@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.1

package/dist/auth/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../src/auth/methods.ts"],"names":[],"mappings":"AAAA,sIAAsI;AACtI,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAInF,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAoB,MAAM,YAAY,CAAC;AAC9G,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAc1E;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,GACzC,SAAS,MAAM,EAAE,CAWnB;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAO3F;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiBzE;AAwBD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,iBAAiB,CAAC,iBAAiB,CAAC,CAyBtC;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,kBAAkB,EAAE,CA0BtB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK7E;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA3BjF,CAAC;;;;;;;;;yBAKK,CAAC;yBACN,CAAC;;;;;;;;;;EAyCd;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,EACxD,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAvBd,CAAF;;;;;;;;;;;;qBAMkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAqFjB,CAAA;iCAAkD,CAAC;;;;;;;;;6BAMlB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAsCjB,CAAC;iCACM,CAAC;;;;;;;;;6BAS2B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA7I5D;AAID,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,OAAO,GAAE,aAAa,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAM,GACnD,OAAO,CAGT;AAED,gFAAgF;AAChF,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,IAAI,CAcN;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7E,OAAO,CAQT;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD,GAAG,IAAI,CAAC;AAET,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAAG,SAAS,CAY/D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,gBAAgB,CAAC,MAAM,CAAC,EAC9D,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,GAAG,SAAS,CAUpD;AAeD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,UAAU,GAAE,aAAa,CAAC,MAAM,CAAM,GACrC,MAAM,EAAE,CAKV;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,OAAO,CAET;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,GAC1B,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CA+CrC"}

package/dist/auth/methods.js

@@ -0,0 +1,321 @@
+import { splitSetCookieHeader } from "better-auth/cookies";
+import { emailOTP, magicLink } from "better-auth/plugins";
+import { signInCodeEmail, signInLinkEmail } from "./emailTemplates.js";
+export function normalizeAuthBasePath(basePath) {
+    if (basePath === undefined)
+        return "/api/auth";
+    const trimmed = basePath.trim();
+    if (trimmed === "")
+        return "/api/auth";
+    if (!trimmed.startsWith("/")) {
+        throw new Error("createMantleAuth: basePath must start with '/'.");
+    }
+    if (trimmed === "/") {
+        throw new Error("createMantleAuth: basePath must not be '/'.");
+    }
+    if (trimmed.endsWith("/")) {
+        return trimmed.replace(/\/+$/, "");
+    }
+    return trimmed;
+}
+/** @internal exported for unit tests; not part of the public API. */
+export function resolveClientIpHeaders(headers) {
+    const resolved = (headers ?? [])
+        .map((header) => header.trim())
+        .filter((header) => header.length > 0);
+    if (resolved.length === 0) {
+        throw new Error("createMantleAuth: ipAddressHeaders is required and must name at least one host-trusted ingress header. " +
+            "Do not default to client-controlled X-Forwarded-For. Host adapters must pass the header(s) their ingress overwrites.");
+    }
+    return resolved;
+}
+export function normalizeAuthErrorURL(errorURL, baseURL) {
+    const base = new URL(baseURL);
+    const resolved = new URL(errorURL ?? "/", base);
+    if (resolved.origin !== base.origin) {
+        throw new Error("createMantleAuth: errorURL must be same-origin with baseURL.");
+    }
+    return `${resolved.pathname}${resolved.search}`;
+}
+export function normalizeAuthResponseCookies(response) {
+    const setCookie = response.headers.get("set-cookie");
+    if (!setCookie)
+        return response;
+    const values = response.headers.getSetCookie?.() ??
+        [setCookie];
+    const cookies = values.flatMap(splitSetCookieHeader);
+    if (cookies.length < 2)
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete("set-cookie");
+    for (const cookie of cookies)
+        headers.append("set-cookie", cookie);
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+function withGithubLogin(options) {
+    return typeof options === "function"
+        ? async () => withGithubLoginMapper(await options())
+        : withGithubLoginMapper(options);
+}
+function withGithubLoginMapper(options) {
+    const developerMapper = options.mapProfileToUser;
+    return {
+        ...options,
+        mapProfileToUser: async (profile) => ({
+            ...(developerMapper ? await developerMapper(profile) : {}),
+            githubLogin: profile.login,
+        }),
+    };
+}
+export function buildSocialProviders(methods) {
+    const out = {};
+    // Duplicate-provider guard: catch the case where two `social`
+    // methods declare the same `provider` id. Better Auth would
+    // silently keep the latter (Record overwrite); for SDK adopters —
+    // and especially for the upcoming feature-overlay path where a
+    // feature can contribute auth methods into the same starter's
+    // `methods[]` array — that silent overwrite is a footgun. Throw at
+    // construction with a clear message so the conflict surfaces
+    // before the first sign-in.
+    const seenProviders = new Set();
+    for (const method of methods) {
+        if (method.kind !== "social")
+            continue;
+        if (seenProviders.has(method.provider)) {
+            throw new Error(`createMantleAuth: social provider '${method.provider}' is registered more than once; ` +
+                `each provider can have only one methods[] entry. Remove the redundant entry or pick a different provider.`);
+        }
+        seenProviders.add(method.provider);
+        out[method.provider] = method.provider === "github"
+            ? withGithubLogin(method.options)
+            : method.options;
+    }
+    return out;
+}
+export function buildGenericOAuthProviders(methods) {
+    const seenProviderIds = new Set();
+    const socialProviderIds = new Set(methods.flatMap((method) => method.kind === "social" ? [method.provider] : []));
+    const out = [];
+    for (const method of methods) {
+        if (method.kind !== "oauth")
+            continue;
+        if (socialProviderIds.has(method.options.providerId)) {
+            throw new Error(`createMantleAuth: OAuth providerId '${method.options.providerId}' conflicts with a registered social provider id. Provider ids must be unique across methods[].`);
+        }
+        if (seenProviderIds.has(method.options.providerId)) {
+            throw new Error(`createMantleAuth: OAuth provider '${method.options.providerId}' is registered more than once; ` +
+                `each providerId can have only one methods[] entry.`);
+        }
+        seenProviderIds.add(method.options.providerId);
+        if (!method.options.discoveryUrl && !(method.options.authorizationUrl && method.options.tokenUrl)) {
+            throw new Error(`createMantleAuth: OAuth provider '${method.options.providerId}' needs either discoveryUrl or both authorizationUrl and tokenUrl.`);
+        }
+        out.push(method.options);
+    }
+    return out;
+}
+/**
+ * First tag off `Accept-Language`, quality values ignored. Locale
+ * contract lives in `EmailSender.ts`.
+ */
+export function pickLocale(req, fallback) {
+    const header = req?.headers.get("accept-language");
+    if (!header)
+        return fallback;
+    const first = header.split(",")[0]?.split(";")[0]?.trim();
+    return first && first.length > 0 ? first : fallback;
+}
+const MAGIC_LINK_DEFAULT_EXPIRES_SECONDS = 900;
+export function buildMagicLinkPlugin(method) {
+    const fallback = method.fallbackLocale ?? "en";
+    return magicLink({
+        storeToken: "hashed",
+        expiresIn: MAGIC_LINK_DEFAULT_EXPIRES_SECONDS,
+        ...method.options,
+        // Returned synchronously — same fire-and-forget contract as
+        // email-otp via `advanced.backgroundTasks.handler`. The body
+        // carries the click-URL; SDK doesn't ship a template, the
+        // sender can render plain text or richer HTML.
+        sendMagicLink: (data, ctx) => {
+            const locale = pickLocale(ctx?.request, fallback);
+            return method.sender.send({
+                to: data.email,
+                ...signInLinkEmail(data.url),
+                locale,
+                category: "auth.magic-link.sign-in",
+            });
+        },
+    });
+}
+export function buildEmailOTPPlugin(method, secret) {
+    const fallback = method.fallbackLocale ?? "en";
+    return emailOTP({
+        storeOTP: { hash: (otp) => hashEmailOtp(secret, otp) },
+        ...method.options,
+        // Return synchronously — the promise is fire-and-forget via the
+        // `advanced.backgroundTasks.handler` we wire in `buildAuth`. For
+        // `email-verification` / `forget-password` types Better Auth only
+        // calls this when the user exists, so awaiting would leak account
+        // existence through response latency. See Better Auth's own
+        // sendVerificationOTP docstring + reviewer finding in PR #161.
+        sendVerificationOTP: (data, ctx) => {
+            const locale = pickLocale(ctx?.request, fallback);
+            return method.sender.send({
+                to: data.email,
+                ...signInCodeEmail(data.otp),
+                locale,
+                category: `auth.email-otp.${data.type}`,
+            });
+        },
+    });
+}
+const EMAIL_AUTH_PLUGIN_IDS = new Set(["email-otp", "magic-link"]);
+/** Exported for the adapters' unit tests; not part of the supported API. */
+export function hasEmailAuthSurface(methods, plugins = []) {
+    return methods.some((method) => method.kind === "email-otp" || method.kind === "magic-link")
+        || plugins.some((plugin) => EMAIL_AUTH_PLUGIN_IDS.has(plugin.id));
+}
+/** HMAC-SHA-256(secret, otp) as unpadded base64url. Exported for tests only. */
+export async function hashEmailOtp(secret, otp) {
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(otp)));
+    let binary = "";
+    for (const byte of mac)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
+}
+/**
+ * Cross-check bootstrap rule against registered methods. Catches the
+ * silent-no-op case where the rule's discriminator can never match
+ * any signal a registered method actually produces — e.g.
+ * `match: "github-login"` with no `github` provider registered. Throws
+ * at construction so vibe-coders see the mistake before the first
+ * sign-in attempt.
+ *
+ * `match: "email"` is permissive — every Better Auth method that
+ * creates a user populates `email`, including GitHub (via the
+ * upstream profile). No registration constraint to enforce.
+ */
+export function validateBootstrap(rule, methods) {
+    if (rule.match === "github-login") {
+        const hasGithub = methods.some((method) => (method.kind === "social" && method.provider === "github") ||
+            (method.kind === "oauth" && method.options.providerId === "github"));
+        if (!hasGithub) {
+            throw new Error("createMantleAuth: bootstrapOwner.match='github-login' but no GitHub provider is registered. " +
+                "Register social GitHub or a trusted OAuth providerId='github', or switch to email matching.");
+        }
+    }
+}
+export function shouldPromoteToOwner(rule, user) {
+    const target = rule.value.trim().toLowerCase();
+    switch (rule.match) {
+        case "github-login":
+            return !!user.githubLogin && user.githubLogin.toLowerCase() === target;
+        case "email":
+            return !!user.email && user.email.toLowerCase() === target;
+    }
+}
+/** Keep provider-owned GitHub logins off user-controlled auth paths. */
+export function guardGithubLoginProfile(user, context, methods) {
+    if (!("githubLogin" in user))
+        return undefined;
+    const providerId = context?.path === "/callback/:id" ? context.params?.id : null;
+    const trusted = typeof providerId === "string" && methods.some((method) => method.kind === "social"
+        ? context?.path === "/callback/:id" && method.provider === "github" && providerId === "github"
+        : method.kind === "oauth" &&
+            context?.path === "/callback/:id" &&
+            method.options.providerId === providerId &&
+            Boolean(method.options.mapProfileToUser));
+    return trusted ? undefined : { data: { githubLogin: null } };
+}
+/**
+ * Find the at-most-one method of `kind`. Throws when adopters register
+ * the same kind twice — Better Auth's plugin layer accepts duplicates
+ * silently, which would mask the intent at boot. One helper covers
+ * every singleton-shaped method (email-otp, magic-link, future ones).
+ */
+export function pickSingleton(methods, kind) {
+    const matches = methods.filter((m) => m.kind === kind);
+    if (matches.length > 1) {
+        throw new Error(`createMantleAuth: more than one \`${kind}\` method registered. Combine into one.`);
+    }
+    return matches[0];
+}
+/**
+ * Origins each registered social provider needs in
+ * `trustedOrigins`. Adding a provider that demands an extra
+ * `trustedOrigins` entry = adding a row here. Apple is the only one
+ * in 1.6.9 that hard-requires this; if Better Auth ever drops the
+ * requirement, the entry stays harmless (Better Auth dedupes).
+ */
+const SOCIAL_PROVIDER_TRUSTED_ORIGINS = {
+    apple: ["https://appleid.apple.com"],
+};
+export function buildTrustedOriginsFor(methods, configured = []) {
+    const origins = methods.flatMap((m) => m.kind === "social" ? SOCIAL_PROVIDER_TRUSTED_ORIGINS[m.provider] ?? [] : []);
+    return [...new Set([...origins, ...configured])];
+}
+/**
+ * Apple uses `response_mode=form_post` — Apple POSTs cross-site to
+ * our callback. The OAuth state cookie must have `sameSite: "none"`
+ * (and `secure: true`, which browsers require alongside) or the
+ * cookie won't ride the POST and Better Auth raises a state mismatch.
+ * Other providers don't need this. We only auto-set when Apple is
+ * registered AND the adopter hasn't already specified
+ * `defaultCookieAttributes.sameSite` themselves.
+ */
+export function methodsRequireSameSiteNone(methods) {
+    return methods.some((m) => m.kind === "social" && m.provider === "apple");
+}
+export function buildOAuthProviderOptions(config) {
+    return {
+        loginPage: config.loginPage,
+        consentPage: config.consentPage,
+        ...(config.scopes ? { scopes: [...config.scopes] } : {}),
+        ...(config.resources
+            ? { resources: [...config.resources] }
+            : {}),
+        ...(config.clientRegistrationDefaultResources
+            ? { clientRegistrationDefaultResources: [...config.clientRegistrationDefaultResources] }
+            : {}),
+        ...(config.mcpResource
+            ? {
+                clientRegistrationClientSecretExpiration: "90d",
+                allowPublicClientPrelogin: true,
+            }
+            : {}),
+        ...(config.allowDynamicClientRegistration !== undefined
+            ? { allowDynamicClientRegistration: config.allowDynamicClientRegistration }
+            : {}),
+        ...(config.allowUnauthenticatedClientRegistration !== undefined
+            ? {
+                allowUnauthenticatedClientRegistration: config.allowUnauthenticatedClientRegistration,
+            }
+            : {}),
+        ...(config.clientRegistrationDefaultScopes
+            ? {
+                clientRegistrationDefaultScopes: [
+                    ...config.clientRegistrationDefaultScopes,
+                ],
+            }
+            : {}),
+        ...(config.clientRegistrationAllowedScopes
+            ? {
+                clientRegistrationAllowedScopes: [
+                    ...config.clientRegistrationAllowedScopes,
+                ],
+            }
+            : {}),
+        ...(config.cachedTrustedClients
+            ? { cachedTrustedClients: new Set(config.cachedTrustedClients) }
+            : {}),
+        ...(config.clientPrivileges
+            ? { clientPrivileges: config.clientPrivileges }
+            : {}),
+    };
+}
+//# sourceMappingURL=methods.js.map

package/dist/auth/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../src/auth/methods.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGvE,MAAM,UAAU,qBAAqB,CAAC,QAA4B;IAChE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB,CACpC,OAA0C;IAE1C,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,yGAAyG;YACvG,sHAAsH,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAA4B,EAAE,OAAe;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAkB;IAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,MAAM,GACT,QAAQ,CAAC,OAAuD,CAAC,YAAY,EAAE,EAAE;QAClF,CAAC,SAAS,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAOD,SAAS,eAAe,CAAC,OAA+C;IACtE,OAAO,OAAO,OAAO,KAAK,UAAU;QAClC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA4B;IACzD,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACjD,OAAO;QACL,GAAG,OAAO;QACV,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YACpC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,WAAW,EAAE,OAAO,CAAC,KAAK;SAC3B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAwC;IAExC,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,8DAA8D;IAC9D,4DAA4D;IAC5D,kEAAkE;IAClE,+DAA+D;IAC/D,8DAA8D;IAC9D,mEAAmE;IACnE,6DAA6D;IAC7D,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,sCAAsC,MAAM,CAAC,QAAQ,kCAAkC;gBACrF,2GAA2G,CAC9G,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACjD,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,OAAO,GAAsB,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CACpD,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAClD,CACF,CAAC;IACF,MAAM,GAAG,GAAkD,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACtC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,OAAO,CAAC,UAAU,iGAAiG,CAAC,CAAC;QACrL,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,CAAC,OAAO,CAAC,UAAU,kCAAkC;gBAC9F,oDAAoD,CACvD,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,OAAO,CAAC,UAAU,oEAAoE,CAAC,CAAC;QACtJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAwB,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAE/C,MAAM,UAAU,oBAAoB,CAAC,MAAyD;IAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,OAAO,SAAS,CAAC;QACf,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,kCAAkC;QAC7C,GAAG,MAAM,CAAC,OAAO;QACjB,4DAA4D;QAC5D,6DAA6D;QAC7D,0DAA0D;QAC1D,+CAA+C;QAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC5B,MAAM;gBACN,QAAQ,EAAE,yBAAyB;aACpC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAwD,EACxD,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACtD,GAAG,MAAM,CAAC,OAAO;QACjB,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,mBAAmB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC5B,MAAM;gBACN,QAAQ,EAAE,kBAAkB,IAAI,CAAC,IAAI,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAEnE,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,OAAwC,EACxC,UAAkD,EAAE;IAEpD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC;WACvF,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,GAAG;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAwB,EACxB,OAAwC;IAExC,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1D,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CACtE,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8FAA8F;gBAC5F,6FAA6F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,IAA8E;IAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,cAAc;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACzE,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IAC/D,CAAC;AACH,CAAC;AAOD,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CACrC,IAAuC,EACvC,OAAwB,EACxB,OAAwC;IAExC,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACxE,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ;QAC9F,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YACvB,OAAO,EAAE,IAAI,KAAK,eAAe;YACjC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU;YACxC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAC7C,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAwC,EACxC,IAAO;IAEP,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,CAAC,CAAC,EAA+C,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CACpE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,yCAAyC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,+BAA+B,GAEjC;IACF,KAAK,EAAE,CAAC,2BAA2B,CAAC;CACrC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,OAAwC,EACxC,aAAoC,EAAE;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7E,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAA2B;IAE3B,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,kCAAkC;YAC3C,CAAC,CAAC,EAAE,kCAAkC,EAAE,CAAC,GAAG,MAAM,CAAC,kCAAkC,CAAC,EAAE;YACxF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC;gBACE,wCAAwC,EAAE,KAAK;gBAC/C,yBAAyB,EAAE,IAAI;aAChC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,8BAA8B,KAAK,SAAS;YACrD,CAAC,CAAC,EAAE,8BAA8B,EAAE,MAAM,CAAC,8BAA8B,EAAE;YAC3E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,sCAAsC,KAAK,SAAS;YAC7D,CAAC,CAAC;gBACE,sCAAsC,EACpC,MAAM,CAAC,sCAAsC;aAChD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,+BAA+B;YACxC,CAAC,CAAC;gBACE,+BAA+B,EAAE;oBAC/B,GAAG,MAAM,CAAC,+BAA+B;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,+BAA+B;YACxC,CAAC,CAAC;gBACE,+BAA+B,EAAE;oBAC/B,GAAG,MAAM,CAAC,+BAA+B;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,oBAAoB;YAC7B,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/auth/oauthTokens.d.ts

@@ -0,0 +1,24 @@
+/** OAuth access tokens: JWT and DPoP verification, provider tokens, and the registered-client projection. */
+import { verifyJwsAccessToken, type DpopReplayStore } from "better-auth/oauth2";
+import type { DatabaseDriver } from "../core/index.js";
+import type { OAuthAccessTokenVerification, ProviderAccessToken, RegisteredOAuthClient } from "./types.js";
+export declare function getProviderAccessTokenForRequest(api: {
+    getAccessToken(input: {
+        headers: Headers;
+        body: {
+            accountId: string;
+        };
+    }): Promise<unknown>;
+}, request: Request, accountId: string, providerId: string): Promise<ProviderAccessToken>;
+/** A JSON array of strings as the store returns it: JSON text on SQLite, an already decoded array from PostgreSQL's jsonb. */
+export declare function parseStoredStringArray(value: unknown): string[] | null;
+export declare function assertActiveUserGrant(driver: DatabaseDriver, claims: Record<string, unknown>, audience: string): Promise<void>;
+type LocalJwksFetcher = Exclude<Parameters<typeof verifyJwsAccessToken>[1]["jwksFetch"], string>;
+export declare function verifyOAuthJwtWithLocalJwks(token: string, audience: string, issuer: string, jwksFetch: LocalJwksFetcher, jwksCacheKey?: object): Promise<Record<string, unknown>>;
+export declare function verifyOAuthJwt(tokenOrRequest: string | Request, options: {
+    readonly audience: string;
+    readonly scopes?: readonly string[];
+}, verify: ((token: string, audience: string) => Promise<Record<string, unknown>>) | null, getDpopReplayStore?: () => Promise<DpopReplayStore>): Promise<OAuthAccessTokenVerification>;
+export declare function mapRegisteredOAuthClient(value: unknown): RegisteredOAuthClient;
+export {};
+//# sourceMappingURL=oauthTokens.d.ts.map

package/dist/auth/oauthTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthTokens.d.ts","sourceRoot":"","sources":["../../src/auth/oauthTokens.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAyE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACvJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC3G,wBAAsB,gCAAgC,CACpD,GAAG,EAAE;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB,EACD,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAqB9B;AAUD,8HAA8H;AAC9H,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAUtE;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,KAAK,gBAAgB,GAAG,OAAO,CAC7B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EACvD,MAAM,CACP,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,gBAAgB,EAC3B,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMlC;AAED,wBAAsB,cAAc,CAClC,cAAc,EAAE,MAAM,GAAG,OAAO,EAChC,OAAO,EAAE;IACP,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,EACD,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,EACtF,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAClD,OAAO,CAAC,4BAA4B,CAAC,CAwDvC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CA4B9E"}

package/dist/auth/oauthTokens.js

@@ -0,0 +1,146 @@
+/** OAuth access tokens: JWT and DPoP verification, provider tokens, and the registered-client projection. */
+import { enforceDpopBinding, isDpopBindingError, parseAccessTokenAuthorization, verifyJwsAccessToken } from "better-auth/oauth2";
+import { dbOf } from "./db.js";
+export async function getProviderAccessTokenForRequest(api, request, accountId, providerId) {
+    const value = (await api.getAccessToken({
+        headers: request.headers,
+        body: { accountId },
+    }));
+    if (typeof value?.accessToken !== "string") {
+        throw new Error(`getProviderAccessToken: provider '${providerId}' returned no access token.`);
+    }
+    return {
+        accessToken: value.accessToken,
+        ...(value.accessTokenExpiresAt instanceof Date
+            ? { accessTokenExpiresAt: value.accessTokenExpiresAt }
+            : {}),
+        scopes: Array.isArray(value.scopes)
+            ? value.scopes.filter((scope) => typeof scope === "string")
+            : [],
+    };
+}
+function scopesFromClaim(value) {
+    if (typeof value === "string")
+        return value.split(/\s+/).filter(Boolean);
+    if (Array.isArray(value)) {
+        return value.filter((scope) => typeof scope === "string");
+    }
+    return [];
+}
+/** A JSON array of strings as the store returns it: JSON text on SQLite, an already decoded array from PostgreSQL's jsonb. */
+export function parseStoredStringArray(value) {
+    if (typeof value !== "string" && !Array.isArray(value))
+        return null;
+    try {
+        const parsed = typeof value === "string" ? JSON.parse(value) : value;
+        return Array.isArray(parsed) && parsed.every((item) => typeof item === "string")
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function assertActiveUserGrant(driver, claims, audience) {
+    const db = dbOf(driver);
+    const userId = claims["sub"];
+    const clientId = claims["azp"];
+    const sessionId = claims["sid"];
+    const consentId = claims["mantle_consent_id"];
+    if (typeof userId !== "string" ||
+        typeof clientId !== "string" ||
+        typeof sessionId !== "string" ||
+        typeof consentId !== "string" || !consentId) {
+        throw new Error("OAuth token is not bound to a user session.");
+    }
+    const result = await db.first('SELECT c.resources, c.scopes FROM "oauthConsent" AS c ' +
+        'JOIN session AS s ON s.id = ? AND s."userId" = c."userId" AND s."expiresAt" > ? ' +
+        'WHERE c.id = ? AND c."userId" = ? AND c."clientId" = ?', sessionId, new Date().toISOString(), consentId, userId, clientId);
+    const tokenScopes = scopesFromClaim(claims["scope"]);
+    const resources = parseStoredStringArray(result?.resources);
+    const scopes = parseStoredStringArray(result?.scopes);
+    const active = resources?.includes(audience) === true && scopes !== null &&
+        tokenScopes.every((scope) => scopes.includes(scope));
+    if (!active)
+        throw new Error("OAuth authorization grant is no longer active.");
+}
+export function verifyOAuthJwtWithLocalJwks(token, audience, issuer, jwksFetch, jwksCacheKey) {
+    return verifyJwsAccessToken(token, {
+        jwksFetch,
+        ...(jwksCacheKey ? { jwksCacheKey } : {}),
+        verifyOptions: { audience, issuer },
+    });
+}
+export async function verifyOAuthJwt(tokenOrRequest, options, verify, getDpopReplayStore) {
+    const request = typeof tokenOrRequest === "string" ? null : tokenOrRequest;
+    const authorization = parseAccessTokenAuthorization(request?.headers.get("authorization") ?? `Bearer ${tokenOrRequest}`);
+    const token = authorization?.token;
+    // JWT compact serialization has exactly three non-empty parts.
+    // Reject opaque tokens before any network/JWKS work.
+    if (!verify ||
+        !token ||
+        token.split(".").length !== 3 ||
+        token.split(".").some((part) => part.length === 0)) {
+        return { ok: false, status: 401, reason: "invalid-token" };
+    }
+    try {
+        const claims = await verify(token, options.audience);
+        await enforceDpopBinding({
+            payload: claims,
+            authorization,
+            proofJwt: request?.headers.get("dpop"),
+            method: request?.method ?? "GET",
+            url: request?.url ?? options.audience,
+            ...(request && authorization.scheme === "DPoP" && getDpopReplayStore
+                ? { replayStore: await getDpopReplayStore() }
+                : {}),
+        });
+        if (typeof claims["sub"] !== "string" || claims["sub"].length === 0) {
+            return { ok: false, status: 401, reason: "invalid-token" };
+        }
+        const scopes = scopesFromClaim(claims["scope"]);
+        const missingScopes = (options.scopes ?? []).filter((scope) => !scopes.includes(scope));
+        if (missingScopes.length > 0) {
+            return {
+                ok: false,
+                status: 403,
+                reason: "insufficient-scope",
+                missingScopes,
+            };
+        }
+        return {
+            ok: true,
+            userId: claims["sub"],
+            clientId: typeof claims["azp"] === "string" ? claims["azp"] : null,
+            credentialId: typeof claims["jti"] === "string" ? claims["jti"] : null,
+            scopes,
+        };
+    }
+    catch (error) {
+        if (isDpopBindingError(error)) {
+            return { ok: false, status: 401, reason: "invalid-dpop-proof" };
+        }
+        return { ok: false, status: 401, reason: "invalid-token" };
+    }
+}
+export function mapRegisteredOAuthClient(value) {
+    const row = value;
+    if (!row.client_id || !Array.isArray(row.redirect_uris)) {
+        throw new Error("registerOAuthClient: Better Auth returned an invalid client.");
+    }
+    return {
+        clientId: row.client_id,
+        ...(row.client_secret && row.token_endpoint_auth_method !== "none"
+            ? { clientSecret: row.client_secret }
+            : {}),
+        redirectUris: row.redirect_uris,
+        ...(row.scope ? { scope: row.scope.split(" ").filter(Boolean) } : {}),
+        ...(row.client_name ? { clientName: row.client_name } : {}),
+        ...(row.client_uri ? { clientUri: row.client_uri } : {}),
+        ...(row.token_endpoint_auth_method
+            ? { tokenEndpointAuthMethod: row.token_endpoint_auth_method }
+            : {}),
+        ...(row.application_type ? { applicationType: row.application_type } : {}),
+    };
+}
+//# sourceMappingURL=oauthTokens.js.map

package/dist/auth/oauthTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthTokens.js","sourceRoot":"","sources":["../../src/auth/oauthTokens.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,oBAAoB,EAAwB,MAAM,oBAAoB,CAAC;AAEvJ,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAG/B,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAKC,EACD,OAAgB,EAChB,SAAiB,EACjB,UAAkB;IAElB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,cAAc,CAAC;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,EAAE,SAAS,EAAE;KACpB,CAAC,CAID,CAAC;IACF,IAAI,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,6BAA6B,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,oBAAoB,YAAY,IAAI;YAC5C,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC5E,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9E,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAC9E,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAsB,EACtB,MAA+B,EAC/B,QAAgB;IAEhB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAA0C,wDAAwD;QACzH,kFAAkF;QAClF,wDAAwD,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QACtE,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACjF,CAAC;AAOD,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,QAAgB,EAChB,MAAc,EACd,SAA2B,EAC3B,YAAqB;IAErB,OAAO,oBAAoB,CAAC,KAAK,EAAE;QACjC,SAAS;QACT,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,cAAgC,EAChC,OAGC,EACD,MAAsF,EACtF,kBAAmD;IAEnD,MAAM,OAAO,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,MAAM,aAAa,GAAG,6BAA6B,CACjD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,UAAU,cAAc,EAAE,CACpE,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,EAAE,KAAK,CAAC;IACnC,+DAA+D;IAC/D,qDAAqD;IACrD,IACE,CAAC,MAAM;QACP,CAAC,KAAK;QACN,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,kBAAkB,CAAC;YACvB,OAAO,EAAE,MAAM;YACf,aAAa;YACb,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK;YAChC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ;YACrC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,IAAI,kBAAkB;gBAClE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,kBAAkB,EAAE,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CACnC,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,oBAAoB;gBAC5B,aAAa;aACd,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;YACrB,QAAQ,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YAClE,YAAY,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,GAAG,GAAG,KASX,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,0BAA0B,KAAK,MAAM;YAChE,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,0BAA0B;YAChC,CAAC,CAAC,EAAE,uBAAuB,EAAE,GAAG,CAAC,0BAA0B,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/auth/setupIncomplete.d.ts

@@ -0,0 +1,16 @@
+/** The fail-closed `MantleAuth` for a service whose sign-in is not configured yet. */
+import type { MantleAuth } from "./types.js";
+export interface SetupIncompleteAuthOptions {
+    readonly basePath?: string;
+    readonly message?: string;
+    readonly response?: () => Response | Promise<Response>;
+}
+/**
+ * Safe Auth facade for first-deploy/bootstrap windows where an
+ * adopter's public Worker should boot before staff sign-in providers
+ * have been provisioned. Auth-gated routes should still be blocked by
+ * the consumer; this facade never authenticates anyone.
+ */
+export declare function createSetupIncompleteAuth(options?: SetupIncompleteAuthOptions): MantleAuth;
+/** Pin the session-bound Better Auth request and secret-minimizing response mapping. */
+//# sourceMappingURL=setupIncomplete.d.ts.map

package/dist/auth/setupIncomplete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupIncomplete.d.ts","sourceRoot":"","sources":["../../src/auth/setupIncomplete.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAGtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,UAAU,CA4CZ;AAED,wFAAwF"}

package/dist/auth/setupIncomplete.js

@@ -0,0 +1,50 @@
+/** The fail-closed `MantleAuth` for a service whose sign-in is not configured yet. */
+import { normalizeAuthBasePath } from "./methods.js";
+/**
+ * Safe Auth facade for first-deploy/bootstrap windows where an
+ * adopter's public Worker should boot before staff sign-in providers
+ * have been provisioned. Auth-gated routes should still be blocked by
+ * the consumer; this facade never authenticates anyone.
+ */
+export function createSetupIncompleteAuth(options = {}) {
+    const basePath = normalizeAuthBasePath(options.basePath);
+    const message = options.message ?? "Auth is not configured yet.";
+    const response = options.response ??
+        (() => Response.json({ error: "setup_incomplete", message }, { status: 503, headers: { "cache-control": "private, no-store" } }));
+    const auth = {
+        basePath,
+        handler: async () => response(),
+        getSession: async () => null,
+        getUserRole: async () => null,
+        getUser: async () => null,
+        getProviderAccessToken: async () => {
+            throw new Error(message);
+        },
+        verifyOAuthAccessToken: async () => ({
+            ok: false,
+            status: 401,
+            reason: "invalid-token",
+        }),
+        getOAuthConsentRequest: async () => null,
+        completeOAuthConsent: async () => {
+            throw new Error(message);
+        },
+        methods: [],
+        listLinkedAccounts: async () => [],
+        unlinkAccount: async () => false,
+        listUsers: async () => [],
+        listMembers: async () => ({ items: [], previousCursor: null, nextCursor: null }),
+        setUserRole: async () => false,
+        inviteUser: async () => {
+            throw new Error(message);
+        },
+        revokeInvite: async () => false,
+        deleteUser: async () => false,
+        registerOAuthClient: async () => {
+            throw new Error(message);
+        },
+    };
+    return auth;
+}
+/** Pin the session-bound Better Auth request and secret-minimizing response mapping. */
+//# sourceMappingURL=setupIncomplete.js.map

package/dist/auth/setupIncomplete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupIncomplete.js","sourceRoot":"","sources":["../../src/auth/setupIncomplete.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AASrD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;IACjE,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,GAAG,EAAE,CACJ,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,EAAE,CACnE,CAAC,CAAC;IACP,MAAM,IAAI,GAAe;QACvB,QAAQ;QACR,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAC5B,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAC7B,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACzB,sBAAsB,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,eAAe;SACxB,CAAC;QACF,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACxC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAC/B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,EAAE;QACX,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QAClC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAChC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QACzB,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAChF,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAC9B,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAC/B,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAC7B,mBAAmB,EAAE,KAAK,IAAI,EAAE;YAC9B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF"}