@aotter/mantle-cloudflare 0.1.2 → 0.1.3-alpha.1

package/README.md

@@ -91,6 +91,12 @@ with Mantle's `EmailSender`; raw `plugins` are available when the application
 must own the callback and UI. The hosted-auth and self-hosted-auth boundary is documented in
 `node_modules/@aotter/mantle/docs/auth-hosting-model.md`.
 
+Rate-limit identity uses `CF-Connecting-IP` only. `createAuth` always passes
+`ipAddressHeaders: ["cf-connecting-ip"]` into `@aotter/mantle-auth`. The
+portable package has no Cloudflare default and will not boot without a
+host-trusted header list; do not fall back to client-controlled
+`X-Forwarded-For`.
+
 For trusted first-party apps that share one parent domain, configure
 same-parent-domain cookies explicitly:
 

package/dist/auth/conventionalAuth.d.ts

@@ -1,4 +1,4 @@
-import { type Auth } from "./createAuth.js";
+import { type MantleAuth as Auth } from "@aotter/mantle-auth";
 export interface ConventionalAuthEnv {
     readonly DB: D1Database;
     readonly MANTLE_KV?: KVNamespace;

package/dist/auth/conventionalAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conventionalAuth.d.ts","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA+FrE;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAExE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAExE;AAED,sEAAsE;AACtE,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAG1B"}
+{"version":3,"file":"conventionalAuth.d.ts","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,UAAU,IAAI,IAAI,EACxB,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA+FrE;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAExE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAExE;AAED,sEAAsE;AACtE,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAG1B"}

package/dist/auth/conventionalAuth.js

@@ -1,4 +1,5 @@
-import { createAuth, createSetupIncompleteAuth, isSetupIncompleteAuth, } from "./createAuth.js";
+import { createSetupIncompleteAuth, isSetupIncompleteAuth, } from "@aotter/mantle-auth";
+import { createAuth } from "./createAuth.js";
 import { applyCachePolicy } from "../oauth/cachePolicy.js";
 /** Choose hosted or self-managed GitHub Auth, otherwise fail closed. */
 export function createConventionalAuth(env) {

package/dist/auth/conventionalAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"conventionalAuth.js","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAe3D,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,GAAwB;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG;QACpB,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,8BAA8B,EAAE,IAAI;QACpC,sCAAsC,EAAE,IAAI;QAC5C,+BAA+B,EAAE,CAAC,KAAK,CAAC;QACxC,+BAA+B,EAAE,CAAC,KAAK,CAAC;QACxC,WAAW,EAAE,uBAAuB,CAAC,GAAG,CAAC;KACjC,CAAC;IAEX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YAClG,OAAO,UAAU,CAAC,qCAAqC;gBACrD,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI;gBAChD,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI;gBAC1D,CAAC,YAAY;oBACX,CAAC,CAAC,gCAAgC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;oBAC3E,CAAC,CAAC,IAAI;gBACR,CAAC,cAAc;oBACb,CAAC,CAAC,mCAAmC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;oBAChF,CAAC,CAAC,IAAI;gBACR,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI;gBACjD,kBAAkB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI;aAC1D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,cAAc,EAAE,GAAG,CAAC,SAAS;YAC7B,OAAO;YACP,MAAM;YACN,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,QAAQ;oBACrB,OAAO,EAAE;wBACP,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,cAAc;wBACxB,gBAAgB,EAAE,GAAG,YAAY,YAAY;wBAC7C,QAAQ,EAAE,GAAG,YAAY,QAAQ;wBACjC,WAAW,EAAE,GAAG,YAAY,WAAW;wBACvC,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;wBAC5B,WAAW,EAAE,GAAG,OAAO,2BAA2B;wBAClD,IAAI,EAAE,IAAI;wBACV,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;4BAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;4BAChD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7C,CAAC;qBACF;iBACF,CAAC;YACF,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE;YACvD,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;YACxG,OAAO,UAAU,CAAC,2CAA2C;gBAC3D,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI;gBAChD,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI;gBAC1D,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI;gBACtD,CAAC,kBAAkB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI;gBAC9D,eAAe,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI;gBAC3D,iBAAiB,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,IAAI;aACjE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,cAAc,EAAE,GAAG,CAAC,SAAS;YAC7B,OAAO;YACP,MAAM;YACN,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE;wBACP,QAAQ,EAAE,cAAc;wBACxB,YAAY,EAAE,kBAAkB;qBACjC;iBACF,CAAC;YACF,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE;YACvD,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC,kDAAkD,CAAC,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,uBAAuB,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,IAAU;IAEV,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,IAAU;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/C,OAAO,QAAQ,KAAK,QAAQ;WACvB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,KAAK,IAAI,CAAC,QAAQ;WAC1B,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;WACxC,QAAQ,KAAK,QAAQ;WACrB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;WACzC,QAAQ,KAAK,MAAM;WACnB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,yBAAyB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB,EAAE,MAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI;YACpJ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;YAChB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CACrE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC3F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAA8B;IAC3C,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"conventionalAuth.js","sourceRoot":"","sources":["../../src/auth/conventionalAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAe3D,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,GAAwB;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG;QACpB,SAAS,EAAE,gBAAgB;QAC3B,WAAW,EAAE,gBAAgB;QAC7B,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,8BAA8B,EAAE,IAAI;QACpC,sCAAsC,EAAE,IAAI;QAC5C,+BAA+B,EAAE,CAAC,KAAK,CAAC;QACxC,+BAA+B,EAAE,CAAC,KAAK,CAAC;QACxC,WAAW,EAAE,uBAAuB,CAAC,GAAG,CAAC;KACjC,CAAC;IAEX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YAClG,OAAO,UAAU,CAAC,qCAAqC;gBACrD,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI;gBAChD,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI;gBAC1D,CAAC,YAAY;oBACX,CAAC,CAAC,gCAAgC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;oBAC3E,CAAC,CAAC,IAAI;gBACR,CAAC,cAAc;oBACb,CAAC,CAAC,mCAAmC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;oBAChF,CAAC,CAAC,IAAI;gBACR,cAAc,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI;gBACjD,kBAAkB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI;aAC1D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,cAAc,EAAE,GAAG,CAAC,SAAS;YAC7B,OAAO;YACP,MAAM;YACN,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,QAAQ;oBACrB,OAAO,EAAE;wBACP,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,cAAc;wBACxB,gBAAgB,EAAE,GAAG,YAAY,YAAY;wBAC7C,QAAQ,EAAE,GAAG,YAAY,QAAQ;wBACjC,WAAW,EAAE,GAAG,YAAY,WAAW;wBACvC,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;wBAC5B,WAAW,EAAE,GAAG,OAAO,2BAA2B;wBAClD,IAAI,EAAE,IAAI;wBACV,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE;4BAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;4BAChD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7C,CAAC;qBACF;iBACF,CAAC;YACF,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE;YACvD,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;YACxG,OAAO,UAAU,CAAC,2CAA2C;gBAC3D,CAAC,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI;gBAChD,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,IAAI;gBAC1D,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI;gBACtD,CAAC,kBAAkB,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,IAAI;gBAC9D,eAAe,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI;gBAC3D,iBAAiB,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,IAAI;aACjE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,UAAU,CAAC;YAChB,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,cAAc,EAAE,GAAG,CAAC,SAAS;YAC7B,OAAO;YACP,MAAM;YACN,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE;wBACP,QAAQ,EAAE,cAAc;wBACxB,YAAY,EAAE,kBAAkB;qBACjC;iBACF,CAAC;YACF,cAAc,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE;YACvD,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC,kDAAkD,CAAC,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,uBAAuB,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAgB,EAChB,IAAU;IAEV,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,gBAAgB,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,IAAU;IACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/C,OAAO,QAAQ,KAAK,QAAQ;WACvB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,KAAK,IAAI,CAAC,QAAQ;WAC1B,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;WACxC,QAAQ,KAAK,QAAQ;WACrB,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;WAC9B,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;WACzC,QAAQ,KAAK,MAAM;WACnB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,yBAAyB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAkB,EAAE,MAAqB;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,OAAO,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI;YACpJ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;YAChB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CACrE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC3F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAA8B;IAC3C,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7B,CAAC"}

package/dist/auth/createAuth.d.ts

@@ -1,433 +1,22 @@
-import { type BetterAuthPlugin } from "better-auth";
-import type { SocialProviders } from "better-auth/social-providers";
-import { type EmailOTPOptions, type GenericOAuthConfig, type MagicLinkOptions } from "better-auth/plugins";
-import { type Scope } from "@better-auth/oauth-provider";
-import { decodeMemberCursor, encodeMemberCursor, type OAuthConsentInfo, type OAuthConsentRequest } from "@aotter/mantle-admin";
-import type { EmailSender } from "@aotter/mantle-runtime";
-import { STAFF_ROLES, type StaffRole } from "@aotter/mantle-spec";
-export { decodeMemberCursor, encodeMemberCursor };
-export type { OAuthConsentInfo, OAuthConsentRequest } from "@aotter/mantle-admin";
-export { STAFF_ROLES, type StaffRole };
-/**
- * Set lookup for "is this role string a staff role?" — handlers/MCP
- * gating reach for this every request, so the Set form is worth the
- * one-time allocation over `STAFF_ROLES.includes(x)`.
- */
-export declare const STAFF_ROLE_SET: ReadonlySet<string>;
-/**
- * Provider id for the `kind: "social"` method — Better Auth's own
- * `socialProviders` block keys. The config flows through to Better
- * Auth as-is; no per-provider wiring in this adapter (beyond the
- * github `mapProfileToUser` shim).
- */
-export type SocialProviderId = keyof SocialProviders;
-type SocialAuthMethodConfig = {
-    [Provider in SocialProviderId]: {
-        readonly kind: "social";
-        readonly provider: Provider;
-        /** Native Better Auth options for this provider, including async factories. */
-        readonly options: NonNullable<SocialProviders[Provider]>;
-    };
-}[SocialProviderId];
-/**
- * Auth method config (discriminated union). Each `kind` is one auth
- * surface adopters can opt into; adding a new method = adding a new
- * union case here, not a new top-level key on `CreateAuthConfig` —
- * per ADR-0014.
- *
- * `kind: "social"` is the OAuth-based bucket — `provider` discriminates
- * the upstream IDP. We use one case rather than one-per-provider so
- * adding (e.g.) Apple doesn't churn Mantle-owned fields; Better Auth's
- * provider-specific options remain natively typed under `options`.
- */
-export type AuthMethodConfig = SocialAuthMethodConfig | {
-    readonly kind: "oauth";
-    /** Human label surfaced by `/api/auth/methods` so the admin SPA
-     *  can render "Continue with Mantle Platform" without knowing
-     *  product-specific provider ids. */
-    readonly displayName?: string;
-    /** Native Better Auth generic OAuth configuration. */
-    readonly options: GenericOAuthConfig;
-} | {
-    readonly kind: "email-otp";
-    /** Transactional-email sender. SDK never owns body templates;
-     *  the locale is passed through so the sender can branch. */
-    readonly sender: EmailSender;
-    /** Native Better Auth options. Mantle owns the sender callback and defaults storage to hashed. */
-    readonly options?: Omit<EmailOTPOptions, "sendVerificationOTP">;
-    /** Fallback locale when the request carries no Accept-Language —
-     *  typically the site's canonical locale. BCP 47. Defaults to "en". */
-    readonly fallbackLocale?: string;
-} | {
-    readonly kind: "magic-link";
-    /** Transactional-email sender. The email body carries a single
-     *  clickable URL; Better Auth verifies the token when the user
-     *  lands on it. */
-    readonly sender: EmailSender;
-    /** Native Better Auth options. Mantle owns the sender callback and defaults storage to hashed. */
-    readonly options?: Omit<MagicLinkOptions, "sendMagicLink">;
-    /** Fallback locale when the request carries no Accept-Language. */
-    readonly fallbackLocale?: string;
-};
-/**
- * First-staff promotion rule. Decoupled from `methods[]` so switching
- * the bootstrap signal (e.g. `github-login` → `email`) doesn't touch
- * any method's options.
- *
- * Promotion fires on `user.create.after`, which Better Auth dispatches
- * **only on first user creation**. If the operator signs in via one
- * method (say GitHub) before the rule can match (say `match: "email"`
- * with a non-GitHub email), the user row is created and a later
- * sign-in via a different method on the SAME email reuses that row —
- * `create.after` does not re-fire and the owner role is never
- * assigned. Match key first; the linked second method inherits the
- * role via the shared `user.id`.
- *
- * `match: "github-login"` is also brittle when multiple social
- * methods are registered. Only the `github` provider's
- * `mapProfileToUser` shim populates `user.githubLogin`; if the
- * operator's first sign-in is via Google or another non-GitHub
- * social, `githubLogin` is null and the rule silently no-ops. For
- * mixed-social setups prefer `match: "email"`.
- */
-export type BootstrapOwnerRule = {
-    readonly match: "github-login";
-    readonly value: string;
-} | {
-    readonly match: "email";
-    readonly value: string;
-};
-export interface CrossSubDomainCookiesConfig {
-    readonly enabled: boolean;
-    readonly domain?: string;
-}
-export interface OAuthProviderConfig {
-    /** Provider scopes. Include `openid` to expose a real OIDC server. */
-    readonly scopes?: ReadonlyArray<Scope>;
-    /** Better Auth OAuth provider login page. Usually `/admin/sign-in`
-     *  or a platform owner sign-in route. */
-    readonly loginPage: string;
-    /** Page that calls `/oauth2/consent` after owner approval. */
-    readonly consentPage: string;
-    readonly allowDynamicClientRegistration?: boolean;
-    readonly allowUnauthenticatedClientRegistration?: boolean;
-    readonly clientRegistrationDefaultScopes?: ReadonlyArray<Scope>;
-    readonly clientRegistrationAllowedScopes?: ReadonlyArray<Scope>;
-    /** MCP resources still require a persisted user consent; do not bypass it. */
-    readonly cachedTrustedClients?: ReadonlySet<string>;
-    /** Protected resources this authorization server may issue tokens for. */
-    readonly resources?: ReadonlyArray<string>;
-    /** Resources linked to newly registered public clients. Does not bypass consent. */
-    readonly clientRegistrationDefaultResources?: ReadonlyArray<string>;
-    /** Turn this provider into the MCP authorization server for one canonical
-     *  resource. Cloudflare deployments must enable
-     *  `global_fetch_strictly_public` for CIMD fetches. */
-    readonly mcpResource?: string;
-    readonly clientPrivileges?: (context: {
-        readonly headers: Headers;
-        readonly action: "create" | "read" | "update" | "delete" | "list" | "rotate" | "configure-client-credentials-scopes";
-        readonly user?: {
-            readonly id: string;
-            readonly email: string;
-        } & Record<string, unknown>;
-        readonly session?: {
-            readonly id: string;
-            readonly userId: string;
-        } & Record<string, unknown>;
-    }) => boolean | undefined | Promise<boolean | undefined>;
-}
-export interface RegisterOAuthClientInput {
-    /** Current owner/admin request headers. Better Auth enforces its
-     *  clientPrivileges hook against this session before persistence. */
-    readonly requestHeaders: HeadersInit;
-    readonly redirectUris: ReadonlyArray<string>;
-    readonly scope?: ReadonlyArray<string>;
-    readonly clientName?: string;
-    readonly clientUri?: string;
-    readonly logoUri?: string;
-    readonly contacts?: ReadonlyArray<string>;
-    readonly tosUri?: string;
-    readonly policyUri?: string;
-    readonly postLogoutRedirectUris?: ReadonlyArray<string>;
-    readonly tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post";
-    readonly grantTypes?: ReadonlyArray<"authorization_code" | "client_credentials" | "refresh_token">;
-    readonly responseTypes?: ReadonlyArray<"code">;
-    readonly applicationType?: "web" | "native";
-    /** Not suitable for MCP clients: MCP access requires a persisted user consent. */
-    readonly skipConsent?: boolean;
-    readonly enableEndSession?: boolean;
-    readonly requirePKCE?: boolean;
-    readonly subjectType?: "public" | "pairwise";
-    readonly metadata?: Record<string, unknown>;
-}
-export interface RegisteredOAuthClient {
-    readonly clientId: string;
-    readonly clientSecret?: string;
-    readonly redirectUris: readonly string[];
-    readonly scope?: readonly string[];
-    readonly clientName?: string;
-    readonly clientUri?: string;
-    readonly tokenEndpointAuthMethod?: string;
-    readonly applicationType?: "web" | "native";
-}
-export interface CreateAuthConfig {
+import type { AuthSessionCache, CreateMantleAuthOptions, MantleAuth } from "@aotter/mantle-auth";
+/** Ingress header Cloudflare overwrites. `createAuth` always passes this
+ *  to the portable package; callers do not configure it. */
+export declare const CLOUDFLARE_CLIENT_IP_HEADERS: readonly ["cf-connecting-ip"];
+export { STAFF_ROLE_SET, STAFF_ROLES, buildGenericOAuthProviders, buildOAuthProviderOptions, buildSocialProviders, buildTrustedOriginsFor, createSetupIncompleteAuth, decodeMemberCursor, encodeMemberCursor, getProviderAccessTokenForRequest, guardGithubLoginProfile, hasEmailAuthSurface, hashEmailOtp, isSetupIncompleteAuth, mapRegisteredOAuthClient, normalizeAuthBasePath, normalizeAuthResponseCookies, pickLocale, shouldPromoteToOwner, validateBootstrap, verifyOAuthJwt, verifyOAuthJwtWithLocalJwks, } from "@aotter/mantle-auth";
+export type { AuthMethodConfig, AuthMethodInfo, AuthSessionCache, AuthUserInfo, BootstrapOwnerRule, CrossSubDomainCookiesConfig, InviteUserResult, LinkedAccountInfo, ListMembersArgs, MantleAuth, MantleAuthRequestContext, MemberListResult, MemberUserInfo, OAuthAccessTokenVerification, OAuthConsentInfo, OAuthConsentRequest, OAuthProviderConfig, ProviderAccessToken, RegisterOAuthClientInput, RegisteredOAuthClient, SetupIncompleteAuthOptions, SocialProviderId, StaffRole, StaffUserInfo, } from "@aotter/mantle-auth";
+export type { MantleAuth as Auth } from "@aotter/mantle-auth";
+/** Workers KV as a Better Auth session cache. Key naming and TTL policy stay
+ *  in `@aotter/mantle-auth`; this only stores what it is handed. */
+export declare function kvSessionCache(kv: KVNamespace): AuthSessionCache;
+export interface CreateAuthConfig extends Omit<CreateMantleAuthOptions, "database" | "driver" | "sessionCache" | "ipAddressHeaders"> {
     readonly database: D1Database;
     /** Deployment-owned KV used by Better Auth for session reads. Session rows
      * stay in D1; verification codes and rate limits never use eventually
      * consistent KV. */
     readonly sessionCacheKv?: KVNamespace;
-    readonly baseURL: string;
-    /** Better Auth route prefix. Defaults to `/api/auth`. Set this when
-     *  multiple auth instances live in one Worker, e.g. hosted platform
-     *  provider + site staff auth + launch GitHub auth. */
-    readonly basePath?: string;
-    /** Same-origin destination for auth failures. Defaults to `/`. */
-    readonly errorURL?: string;
-    readonly secret: string;
-    /** Registered auth methods. Boot fails fast when this and `plugins` are both empty. */
-    readonly methods: ReadonlyArray<AuthMethodConfig>;
-    /** Native Better Auth plugins for flows whose callbacks and UI are fully adopter-owned. */
-    readonly plugins?: ReadonlyArray<BetterAuthPlugin>;
-    /** Sends an English notification after Admin successfully assigns a staff role. */
-    readonly staffInvitationSender?: EmailSender;
-    /** First-user-becomes-owner rule. Without it, the `owner` role must
-     *  be assigned manually in D1. */
-    readonly bootstrapOwner?: BootstrapOwnerRule;
-    /** Better Auth's always-enabled rate limit. Email methods default to
-     *  10/minute, others to 100/minute; plugin-specific limits still apply. */
-    readonly rateLimit?: {
-        readonly window: number;
-        readonly max: number;
-    };
-    /** Additional Better Auth trusted origins. SDK still injects
-     *  provider-required origins such as Apple automatically. */
-    readonly trustedOrigins?: ReadonlyArray<string>;
-    /** Forwarded to Better Auth's `advanced.crossSubDomainCookies`.
-     *  Use only for trusted first-party app families. */
-    readonly crossSubDomainCookies?: CrossSubDomainCookiesConfig;
-    /** Forwarded to Better Auth's `advanced.cookiePrefix`. Set this
-     *  when multiple Better Auth apps share a parent cookie domain. */
-    readonly cookiePrefix?: string;
-    /** HTTPS-only __Host- cookies for isolation from sibling tenant domains.
-     * Incompatible with crossSubDomainCookies.enabled. Defaults to false. */
-    readonly hostOnlyCookies?: boolean;
-    /** Turn this Better Auth instance into an OAuth/OIDC provider.
-     *  Consumer sites should use `methods: [{ kind: "oauth", ... }]`
-     *  against its discovery document. */
-    readonly oauthProvider?: OAuthProviderConfig;
-}
-export declare function buildTrustedOriginsFor(methods: ReadonlyArray<AuthMethodConfig>, configured?: ReadonlyArray<string>): string[];
-/**
- * Public-facing method descriptor exposed via `Auth.methods` and the
- * `GET /api/auth/methods` endpoint. The `social` kind carries the
- * upstream `provider` so the admin SPA can render a per-provider
- * button (label + future brand icon). Secrets, senders, and per-
- * provider extras stay private.
- */
-export type AuthMethodInfo = {
-    readonly kind: "email-otp";
-} | {
-    readonly kind: "magic-link";
-} | {
-    readonly kind: "social";
-    readonly provider: SocialProviderId;
-} | {
-    readonly kind: "oauth";
-    readonly providerId: string;
-    readonly displayName?: string;
-};
-/**
- * Linked-account row as exposed to consumers. Mirrors the BA `account`
- * table's identity columns; OAuth tokens and other secret-shaped
- * columns are intentionally excluded — callers should never need them
- * to render a "signed in via <provider>" list.
- */
-export interface LinkedAccountInfo {
-    readonly id: string;
-    readonly providerId: string;
-    readonly accountId: string;
-    readonly createdAt: Date;
-    readonly updatedAt: Date;
-}
-/**
- * User row as exposed to the staff-management surface. Mirrors the BA
- * `user` table's identity columns; password hashes, ban metadata, and
- * other secret-shaped columns are intentionally excluded.
- *
- * `emailVerified: false` + no linked account identifies a pending
- * invitation; invited rows already carry their requested staff role.
- */
-export interface StaffUserInfo {
-    readonly id: string;
-    readonly email: string;
-    readonly name: string;
-    readonly role: string | null;
-    readonly githubLogin: string | null;
-    readonly emailVerified: boolean;
-    readonly createdAt: Date;
-}
-export type MemberUserInfo = Pick<StaffUserInfo, "id" | "email" | "name" | "emailVerified" | "createdAt">;
-export interface MemberListResult {
-    readonly items: readonly MemberUserInfo[];
-    readonly previousCursor: string | null;
-    readonly nextCursor: string | null;
-}
-export interface ListMembersArgs {
-    readonly search?: string;
-    readonly cursor?: string;
-    readonly cursorDirection?: "forward" | "backward";
-    readonly limit: number;
-}
-/** Stable, secret-free user projection for consumer-owned services. */
-export interface AuthUserInfo extends StaffUserInfo {
-    readonly image: string | null;
-}
-/** Result of `inviteUser`. `exists` carries the prior row's id so the
- *  caller can point the operator at the existing user instead of
- *  surfacing a bare failure. */
-export type InviteUserResult = {
-    readonly kind: "created";
-    readonly id: string;
-} | {
-    readonly kind: "exists";
-    readonly id: string;
-};
-export interface ProviderAccessToken {
-    readonly accessToken: string;
-    readonly accessTokenExpiresAt?: Date;
-    readonly scopes: readonly string[];
-}
-export type OAuthAccessTokenVerification = {
-    readonly ok: true;
-    readonly userId: string;
-    readonly clientId: string | null;
-    readonly credentialId: string | null;
-    readonly scopes: readonly string[];
-} | {
-    readonly ok: false;
-    readonly status: 401 | 403;
-    readonly reason: "invalid-token" | "invalid-dpop-proof" | "insufficient-scope";
-    readonly missingScopes?: readonly string[];
-};
-export interface Auth {
-    readonly basePath: string;
-    /** Better Auth's per-isolate context; Workers must anchor this before responding. */
-    readonly ready?: Promise<void>;
-    /** Canonical MCP protected resource when this Auth owns one. */
-    readonly mcpResource?: string;
-    readonly handler: (request: Request) => Promise<Response>;
-    readonly getSession: (request: Request) => Promise<{
-        session: {
-            id: string;
-            userId: string;
-            expiresAt: Date;
-        };
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | null;
-            role?: string | null;
-            /** The role came from the same uncached database read as this session. */
-            roleCurrent?: true;
-            githubLogin?: string | null;
-        };
-    } | null>;
-    /** Authoritative `user.role` lookup. Protected Admin, MCP, preview,
-     *  and HTTP Trigger calls use this on every request so custom Auth
-     *  session snapshots cannot retain revoked staff access. */
-    readonly getUserRole: (userId: string) => Promise<string | null>;
-    /** Read one Better Auth-owned user without coupling consumers to its SQL schema.
-     *  Optional so existing custom Auth implementations remain source-compatible. */
-    readonly getUser?: (userId: string) => Promise<AuthUserInfo | null>;
-    /** Retrieve (and, when expired, refresh) a linked provider token for
-     *  the user identified by the current local session request. Refresh
-     *  tokens and account rows are never returned. */
-    readonly getProviderAccessToken: (request: Request, providerId: string) => Promise<ProviderAccessToken>;
-    /** Verify a JWT access token against this Auth instance's issuer and
-     *  JWKS. Passing a Request also enforces DPoP proof binding and persistent
-     *  replay protection. Opaque tokens and remote introspection are not
-     *  supported. */
-    readonly verifyOAuthAccessToken: (tokenOrRequest: string | Request, options: {
-        readonly audience: string;
-        readonly scopes?: readonly string[];
-    }) => Promise<OAuthAccessTokenVerification>;
-    /** Secret-free client projection for the current consent redirect. */
-    readonly getOAuthConsentRequest: (request: Request) => Promise<OAuthConsentRequest | null>;
-    /** Submit the original signed query and return the validated client redirect. */
-    readonly completeOAuthConsent: (request: Request, accept: boolean) => Promise<string>;
-    /** User-facing OAuth grants. Optional so custom Auth facades stay compatible. */
-    readonly listOAuthConsents?: (userId: string) => Promise<readonly OAuthConsentInfo[]>;
-    /** Revoke every token and consent row for one user/client grant. */
-    readonly revokeOAuthConsent?: (userId: string, consentId: string) => Promise<boolean>;
-    /** Methods the consumer registered, in declaration order. The admin
-     *  SPA renders sign-in sections per this list. Secrets, senders, and
-     *  per-provider extras are intentionally excluded — UI doesn't need
-     *  them. `social` methods carry the upstream `provider` id for
-     *  per-provider rendering. */
-    readonly methods: ReadonlyArray<AuthMethodInfo>;
-    /** List a user's linked social/credential accounts. Ordered by
-     *  `createdAt` ascending so the UI can render "linked since" in a
-     *  stable order across reloads. Read-only — uses the underlying D1
-     *  binding directly, no Better Auth API call. */
-    readonly listLinkedAccounts: (userId: string) => Promise<readonly LinkedAccountInfo[]>;
-    /** Unlink a single account by `(userId, providerId)`. Returns true if
-     *  a row was deleted, false if no matching account existed. Does NOT
-     *  guard against unlinking the user's only sign-in method — the
-     *  caller knows their auth method mix and decides whether the
-     *  resulting state is sign-in-able. The runtime can't, because
-     *  email-OTP / magic-link sign-ins do not write to the `account`
-     *  table at all, so "rows left" is not a reliable indicator. */
-    readonly unlinkAccount: (userId: string, providerId: string) => Promise<boolean>;
-    /** List only users with a staff role, ordered by `createdAt`
-     *  ascending. End-user identities stay outside the team-management
-     *  surface. Owner-only enforcement is the mount layer's job. */
-    readonly listUsers: () => Promise<readonly StaffUserInfo[]>;
-    /** List non-staff identities for the member-management surface. */
-    readonly listMembers: (args: ListMembersArgs) => Promise<MemberListResult>;
-    /** Assign or clear a user's staff role. `null` revokes staff access
-     *  (the row keeps existing — the user can still sign in, but every
-     *  staff-gated surface 403s). Returns false when no row matched.
-     *  Throws on a non-staff role string — programmer error, not an
-     *  operator input path (endpoints validate before calling). Does NOT
-     *  guard self-demotion; that's session-aware and lives in the mount
-     *  layer. */
-    readonly setUserRole: (userId: string, role: StaffRole | null) => Promise<boolean>;
-    /** Invite a staff member by email: pre-create the user row
-     *  (`emailVerified: 0`) with the role already assigned, so the
-     *  invitee's FIRST sign-in with that email lands with the role in
-     *  effect — no second assignment step. Magic-link / email-OTP
-     *  sign-ins match the row by email; social sign-ins with the same
-     *  email link onto it only when the provider is listed in
-     *  `accountLinking.trustedProviders` (document this to operators).
-     *  Email is normalized (trim + lowercase). Returns `exists` instead
-     *  of throwing when the email already has a row. */
-    readonly inviteUser: (email: string, role: StaffRole) => Promise<InviteUserResult>;
-    readonly sendStaffInvitation?: (email: string, role: StaffRole) => Promise<void>;
-    /** Delete an invitation row. Guarded to rows nobody ever signed in
-     *  to (`emailVerified = 0` AND no linked `account` row) so a real
-     *  user with sessions/accounts can never be cascade-deleted through
-     *  this path. Returns false when the row didn't match the guard. */
-    readonly revokeInvite: (userId: string) => Promise<boolean>;
-    /** Register an OAuth/OIDC client when `oauthProvider` is configured.
-     *  Uses Better Auth's own provider plugin endpoint and returns the
-     *  client secret only on creation. The caller must pass the current
-     *  owner/admin request headers so Better Auth can enforce privileges. */
-    readonly registerOAuthClient: (input: RegisterOAuthClientInput) => Promise<RegisteredOAuthClient>;
-}
-/** True only for the fail-closed facade returned by createSetupIncompleteAuth. */
-export declare function isSetupIncompleteAuth(auth: Auth): boolean;
-export declare function createAuth(config: CreateAuthConfig): Auth;
-export interface SetupIncompleteAuthOptions {
-    readonly basePath?: string;
-    readonly message?: string;
-    readonly response?: () => Response | Promise<Response>;
 }
-/**
- * Safe Auth facade for first-deploy/bootstrap windows where an
- * adopter's public Worker should boot before staff sign-in providers
- * have been provisioned. Auth-gated routes should still be blocked by
- * the consumer; this facade never authenticates anyone.
- */
-export declare function createSetupIncompleteAuth(options?: SetupIncompleteAuthOptions): Auth;
+/** Better Auth on Cloudflare: D1 for state, optional Workers KV for session
+ *  reads. Wiring only — the auth surface itself is host-neutral. Always
+ *  supplies `cf-connecting-ip` as the rate-limit identity header. */
+export declare function createAuth(config: CreateAuthConfig): MantleAuth;
 //# sourceMappingURL=createAuth.d.ts.map

package/dist/auth/createAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../../src/auth/createAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AAWrB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAAiB,KAAK,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAGxE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAwBlE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;AAClD,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAAwB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAAC;AAErD,KAAK,sBAAsB,GAAG;KAC3B,QAAQ,IAAI,gBAAgB,GAAG;QAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,+EAA+E;QAC/E,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;KAC1D;CACF,CAAC,gBAAgB,CAAC,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;yCAEqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;iEAC6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IAChE;2EACuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAC3D,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC;6CACyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,8EAA8E;IAC9E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,kCAAkC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpE;;2DAEuD;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,MAAM,EACX,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,qCAAqC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAC1E,MAAM,EACN,OAAO,CACR,CAAC;KACH,KAAK,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC;yEACqE;IACrE,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,uBAAuB,CAAC,EAC7B,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CACjC,oBAAoB,GAAG,oBAAoB,GAAG,eAAe,CAC9D,CAAC;IACF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B;;wBAEoB;IACpB,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,mFAAmF;IACnF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,WAAW,CAAC;IAC7C;sCACkC;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C;+EAC2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;iEAC6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;yDACqD;IACrD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D;uEACmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;6EACyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;0CAEsC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;CAC9C;AA4TD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,UAAU,GAAE,aAAa,CAAC,MAAM,CAAM,GACrC,MAAM,EAAE,CAKV;AA4UD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAChE;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,aAAa,EACb,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,eAAe,GAAG,WAAW,CACxD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;gCAEgC;AAChC,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,MAAM,EACX,eAAe,GACf,oBAAoB,GACpB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C,CAAC;AAMN,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QACjD,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAA;SAAE,CAAC;QACzD,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,0EAA0E;YAC1E,WAAW,CAAC,EAAE,IAAI,CAAC;YACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SAC7B,CAAC;KACH,GAAG,IAAI,CAAC,CAAC;IACV;;gEAE4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjE;qFACiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACpE;;sDAEkD;IAClD,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC;;;qBAGiB;IACjB,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,cAAc,EAAE,MAAM,GAAG,OAAO,EAChC,OAAO,EAAE;QACP,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,KACE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,iFAAiF;IACjF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;IAC1C,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;kCAI8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAChD;;;qDAGiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IAC3C;;;;;;oEAMgE;IAChE,QAAQ,CAAC,aAAa,EAAE,CACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;oEAEgE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC5D,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E;;;;;;iBAMa;IACb,QAAQ,CAAC,WAAW,EAAE,CACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GAAG,IAAI,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;;;;wDAQoD;IACpD,QAAQ,CAAC,UAAU,EAAE,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,KACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF;;;wEAGoE;IACpE,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D;;;6EAGyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,KAAK,EAAE,wBAAwB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC;AAID,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAEzD;AAKD,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAohBzD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,IAAI,CA4CN"}
+{"version":3,"file":"createAuth.d.ts","sourceRoot":"","sources":["../../src/auth/createAuth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACX,MAAM,qBAAqB,CAAC;AAI7B;4DAC4D;AAC5D,eAAO,MAAM,4BAA4B,+BAAgC,CAAC;AAK1E,OAAO,EACL,cAAc,EACd,WAAW,EACX,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,kBAAkB,EAClB,gCAAgC,EAChC,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,EAC5B,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,gBAAgB,EAChB,SAAS,EACT,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAE9D;oEACoE;AACpE,wBAAgB,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,gBAAgB,CAOhE;AAED,MAAM,WAAW,gBACf,SAAQ,IAAI,CACV,uBAAuB,EACvB,UAAU,GAAG,QAAQ,GAAG,cAAc,GAAG,kBAAkB,CAC5D;IACD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B;;wBAEoB;IACpB,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC;CACvC;AAED;;qEAEqE;AACrE,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAS/D"}