@aotter/mantle-cloudflare 0.1.2 → 0.1.3-alpha.2

package/dist/mount/resolveCaller.d.ts

@@ -1,6 +1,6 @@
 import type { HandlerContext } from "@aotter/mantle-runtime";
 import { type Diagnostic } from "@aotter/mantle-spec";
-import { type Auth } from "../auth/createAuth.js";
+import { type MantleAuth as Auth } from "@aotter/mantle-auth";
 export type ConsumerCredentialResolution = {
     readonly kind: "not-handled";
 } | {
@@ -30,7 +30,11 @@ export interface ResolveCallerOptions {
     };
     readonly env?: unknown;
     readonly waitUntil?: (promise: Promise<unknown>) => void;
+    /** Optional observability wrapper around the two I/O steps: bearer
+     *  verification (`oauth`) and the fresh role read (`role`). */
+    readonly phase?: PhaseHook;
 }
+export type PhaseHook = <T>(phase: "oauth" | "role", run: () => Promise<T>) => Promise<T>;
 export type CallerResolution = {
     readonly kind: "anonymous" | "authenticated";
     readonly context: HandlerContext;
@@ -38,10 +42,36 @@ export type CallerResolution = {
     readonly kind: "invalid";
     readonly status: 401 | 403;
     readonly diagnostic: Diagnostic;
+    /** Verifier reason (e.g. `invalid-dpop-proof`) for transports that render a challenge. */
+    readonly reason: string;
 };
 /** Normalize consumer credentials, OAuth bearer, or cookie session in
  * that precedence order. A presented-but-invalid credential never
  * falls back to a valid session cookie. */
 export declare function resolveCaller(request: Request, options: ResolveCallerOptions): Promise<CallerResolution>;
-export declare function contextForVerifiedUser(userId: string | null, authContext: NonNullable<HandlerContext["auth"]>, auth: Auth, base: Pick<HandlerContext, "env" | "waitUntil">, currentRole?: string | null): Promise<HandlerContext>;
+export declare function contextForVerifiedUser(userId: string | null, authContext: NonNullable<HandlerContext["auth"]>, auth: Auth, base: Pick<HandlerContext, "env" | "waitUntil">, currentRole?: string | null, phase?: PhaseHook): Promise<HandlerContext>;
+/** Which callers a transport surface admits before the target's own `requires` runs. */
+export type SurfacePolicy = "public" | "staff";
+export type CallerGate = {
+    readonly kind: "allow";
+    readonly context: HandlerContext;
+} | {
+    readonly kind: "deny";
+    readonly status: 401 | 403;
+    readonly diagnostic: Diagnostic;
+    /** `invalid-credential`, `invalid-dpop-proof`, `insufficient-scope`, `cross-origin`, `unauthenticated` or `insufficient-role`. */
+    readonly reason: string;
+};
+/**
+ * The one caller gate every transport shares (#977). It resolves identity
+ * through `resolveCaller`, applies the cross-origin guard only when the
+ * credential is a cookie session, and lets `surface` decide exactly one
+ * thing: whether `ctx.staff` is required. `public` admits anonymous callers;
+ * the target's `requires.auth` and guard still run on every invocation, so
+ * enforcement stays where the manifest declares it rather than at the
+ * transport. Transports differ only in how they render a denial.
+ */
+export declare function gateCaller(request: Request, options: ResolveCallerOptions & {
+    readonly surface?: SurfacePolicy;
+}): Promise<CallerGate>;
 //# sourceMappingURL=resolveCaller.d.ts.map

package/dist/mount/resolveCaller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveCaller.d.ts","sourceRoot":"","sources":["../../src/mount/resolveCaller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAEL,KAAK,UAAU,EAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,gBAAgB,CAAC;QAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEN;oEACoE;AACpE,MAAM,MAAM,0BAA0B,GAAG,CACvC,OAAO,EAAE,OAAO,KACb,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAE1E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B;mEAC2D;QAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CAC1D;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC,CAAC;AAEN;;2CAE2C;AAC3C,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CA8E3B;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,EAAE,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAChD,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,WAAW,CAAC,EAC/C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,OAAO,CAAC,cAAc,CAAC,CAczB"}
+{"version":3,"file":"resolveCaller.d.ts","sourceRoot":"","sources":["../../src/mount/resolveCaller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAEL,KAAK,UAAU,EAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAkB,KAAK,UAAU,IAAI,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAG9E,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,gBAAgB,CAAC;QAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEN;oEACoE;AACpE,MAAM,MAAM,0BAA0B,GAAG,CACvC,OAAO,EAAE,OAAO,KACb,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;AAE1E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B;mEAC2D;QAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IACzD;mEAC+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAG1F,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,eAAe,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;2CAE2C;AAC3C,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAuF3B;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,WAAW,EAAE,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAChD,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,WAAW,CAAC,EAC/C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,EAC3B,KAAK,GAAE,SAAqB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAczB;AAuBD,wFAAwF;AACxF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GAC5D;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,kIAAkI;IAClI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAIN;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,oBAAoB,GAAG;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;CAAE,GACnE,OAAO,CAAC,UAAU,CAAC,CAwCrB"}

package/dist/mount/resolveCaller.js

@@ -1,5 +1,7 @@
 import { runtimeDiagnostic, } from "@aotter/mantle-spec";
-import { STAFF_ROLE_SET } from "../auth/createAuth.js";
+import { STAFF_ROLE_SET } from "@aotter/mantle-auth";
+import { rejectCrossOriginMutation } from "@aotter/mantle-admin";
+const runDirect = (_phase, run) => run();
 /** Normalize consumer credentials, OAuth bearer, or cookie session in
  * that precedence order. A presented-but-invalid credential never
  * falls back to a valid session cookie. */
@@ -8,6 +10,7 @@ export async function resolveCaller(request, options) {
         env: options.env ?? {},
         ...(options.waitUntil ? { waitUntil: options.waitUntil } : {}),
     };
+    const phase = options.phase ?? runDirect;
     if (options.credentialResolver) {
         const resolved = await options.credentialResolver(request);
         if (resolved.kind === "invalid")
@@ -21,24 +24,27 @@ export async function resolveCaller(request, options) {
                     credentialId: credential.credentialId,
                     clientId: credential.clientId ?? null,
                     scopes: credential.scopes ?? [],
-                }, options.auth, base),
+                }, options.auth, base, undefined, phase),
             };
         }
     }
     const authorization = request.headers.get("authorization");
     if (authorization !== null) {
-        const token = /^Bearer ([^\s]+)$/i.exec(authorization)?.[1];
+        // Bearer or DPoP (sender-constrained) access tokens; the verifier checks
+        // the proof. MCP clients use DPoP, so the shared gate must admit it.
+        const token = /^(?:Bearer|DPoP) ([^\s]+)$/i.exec(authorization)?.[1];
         if (!token) {
             return invalidCredential(401);
         }
         if (!options.jwtBearer)
             return invalidCredential(401);
-        const verified = await options.auth.verifyOAuthAccessToken(request, {
-            audience: options.jwtBearer.audience,
-            scopes: options.jwtBearer.scopes,
-        });
+        const jwtBearer = options.jwtBearer;
+        const verified = await phase("oauth", () => options.auth.verifyOAuthAccessToken(request, {
+            audience: jwtBearer.audience,
+            scopes: jwtBearer.scopes,
+        }));
         if (!verified.ok)
-            return invalidCredential(verified.status);
+            return invalidCredential(verified.status, verified.reason);
         return {
             kind: "authenticated",
             context: await contextForVerifiedUser(verified.userId, {
@@ -46,7 +52,7 @@ export async function resolveCaller(request, options) {
                 credentialId: verified.credentialId,
                 clientId: verified.clientId,
                 scopes: verified.scopes,
-            }, options.auth, base),
+            }, options.auth, base, undefined, phase),
         };
     }
     const session = await options.auth.getSession(request);
@@ -63,13 +69,13 @@ export async function resolveCaller(request, options) {
             credentialId: session.session.id,
             clientId: null,
             scopes: [],
-        }, options.auth, base, session.user.roleCurrent ? session.user.role ?? null : undefined),
+        }, options.auth, base, session.user.roleCurrent ? session.user.role ?? null : undefined, phase),
     };
 }
-export async function contextForVerifiedUser(userId, authContext, auth, base, currentRole) {
+export async function contextForVerifiedUser(userId, authContext, auth, base, currentRole, phase = runDirect) {
     const role = currentRole !== undefined
         ? currentRole
-        : userId ? await auth.getUserRole(userId) : null;
+        : userId ? await phase("role", () => auth.getUserRole(userId)) : null;
     const staff = userId && role && STAFF_ROLE_SET.has(role)
         ? { id: userId, role: role }
         : null;
@@ -80,10 +86,11 @@ export async function contextForVerifiedUser(userId, authContext, auth, base, cu
         ...base,
     };
 }
-function invalidCredential(status) {
+function invalidCredential(status, reason) {
     return {
         kind: "invalid",
         status,
+        reason: reason ?? (status === 403 ? "insufficient-scope" : "invalid-credential"),
         diagnostic: runtimeDiagnostic({
             code: status === 401 ? "UNAUTHENTICATED" : "AUTH_DENIED",
             severity: "error",
@@ -97,4 +104,55 @@ function invalidCredential(status) {
         }),
     };
 }
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/**
+ * The one caller gate every transport shares (#977). It resolves identity
+ * through `resolveCaller`, applies the cross-origin guard only when the
+ * credential is a cookie session, and lets `surface` decide exactly one
+ * thing: whether `ctx.staff` is required. `public` admits anonymous callers;
+ * the target's `requires.auth` and guard still run on every invocation, so
+ * enforcement stays where the manifest declares it rather than at the
+ * transport. Transports differ only in how they render a denial.
+ */
+export async function gateCaller(request, options) {
+    const caller = await resolveCaller(request, options);
+    if (caller.kind === "invalid") {
+        return { kind: "deny", status: caller.status, diagnostic: caller.diagnostic, reason: caller.reason };
+    }
+    if (caller.context.auth?.credential === "session" && !SAFE_METHODS.has(request.method)) {
+        const rejected = rejectCrossOriginMutation(request);
+        if (rejected) {
+            return {
+                kind: "deny",
+                status: 403,
+                reason: "cross-origin",
+                diagnostic: runtimeDiagnostic({
+                    code: "AUTH_DENIED",
+                    severity: "error",
+                    path: "request:origin",
+                    expected: "a same-origin request when the credential is a cookie session",
+                    message: "Cross-origin session mutation rejected.",
+                }),
+            };
+        }
+    }
+    if (options.surface === "staff" && !caller.context.staff) {
+        const anonymous = caller.kind === "anonymous";
+        return {
+            kind: "deny",
+            status: anonymous ? 401 : 403,
+            reason: anonymous ? "unauthenticated" : "insufficient-role",
+            diagnostic: runtimeDiagnostic({
+                code: anonymous ? "UNAUTHENTICATED" : "AUTH_DENIED",
+                severity: "error",
+                path: "request:surface",
+                expected: "a staff caller on the staff surface",
+                message: anonymous
+                    ? "The staff surface requires a signed-in staff caller."
+                    : "The caller is signed in but holds no staff role.",
+            }),
+        };
+    }
+    return { kind: "allow", context: caller.context };
+}
 //# sourceMappingURL=resolveCaller.js.map

package/dist/mount/resolveCaller.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveCaller.js","sourceRoot":"","sources":["../../src/mount/resolveCaller.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAa,MAAM,uBAAuB,CAAC;AA+ClE;;2CAE2C;AAC3C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,OAA6B;IAE7B,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;QACtB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IAEF,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,MAAM,sBAAsB,CACnC,UAAU,CAAC,MAAM,EACjB;oBACE,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI;oBACrC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE;iBAChC,EACD,OAAO,CAAC,IAAI,EACZ,IAAI,CACL;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE;YAClE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ;YACpC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,MAAM,sBAAsB,CACnC,QAAQ,CAAC,MAAM,EACf;gBACE,UAAU,EAAE,OAAO;gBACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,EACD,OAAO,CAAC,IAAI,EACZ,IAAI,CACL;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE;SAC9C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,MAAM,sBAAsB,CACnC,OAAO,CAAC,IAAI,CAAC,EAAE,EACf;YACE,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAChC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;SACX,EACD,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CACjE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAqB,EACrB,WAAgD,EAChD,IAAU,EACV,IAA+C,EAC/C,WAA2B;IAE3B,MAAM,IAAI,GAAG,WAAW,KAAK,SAAS;QACpC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,KAAK,GACT,MAAM,IAAI,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAiB,EAAE;QACzC,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QACpC,KAAK;QACL,IAAI,EAAE,WAAW;QACjB,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM;QACN,UAAU,EAAE,iBAAiB,CAAC;YAC5B,IAAI,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa;YACxD,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EACN,MAAM,KAAK,GAAG;gBACZ,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,+CAA+C;YACrD,OAAO,EACL,MAAM,KAAK,GAAG;gBACZ,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,wDAAwD;SAC/D,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resolveCaller.js","sourceRoot":"","sources":["../../src/mount/resolveCaller.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAA2B,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAwCjE,MAAM,SAAS,GAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;AAepD;;2CAE2C;AAC3C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,OAA6B;IAE7B,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;QACtB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;IAEzC,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;YACvC,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,MAAM,sBAAsB,CACnC,UAAU,CAAC,MAAM,EACjB;oBACE,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI;oBACrC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE;iBAChC,EACD,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,SAAS,EACT,KAAK,CACN;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE;YACvF,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7E,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,MAAM,sBAAsB,CACnC,QAAQ,CAAC,MAAM,EACf;gBACE,UAAU,EAAE,OAAO;gBACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,EACD,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,SAAS,EACT,KAAK,CACN;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE;SAC9C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,MAAM,sBAAsB,CACnC,OAAO,CAAC,IAAI,CAAC,EAAE,EACf;YACE,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAChC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;SACX,EACD,OAAO,CAAC,IAAI,EACZ,IAAI,EACJ,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,EAChE,KAAK,CACN;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAqB,EACrB,WAAgD,EAChD,IAAU,EACV,IAA+C,EAC/C,WAA2B,EAC3B,QAAmB,SAAS;IAE5B,MAAM,IAAI,GAAG,WAAW,KAAK,SAAS;QACpC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,KAAK,GACT,MAAM,IAAI,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QACxC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAiB,EAAE;QACzC,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QACpC,KAAK;QACL,IAAI,EAAE,WAAW;QACjB,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAiB,EAAE,MAAe;IAC3D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM;QACN,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAChF,UAAU,EAAE,iBAAiB,CAAC;YAC5B,IAAI,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa;YACxD,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EACN,MAAM,KAAK,GAAG;gBACZ,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,+CAA+C;YACrD,OAAO,EACL,MAAM,KAAK,GAAG;gBACZ,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,wDAAwD;SAC/D,CAAC;KACH,CAAC;AACJ,CAAC;AAeD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAgB,EAChB,OAAoE;IAEpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,cAAc;gBACtB,UAAU,EAAE,iBAAiB,CAAC;oBAC5B,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,gBAAgB;oBACtB,QAAQ,EAAE,+DAA+D;oBACzE,OAAO,EAAE,yCAAyC;iBACnD,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC7B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB;YAC3D,UAAU,EAAE,iBAAiB,CAAC;gBAC5B,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa;gBACnD,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,qCAAqC;gBAC/C,OAAO,EAAE,SAAS;oBAChB,CAAC,CAAC,sDAAsD;oBACxD,CAAC,CAAC,kDAAkD;aACvD,CAAC;SACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACpD,CAAC"}

package/dist/worker/createMantleWorker.d.ts

@@ -4,7 +4,7 @@ import type { PublicPathResolver, TemplateRegistry } from "@aotter/mantle-web";
 import { createRuntimeClient } from "@aotter/mantle-web/client-runtime";
 import type { SiteDefaults } from "@aotter/mantle-spec";
 import { type ConventionalAuthEnv } from "../auth/conventionalAuth.js";
-import type { Auth } from "../auth/createAuth.js";
+import type { MantleAuth as Auth } from "@aotter/mantle-auth";
 import { type MantleWorkerBindings } from "../bindings/conventionalBindings.js";
 import { type CloudflareMantleRuntime, type MantleRuntimeRef } from "../mount/bootRuntimeOnce.js";
 import type { MantleCloudflareConfig } from "../mount/cmsConfig.js";

package/dist/worker/createMantleWorker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createMantleWorker.d.ts","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,KAAK,GAAG,IAAI,OAAO,EACnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACvB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAKpE,OAAO,EAAiB,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAO3F,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,8EAOhC,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,EAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,sBAAuB,CAAC;AAEhE,KAAK,cAAc,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,KAAK,aAAa,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,KAAK,YAAY,GACb,aAAa,GACb,cAAc,GACd,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,GAC9C,GAAG,OAAO,iCAAiC,GAAG,MAAM,EAAE,CAAC;AAE3D,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,CAAC,IAAI,SAAS,MAAM,IAAI,MAAM,SAAS,IAAI,GACtE,IAAI,GACJ,IAAI,SAAS,YAAY,GACvB,KAAK,GACL,IAAI,CAAC;AAEX,KAAK,aAAa,CAAC,QAAQ,SAAS,MAAM,IAAI;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AACrE,KAAK,gBAAgB,CAAC,QAAQ,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAC9D,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GACtC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,KAAK,QAAQ,CAAC,IAAI,SAAS,MAAM,IAAI,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACtE,KAAK,cAAc,CAAC,QAAQ,SAAS,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EACvE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,KACnF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,GACrF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,GACrH,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,MAAM,SAAS,OAAO,EACrD,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAChB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B,CAAC,GAAG,SAAS,mBAAmB;IAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB,CAAC,GAAG,SAAS,mBAAmB,CACvE,SAAQ,4BAA4B,CAAC,GAAG,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,yBAAyB,CAAC,GAAG,SAAS,mBAAmB;IACxE,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACpE,mFAAmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;IACtD,iFAAiF;IACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;IACjF,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;QAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;QAClB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;QACxD,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;KACzC,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,oBAAoB,KAC/B,oBAAoB,CAAC;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,KACvC,qBAAqB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB,CAAC,GAAG,SAAS,mBAAmB;IAClE;6EACyE;IACzE,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAYD,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB,EACtF,OAAO,EAAE,yBAAyB,CAAC,GAAG,CAAC,GACtC,mBAAmB,CAAC,GAAG,CAAC,CAqJ1B;AAaD,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAqBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,SAAc,GAAG,OAAO,CAKtF"}
+{"version":3,"file":"createMantleWorker.d.ts","sourceRoot":"","sources":["../../src/worker/createMantleWorker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,EACJ,KAAK,GAAG,IAAI,OAAO,EACnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACvB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAKpE,OAAO,EAAiB,KAAK,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAO3F,mEAAmE;AACnE,eAAO,MAAM,6BAA6B,8EAOhC,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,iCAAiC,EAAG,oBAA6B,CAAC;AAE/E,oDAAoD;AACpD,eAAO,MAAM,2BAA2B,sBAAuB,CAAC;AAEhE,KAAK,cAAc,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,KAAK,aAAa,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,KAAK,YAAY,GACb,aAAa,GACb,cAAc,GACd,GAAG,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,GAC9C,GAAG,OAAO,iCAAiC,GAAG,MAAM,EAAE,CAAC;AAE3D,mFAAmF;AACnF,MAAM,MAAM,mBAAmB,CAAC,IAAI,SAAS,MAAM,IAAI,MAAM,SAAS,IAAI,GACtE,IAAI,GACJ,IAAI,SAAS,YAAY,GACvB,KAAK,GACL,IAAI,CAAC;AAEX,KAAK,aAAa,CAAC,QAAQ,SAAS,MAAM,IAAI;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AACrE,KAAK,gBAAgB,CAAC,QAAQ,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAC9D,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GACtC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AACrD,KAAK,QAAQ,CAAC,IAAI,SAAS,MAAM,IAAI,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACtE,KAAK,cAAc,CAAC,QAAQ,SAAS,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EACvE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,KACnF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACvC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAClC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,GACrF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,QAAQ,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,GACrH,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChC,KAAK,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,MAAM,SAAS,OAAO,EACrD,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EACpB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAChB,kBAAkB,CAAC,QAAQ,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC;CAClC;AAED,MAAM,WAAW,4BAA4B,CAAC,GAAG,SAAS,mBAAmB;IAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB,CAAC,GAAG,SAAS,mBAAmB,CACvE,SAAQ,4BAA4B,CAAC,GAAG,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;CAChC;AAED,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,yBAAyB,CAAC,GAAG,SAAS,mBAAmB;IACxE,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,YAAY,CAAC,CAAC;IACpE,mFAAmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;IACtD,iFAAiF;IACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,SAAS,MAAM,EAAE,CAAC,CAAC;IACjF,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;QAC9C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;QAClB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;QACxD,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;KACzC,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,GAAG,EAAE,GAAG,EACR,YAAY,EAAE,oBAAoB,KAC/B,oBAAoB,CAAC;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,KACvC,qBAAqB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB,CAAC,GAAG,SAAS,mBAAmB;IAClE;6EACyE;IACzE,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACvD,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAYD,8DAA8D;AAC9D,wBAAgB,kBAAkB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB,EACtF,OAAO,EAAE,yBAAyB,CAAC,GAAG,CAAC,GACtC,mBAAmB,CAAC,GAAG,CAAC,CAqJ1B;AAaD,uFAAuF;AACvF,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GACtC,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAqBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,SAAc,GAAG,OAAO,CAKtF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aotter/mantle-cloudflare",
-  "version": "0.1.2",
+  "version": "0.1.3-alpha.2",
   "description": "Cloudflare Workers adapter for Mantle runtime, Admin, MCP, and public Web mounts.",
   "license": "Apache-2.0",
   "homepage": "https://mantle.tools/",
@@ -33,13 +33,11 @@
     "README.md"
   ],
   "dependencies": {
-    "@better-auth/cimd": "1.7.2",
-    "@better-auth/mcp": "1.7.2",
-    "@better-auth/oauth-provider": "1.7.2",
-    "@aotter/mantle-admin": "0.1.2",
-    "@aotter/mantle-runtime": "0.1.2",
-    "@aotter/mantle-spec": "0.1.2",
-    "@aotter/mantle-web": "0.1.2"
+    "@aotter/mantle-admin": "0.1.3-alpha.2",
+    "@aotter/mantle-runtime": "0.1.3-alpha.2",
+    "@aotter/mantle-spec": "0.1.3-alpha.2",
+    "@aotter/mantle-web": "0.1.3-alpha.2",
+    "@aotter/mantle-auth": "0.1.3-alpha.2"
   },
   "peerDependencies": {
     "aws4fetch": "^1.0.20",

package/dist/auth/ConsoleEmailSender.d.ts

@@ -1,15 +0,0 @@
-import type { EmailSender, EmailSendArgs } from "@aotter/mantle-runtime";
-/**
- * Dev convenience: writes the email to `console.log` instead of
- * sending it. Use this in `wrangler dev` to read OTP codes off the
- * Worker logs without wiring a real sender.
- *
- * **Never wire this in production.** Boot diagnostics will not stop
- * you — Better Auth is happy to call `sender.send()` either way —
- * but real recipients won't get the email. Wrap in an env-gated
- * factory at the adapter wiring site.
- */
-export declare class ConsoleEmailSender implements EmailSender {
-    send(args: EmailSendArgs): Promise<void>;
-}
-//# sourceMappingURL=ConsoleEmailSender.d.ts.map

package/dist/auth/ConsoleEmailSender.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ConsoleEmailSender.d.ts","sourceRoot":"","sources":["../../src/auth/ConsoleEmailSender.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IAC9C,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ/C"}

package/dist/auth/ConsoleEmailSender.js

@@ -1,19 +0,0 @@
-/**
- * Dev convenience: writes the email to `console.log` instead of
- * sending it. Use this in `wrangler dev` to read OTP codes off the
- * Worker logs without wiring a real sender.
- *
- * **Never wire this in production.** Boot diagnostics will not stop
- * you — Better Auth is happy to call `sender.send()` either way —
- * but real recipients won't get the email. Wrap in an env-gated
- * factory at the adapter wiring site.
- */
-export class ConsoleEmailSender {
-    async send(args) {
-        const { to, subject, text, locale, category } = args;
-        console.log(`[ConsoleEmailSender] ${category ?? "email"} → ${to} (${locale})\n` +
-            `  subject: ${subject}\n` +
-            `  body: ${text}`);
-    }
-}
-//# sourceMappingURL=ConsoleEmailSender.js.map

package/dist/auth/ConsoleEmailSender.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ConsoleEmailSender.js","sourceRoot":"","sources":["../../src/auth/ConsoleEmailSender.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAC7B,KAAK,CAAC,IAAI,CAAC,IAAmB;QAC5B,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,wBAAwB,QAAQ,IAAI,OAAO,MAAM,EAAE,KAAK,MAAM,KAAK;YACjE,cAAc,OAAO,IAAI;YACzB,WAAW,IAAI,EAAE,CACpB,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/appleClientSecret.d.ts

@@ -1,72 +0,0 @@
-/**
- * Helper for the Sign In with Apple `clientSecret` field.
- *
- * Apple's "client secret" is **not** an OAuth client secret — it is
- * an ES256-signed JWT the relying party generates from:
- *
- *   - Team ID  (Apple Developer team identifier, 10 chars)
- *   - Key ID   (the Sign-In key id, 10 chars; visible in Apple Developer)
- *   - Private key (the `.p8` file Apple lets you download once)
- *   - Audience (typically the Services ID — same as the Better Auth
- *     `clientId` you pass for `provider: "apple"`)
- *
- * The JWT lives at most 180 days per Apple's policy. This helper
- * defaults to 30 days; **the adopter is responsible for regenerating
- * the JWT before it expires** (e.g. on deploy, or via a scheduled
- * worker). A long-lived Cloudflare isolate can outlive the default,
- * and Apple will reject signin attempts with an expired secret —
- * don't rely on isolate restart cadence for rotation.
- *
- * Built on `crypto.subtle` (native to Workers) — no `node:crypto`, no
- * JWT deps.
- *
- * # Adopter usage
- *
- * ```ts
- * const appleSecret = await appleClientSecret({
- *   teamId: env.APPLE_TEAM_ID,
- *   keyId: env.APPLE_KEY_ID,
- *   privateKey: env.APPLE_PRIVATE_KEY,  // contents of the .p8 file
- *   audience: env.APPLE_SERVICES_ID,    // your Services ID
- * });
- * const auth = createAuth({
- *   methods: [{
- *     kind: "social",
- *     provider: "apple",
- *     options: {
- *       clientId: env.APPLE_SERVICES_ID,
- *       clientSecret: appleSecret,
- *     },
- *   }],
- *   // ...
- * });
- * ```
- *
- * `env.APPLE_PRIVATE_KEY` is the multi-line PEM contents of the `.p8`
- * file (set via `wrangler secret put APPLE_PRIVATE_KEY` — paste the
- * whole file when prompted). The helper also accepts the bare
- * base64-encoded DER if the PEM wrapping doesn't survive your secret
- * pipeline.
- */
-export interface AppleClientSecretArgs {
-    /** Apple Developer team identifier (10 chars). */
-    readonly teamId: string;
-    /** Sign-In key id (10 chars). */
-    readonly keyId: string;
-    /**
-     * `.p8` file contents — either PEM-wrapped
-     * (`-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----`)
-     * or just the base64 of the DER.
-     */
-    readonly privateKey: string;
-    /** Typically the Services ID — same string you pass for `clientId`. */
-    readonly audience: string;
-    /**
-     * JWT lifetime in seconds. Apple caps at 180 days
-     * (`180 * 24 * 60 * 60 = 15552000`); the default here is 30 days.
-     * The helper rejects values above Apple's cap.
-     */
-    readonly expiresInSeconds?: number;
-}
-export declare function appleClientSecret(args: AppleClientSecretArgs): Promise<string>;
-//# sourceMappingURL=appleClientSecret.d.ts.map

package/dist/auth/appleClientSecret.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"appleClientSecret.d.ts","sourceRoot":"","sources":["../../src/auth/appleClientSecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAMD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAoCjB"}

package/dist/auth/appleClientSecret.js

@@ -1,113 +0,0 @@
-/**
- * Helper for the Sign In with Apple `clientSecret` field.
- *
- * Apple's "client secret" is **not** an OAuth client secret — it is
- * an ES256-signed JWT the relying party generates from:
- *
- *   - Team ID  (Apple Developer team identifier, 10 chars)
- *   - Key ID   (the Sign-In key id, 10 chars; visible in Apple Developer)
- *   - Private key (the `.p8` file Apple lets you download once)
- *   - Audience (typically the Services ID — same as the Better Auth
- *     `clientId` you pass for `provider: "apple"`)
- *
- * The JWT lives at most 180 days per Apple's policy. This helper
- * defaults to 30 days; **the adopter is responsible for regenerating
- * the JWT before it expires** (e.g. on deploy, or via a scheduled
- * worker). A long-lived Cloudflare isolate can outlive the default,
- * and Apple will reject signin attempts with an expired secret —
- * don't rely on isolate restart cadence for rotation.
- *
- * Built on `crypto.subtle` (native to Workers) — no `node:crypto`, no
- * JWT deps.
- *
- * # Adopter usage
- *
- * ```ts
- * const appleSecret = await appleClientSecret({
- *   teamId: env.APPLE_TEAM_ID,
- *   keyId: env.APPLE_KEY_ID,
- *   privateKey: env.APPLE_PRIVATE_KEY,  // contents of the .p8 file
- *   audience: env.APPLE_SERVICES_ID,    // your Services ID
- * });
- * const auth = createAuth({
- *   methods: [{
- *     kind: "social",
- *     provider: "apple",
- *     options: {
- *       clientId: env.APPLE_SERVICES_ID,
- *       clientSecret: appleSecret,
- *     },
- *   }],
- *   // ...
- * });
- * ```
- *
- * `env.APPLE_PRIVATE_KEY` is the multi-line PEM contents of the `.p8`
- * file (set via `wrangler secret put APPLE_PRIVATE_KEY` — paste the
- * whole file when prompted). The helper also accepts the bare
- * base64-encoded DER if the PEM wrapping doesn't survive your secret
- * pipeline.
- */
-const DEFAULT_EXPIRES_IN_SECONDS = 30 * 24 * 60 * 60; // 30 days
-const APPLE_MAX_EXPIRES_IN_SECONDS = 180 * 24 * 60 * 60; // 180 days
-const APPLE_TOKEN_AUDIENCE_ISSUER = "https://appleid.apple.com";
-export async function appleClientSecret(args) {
-    const expiresIn = args.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS;
-    if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-        // `Number.isFinite` filters NaN / Infinity — without it, NaN slips
-        // through `<= 0` and lands as `exp: NaN` → JSON serialises null
-        // → Apple rejects opaquely. Catch at the boundary with a clear msg.
-        throw new Error("appleClientSecret: expiresInSeconds must be a positive finite number");
-    }
-    if (expiresIn > APPLE_MAX_EXPIRES_IN_SECONDS) {
-        throw new Error(`appleClientSecret: expiresInSeconds ${expiresIn} exceeds Apple's 180-day max (${APPLE_MAX_EXPIRES_IN_SECONDS}).`);
-    }
-    const now = Math.floor(Date.now() / 1000);
-    const header = { alg: "ES256", kid: args.keyId };
-    const payload = {
-        iss: args.teamId,
-        iat: now,
-        exp: now + expiresIn,
-        aud: APPLE_TOKEN_AUDIENCE_ISSUER,
-        sub: args.audience,
-    };
-    const headerB64 = base64UrlEncode(textEncoder.encode(JSON.stringify(header)));
-    const payloadB64 = base64UrlEncode(textEncoder.encode(JSON.stringify(payload)));
-    const signingInput = `${headerB64}.${payloadB64}`;
-    const key = await importApplePrivateKey(args.privateKey);
-    const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key, textEncoder.encode(signingInput));
-    return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
-}
-const textEncoder = new TextEncoder();
-const PEM_MARKERS_RE = /-----(?:BEGIN|END) [^-]+-----/g;
-async function importApplePrivateKey(input) {
-    const der = decodePrivateKeyToDer(input);
-    return crypto.subtle.importKey("pkcs8", der, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
-}
-function decodePrivateKeyToDer(input) {
-    // Strip PEM markers + all whitespace; tolerate the bare-base64 path too.
-    const body = input.replace(PEM_MARKERS_RE, "").replace(/\s+/g, "");
-    if (body.length === 0) {
-        throw new Error("appleClientSecret: privateKey is empty after stripping the PEM wrapper.");
-    }
-    try {
-        return base64ToBytes(body);
-    }
-    catch {
-        throw new Error("appleClientSecret: privateKey is not valid base64 — paste the contents of your .p8 file (PEM or base64).");
-    }
-}
-function base64UrlEncode(bytes) {
-    let bin = "";
-    for (let i = 0; i < bytes.length; i++)
-        bin += String.fromCharCode(bytes[i]);
-    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64ToBytes(b64) {
-    const bin = atob(b64);
-    const out = new Uint8Array(bin.length);
-    for (let i = 0; i < bin.length; i++)
-        out[i] = bin.charCodeAt(i);
-    return out;
-}
-//# sourceMappingURL=appleClientSecret.js.map

package/dist/auth/appleClientSecret.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appleClientSecret.js","sourceRoot":"","sources":["../../src/auth/appleClientSecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAuBH,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAChE,MAAM,4BAA4B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AACpE,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEhE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,4BAA4B,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,uCAAuC,SAAS,iCAAiC,4BAA4B,IAAI,CAClH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,SAAS;QACpB,GAAG,EAAE,2BAA2B;QAChC,GAAG,EAAE,IAAI,CAAC,QAAQ;KACnB,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,eAAe,CAChC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAC5C,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CACjC,CAAC;IACF,OAAO,GAAG,YAAY,IAAI,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,KAAK,UAAU,qBAAqB,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,OAAO,EACP,GAAG,EACH,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,yEAAyE;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/auth/emailTemplates.d.ts

@@ -1,7 +0,0 @@
-import type { EmailSendArgs } from "@aotter/mantle-runtime";
-type EmailContent = Pick<EmailSendArgs, "subject" | "text">;
-export declare function signInCodeEmail(code: string): EmailContent;
-export declare function signInLinkEmail(url: string): EmailContent;
-export declare function staffInvitationEmail(role: string, signInUrl: string): EmailContent;
-export {};
-//# sourceMappingURL=emailTemplates.d.ts.map

package/dist/auth/emailTemplates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"emailTemplates.d.ts","sourceRoot":"","sources":["../../src/auth/emailTemplates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,KAAK,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAS5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAK1D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAMzD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAMlF"}

package/dist/auth/emailTemplates.js

@@ -1,27 +0,0 @@
-function englishEmail(subject, lines) {
-    return {
-        subject,
-        text: `${lines.join("\n\n")}\n\nIf you did not expect this email, you can ignore it.`,
-    };
-}
-export function signInCodeEmail(code) {
-    return englishEmail(`Your Mantle sign-in code: ${code}`, [
-        `Your one-time code is ${code}.`,
-        "It expires shortly.",
-    ]);
-}
-export function signInLinkEmail(url) {
-    return englishEmail("Your Mantle sign-in link", [
-        "Use this link to sign in:",
-        url,
-        "The link expires shortly.",
-    ]);
-}
-export function staffInvitationEmail(role, signInUrl) {
-    return englishEmail("You have been invited to Mantle", [
-        `You now have ${role} access to Mantle.`,
-        "Sign in with this email address to accept the invitation:",
-        signInUrl,
-    ]);
-}
-//# sourceMappingURL=emailTemplates.js.map

package/dist/auth/emailTemplates.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"emailTemplates.js","sourceRoot":"","sources":["../../src/auth/emailTemplates.ts"],"names":[],"mappings":"AAIA,SAAS,YAAY,CAAC,OAAe,EAAE,KAAwB;IAC7D,OAAO;QACL,OAAO;QACP,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,0DAA0D;KACtF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,YAAY,CAAC,6BAA6B,IAAI,EAAE,EAAE;QACvD,yBAAyB,IAAI,GAAG;QAChC,qBAAqB;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,YAAY,CAAC,0BAA0B,EAAE;QAC9C,2BAA2B;QAC3B,GAAG;QACH,2BAA2B;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAiB;IAClE,OAAO,YAAY,CAAC,iCAAiC,EAAE;QACrD,gBAAgB,IAAI,oBAAoB;QACxC,2DAA2D;QAC3D,SAAS;KACV,CAAC,CAAC;AACL,CAAC"}