredentialResolver;
-    readonly jwtBearer?: CmsConfig["jwtBearer"];
-    readonly scopesSupported?: readonly string[];
+    readonly jwtBearer?: MantleCloudflareConfig["jwtBearer"];
     /** Standard routes mount first; extension routes may only add new paths. */
     readonly mount?: (context: MantleWorkerMountContext<Env>) => void;
 }
 export interface CreateMantleWorkerOptions<Env extends MantleCloudflareEnv> {
-    /** Parsed manifests, normally imported from `.mantle/generated/site.js`. */
-    readonly manifest: readonly Manifest[];
+    /** Sealed generated plan imported from `.mantle/generated/mantle.js`. */
+    readonly plan: RuntimePlan;
     readonly handlers?: Readonly<Record<string, AnyHandler>>;
     readonly siteDefaults?: SiteDefaults | ((env: Env) => SiteDefaults);
     readonly templates?: TemplateRegistry;
@@ -81,7 +80,7 @@ export interface CreateMantleWorkerOptions<Env extends MantleCloudflareEnv> {
 export interface MantleWorkerHandler<Env extends MantleCloudflareEnv> {
     /** Boot and return the same runtime used by fetch. Queue/scheduled handlers
      *  use this instead of constructing a second runtime or bypassing it. */
-    getRuntime(env: Env): Promise<CmsRuntime>;
+    getRuntime(env: Env): Promise<CloudflareMantleRuntime>;
     fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response>;
 }
 /** Assemble Mantle's conventional Worker once per isolate. */

package/dist/worker/createMantleWorker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createMantleWorker.d.ts","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,KAAK,GAAG,IAAI,OAAO,EACnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACvB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAM5E,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,8EAOhC,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,EAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,sBAAuB,CAAC;AAEhE,KAAK,cAAc,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,KAAK,aAAa,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,KAAK,YAAY,GACb,aAAa,GACb,cAAc,GACd,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,GAC9C,GAAG,OAAO,iCAAiC,GAAG,MAAM,EAAE,CAAC;AAE3D,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,CAAC,IAAI,SAAS,MAAM,IAAI,MAAM,SAAS,IAAI,GACtE,IAAI,GACJ,IAAI,SAAS,YAAY,GACvB,KAAK,GACL,IAAI,CAAC;AAEX,KAAK,aAAa,CAAC,QAAQ,SAAS,MAAM,IAAI;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AACrE,KAAK,gBAAgB,CAAC,QAAQ,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAC9D,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GACtC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,KAAK,QAAQ,CAAC,IAAI,SAAS,MAAM,IAAI,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACtE,KAAK,cAAc,CAAC,QAAQ,SAAS,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EACvE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,KACnF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,GACrF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,GACrH,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,MAAM,SAAS,OAAO,EACrD,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAChB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B,CAAC,GAAG,SAAS,mBAAmB;IAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,wBAAwB,CAAC,GAAG,SAAS,mBAAmB,CACvE,SAAQ,4BAA4B,CAAC,GAAG,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAC5C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,yBAAyB,CAAC,GAAG,SAAS,mBAAmB;IACxE,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,oBAAoB,KAC/B,oBAAoB,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,KACvC,qBAAqB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB,CAAC,GAAG,SAAS,mBAAmB;IAClE;6EACyE;IACzE,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAYD,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB,EACtF,OAAO,EAAE,yBAAyB,CAAC,GAAG,CAAC,GACtC,mBAAmB,CAAC,GAAG,CAAC,CA0E1B;AAuBD,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,QAAQ,CAAC,CAUnB"}
+{"version":3,"file":"createMantleWorker.d.ts","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,KAAK,GAAG,IAAI,OAAO,EACnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACvB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAIpE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAI5E,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,8EAOhC,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,EAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,sBAAuB,CAAC;AAEhE,KAAK,cAAc,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,KAAK,aAAa,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,KAAK,YAAY,GACb,aAAa,GACb,cAAc,GACd,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,GAC9C,GAAG,OAAO,iCAAiC,GAAG,MAAM,EAAE,CAAC;AAE3D,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,CAAC,IAAI,SAAS,MAAM,IAAI,MAAM,SAAS,IAAI,GACtE,IAAI,GACJ,IAAI,SAAS,YAAY,GACvB,KAAK,GACL,IAAI,CAAC;AAEX,KAAK,aAAa,CAAC,QAAQ,SAAS,MAAM,IAAI;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AACrE,KAAK,gBAAgB,CAAC,QAAQ,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAC9D,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GACtC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,KAAK,QAAQ,CAAC,IAAI,SAAS,MAAM,IAAI,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACtE,KAAK,cAAc,CAAC,QAAQ,SAAS,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EACvE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,KACnF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,GACrF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,GACrH,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,MAAM,SAAS,OAAO,EACrD,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAChB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,4BAA4B,CAAC,GAAG,SAAS,mBAAmB;IAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB,CAAC,GAAG,SAAS,mBAAmB,CACvE,SAAQ,4BAA4B,CAAC,GAAG,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,yBAAyB,CAAC,GAAG,SAAS,mBAAmB;IACxE,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,oBAAoB,KAC/B,oBAAoB,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,KACvC,qBAAqB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB,CAAC,GAAG,SAAS,mBAAmB;IAClE;6EACyE;IACzE,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAYD,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB,EACtF,OAAO,EAAE,yBAAyB,CAAC,GAAG,CAAC,GACtC,mBAAmB,CAAC,GAAG,CAAC,CA4F1B;AAmBD,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/worker/createMantleWorker.js

@@ -1,13 +1,12 @@
 import { Hono, } from "hono";
-import { createConventionalAuth, setupIncompleteAuthResponse, } from "../auth/conventionalAuth.js";
+import { conventionalMcpResource, createConventionalAuth, setupIncompleteAuthResponse, } from "../auth/conventionalAuth.js";
 import { createConventionalBindings, } from "../bindings/conventionalBindings.js";
-import { createCmsRef } from "../mount/bootRuntimeOnce.js";
+import { createMantleRuntimeRef, } from "../mount/bootRuntimeOnce.js";
 import { createMcpApiHandler } from "../mount/mountMcp.js";
-import { mountServerEndpoints } from "../mount/mountServerEndpoints.js";
+import { mountAdmin } from "../mount/mountAdmin.js";
+import { mountRuntimeEndpoints } from "../mount/mountRuntimeEndpoints.js";
 import { mountAuthorize } from "../oauth/mountOAuth.js";
-import { OAUTH_REGISTER_PATH, OAUTH_TOKEN_PATH } from "../oauth/oauthConstants.js";
-import { createOAuthProvider } from "../oauth/oauthSingleton.js";
-import { PUBLIC_CACHE_TAG } from "../oauth/cachePolicy.js";
+import { applyCachePolicy, PUBLIC_CACHE_TAG } from "../oauth/cachePolicy.js";
 /** Fixed namespaces owned by Mantle's standard Worker surfaces. */
 export const MANTLE_RESERVED_PATH_PREFIXES = [
     "/admin",
@@ -36,12 +35,17 @@ export function createMantleWorker(options) {
             : Promise.reject(new Error("Mantle runtime is unavailable until `extend` returns."));
         const bootstrap = { env, auth, bindings, getRuntime };
         const extension = options.extend?.(bootstrap) ?? {};
-        ref = createCmsRef({
-            manifests: options.manifest,
+        ref = createMantleRuntimeRef({
+            plan: options.plan,
             handlers: mergeHandlers(options.handlers, extension.handlers),
             siteDefaults: resolve(options.siteDefaults, env),
             templates: options.templates,
             publicPathResolver: options.publicPathResolver,
+            reservedHttpPathPrefixes: [
+                ...MANTLE_RESERVED_PATH_PREFIXES,
+                MANTLE_RESERVED_WELL_KNOWN_PREFIX,
+                auth.basePath,
+            ],
             mediaAllowSvg: resolve(options.mediaAllowSvg, env),
             bindings,
             auth,
@@ -50,8 +54,23 @@ export function createMantleWorker(options) {
             onPublicChange: purgePublicCache,
         });
         const app = new Hono();
-        mountServerEndpoints(app, ref);
-        mountAuthorize(app, { auth, loginPath: "/admin/sign-in" });
+        mountRuntimeEndpoints(app, ref);
+        if (bindings.adminAssets)
+            mountAdmin(app, ref, bindings.adminAssets);
+        mountAuthorize(app, { auth });
+        const mcpResource = auth.mcpResource ?? conventionalMcpResource(env);
+        const publicMcp = createMcpApiHandler({
+            ref,
+            surface: "public",
+            resource: mcpResource,
+        });
+        const staffMcp = createMcpApiHandler({
+            ref,
+            surface: "staff",
+            resource: mcpResource,
+        });
+        app.all("/mcp", (c) => publicMcp.fetch(c.req.raw, c.env, c.executionCtx));
+        app.all("/mcp/staff", (c) => staffMcp.fetch(c.req.raw, c.env, c.executionCtx));
         const standardRouteCount = app.routes.length;
         extension.mount?.({
             ...bootstrap,
@@ -59,20 +78,10 @@ export function createMantleWorker(options) {
             ref,
         });
         assertExtensionRoutes(app, standardRouteCount, auth.basePath);
-        const provider = createOAuthProvider({
-            defaultHandler: {
-                fetch: (request, workerEnv, ctx) => app.fetch(request, workerEnv, ctx),
-            },
-            apiHandlers: {
-                "/mcp/staff": createMcpApiHandler({ ref, surface: "staff" }),
-                "/mcp": createMcpApiHandler({ ref, surface: "public" }),
-            },
-            scopesSupported: [...new Set(["mcp", ...(extension.scopesSupported ?? [])])],
-        });
         const next = {
             auth,
             getRuntime,
-            fetch: (request, workerEnv, ctx) => provider.fetch(request, workerEnv, ctx),
+            fetch: async (request, workerEnv, ctx) => applyCachePolicy(request, await app.fetch(request, workerEnv, ctx)),
         };
         assembled = next;
         return next;
@@ -106,9 +115,7 @@ async function purgePublicCache() {
 }
 function isRuntimeIndependentOAuthRequest(request) {
     const pathname = new URL(request.url).pathname;
-    if (pathname === OAUTH_TOKEN_PATH ||
-        pathname === OAUTH_REGISTER_PATH ||
-        pathname.startsWith(MANTLE_RESERVED_WELL_KNOWN_PREFIX))
+    if (pathname.startsWith(MANTLE_RESERVED_WELL_KNOWN_PREFIX))
         return true;
     return (pathname === "/mcp" || pathname.startsWith("/mcp/")) &&
         !request.headers.has("authorization");

package/dist/worker/createMantleWorker.js.map

@@ -1 +1 @@
-{"version":3,"file":"createMantleWorker.js","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,GAIL,MAAM,MAAM,CAAC;AAQd,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAE5B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAsB,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,mEAAmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ;IACR,UAAU;IACV,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,MAAM;CACE,CAAC;AAEX,wEAAwE;AACxE,MAAM,CAAC,MAAM,iCAAiC,GAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,IAAI,CAAU,CAAC;AAwHhE,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAChC,OAAuC;IAEvC,IAAI,SAAS,GAAgC,IAAI,CAAC;IAElD,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAwB,EAAE;QAClD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,YAAY,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,YAAY,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,GAAyB,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,GAAwB,EAAE,CAAC,GAAG;YAC/C,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;YACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAEpD,GAAG,GAAG,YAAY,CAAC;YACjB,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC7D,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;YAClD,QAAQ;YACR,IAAI;YACJ,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;YAChD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAsB,CAAC;QAC3C,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7C,SAAS,CAAC,KAAK,EAAE,CAAC;YAChB,GAAG,SAAS;YACZ,GAAG,EAAE,GAAyC;YAC9C,GAAG;SACJ,CAAC,CAAC;QACH,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,mBAAmB,CAAM;YACxC,cAAc,EAAE;gBACd,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC;aACvE;YACD,WAAW,EAAE;gBACX,YAAY,EAAE,mBAAmB,CAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBACjE,MAAM,EAAE,mBAAmB,CAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;aAC7D;YACD,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;SAC7E,CAAC,CAAC;QACH,MAAM,IAAI,GAAyB;YACjC,IAAI;YACJ,UAAU;YACV,KAAK,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC;SAC5E,CAAC;QACF,SAAS,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,CAAC,GAAG;YACZ,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YAC3B,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChF,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;gBAC5C,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC;oBAAE,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1E,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,mEAAmE;IACnE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO;IAC9C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,OAAgB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/C,IACE,QAAQ,KAAK,gBAAgB;QAC7B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,CAAC,UAAU,CAAC,iCAAiC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC1C,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAuC;IAEvC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,EAAE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAA6B,EAC7B,kBAA0B,EAC1B,YAAoB;IAEpB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzD,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,wBAAwB,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACnF,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,YAAoB;IACxD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC;WAC7D,6BAA6B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;WAC1E,IAAI,CAAC,UAAU,CAAC,iCAAiC,CAAC;WAClD,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,OAAO,IAAI,KAAK,MAAM;WACjB,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;WAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;WAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CACpB,IAAsD,EACtD,KAAuD;IAEvD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,wBAAwB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CACd,KAAgD,EAChD,GAAQ;IAER,OAAO,OAAO,KAAK,KAAK,UAAU;QAChC,CAAC,CAAE,KAA+B,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC"}
+{"version":3,"file":"createMantleWorker.js","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,GAIL,MAAM,MAAM,CAAC;AAOd,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,GAE5B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,sBAAsB,GAGvB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,QAAQ;IACR,UAAU;IACV,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,MAAM;CACE,CAAC;AAEX,wEAAwE;AACxE,MAAM,CAAC,MAAM,iCAAiC,GAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,IAAI,CAAU,CAAC;AAsHhE,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAChC,OAAuC;IAEvC,IAAI,SAAS,GAAgC,IAAI,CAAC;IAElD,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAwB,EAAE;QAClD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,YAAY,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,YAAY,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,GAA4B,IAAI,CAAC;QACxC,MAAM,UAAU,GAAG,GAAqC,EAAE,CAAC,GAAG;YAC5D,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE;YACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAEpD,GAAG,GAAG,sBAAsB,CAAC;YAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC;YAC7D,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,wBAAwB,EAAE;gBACxB,GAAG,6BAA6B;gBAChC,iCAAiC;gBACjC,IAAI,CAAC,QAAQ;aACd;YACD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;YAClD,QAAQ;YACR,IAAI;YACJ,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;YAChD,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,cAAc,EAAE,gBAAgB;SACjC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAsB,CAAC;QAC3C,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,WAAW;YAAE,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrE,cAAc,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,mBAAmB,CAAM;YACzC,GAAG;YACH,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAM;YACxC,GAAG;YACH,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAM,CACrC,CAAC,CAAC,GAAG,CAAC,GAAyD,EAC/D,CAAC,CAAC,GAAG,EACL,CAAC,CAAC,YAAkE,CACrE,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAM,CAC1C,CAAC,CAAC,GAAG,CAAC,GAAwD,EAC9D,CAAC,CAAC,GAAG,EACL,CAAC,CAAC,YAAiE,CACpE,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7C,SAAS,CAAC,KAAK,EAAE,CAAC;YAChB,GAAG,SAAS;YACZ,GAAG,EAAE,GAAyC;YAC9C,GAAG;SACJ,CAAC,CAAC;QACH,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9D,MAAM,IAAI,GAAyB;YACjC,IAAI;YACJ,UAAU;YACV,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CACvC,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;SACtE,CAAC;QACF,SAAS,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,CAAC,GAAG;YACZ,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG;YAC3B,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC7B,MAAM,eAAe,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChF,IAAI,eAAe;oBAAE,OAAO,eAAe,CAAC;gBAC5C,IAAI,CAAC,gCAAgC,CAAC,OAAO,CAAC;oBAAE,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC1E,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,mEAAmE;IACnE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO;IAC9C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,OAAgB;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,iCAAiC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC1C,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAuC;IAEvC,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,EAAE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAA6B,EAC7B,kBAA0B,EAC1B,YAAoB;IAEpB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACzD,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,wBAAwB,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CACnF,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,YAAoB;IACxD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC;WAC7D,6BAA6B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;WAC1E,IAAI,CAAC,UAAU,CAAC,iCAAiC,CAAC;WAClD,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,OAAO,IAAI,KAAK,MAAM;WACjB,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;WAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;WAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa;IACjD,OAAO,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CACpB,IAAsD,EACtD,KAAuD;IAEvD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,wBAAwB,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CACd,KAAgD,EAChD,GAAQ;IAER,OAAO,OAAO,KAAK,KAAK,UAAU;QAChC,CAAC,CAAE,KAA+B,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aotter/mantle-cloudflare",
-  "version": "0.1.0-alpha.7",
-  "description": "Cloudflare Workers adapter for mantle. Hono-based mountServerEndpoints / createMcpApiHandler / mountAuthorize / mountPublicRoutes. Better Auth for staff sign-in; @cloudflare/workers-oauth-provider for the MCP OAuth AS surface.",
+  "version": "0.1.0-alpha.8",
+  "description": "Cloudflare Workers adapter for Mantle runtime, Admin, MCP, and public Web mounts.",
   "license": "Apache-2.0",
   "homepage": "https://mantle.tools/",
   "repository": {
@@ -29,29 +29,30 @@
     "README.md"
   ],
   "dependencies": {
-    "@better-auth/oauth-provider": "^1.6.27",
-    "@aotter/mantle-runtime": "0.1.0-alpha.7",
-    "@aotter/mantle-spec": "0.1.0-alpha.7",
-    "@aotter/mantle-admin-ui": "0.1.0-alpha.7"
+    "@better-auth/cimd": "^1.7.1",
+    "@better-auth/mcp": "^1.7.1",
+    "@better-auth/oauth-provider": "^1.7.1",
+    "@aotter/mantle-runtime": "0.1.0-alpha.8",
+    "@aotter/mantle-spec": "0.1.0-alpha.8",
+    "@aotter/mantle-web": "0.1.0-alpha.8",
+    "@aotter/mantle-admin": "0.1.0-alpha.8"
   },
   "peerDependencies": {
-    "@cloudflare/workers-oauth-provider": "^0.8.2",
     "aws4fetch": "^1.0.20",
-    "better-auth": "^1.6.27",
+    "better-auth": "^1.7.1",
     "hono": "^4.12.0",
     "zod": "^4.0.0"
   },
   "devDependencies": {
-    "@cloudflare/workers-oauth-provider": "^0.8.2",
     "@cloudflare/workers-types": "^5.20260729.1",
     "@types/node": "^26",
     "aws4fetch": "^1.0.20",
-    "better-auth": "^1.6.27",
+    "better-auth": "^1.7.1",
     "hono": "^4.12.34",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
     "wrangler": "^4.115.0",
-    "zod": "^4.4.2"
+    "zod": "^4.4.3"
   },
   "scripts": {
     "prebuild": "rm -rf dist .tsbuildinfo",

package/dist/mount/mountServerEndpoints.d.ts

@@ -1,9 +0,0 @@
-import type { Env, Hono } from "hono";
-import type { CmsRuntimeRef } from "./bootRuntimeOnce.js";
-/** Mount HTTP Triggers + Views + the Better Auth admin surface.
- *  HTTP Triggers resolve configured credentials and sessions through
- *  `resolveCaller`; the target Procedure's `requires.auth` owns
- *  authorization. */
-export declare function mountServerEndpoints<E extends Env>(app: Hono<E>, ref: CmsRuntimeRef): void;
-export type { CmsRuntimeRef };
-//# sourceMappingURL=mountServerEndpoints.d.ts.map

package/dist/mount/mountServerEndpoints.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mountServerEndpoints.d.ts","sourceRoot":"","sources":["../../src/mount/mountServerEndpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,GAAG,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAkC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAa1D;;;qBAGqB;AACrB,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,GAAG,EAChD,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EACZ,GAAG,EAAE,aAAa,GACjB,IAAI,CAuCN;AA28DD,YAAY,EAAE,aAAa,EAAE,CAAC"}