@aotter/mantle-cloudflare 0.1.2 → 0.1.3-alpha.2

package/dist/auth/createAuth.js

@@ -1,1268 +1,32 @@
-import { AsyncLocalStorage } from "node:async_hooks";
-import { betterAuth, } from "better-auth";
-import { getMigrations } from "better-auth/db/migration";
+import { createMantleAuth } from "@aotter/mantle-auth";
 import { D1DatabaseDriver } from "../bindings/D1DatabaseDriver.js";
-import { createDpopReplayStore, enforceDpopBinding, isDpopBindingError, parseAccessTokenAuthorization, verifyJwsAccessToken, } from "better-auth/oauth2";
-import { admin, emailOTP, jwt, magicLink, } from "better-auth/plugins";
-import { createAccessControl } from "better-auth/plugins/access";
-import { defaultStatements } from "better-auth/plugins/admin/access";
-import { genericOAuth } from "better-auth/plugins/generic-oauth";
-import { splitSetCookieHeader } from "better-auth/cookies";
-import { oauthProvider } from "@better-auth/oauth-provider";
-import { mcp } from "@better-auth/mcp";
-import { cimd } from "@better-auth/cimd";
-import { decodeMemberCursor, encodeMemberCursor, } from "@aotter/mantle-admin";
-import { signInCodeEmail, signInLinkEmail, staffInvitationEmail } from "./emailTemplates.js";
-import { STAFF_ROLES } from "@aotter/mantle-spec";
-// Better Auth 1.7.2 initializes its shared stores asynchronously. Seed them
-// before any request can be canceled; the accessor-identity regression test
-// pins this version-specific integration to the stores Better Auth uses.
-const betterAuthGlobalKey = Symbol.for("better-auth:global");
-const betterAuthGlobals = globalThis;
-const betterAuthGlobal = betterAuthGlobals[betterAuthGlobalKey] ??= {
-    version: "",
-    epoch: 0,
-    context: {},
-};
-betterAuthGlobal.context.requestStateAsyncStorage ??= new AsyncLocalStorage();
-betterAuthGlobal.context.endpointContextAsyncStorage ??= new AsyncLocalStorage();
-betterAuthGlobal.context.adapterAsyncStorage ??= new AsyncLocalStorage();
-export { decodeMemberCursor, encodeMemberCursor };
-export { STAFF_ROLES };
-/**
- * Set lookup for "is this role string a staff role?" — handlers/MCP
- * gating reach for this every request, so the Set form is worth the
- * one-time allocation over `STAFF_ROLES.includes(x)`.
- */
-export const STAFF_ROLE_SET = new Set(STAFF_ROLES);
-function normalizeAuthBasePath(basePath) {
-    if (basePath === undefined)
-        return "/api/auth";
-    const trimmed = basePath.trim();
-    if (trimmed === "")
-        return "/api/auth";
-    if (!trimmed.startsWith("/")) {
-        throw new Error("createAuth: basePath must start with '/'.");
-    }
-    if (trimmed === "/") {
-        throw new Error("createAuth: basePath must not be '/'.");
-    }
-    if (trimmed.endsWith("/")) {
-        return trimmed.replace(/\/+$/, "");
-    }
-    return trimmed;
-}
-function normalizeAuthErrorURL(errorURL, baseURL) {
-    const base = new URL(baseURL);
-    const resolved = new URL(errorURL ?? "/", base);
-    if (resolved.origin !== base.origin) {
-        throw new Error("createAuth: errorURL must be same-origin with baseURL.");
-    }
-    return `${resolved.pathname}${resolved.search}`;
-}
-/** @internal Exported for regression tests. */
-export function normalizeAuthResponseCookies(response) {
-    const setCookie = response.headers.get("set-cookie");
-    if (!setCookie)
-        return response;
-    const values = response.headers.getSetCookie?.() ??
-        [setCookie];
-    const cookies = values.flatMap(splitSetCookieHeader);
-    if (cookies.length < 2)
-        return response;
-    const headers = new Headers(response.headers);
-    headers.delete("set-cookie");
-    for (const cookie of cookies)
-        headers.append("set-cookie", cookie);
-    return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers,
-    });
-}
-const ac = createAccessControl(defaultStatements);
-const ownerAc = ac.newRole({
-    user: defaultStatements.user,
-    session: defaultStatements.session,
-});
-const editorAc = ac.newRole({
-    user: ["list", "ban", "get", "update"],
-    session: ["list", "revoke"],
-});
-const contributorAc = ac.newRole({
-    user: ["list", "get"],
-    session: [],
-});
-const userAc = ac.newRole({
-    user: [],
-    session: [],
-});
-function withGithubLogin(options) {
-    return typeof options === "function"
-        ? async () => withGithubLoginMapper(await options())
-        : withGithubLoginMapper(options);
-}
-function withGithubLoginMapper(options) {
-    const developerMapper = options.mapProfileToUser;
-    return {
-        ...options,
-        mapProfileToUser: async (profile) => ({
-            ...(developerMapper ? await developerMapper(profile) : {}),
-            githubLogin: profile.login,
-        }),
-    };
-}
-/** @internal exported for unit tests; not part of the public API. */
-export function buildSocialProviders(methods) {
-    const out = {};
-    // Duplicate-provider guard: catch the case where two `social`
-    // methods declare the same `provider` id. Better Auth would
-    // silently keep the latter (Record overwrite); for SDK adopters —
-    // and especially for the upcoming feature-overlay path where a
-    // feature can contribute auth methods into the same starter's
-    // `methods[]` array — that silent overwrite is a footgun. Throw at
-    // construction with a clear message so the conflict surfaces
-    // before the first sign-in.
-    const seenProviders = new Set();
-    for (const method of methods) {
-        if (method.kind !== "social")
-            continue;
-        if (seenProviders.has(method.provider)) {
-            throw new Error(`createAuth: social provider '${method.provider}' is registered more than once; ` +
-                `each provider can have only one methods[] entry. Remove the redundant entry or pick a different provider.`);
-        }
-        seenProviders.add(method.provider);
-        out[method.provider] = method.provider === "github"
-            ? withGithubLogin(method.options)
-            : method.options;
-    }
-    return out;
-}
-/** @internal exported for unit tests; not part of the public API. */
-export function buildGenericOAuthProviders(methods) {
-    const seenProviderIds = new Set();
-    const socialProviderIds = new Set(methods.flatMap((method) => method.kind === "social" ? [method.provider] : []));
-    const out = [];
-    for (const method of methods) {
-        if (method.kind !== "oauth")
-            continue;
-        if (socialProviderIds.has(method.options.providerId)) {
-            throw new Error(`createAuth: OAuth providerId '${method.options.providerId}' conflicts with a registered social provider id. Provider ids must be unique across methods[].`);
-        }
-        if (seenProviderIds.has(method.options.providerId)) {
-            throw new Error(`createAuth: OAuth provider '${method.options.providerId}' is registered more than once; ` +
-                `each providerId can have only one methods[] entry.`);
-        }
-        seenProviderIds.add(method.options.providerId);
-        if (!method.options.discoveryUrl && !(method.options.authorizationUrl && method.options.tokenUrl)) {
-            throw new Error(`createAuth: OAuth provider '${method.options.providerId}' needs either discoveryUrl or both authorizationUrl and tokenUrl.`);
-        }
-        out.push(method.options);
-    }
-    return out;
-}
-/**
- * First tag off `Accept-Language`, quality values ignored. Locale
- * contract lives in `EmailSender.ts`.
- */
-/** @internal exported for unit tests; not part of the public API. */
-export function pickLocale(req, fallback) {
-    const header = req?.headers.get("accept-language");
-    if (!header)
-        return fallback;
-    const first = header.split(",")[0]?.split(";")[0]?.trim();
-    return first && first.length > 0 ? first : fallback;
-}
-const MAGIC_LINK_DEFAULT_EXPIRES_SECONDS = 900;
-function buildMagicLinkPlugin(method) {
-    const fallback = method.fallbackLocale ?? "en";
-    return magicLink({
-        storeToken: "hashed",
-        expiresIn: MAGIC_LINK_DEFAULT_EXPIRES_SECONDS,
-        ...method.options,
-        // Returned synchronously — same fire-and-forget contract as
-        // email-otp via `advanced.backgroundTasks.handler`. The body
-        // carries the click-URL; SDK doesn't ship a template, the
-        // sender can render plain text or richer HTML.
-        sendMagicLink: (data, ctx) => {
-            const locale = pickLocale(ctx?.request, fallback);
-            return method.sender.send({
-                to: data.email,
-                ...signInLinkEmail(data.url),
-                locale,
-                category: "auth.magic-link.sign-in",
-            });
-        },
-    });
-}
-function buildEmailOTPPlugin(method) {
-    const fallback = method.fallbackLocale ?? "en";
-    return emailOTP({
-        storeOTP: "hashed",
-        ...method.options,
-        // Return synchronously — the promise is fire-and-forget via the
-        // `advanced.backgroundTasks.handler` we wire in `buildAuth`. For
-        // `email-verification` / `forget-password` types Better Auth only
-        // calls this when the user exists, so awaiting would leak account
-        // existence through response latency. See Better Auth's own
-        // sendVerificationOTP docstring + reviewer finding in PR #161.
-        sendVerificationOTP: (data, ctx) => {
-            const locale = pickLocale(ctx?.request, fallback);
-            return method.sender.send({
-                to: data.email,
-                ...signInCodeEmail(data.otp),
-                locale,
-                category: `auth.email-otp.${data.type}`,
-            });
-        },
-    });
-}
-/**
- * Cross-check bootstrap rule against registered methods. Catches the
- * silent-no-op case where the rule's discriminator can never match
- * any signal a registered method actually produces — e.g.
- * `match: "github-login"` with no `github` provider registered. Throws
- * at construction so vibe-coders see the mistake before the first
- * sign-in attempt.
- *
- * `match: "email"` is permissive — every Better Auth method that
- * creates a user populates `email`, including GitHub (via the
- * upstream profile). No registration constraint to enforce.
- */
-/** @internal exported for unit tests; not part of the public API. */
-export function validateBootstrap(rule, methods) {
-    if (rule.match === "github-login") {
-        const hasGithub = methods.some((method) => (method.kind === "social" && method.provider === "github") ||
-            (method.kind === "oauth" && method.options.providerId === "github"));
-        if (!hasGithub) {
-            throw new Error("createAuth: bootstrapOwner.match='github-login' but no GitHub provider is registered. " +
-                "Register social GitHub or a trusted OAuth providerId='github', or switch to email matching.");
-        }
-    }
-}
-/** @internal exported for unit tests; not part of the public API. */
-export function shouldPromoteToOwner(rule, user) {
-    const target = rule.value.trim().toLowerCase();
-    switch (rule.match) {
-        case "github-login":
-            return !!user.githubLogin && user.githubLogin.toLowerCase() === target;
-        case "email":
-            return !!user.email && user.email.toLowerCase() === target;
-    }
-}
-/** @internal Keep provider-owned GitHub logins off user-controlled auth paths. */
-export function guardGithubLoginProfile(user, context, methods) {
-    if (!("githubLogin" in user))
-        return undefined;
-    const providerId = context?.path === "/callback/:id" ? context.params?.id : null;
-    const trusted = typeof providerId === "string" && methods.some((method) => method.kind === "social"
-        ? context?.path === "/callback/:id" && method.provider === "github" && providerId === "github"
-        : method.kind === "oauth" &&
-            context?.path === "/callback/:id" &&
-            method.options.providerId === providerId &&
-            Boolean(method.options.mapProfileToUser));
-    return trusted ? undefined : { data: { githubLogin: null } };
-}
-/**
- * Find the at-most-one method of `kind`. Throws when adopters register
- * the same kind twice — Better Auth's plugin layer accepts duplicates
- * silently, which would mask the intent at boot. One helper covers
- * every singleton-shaped method (email-otp, magic-link, future ones).
- */
-function pickSingleton(methods, kind) {
-    const matches = methods.filter((m) => m.kind === kind);
-    if (matches.length > 1) {
-        throw new Error(`createAuth: more than one \`${kind}\` method registered. Combine into one.`);
-    }
-    return matches[0];
-}
-/**
- * Origins each registered social provider needs in
- * `trustedOrigins`. Adding a provider that demands an extra
- * `trustedOrigins` entry = adding a row here. Apple is the only one
- * in 1.6.9 that hard-requires this; if Better Auth ever drops the
- * requirement, the entry stays harmless (Better Auth dedupes).
- */
-const SOCIAL_PROVIDER_TRUSTED_ORIGINS = {
-    apple: ["https://appleid.apple.com"],
-};
-export function buildTrustedOriginsFor(methods, configured = []) {
-    const origins = methods.flatMap((m) => m.kind === "social" ? SOCIAL_PROVIDER_TRUSTED_ORIGINS[m.provider] ?? [] : []);
-    return [...new Set([...origins, ...configured])];
-}
-/**
- * Apple uses `response_mode=form_post` — Apple POSTs cross-site to
- * our callback. The OAuth state cookie must have `sameSite: "none"`
- * (and `secure: true`, which browsers require alongside) or the
- * cookie won't ride the POST and Better Auth raises a state mismatch.
- * Other providers don't need this. We only auto-set when Apple is
- * registered AND the adopter hasn't already specified
- * `defaultCookieAttributes.sameSite` themselves.
- */
-function methodsRequireSameSiteNone(methods) {
-    return methods.some((m) => m.kind === "social" && m.provider === "apple");
-}
-/** @internal exported for provider-option mapping tests. */
-export function buildOAuthProviderOptions(config) {
+/** Ingress header Cloudflare overwrites. `createAuth` always passes this
+ *  to the portable package; callers do not configure it. */
+export const CLOUDFLARE_CLIENT_IP_HEADERS = ["cf-connecting-ip"];
+// Stable Cloudflare-facing surface. Explicit names only — do not star-export
+// `@aotter/mantle-auth` (that would leak the portable constructor and make
+// the Cloudflare header look like a portable default).
+export { STAFF_ROLE_SET, STAFF_ROLES, buildGenericOAuthProviders, buildOAuthProviderOptions, buildSocialProviders, buildTrustedOriginsFor, createSetupIncompleteAuth, decodeMemberCursor, encodeMemberCursor, getProviderAccessTokenForRequest, guardGithubLoginProfile, hasEmailAuthSurface, hashEmailOtp, isSetupIncompleteAuth, mapRegisteredOAuthClient, normalizeAuthBasePath, normalizeAuthResponseCookies, pickLocale, shouldPromoteToOwner, validateBootstrap, verifyOAuthJwt, verifyOAuthJwtWithLocalJwks, } from "@aotter/mantle-auth";
+/** Workers KV as a Better Auth session cache. Key naming and TTL policy stay
+ *  in `@aotter/mantle-auth`; this only stores what it is handed. */
+export function kvSessionCache(kv) {
     return {
-        loginPage: config.loginPage,
-        consentPage: config.consentPage,
-        ...(config.scopes ? { scopes: [...config.scopes] } : {}),
-        ...(config.resources
-            ? { resources: [...config.resources] }
-            : {}),
-        ...(config.clientRegistrationDefaultResources
-            ? { clientRegistrationDefaultResources: [...config.clientRegistrationDefaultResources] }
-            : {}),
-        ...(config.mcpResource
-            ? {
-                clientRegistrationClientSecretExpiration: "90d",
-                allowPublicClientPrelogin: true,
-            }
-            : {}),
-        ...(config.allowDynamicClientRegistration !== undefined
-            ? { allowDynamicClientRegistration: config.allowDynamicClientRegistration }
-            : {}),
-        ...(config.allowUnauthenticatedClientRegistration !== undefined
-            ? {
-                allowUnauthenticatedClientRegistration: config.allowUnauthenticatedClientRegistration,
-            }
-            : {}),
-        ...(config.clientRegistrationDefaultScopes
-            ? {
-                clientRegistrationDefaultScopes: [
-                    ...config.clientRegistrationDefaultScopes,
-                ],
-            }
-            : {}),
-        ...(config.clientRegistrationAllowedScopes
-            ? {
-                clientRegistrationAllowedScopes: [
-                    ...config.clientRegistrationAllowedScopes,
-                ],
-            }
-            : {}),
-        ...(config.cachedTrustedClients
-            ? { cachedTrustedClients: new Set(config.cachedTrustedClients) }
-            : {}),
-        ...(config.clientPrivileges
-            ? { clientPrivileges: config.clientPrivileges }
-            : {}),
+        get: (key) => kv.get(key),
+        set: (key, value, ttlSeconds) => kv.put(key, value, ttlSeconds ? { expirationTtl: ttlSeconds } : undefined),
+        delete: (key) => kv.delete(key),
     };
 }
-function buildAuth(config) {
-    if (config.hostOnlyCookies && (new URL(config.baseURL).protocol !== "https:" || config.crossSubDomainCookies?.enabled)) {
-        throw new Error("createAuth: hostOnlyCookies requires HTTPS and cannot share cookies across subdomains.");
-    }
-    if (config.methods.length === 0 && !config.plugins?.length) {
-        throw new Error("createAuth: methods[] is empty — register an AuthMethodConfig or native Better Auth plugin so staff can sign in.");
-    }
-    if (config.bootstrapOwner) {
-        validateBootstrap(config.bootstrapOwner, config.methods);
-    }
-    const socialProviders = buildSocialProviders(config.methods);
-    const genericOAuthProviders = buildGenericOAuthProviders(config.methods);
-    const bootstrap = config.bootstrapOwner;
-    const emailOtpMethod = pickSingleton(config.methods, "email-otp");
-    const magicLinkMethod = pickSingleton(config.methods, "magic-link");
-    const providerOptions = config.oauthProvider
-        ? buildOAuthProviderOptions(config.oauthProvider)
-        : null;
-    // Workers may not set NODE_ENV. Explicitly enable the provider's route
-    // limits too (notably anonymous DCR: 5/minute).
-    // ponytail: memory limits are per isolate; use an ingress rate-limit rule
-    // when a deployment needs a distributed abuse quota.
-    const hasEmailMethod = !!(emailOtpMethod || magicLinkMethod);
-    const rateLimit = {
-        window: 60,
-        max: hasEmailMethod ? 10 : 100,
-        ...config.rateLimit,
-        enabled: true,
-        storage: "memory",
-    };
-    // `trustedOrigins`: per-provider auto-origins (Apple needs
-    // `https://appleid.apple.com`) plus adopter-owned first-party
-    // origins for flows such as hosted auth across trusted subdomains.
-    const trustedOrigins = buildTrustedOriginsFor(config.methods, config.trustedOrigins);
-    const sdkPlugins = [
-        admin({
-            defaultRole: "user",
-            adminRoles: [...STAFF_ROLES],
-            ac,
-            roles: {
-                owner: ownerAc,
-                editor: editorAc,
-                contributor: contributorAc,
-                user: userAc,
-            },
-        }),
-        ...(genericOAuthProviders.length > 0
-            ? [
-                genericOAuth({
-                    config: genericOAuthProviders,
-                }),
-            ]
-            : []),
-        ...(emailOtpMethod ? [buildEmailOTPPlugin(emailOtpMethod)] : []),
-        ...(magicLinkMethod ? [buildMagicLinkPlugin(magicLinkMethod)] : []),
-        ...(config.oauthProvider && providerOptions
-            ? [
-                jwt(),
-                config.oauthProvider.mcpResource
-                    ? mcp({
-                        ...providerOptions,
-                        resource: config.oauthProvider.mcpResource,
-                        extensions: [{
-                                claims: {
-                                    accessToken: ({ referenceId }) => ({ mantle_consent_id: referenceId ?? null }),
-                                },
-                            }],
-                    })
-                    : oauthProvider(providerOptions),
-                ...(config.oauthProvider.mcpResource
-                    ? [
-                        cimd({
-                            // Cloudflare's `global_fetch_strictly_public` flag is the
-                            // runtime network boundary: resolution and connection stay
-                            // on the public Internet. Better Auth owns timeout, limits,
-                            // validation, caching, and redirect rejection above it.
-                            // Workers does not implement `redirect: "error"`; `manual`
-                            // exposes 3xx responses so Better Auth can reject them.
-                            fetchClientMetadataResource: (input, init) => fetch(input, { ...init, redirect: "manual" }),
-                            metadataProfile: "mcp-2026-07-28",
-                        }),
-                    ]
-                    : []),
-            ]
-            : []),
-    ];
-    const plugins = [...sdkPlugins, ...(config.plugins ?? [])];
-    const pluginIds = new Set();
-    for (const plugin of plugins) {
-        if (pluginIds.has(plugin.id)) {
-            throw new Error(`createAuth: Better Auth plugin '${plugin.id}' is registered more than once. Remove the duplicate plugin.`);
-        }
-        pluginIds.add(plugin.id);
-    }
-    // `user.additionalFields`: SDK owns `githubLogin` only.
-    const userConfig = {
-        additionalFields: {
-            githubLogin: {
-                type: "string",
-                required: false,
-                // Better Auth applies `input: false` to trusted provider profiles too.
-                // Database hooks below keep this field provider-only instead.
-                input: true,
-            },
-        },
-    };
-    // `advanced`: SDK owns `backgroundTasks`. Apple auto-injects
-    // `defaultCookieAttributes.sameSite: "none"` because Apple's
-    // `form_post` callback is cross-site and a `lax` cookie won't ride
-    // it (Better Auth's default raises a state-mismatch).
-    const appleNeedsCrossSite = methodsRequireSameSiteNone(config.methods);
-    const advancedConfig = {
-        // Cloudflare overwrites this at ingress. Never trust client-controlled XFF.
-        ipAddress: { ipAddressHeaders: ["cf-connecting-ip"] },
-        ...(appleNeedsCrossSite
-            ? {
-                // Browsers require `secure: true` whenever `sameSite: "none"`.
-                defaultCookieAttributes: { secure: true, sameSite: "none" },
-            }
-            : {}),
-        ...(config.crossSubDomainCookies
-            ? { crossSubDomainCookies: config.crossSubDomainCookies }
-            : {}),
-        ...(config.cookiePrefix ? { cookiePrefix: config.cookiePrefix } : {}),
-        ...(config.hostOnlyCookies ? {
-            // Better Auth prepends __Secure- otherwise. Secure is set explicitly below.
-            useSecureCookies: false,
-            cookiePrefix: `__Host-${config.cookiePrefix || "better-auth"}`,
-            crossSubDomainCookies: { enabled: false },
-            defaultCookieAttributes: { secure: true, path: "/", ...(appleNeedsCrossSite ? { sameSite: "none" } : {}) },
-        } : {}),
-        // Fire-and-forget hook closes the user-existence timing oracle
-        // on OTP send — see § "Auth as contract" notes in ADR-0014.
-        backgroundTasks: {
-            handler: (p) => {
-                p.catch((err) => {
-                    // eslint-disable-next-line no-console
-                    console.error("[better-auth backgroundTask]", err);
-                });
-            },
-        },
-    };
-    // `databaseHooks`: SDK owns `user.create.after` for bootstrap-owner
-    // promotion (when `bootstrapOwner` is configured).
-    const sdkUserCreateAfter = async (user) => {
-        if (!bootstrap)
-            return;
-        const u = user;
-        if (!shouldPromoteToOwner(bootstrap, u))
-            return;
-        // Atomic check-then-promote: the `NOT EXISTS` is a GLOBAL guard —
-        // it asks "does any user already hold a staff role?". The whole
-        // statement runs as one D1 op, so two concurrent first signups
-        // can't both win: the loser's UPDATE finds a staff user in the
-        // subquery and silently writes zero rows.
-        const placeholders = STAFF_ROLES.map(() => "?").join(",");
-        const result = await config.database
-            .prepare(`UPDATE user SET role = ? WHERE id = ? AND NOT EXISTS (SELECT 1 FROM user WHERE role IN (${placeholders}))`)
-            .bind("owner", u.id, ...STAFF_ROLES)
-            .run();
-        if ((result.meta?.changes ?? 0) === 0) {
-            // Operator-visible signal that the rule matched but a prior
-            // staff user already exists — otherwise the silent no-op makes a
-            // misconfigured bootstrap rule indistinguishable from a working
-            // first-promotion.
-            console.warn(`[bootstrap] user ${u.id} matched bootstrapOwner rule but promotion was blocked — a staff user already exists.`);
-        }
-    };
-    const databaseHooks = {
-        user: {
-            create: {
-                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
-                after: sdkUserCreateAfter,
-            },
-            update: {
-                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
-            },
-        },
-        verification: {
-            create: {
-                before: async (verification) => {
-                    if (!config.oauthProvider?.mcpResource)
-                        return;
-                    let value;
-                    try {
-                        value = JSON.parse(verification.value);
-                    }
-                    catch {
-                        return; // OTPs and other verification values are not OAuth grants.
-                    }
-                    if (value?.type !== "authorization_code" || typeof value.userId !== "string" ||
-                        typeof value.query?.client_id !== "string")
-                        return;
-                    const consent = await config.database
-                        .prepare("SELECT id FROM oauthConsent WHERE userId = ? AND clientId = ? LIMIT 1")
-                        .bind(value.userId, value.query.client_id)
-                        .first();
-                    // Better Auth carries referenceId from this code through every
-                    // refresh rotation. Never rebind an old lineage to a new consent.
-                    return { data: { value: JSON.stringify({ ...value, referenceId: consent?.id ?? "" }) } };
-                },
-            },
-        },
-    };
-    const secondaryStorage = config.sessionCacheKv ? {
-        get: (key) => key.startsWith("verification:")
-            ? Promise.resolve(null)
-            : config.sessionCacheKv.get(`better-auth:${key}`),
-        set: (key, value, ttl) => key.startsWith("verification:")
-            ? Promise.resolve()
-            : config.sessionCacheKv.put(`better-auth:${key}`, value, ttl ? { expirationTtl: Math.max(60, Math.ceil(ttl)) } : undefined),
-        delete: (key) => key.startsWith("verification:")
-            ? Promise.resolve()
-            : config.sessionCacheKv.delete(`better-auth:${key}`),
-        // Verification and rate limiting stay in D1/memory below. Fail loudly if
-        // Better Auth starts routing either atomic operation through this adapter.
-        getAndDelete: async () => { throw new Error("Better Auth KV getAndDelete is disabled"); },
-        increment: async () => { throw new Error("Better Auth KV increment is disabled"); },
-    } : undefined;
-    return betterAuth({
-        database: config.database,
-        secondaryStorage,
-        session: { storeSessionInDatabase: true },
-        verification: { storeInDatabase: true },
-        secret: config.secret,
-        baseURL: config.baseURL,
-        basePath: normalizeAuthBasePath(config.basePath),
-        onAPIError: { errorURL: normalizeAuthErrorURL(config.errorURL, config.baseURL) },
-        socialProviders,
-        user: userConfig,
-        rateLimit,
-        trustedOrigins,
-        advanced: advancedConfig,
-        plugins,
-        databaseHooks,
-    });
-}
-const SETUP_INCOMPLETE_AUTHS = new WeakSet();
-/** True only for the fail-closed facade returned by createSetupIncompleteAuth. */
-export function isSetupIncompleteAuth(auth) {
-    return SETUP_INCOMPLETE_AUTHS.has(auth);
-}
-const LEGACY_DCR_TTL_MS = 90 * 24 * 60 * 60 * 1_000;
-const LEGACY_DCR_CLEANUP_INTERVAL_MS = 60 * 60 * 1_000;
+/** Better Auth on Cloudflare: D1 for state, optional Workers KV for session
+ *  reads. Wiring only — the auth surface itself is host-neutral. Always
+ *  supplies `cf-connecting-ip` as the rate-limit identity header. */
 export function createAuth(config) {
-    const auth = buildAuth(config);
-    const ready = auth.$context.then(() => undefined);
-    // Observe eager initialization even for low-level callers; keep the original
-    // rejection available to callers awaiting ready and Better Auth's handlers.
-    void ready.catch(() => { });
-    // Auth owns its schema even when content uses a different semantic store.
-    // Keep schema work lazy: static/plan-only routes must not prepare tables.
-    let schemaReady = null;
-    const prepareAuth = () => schemaReady ??= (async () => {
-        const context = await auth.$context;
-        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(context.tables)));
-        const id = `auth-schema:1:${Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, "0")).join("")}`;
-        try {
-            const applied = await config.database.prepare("SELECT id FROM _migrations WHERE id = ?").bind(id).first();
-            if (applied?.id === id)
-                return;
-        }
-        catch (error) {
-            // A new, auth-only database has no legacy Runtime ledger yet.
-            if (!/no such table: _migrations/i.test(String(error)))
-                throw error;
-        }
-        const { compileMigrations } = await getMigrations(context.options);
-        await new D1DatabaseDriver(config.database).migrations.runAll([{
-                id,
-                description: "Selected Better Auth schema and staff-role access path",
-                sql: `${await compileMigrations()}\nCREATE INDEX IF NOT EXISTS user_role_idx ON user (role) WHERE role IS NOT NULL;`,
-            }]);
-    })().catch(error => { schemaReady = null; throw error; });
-    const basePath = normalizeAuthBasePath(config.basePath);
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const api = auth.api;
-    const localJwksCacheKey = {};
-    let dpopReplayStore = null;
-    const getDpopReplayStore = async () => {
-        if (dpopReplayStore)
-            return dpopReplayStore;
-        const context = await auth.$context;
-        dpopReplayStore = createDpopReplayStore(context.internalAdapter);
-        return dpopReplayStore;
-    };
-    const verifyAccessToken = config.oauthProvider
-        ? async (token, audience) => {
-            await prepareAuth();
-            const context = await auth.$context;
-            const claims = await verifyOAuthJwtWithLocalJwks(token, audience, context.baseURL, async () => api.getJwks(), localJwksCacheKey);
-            if (config.oauthProvider?.mcpResource && (audience === config.oauthProvider.mcpResource || config.oauthProvider.resources?.includes(audience))) {
-                await assertActiveUserGrant(config.database, claims, audience);
-            }
-            return claims;
-        }
-        : null;
-    let nextDcrCleanupAt = 0;
-    const pruneExpiredDynamicClients = async () => {
-        const now = Date.now();
-        if (!config.oauthProvider?.mcpResource || now < nextDcrCleanupAt)
-            return;
-        // Set before awaiting so concurrent OAuth requests do not fan out writes.
-        nextDcrCleanupAt = now + LEGACY_DCR_CLEANUP_INTERVAL_MS;
-        try {
-            await config.database
-                .prepare("DELETE FROM oauthClient WHERE clientDiscoveryId IS NULL AND userId IS NULL AND referenceId IS NULL AND createdAt < ?")
-                .bind(new Date(now - LEGACY_DCR_TTL_MS).toISOString())
-                .run();
-        }
-        catch (error) {
-            // Cleanup is bounded storage hygiene, not an authorization decision.
-            console.error("[better-auth] legacy DCR cleanup failed", error);
-        }
-    };
-    return {
-        basePath,
-        ready,
-        ...(config.oauthProvider?.mcpResource
-            ? { mcpResource: config.oauthProvider.mcpResource }
-            : {}),
-        handler: async (request) => {
-            await prepareAuth();
-            const pathname = new URL(request.url).pathname;
-            if (pathname.startsWith(`${basePath}/oauth2/`)) {
-                await pruneExpiredDynamicClients();
-            }
-            return normalizeAuthResponseCookies(await auth.handler(request));
-        },
-        getSession: async (request) => {
-            let session;
-            try {
-                session = await api.getSession({ headers: request.headers });
-            }
-            catch {
-                // Existing sessions resolve from KV without paying the schema-ledger read.
-                // A fresh database with a stale cookie prepares once, then retries safely.
-                await prepareAuth();
-                session = await api.getSession({ headers: request.headers });
-            }
-            return session
-                ? {
-                    ...session,
-                    user: {
-                        ...session.user,
-                        // Secondary storage can outlive or be shared across a D1 replacement.
-                        // Its user snapshot is therefore not authoritative for staff access.
-                        ...(!config.sessionCacheKv && Object.hasOwn(session.user, "role")
-                            ? { roleCurrent: true }
-                            : {}),
-                    },
-                }
-                : null;
-        },
-        getUserRole: async (userId) => {
-            await prepareAuth();
-            const row = await config.database
-                .prepare("SELECT role FROM user WHERE id = ? LIMIT 1")
-                .bind(userId)
-                .first();
-            return row?.role ?? null;
-        },
-        getUser: async (userId) => {
-            await prepareAuth();
-            const row = await config.database
-                .prepare("SELECT id, email, name, image, role, githubLogin, emailVerified, createdAt FROM user WHERE id = ? LIMIT 1")
-                .bind(userId)
-                .first();
-            if (!row)
-                return null;
-            const createdAt = new Date(row.createdAt);
-            if (Number.isNaN(createdAt.getTime())) {
-                throw new Error("Auth user row has an invalid createdAt timestamp.");
-            }
-            return {
-                id: row.id,
-                email: row.email,
-                name: row.name,
-                image: row.image,
-                role: row.role,
-                githubLogin: row.githubLogin,
-                emailVerified: row.emailVerified !== 0,
-                createdAt,
-            };
-        },
-        getProviderAccessToken: async (request, providerId) => {
-            await prepareAuth();
-            const session = await api.getSession({ headers: request.headers });
-            const userId = session?.user?.id;
-            const account = userId
-                ? await config.database
-                    .prepare("SELECT id FROM account WHERE userId = ? AND providerId = ? LIMIT 1")
-                    .bind(userId, providerId)
-                    .first()
-                : null;
-            if (!account) {
-                throw new Error(`getProviderAccessToken: provider '${providerId}' is not linked to the current user.`);
-            }
-            return getProviderAccessTokenForRequest(api, request, account.id, providerId);
-        },
-        verifyOAuthAccessToken: async (tokenOrRequest, options) => {
-            return verifyOAuthJwt(tokenOrRequest, options, verifyAccessToken, getDpopReplayStore);
-        },
-        getOAuthConsentRequest: async (request) => {
-            if (!config.oauthProvider)
-                return null;
-            const url = new URL(request.url);
-            const clientId = url.searchParams.get("client_id");
-            if (!clientId || !url.search)
-                return null;
-            await prepareAuth();
-            const oauthQuery = url.search.slice(1);
-            const client = await api.getOAuthClientPublicPrelogin({
-                headers: request.headers,
-                body: { client_id: clientId, oauth_query: oauthQuery },
-            });
-            const redirectUri = url.searchParams.get("redirect_uri") ??
-                (Array.isArray(client?.redirect_uris) &&
-                    typeof client.redirect_uris[0] === "string"
-                    ? client.redirect_uris[0]
-                    : "");
-            return {
-                clientName: typeof client?.client_name === "string"
-                    ? client.client_name
-                    : clientId,
-                redirectUri,
-                scopes: (url.searchParams.get("scope") ?? "")
-                    .split(/\s+/u)
-                    .filter(Boolean),
-                oauthQuery,
-            };
-        },
-        completeOAuthConsent: async (request, accept) => {
-            if (!config.oauthProvider) {
-                throw new Error("completeOAuthConsent: oauthProvider is not configured.");
-            }
-            const form = await request.formData();
-            const oauthQuery = form.get("oauth_query");
-            if (typeof oauthQuery !== "string" || oauthQuery.length === 0) {
-                throw new Error("completeOAuthConsent: oauth_query is missing.");
-            }
-            await prepareAuth();
-            const headers = new Headers(request.headers);
-            headers.set("content-type", "application/json");
-            headers.delete("content-length");
-            const response = await auth.handler(new Request(new URL(`${basePath}/oauth2/consent`, request.url), {
-                method: "POST",
-                headers,
-                body: JSON.stringify({ accept, oauth_query: oauthQuery }),
-            }));
-            if (!response.ok) {
-                throw new Error(`completeOAuthConsent: Better Auth returned ${response.status}.`);
-            }
-            const result = await response.json();
-            if (!result || typeof result.url !== "string") {
-                throw new Error("completeOAuthConsent: Better Auth omitted the redirect URL.");
-            }
-            return result.url;
-        },
-        ...(config.oauthProvider
-            ? {
-                listOAuthConsents: async (userId) => {
-                    await prepareAuth();
-                    const result = await config.database
-                        .prepare(`SELECT consent.id, consent.clientId,
-                        COALESCE(client.name, consent.clientId) AS clientName,
-                        consent.scopes
-                   FROM oauthConsent AS consent
-                   LEFT JOIN oauthClient AS client ON client.clientId = consent.clientId
-                  WHERE consent.userId = ?
-                  ORDER BY consent.updatedAt DESC, consent.id ASC`)
-                        .bind(userId)
-                        .all();
-                    return (result.results ?? []).map((row) => ({
-                        id: row.id,
-                        clientId: row.clientId,
-                        clientName: row.clientName,
-                        scopes: parseStoredStringArray(row.scopes) ?? [],
-                    }));
-                },
-                revokeOAuthConsent: async (userId, consentId) => {
-                    await prepareAuth();
-                    const consent = await config.database
-                        .prepare("SELECT clientId FROM oauthConsent WHERE id = ? AND userId = ? LIMIT 1")
-                        .bind(consentId, userId)
-                        .first();
-                    if (!consent)
-                        return false;
-                    const revokedAt = new Date().toISOString();
-                    await config.database.batch([
-                        config.database
-                            .prepare("UPDATE oauthRefreshToken SET revoked = ? WHERE userId = ? AND clientId = ? AND revoked IS NULL")
-                            .bind(revokedAt, userId, consent.clientId),
-                        config.database
-                            .prepare("UPDATE oauthAccessToken SET revoked = ? WHERE userId = ? AND clientId = ? AND revoked IS NULL")
-                            .bind(revokedAt, userId, consent.clientId),
-                        config.database
-                            .prepare(`DELETE FROM verification
-                    WHERE CASE WHEN json_valid(value) THEN json_extract(value, '$.type') END = 'authorization_code'
-                      AND CASE WHEN json_valid(value) THEN json_extract(value, '$.userId') END = ?
-                      AND CASE WHEN json_valid(value) THEN json_extract(value, '$.query.client_id') END = ?`)
-                            .bind(userId, consent.clientId),
-                        config.database
-                            .prepare("DELETE FROM oauthConsent WHERE userId = ? AND clientId = ?")
-                            .bind(userId, consent.clientId),
-                    ]);
-                    return true;
-                },
-            }
-            : {}),
-        methods: config.methods.map((m) => {
-            switch (m.kind) {
-                case "social":
-                    return { kind: "social", provider: m.provider };
-                case "oauth":
-                    return {
-                        kind: "oauth",
-                        providerId: m.options.providerId,
-                        ...(m.displayName ? { displayName: m.displayName } : {}),
-                    };
-                case "email-otp":
-                case "magic-link":
-                    return { kind: m.kind };
-            }
-        }),
-        listLinkedAccounts: async (userId) => {
-            await prepareAuth();
-            const result = await config.database
-                .prepare("SELECT id, providerId, accountId, createdAt, updatedAt FROM account WHERE userId = ? ORDER BY createdAt ASC, id ASC")
-                .bind(userId)
-                .all();
-            return (result.results ?? []).map((row) => ({
-                id: row.id,
-                providerId: row.providerId,
-                accountId: row.accountId,
-                createdAt: new Date(row.createdAt),
-                updatedAt: new Date(row.updatedAt),
-            }));
-        },
-        unlinkAccount: async (userId, providerId) => {
-            await prepareAuth();
-            const result = await config.database
-                .prepare("DELETE FROM account WHERE userId = ? AND providerId = ?")
-                .bind(userId, providerId)
-                .run();
-            return (result.meta?.changes ?? 0) > 0;
-        },
-        listUsers: async () => {
-            await prepareAuth();
-            const placeholders = STAFF_ROLES.map(() => "?").join(",");
-            const result = await config.database
-                .prepare(`SELECT id, email, name, role, githubLogin, emailVerified, createdAt FROM user WHERE role IN (${placeholders}) ORDER BY createdAt ASC, id ASC`)
-                .bind(...STAFF_ROLES)
-                .all();
-            return (result.results ?? []).map((row) => ({
-                id: row.id,
-                email: row.email,
-                name: row.name,
-                role: row.role,
-                githubLogin: row.githubLogin,
-                emailVerified: row.emailVerified !== 0,
-                createdAt: new Date(row.createdAt),
-            }));
-        },
-        listMembers: async ({ search, cursor, cursorDirection = "forward", limit }) => {
-            await prepareAuth();
-            const parsedCursor = cursor ? decodeMemberCursor(cursor) : null;
-            const backward = cursorDirection === "backward";
-            const conditions = [
-                `(role IS NULL OR role NOT IN (${STAFF_ROLES.map(() => "?").join(",")}))`,
-            ];
-            const bindings = [...STAFF_ROLES];
-            const term = search?.trim().toLowerCase();
-            if (term) {
-                conditions.push("(LOWER(id) LIKE ? ESCAPE '\\' OR LOWER(name) LIKE ? ESCAPE '\\' OR LOWER(email) LIKE ? ESCAPE '\\')");
-                const like = `%${term.replace(/[\\%_]/g, (character) => `\\${character}`)}%`;
-                bindings.push(like, like, like);
-            }
-            if (parsedCursor) {
-                const operator = backward ? "<" : ">";
-                conditions.push(`(createdAt ${operator} ? OR (createdAt = ? AND id ${operator} ?))`);
-                bindings.push(parsedCursor[0], parsedCursor[0], parsedCursor[1]);
-            }
-            bindings.push(limit + 1);
-            const result = await config.database
-                .prepare(`SELECT id, email, name, emailVerified, createdAt FROM user WHERE ${conditions.join(" AND ")} ORDER BY createdAt ${backward ? "DESC" : "ASC"}, id ${backward ? "DESC" : "ASC"} LIMIT ?`)
-                .bind(...bindings)
-                .all();
-            const rows = (result.results ?? []).slice(0, limit);
-            if (backward)
-                rows.reverse();
-            const items = rows.map((row) => ({
-                id: row.id,
-                email: row.email,
-                name: row.name,
-                emailVerified: row.emailVerified !== 0,
-                createdAt: new Date(row.createdAt),
-            }));
-            const hasMore = (result.results?.length ?? 0) > limit;
-            return {
-                items,
-                previousCursor: (backward ? hasMore : Boolean(parsedCursor)) && rows[0]
-                    ? encodeMemberCursor(rows[0].createdAt, rows[0].id)
-                    : null,
-                nextCursor: (backward ? Boolean(parsedCursor) : hasMore) && rows.at(-1)
-                    ? encodeMemberCursor(rows.at(-1).createdAt, rows.at(-1).id)
-                    : null,
-            };
-        },
-        setUserRole: async (userId, role) => {
-            if (role !== null && !STAFF_ROLE_SET.has(role)) {
-                throw new Error(`setUserRole: '${role}' is not a staff role — expected one of [${STAFF_ROLES.join(", ")}] or null.`);
-            }
-            await prepareAuth();
-            if (config.sessionCacheKv) {
-                const context = await auth.$context;
-                return !!await context.internalAdapter.updateUser(userId, {
-                    role,
-                    updatedAt: new Date(),
-                });
-            }
-            const result = await config.database
-                .prepare("UPDATE user SET role = ?, updatedAt = ? WHERE id = ?")
-                .bind(role, new Date().toISOString(), userId)
-                .run();
-            return (result.meta?.changes ?? 0) > 0;
-        },
-        inviteUser: async (email, role) => {
-            if (!STAFF_ROLE_SET.has(role)) {
-                throw new Error(`inviteUser: '${role}' is not a staff role — expected one of [${STAFF_ROLES.join(", ")}].`);
-            }
-            await prepareAuth();
-            const normalized = email.trim().toLowerCase();
-            const existing = await config.database
-                .prepare("SELECT id FROM user WHERE email = ? LIMIT 1")
-                .bind(normalized)
-                .first();
-            if (existing)
-                return { kind: "exists", id: existing.id };
-            const id = generateUserId();
-            const now = new Date().toISOString();
-            // `name` defaults to the address's local part — Better Auth
-            // requires NOT NULL, and the invitee's real display name arrives
-            // with their first sign-in (social) or stays editable later.
-            await config.database
-                .prepare("INSERT INTO user (id, name, email, emailVerified, createdAt, updatedAt, role) VALUES (?, ?, ?, 0, ?, ?, ?)")
-                .bind(id, normalized.split("@")[0] ?? normalized, normalized, now, now, role)
-                .run();
-            return { kind: "created", id };
-        },
-        ...(config.staffInvitationSender ? {
-            sendStaffInvitation: async (email, role) => {
-                const normalized = email.trim().toLowerCase();
-                await config.staffInvitationSender.send({
-                    to: normalized,
-                    ...staffInvitationEmail(role, new URL("/admin/sign-in", config.baseURL).href),
-                    locale: "en",
-                    category: "auth.staff-invitation",
-                });
-            },
-        } : {}),
-        revokeInvite: async (userId) => {
-            await prepareAuth();
-            const result = await config.database
-                .prepare("DELETE FROM user WHERE id = ? AND emailVerified = 0 AND NOT EXISTS (SELECT 1 FROM account WHERE account.userId = user.id)")
-                .bind(userId)
-                .run();
-            return (result.meta?.changes ?? 0) > 0;
-        },
-        registerOAuthClient: async (input) => {
-            if (!config.oauthProvider) {
-                throw new Error("registerOAuthClient: oauthProvider is not configured.");
-            }
-            await prepareAuth();
-            const created = await api.adminCreateOAuthClient({
-                headers: new Headers(input.requestHeaders),
-                body: {
-                    redirect_uris: [...input.redirectUris],
-                    ...(input.scope ? { scope: input.scope.join(" ") } : {}),
-                    ...(input.clientName ? { client_name: input.clientName } : {}),
-                    ...(input.clientUri ? { client_uri: input.clientUri } : {}),
-                    ...(input.logoUri ? { logo_uri: input.logoUri } : {}),
-                    ...(input.contacts ? { contacts: [...input.contacts] } : {}),
-                    ...(input.tosUri ? { tos_uri: input.tosUri } : {}),
-                    ...(input.policyUri ? { policy_uri: input.policyUri } : {}),
-                    ...(input.postLogoutRedirectUris
-                        ? { post_logout_redirect_uris: [...input.postLogoutRedirectUris] }
-                        : {}),
-                    ...(input.tokenEndpointAuthMethod
-                        ? { token_endpoint_auth_method: input.tokenEndpointAuthMethod }
-                        : {}),
-                    ...(input.grantTypes ? { grant_types: [...input.grantTypes] } : {}),
-                    ...(input.responseTypes ? { response_types: [...input.responseTypes] } : {}),
-                    ...(input.applicationType ? { application_type: input.applicationType } : {}),
-                    ...(input.skipConsent !== undefined ? { skip_consent: input.skipConsent } : {}),
-                    ...(input.enableEndSession !== undefined
-                        ? { enable_end_session: input.enableEndSession }
-                        : {}),
-                    ...(input.requirePKCE !== undefined ? { require_pkce: input.requirePKCE } : {}),
-                    ...(input.subjectType ? { subject_type: input.subjectType } : {}),
-                    ...(input.metadata ? { metadata: input.metadata } : {}),
-                },
-            });
-            return mapRegisteredOAuthClient(created);
-        },
-    };
-}
-/**
- * Safe Auth facade for first-deploy/bootstrap windows where an
- * adopter's public Worker should boot before staff sign-in providers
- * have been provisioned. Auth-gated routes should still be blocked by
- * the consumer; this facade never authenticates anyone.
- */
-export function createSetupIncompleteAuth(options = {}) {
-    const basePath = normalizeAuthBasePath(options.basePath);
-    const message = options.message ?? "Auth is not configured yet.";
-    const response = options.response ??
-        (() => Response.json({ error: "setup_incomplete", message }, { status: 503, headers: { "cache-control": "private, no-store" } }));
-    const auth = {
-        basePath,
-        handler: async () => response(),
-        getSession: async () => null,
-        getUserRole: async () => null,
-        getUser: async () => null,
-        getProviderAccessToken: async () => {
-            throw new Error(message);
-        },
-        verifyOAuthAccessToken: async () => ({
-            ok: false,
-            status: 401,
-            reason: "invalid-token",
-        }),
-        getOAuthConsentRequest: async () => null,
-        completeOAuthConsent: async () => {
-            throw new Error(message);
-        },
-        methods: [],
-        listLinkedAccounts: async () => [],
-        unlinkAccount: async () => false,
-        listUsers: async () => [],
-        listMembers: async () => ({ items: [], previousCursor: null, nextCursor: null }),
-        setUserRole: async () => false,
-        inviteUser: async () => {
-            throw new Error(message);
-        },
-        revokeInvite: async () => false,
-        registerOAuthClient: async () => {
-            throw new Error(message);
-        },
-    };
-    SETUP_INCOMPLETE_AUTHS.add(auth);
-    return auth;
-}
-/** @internal exported to pin the session-bound Better Auth request and
- *  secret-minimizing response mapping. */
-export async function getProviderAccessTokenForRequest(api, request, accountId, providerId) {
-    const value = (await api.getAccessToken({
-        headers: request.headers,
-        body: { accountId },
-    }));
-    if (typeof value?.accessToken !== "string") {
-        throw new Error(`getProviderAccessToken: provider '${providerId}' returned no access token.`);
-    }
-    return {
-        accessToken: value.accessToken,
-        ...(value.accessTokenExpiresAt instanceof Date
-            ? { accessTokenExpiresAt: value.accessTokenExpiresAt }
-            : {}),
-        scopes: Array.isArray(value.scopes)
-            ? value.scopes.filter((scope) => typeof scope === "string")
-            : [],
-    };
-}
-function scopesFromClaim(value) {
-    if (typeof value === "string")
-        return value.split(/\s+/).filter(Boolean);
-    if (Array.isArray(value)) {
-        return value.filter((scope) => typeof scope === "string");
-    }
-    return [];
-}
-function parseStoredStringArray(value) {
-    if (typeof value !== "string")
-        return null;
-    try {
-        const parsed = JSON.parse(value);
-        return Array.isArray(parsed) && parsed.every((item) => typeof item === "string")
-            ? parsed
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
-async function assertActiveUserGrant(database, claims, audience) {
-    const userId = claims["sub"];
-    const clientId = claims["azp"];
-    const sessionId = claims["sid"];
-    const consentId = claims["mantle_consent_id"];
-    if (typeof userId !== "string" ||
-        typeof clientId !== "string" ||
-        typeof sessionId !== "string" ||
-        typeof consentId !== "string" || !consentId) {
-        throw new Error("OAuth token is not bound to a user session.");
-    }
-    const result = await database
-        .prepare("SELECT c.resources, c.scopes FROM oauthConsent AS c " +
-        "JOIN session AS s ON s.id = ? AND s.userId = c.userId AND s.expiresAt > ? " +
-        "WHERE c.id = ? AND c.userId = ? AND c.clientId = ?")
-        .bind(sessionId, new Date().toISOString(), consentId, userId, clientId)
-        .first();
-    const tokenScopes = scopesFromClaim(claims["scope"]);
-    const resources = parseStoredStringArray(result?.resources);
-    const scopes = parseStoredStringArray(result?.scopes);
-    const active = resources?.includes(audience) === true && scopes !== null &&
-        tokenScopes.every((scope) => scopes.includes(scope));
-    if (!active)
-        throw new Error("OAuth authorization grant is no longer active.");
-}
-/** @internal exported to keep same-Worker OAuth verification off the network. */
-export function verifyOAuthJwtWithLocalJwks(token, audience, issuer, jwksFetch, jwksCacheKey) {
-    return verifyJwsAccessToken(token, {
-        jwksFetch,
-        ...(jwksCacheKey ? { jwksCacheKey } : {}),
-        verifyOptions: { audience, issuer },
+    const { database, sessionCacheKv, ...rest } = config;
+    return createMantleAuth({
+        ...rest,
+        database,
+        driver: new D1DatabaseDriver(database),
+        sessionCache: sessionCacheKv ? kvSessionCache(sessionCacheKv) : undefined,
+        ipAddressHeaders: CLOUDFLARE_CLIENT_IP_HEADERS,
     });
 }
-/** @internal exported to pin the stable facade's normalization and
- *  401/403 contract independently of Better Auth network/JWKS I/O. */
-export async function verifyOAuthJwt(tokenOrRequest, options, verify, getDpopReplayStore) {
-    const request = typeof tokenOrRequest === "string" ? null : tokenOrRequest;
-    const authorization = parseAccessTokenAuthorization(request?.headers.get("authorization") ?? `Bearer ${tokenOrRequest}`);
-    const token = authorization?.token;
-    // JWT compact serialization has exactly three non-empty parts.
-    // Reject opaque tokens before any network/JWKS work.
-    if (!verify ||
-        !token ||
-        token.split(".").length !== 3 ||
-        token.split(".").some((part) => part.length === 0)) {
-        return { ok: false, status: 401, reason: "invalid-token" };
-    }
-    try {
-        const claims = await verify(token, options.audience);
-        await enforceDpopBinding({
-            payload: claims,
-            authorization,
-            proofJwt: request?.headers.get("dpop"),
-            method: request?.method ?? "GET",
-            url: request?.url ?? options.audience,
-            ...(request && authorization.scheme === "DPoP" && getDpopReplayStore
-                ? { replayStore: await getDpopReplayStore() }
-                : {}),
-        });
-        if (typeof claims["sub"] !== "string" || claims["sub"].length === 0) {
-            return { ok: false, status: 401, reason: "invalid-token" };
-        }
-        const scopes = scopesFromClaim(claims["scope"]);
-        const missingScopes = (options.scopes ?? []).filter((scope) => !scopes.includes(scope));
-        if (missingScopes.length > 0) {
-            return {
-                ok: false,
-                status: 403,
-                reason: "insufficient-scope",
-                missingScopes,
-            };
-        }
-        return {
-            ok: true,
-            userId: claims["sub"],
-            clientId: typeof claims["azp"] === "string" ? claims["azp"] : null,
-            credentialId: typeof claims["jti"] === "string" ? claims["jti"] : null,
-            scopes,
-        };
-    }
-    catch (error) {
-        if (isDpopBindingError(error)) {
-            return { ok: false, status: 401, reason: "invalid-dpop-proof" };
-        }
-        return { ok: false, status: 401, reason: "invalid-token" };
-    }
-}
-/** @internal exported to pin secret-minimizing DCR response mapping. */
-export function mapRegisteredOAuthClient(value) {
-    const row = value;
-    if (!row.client_id || !Array.isArray(row.redirect_uris)) {
-        throw new Error("registerOAuthClient: Better Auth returned an invalid client.");
-    }
-    return {
-        clientId: row.client_id,
-        ...(row.client_secret && row.token_endpoint_auth_method !== "none"
-            ? { clientSecret: row.client_secret }
-            : {}),
-        redirectUris: row.redirect_uris,
-        ...(row.scope ? { scope: row.scope.split(" ").filter(Boolean) } : {}),
-        ...(row.client_name ? { clientName: row.client_name } : {}),
-        ...(row.client_uri ? { clientUri: row.client_uri } : {}),
-        ...(row.token_endpoint_auth_method
-            ? { tokenEndpointAuthMethod: row.token_endpoint_auth_method }
-            : {}),
-        ...(row.application_type ? { applicationType: row.application_type } : {}),
-    };
-}
-/** Random 32-char alphanumeric id, shaped like Better Auth's own user
- *  ids so invited rows are indistinguishable from organically-created
- *  ones. Modulo bias over 62 symbols is irrelevant here — ids need
- *  uniqueness, not uniform entropy. */
-function generateUserId() {
-    const alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-    const bytes = new Uint8Array(32);
-    crypto.getRandomValues(bytes);
-    let id = "";
-    for (const b of bytes)
-        id += alphabet[b % alphabet.length];
-    return id;
-}
 //# sourceMappingURL=createAuth.js.map