@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.1

package/dist/auth/buildAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildAuth.d.ts","sourceRoot":"","sources":["../../src/auth/buildAuth.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAKrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAiBlF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,2CAAkD,CAAC;AA2BvF,wBAAgB,SAAS,CAAC,MAAM,EAAE,uBAAuB;;;;;;;;;;;;;;;;;;;yBAsJtC,OAAO,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA3F2B,CAAC;;;;;;;;;6BAOjC,CAAC;6BACd,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAoBiD,CAAC;;;;;;;;;;;;yBAIrB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAsC/B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAuEX,CAAC;qCAEc,CAAC;;;;;;;;;iCAOb,CAAL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAyB6D,CAAC;qCAC3C,CAAC;;;;;;;;;iCAQS,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAxSiT,CAAC;;;;;;;;;yCAI3T,CAAC;;;;;;;;;;;;;;;yCAUwB,CAAA;yCAC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAuCI,CAAC;qCACgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAiCO,CAAC;qCACf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAgFb,CAAC;qCACpB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA2B2B,CAAC;qCACC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAmEqB,CAAC;qCACvC,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAgCA,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA2BshB,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAyzC,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAAo6B,CAAC;6BAA8C,CAAC;;;;;;;;;;;;;;;6BAAuY,CAAC;6BAA8C,CAAC;;;;;;;;;yBAA0O,CAAC;;;;;;;;;;;;;;;;;;qCAAksB,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAi0C,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAgzC,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAi2C,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAxP58Q,CAAC;qCACN,CAAC;;;;;;;;;iCAS2B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA0BI,CAAC;;;;;;;;;;;;;;;;;kCAaP,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCAuM61P,CAAC;yCAAoD,CAAC;;;;;;;;;yCAAoW,CAAC;yCAAoD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAAgmD,CAAC;;oCAAiF,CAAC;;;0CAAoJ,CAAC;;2CAA4F,CAAC;+CAA4D,CAAC;;;;;qCAAqL,CAAC;gCAA4C,CAAC;;;;qDAAkM,CAAC;gEAA+F,CAAC;qCAAyF,CAAC;oCAAgD,CAAC;6BAA2C,CAAC;0BAAsC,CAAC;mCAA+C,CAAC;0DAAsE,CAAC;qEAAoG,CAAC;sCAA0F,CAAC;6DAAyE,CAAC;wEAAuG,CAAC;;8DAAoK,CAAC;qDAAkE,CAAC;4CAAyD,CAAC;oDAAiE,CAAC;iDAA8D,CAAC;;;;;;;;;;;;;;;;;;;;sCAA2qB,CAAC;uCAAkC,CAAC;qCAAgC,CAAC;;;;;;;;;sCAAoO,CAAC;uCAAkC,CAAC;qCAAgC,CAAC;;;;;;;;;;uCAAoQ,CAAC;qCAAgC,CAAC;;;;;;;;;;sCAAqQ,CAAC;qCAAgC,CAAC;;;;;;;;;;;;sCAA4S,CAAC;uCAAkC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA+3D,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA+hD,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDAAk3G,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAqpT,CAAC;;;sCAAiF,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAupnB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAw/M,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;qCAAgxB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAwyC,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAkkF,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAw5D,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;qCAAuyB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA80B,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;qCAAisB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;qCAAwsB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA63B,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA3m6C,CAAC;sBAA4P,CAAC;;;;;;;;;;;qBAA8Q,CAAC;;kBAAwH,CAAC;sBAA4P,CAAC;;;;;;;;;;;;qBAAuR,CAAC;;kBAAwH,CAAC;sBAAuK,CAAC;qBAA0M,CAAC;;;;kBAAmL,CAAC;sBAAkQ,CAAC;;;;;;;;;;;;qBAA0R,CAAC;;kBAAuK,CAAC;sBAA+P,CAAC;;;;;;;;;;;;;qBAAmS,CAAC;;kBAA8H,CAAC;sBAA6K,CAAC;qBAAmN,CAAC;;;;kBAAyL,CAAC;sBAAkQ,CAAC;;;;;;;;;;;;;;;;;;qBAAgQ,CAAC;;kBAA6I,CAAC;sBAA8P,CAAC;;;;;;;;;;;;;;;;;;;qBAAmS,CAAC;;kBAA8H,CAAC;sBAA8K,CAAC;qBAAoN,CAAC;;;;kBAAmM,CAAC;sBAA4Q,CAAC;;;;;;;;;;qBAA8S,CAAC;;kBAAwI,CAAC;sBAA4Q,CAAC;;;;;;;;;;;qBAAuT,CAAC;;kBAAwI,CAAC;sBAAuL,CAAC;qBAAkO,CAAC;;;;;;;;;iKAA5sY,CAAC;;;;;;;;mBAzCrhqB,MAAM;mBAGN,MAAM,SAAS,MAAM,QAAQ,MAAM;sBAOhC,MAAM;;;;;;;;;;;;;;;;;GA6B7B"}

package/dist/auth/buildAuth.js

@@ -0,0 +1,307 @@
+/** One Better Auth instance from `CreateMantleAuthOptions`: plugins, staff roles, database hooks and the session cache. */
+import { cimd } from "@better-auth/cimd";
+import { mcp } from "@better-auth/mcp";
+import { oauthProvider } from "@better-auth/oauth-provider";
+import { betterAuth } from "better-auth";
+import { admin, jwt } from "better-auth/plugins";
+import { createAccessControl } from "better-auth/plugins/access";
+import { defaultStatements } from "better-auth/plugins/admin/access";
+import { genericOAuth } from "better-auth/plugins/generic-oauth";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { STAFF_ROLES } from "../spec/domain/index.js";
+import { dbOf, readStoreInstanceId } from "./db.js";
+import { buildEmailOTPPlugin, buildGenericOAuthProviders, buildMagicLinkPlugin, buildOAuthProviderOptions, buildSocialProviders, buildTrustedOriginsFor, guardGithubLoginProfile, hasEmailAuthSurface, methodsRequireSameSiteNone, normalizeAuthBasePath, normalizeAuthErrorURL, pickSingleton, resolveClientIpHeaders, shouldPromoteToOwner, validateBootstrap } from "./methods.js";
+// Better Auth 1.7.2 initializes its shared stores asynchronously. Seed them
+// before any request can be canceled; the accessor-identity regression test
+// pins this version-specific integration to the stores Better Auth uses.
+const betterAuthGlobalKey = Symbol.for("better-auth:global");
+const betterAuthGlobals = globalThis;
+const betterAuthGlobal = betterAuthGlobals[betterAuthGlobalKey] ??= {
+    version: "",
+    epoch: 0,
+    context: {},
+};
+betterAuthGlobal.context.requestStateAsyncStorage ??= new AsyncLocalStorage();
+betterAuthGlobal.context.endpointContextAsyncStorage ??= new AsyncLocalStorage();
+betterAuthGlobal.context.adapterAsyncStorage ??= new AsyncLocalStorage();
+/**
+ * Request-scoped retention for Better Auth's fire-and-forget work. Better Auth
+ * hands `advanced.backgroundTasks.handler` a bare promise with no request in
+ * sight; the handler reads the retainer the current `handler()` call stored
+ * here and registers the promise with it. On Workers that retainer is
+ * `ExecutionContext.waitUntil` — without it the OTP send and the rate-limit
+ * cleanup can be cancelled the moment the response is returned (#976).
+ */
+export const backgroundTaskRetention = new AsyncLocalStorage();
+const ac = createAccessControl(defaultStatements);
+const ownerAc = ac.newRole({
+    user: defaultStatements.user,
+    session: defaultStatements.session,
+});
+const editorAc = ac.newRole({
+    user: ["list", "ban", "get", "update"],
+    session: ["list", "revoke"],
+});
+const contributorAc = ac.newRole({
+    user: ["list", "get"],
+    session: [],
+});
+const userAc = ac.newRole({
+    user: [],
+    session: [],
+});
+export function buildAuth(config) {
+    const db = dbOf(config.driver);
+    const ipAddressHeaders = resolveClientIpHeaders(config.ipAddressHeaders);
+    if (config.hostOnlyCookies && (new URL(config.baseURL).protocol !== "https:" || config.crossSubDomainCookies?.enabled)) {
+        throw new Error("createMantleAuth: hostOnlyCookies requires HTTPS and cannot share cookies across subdomains.");
+    }
+    if (config.methods.length === 0 && !config.plugins?.length) {
+        throw new Error("createMantleAuth: methods[] is empty — register an AuthMethodConfig or native Better Auth plugin so staff can sign in.");
+    }
+    if (config.bootstrapOwner) {
+        validateBootstrap(config.bootstrapOwner, config.methods);
+    }
+    const socialProviders = buildSocialProviders(config.methods);
+    const genericOAuthProviders = buildGenericOAuthProviders(config.methods);
+    const bootstrap = config.bootstrapOwner;
+    const emailOtpMethod = pickSingleton(config.methods, "email-otp");
+    const magicLinkMethod = pickSingleton(config.methods, "magic-link");
+    const providerOptions = config.oauthProvider
+        ? buildOAuthProviderOptions(config.oauthProvider)
+        : null;
+    // Workers may not set NODE_ENV. Explicitly enable the provider's route
+    // limits too (notably anonymous DCR: 5/minute).
+    // ponytail: memory limits are per isolate; use an ingress rate-limit rule
+    // when a deployment needs a distributed abuse quota.
+    const hasEmailMethod = hasEmailAuthSurface(config.methods, config.plugins);
+    const rateLimit = {
+        window: 60,
+        max: hasEmailMethod ? 10 : 100,
+        ...config.rateLimit,
+        enabled: true,
+        storage: "memory",
+    };
+    // `trustedOrigins`: per-provider auto-origins (Apple needs
+    // `https://appleid.apple.com`) plus adopter-owned first-party
+    // origins for flows such as hosted auth across trusted subdomains.
+    const trustedOrigins = buildTrustedOriginsFor(config.methods, config.trustedOrigins);
+    const sdkPlugins = [
+        admin({
+            defaultRole: "user",
+            adminRoles: [...STAFF_ROLES],
+            ac,
+            roles: {
+                owner: ownerAc,
+                editor: editorAc,
+                contributor: contributorAc,
+                user: userAc,
+            },
+        }),
+        ...(genericOAuthProviders.length > 0
+            ? [
+                genericOAuth({
+                    config: genericOAuthProviders,
+                }),
+            ]
+            : []),
+        ...(emailOtpMethod ? [buildEmailOTPPlugin(emailOtpMethod, config.secret)] : []),
+        ...(magicLinkMethod ? [buildMagicLinkPlugin(magicLinkMethod)] : []),
+        ...(config.oauthProvider && providerOptions
+            ? [
+                jwt(),
+                config.oauthProvider.mcpResource
+                    ? mcp({
+                        ...providerOptions,
+                        resource: config.oauthProvider.mcpResource,
+                        extensions: [
+                            {
+                                claims: {
+                                    accessToken: ({ referenceId }) => ({ mantle_consent_id: referenceId ?? null }),
+                                },
+                            },
+                            ...(config.oauthProvider.extensions ?? []),
+                        ],
+                    })
+                    : oauthProvider({
+                        ...providerOptions,
+                        ...(config.oauthProvider.extensions
+                            ? { extensions: [...config.oauthProvider.extensions] }
+                            : {}),
+                    }),
+                ...(config.oauthProvider.mcpResource
+                    ? [
+                        cimd({
+                            // Cloudflare's `global_fetch_strictly_public` flag is the
+                            // runtime network boundary: resolution and connection stay
+                            // on the public Internet. Better Auth owns timeout, limits,
+                            // validation, caching, and redirect rejection above it.
+                            // Workers does not implement `redirect: "error"`; `manual`
+                            // exposes 3xx responses so Better Auth can reject them.
+                            fetchClientMetadataResource: (input, init) => fetch(input, { ...init, redirect: "manual" }),
+                            metadataProfile: "mcp-2026-07-28",
+                        }),
+                    ]
+                    : []),
+            ]
+            : []),
+    ];
+    const plugins = [...sdkPlugins, ...(config.plugins ?? [])];
+    const pluginIds = new Set();
+    for (const plugin of plugins) {
+        if (pluginIds.has(plugin.id)) {
+            throw new Error(`createMantleAuth: Better Auth plugin '${plugin.id}' is registered more than once. Remove the duplicate plugin.`);
+        }
+        pluginIds.add(plugin.id);
+    }
+    // `user.additionalFields`: SDK owns `githubLogin` only.
+    const userConfig = {
+        additionalFields: {
+            githubLogin: {
+                type: "string",
+                required: false,
+                // Better Auth applies `input: false` to trusted provider profiles too.
+                // Database hooks below keep this field provider-only instead.
+                input: true,
+            },
+        },
+    };
+    // `advanced`: SDK owns `backgroundTasks`. Apple auto-injects
+    // `defaultCookieAttributes.sameSite: "none"` because Apple's
+    // `form_post` callback is cross-site and a `lax` cookie won't ride
+    // it (Better Auth's default raises a state-mismatch).
+    const appleNeedsCrossSite = methodsRequireSameSiteNone(config.methods);
+    const advancedConfig = {
+        // Host adapter supplies the trusted ingress header(s). Never default to XFF.
+        ipAddress: { ipAddressHeaders: [...ipAddressHeaders] },
+        ...(appleNeedsCrossSite
+            ? {
+                // Browsers require `secure: true` whenever `sameSite: "none"`.
+                defaultCookieAttributes: { secure: true, sameSite: "none" },
+            }
+            : {}),
+        ...(config.crossSubDomainCookies
+            ? { crossSubDomainCookies: config.crossSubDomainCookies }
+            : {}),
+        ...(config.cookiePrefix ? { cookiePrefix: config.cookiePrefix } : {}),
+        ...(config.hostOnlyCookies ? {
+            // Better Auth prepends __Secure- otherwise. Secure is set explicitly below.
+            useSecureCookies: false,
+            cookiePrefix: `__Host-${config.cookiePrefix || "better-auth"}`,
+            crossSubDomainCookies: { enabled: false },
+            defaultCookieAttributes: { secure: true, path: "/", ...(appleNeedsCrossSite ? { sameSite: "none" } : {}) },
+        } : {}),
+        // Fire-and-forget hook closes the user-existence timing oracle
+        // on OTP send — see § "Auth as contract" notes in ADR-0014.
+        backgroundTasks: {
+            handler: (p) => {
+                const settled = p.then(() => undefined, (err) => {
+                    // eslint-disable-next-line no-console
+                    console.error("[better-auth backgroundTask]", err);
+                });
+                // Registered with the request's retainer when the host supplied one;
+                // otherwise the work simply runs detached as before.
+                backgroundTaskRetention.getStore()?.(settled);
+            },
+        },
+    };
+    // `databaseHooks`: SDK owns `user.create.after` for bootstrap-owner
+    // promotion (when `bootstrapOwner` is configured).
+    const sdkUserCreateAfter = async (user) => {
+        if (!bootstrap)
+            return;
+        const u = user;
+        if (!shouldPromoteToOwner(bootstrap, u))
+            return;
+        // Atomic check-then-promote: the `NOT EXISTS` is a GLOBAL guard —
+        // it asks "does any user already hold a staff role?". The whole
+        // statement runs as one database op, so two concurrent first signups
+        // can't both win: the loser's UPDATE finds a staff user in the
+        // subquery and silently writes zero rows.
+        const placeholders = STAFF_ROLES.map(() => "?").join(",");
+        const promoted = (await db.all(`UPDATE "user" SET role = ? WHERE id = ? AND NOT EXISTS (SELECT 1 FROM "user" WHERE role IN (${placeholders})) RETURNING id`, "owner", u.id, ...STAFF_ROLES)).length;
+        if (promoted === 0) {
+            // Operator-visible signal that the rule matched but a prior
+            // staff user already exists — otherwise the silent no-op makes a
+            // misconfigured bootstrap rule indistinguishable from a working
+            // first-promotion.
+            console.warn(`[bootstrap] user ${u.id} matched bootstrapOwner rule but promotion was blocked — a staff user already exists.`);
+        }
+    };
+    const databaseHooks = {
+        user: {
+            create: {
+                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
+                after: sdkUserCreateAfter,
+            },
+            update: {
+                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
+            },
+        },
+        verification: {
+            create: {
+                before: async (verification) => {
+                    if (!config.oauthProvider?.mcpResource)
+                        return;
+                    let value;
+                    try {
+                        value = JSON.parse(verification.value);
+                    }
+                    catch {
+                        return; // OTPs and other verification values are not OAuth grants.
+                    }
+                    if (value?.type !== "authorization_code" || typeof value.userId !== "string" ||
+                        typeof value.query?.client_id !== "string")
+                        return;
+                    const consent = await db.first('SELECT id FROM "oauthConsent" WHERE "userId" = ? AND "clientId" = ? LIMIT 1', value.userId, value.query.client_id);
+                    // Better Auth carries referenceId from this code through every
+                    // refresh rotation. Never rebind an old lineage to a new consent.
+                    return { data: { value: JSON.stringify({ ...value, referenceId: consent?.id ?? "" }) } };
+                },
+            },
+        },
+    };
+    const sessionCache = config.sessionCache;
+    let storeInstanceId;
+    const cacheKey = async (key) => {
+        storeInstanceId ??= readStoreInstanceId(config.driver)
+            .catch((error) => { storeInstanceId = undefined; throw error; });
+        return `better-auth:${await storeInstanceId}:${key}`;
+    };
+    const secondaryStorage = sessionCache ? {
+        get: async (key) => key.startsWith("verification:")
+            ? Promise.resolve(null)
+            : sessionCache.get(await cacheKey(key)),
+        set: async (key, value, ttl) => key.startsWith("verification:")
+            ? Promise.resolve()
+            : sessionCache.set(await cacheKey(key), value, ttl ? Math.max(60, Math.ceil(ttl)) : undefined),
+        delete: async (key) => key.startsWith("verification:")
+            ? Promise.resolve()
+            : sessionCache.delete(await cacheKey(key)),
+        // Verification and rate limiting stay in the primary store / memory below. Fail loudly if
+        // Better Auth starts routing either atomic operation through this adapter.
+        getAndDelete: async () => { throw new Error("Better Auth KV getAndDelete is disabled"); },
+        increment: async () => { throw new Error("Better Auth KV increment is disabled"); },
+    } : undefined;
+    return betterAuth({
+        database: config.database,
+        secondaryStorage,
+        session: { storeSessionInDatabase: true },
+        verification: { storeInDatabase: true },
+        secret: config.secret,
+        baseURL: config.baseURL,
+        basePath: normalizeAuthBasePath(config.basePath),
+        onAPIError: { errorURL: normalizeAuthErrorURL(config.errorURL, config.baseURL) },
+        socialProviders,
+        ...(config.accountLinking
+            ? { account: { accountLinking: config.accountLinking } }
+            : {}),
+        user: userConfig,
+        rateLimit,
+        trustedOrigins,
+        advanced: advancedConfig,
+        plugins,
+        databaseHooks,
+    });
+}
+//# sourceMappingURL=buildAuth.js.map

package/dist/auth/buildAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildAuth.js","sourceRoot":"","sources":["../../src/auth/buildAuth.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EAAwB,mBAAmB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE5Y,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,UAEzB,CAAC;AACF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,KAAK;IAClE,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,EAAE;CACZ,CAAC;AACF,gBAAgB,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI,iBAAiB,EAAE,CAAC;AAC9E,gBAAgB,CAAC,OAAO,CAAC,2BAA2B,KAAK,IAAI,iBAAiB,EAAE,CAAC;AACjF,gBAAgB,CAAC,OAAO,CAAC,mBAAmB,KAAK,IAAI,iBAAiB,EAAE,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,iBAAiB,EAA0B,CAAC;AAQvF,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAElD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC,IAAI;IAC5B,OAAO,EAAE,iBAAiB,CAAC,OAAO;CACnC,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IACtC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC5B,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;IACxB,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,MAA+B;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wHAAwH,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa;QAC1C,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,uEAAuE;IACvE,gDAAgD;IAChD,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;QAC9B,GAAG,MAAM,CAAC,SAAS;QACnB,OAAO,EAAE,IAAa;QACtB,OAAO,EAAE,QAAiB;KAC3B,CAAC;IAEF,2DAA2D;IAC3D,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC;YACJ,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC;YAC5B,EAAE;YACF,KAAK,EAAE;gBACL,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,aAAa;gBAC1B,IAAI,EAAE,MAAM;aACb;SACF,CAAC;QACF,GAAG,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,CAAC;oBACX,MAAM,EAAE,qBAAqB;iBAC9B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,eAAe;YACzC,CAAC,CAAC;gBACE,GAAG,EAAE;gBACL,MAAM,CAAC,aAAa,CAAC,WAAW;oBAC9B,CAAC,CAAC,GAAG,CAAC;wBACF,GAAG,eAAe;wBAClB,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW;wBAC1C,UAAU,EAAE;4BACV;gCACE,MAAM,EAAE;oCACN,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC;iCAC/E;6BACF;4BACD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;yBAC3C;qBACF,CAAC;oBACJ,CAAC,CAAC,aAAa,CAAC;wBACZ,GAAG,eAAe;wBAClB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU;4BACjC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;4BACtD,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW;oBAClC,CAAC,CAAC;wBACE,IAAI,CAAC;4BACH,0DAA0D;4BAC1D,2DAA2D;4BAC3D,4DAA4D;4BAC5D,wDAAwD;4BACxD,2DAA2D;4BAC3D,wDAAwD;4BACxD,2BAA2B,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC3C,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;4BAC/C,eAAe,EAAE,gBAAgB;yBAClC,CAAC;qBACH;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,EAAE,8DAA8D,CAAC,CAAC;QACpI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,MAAM,UAAU,GAAG;QACjB,gBAAgB,EAAE;YAChB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,QAAQ,EAAE,KAAK;gBACf,uEAAuE;gBACvE,8DAA8D;gBAC9D,KAAK,EAAE,IAAI;aACZ;SACF;KACF,CAAC;IAEF,6DAA6D;IAC7D,6DAA6D;IAC7D,mEAAmE;IACnE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG;QACrB,6EAA6E;QAC7E,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE;QACtD,GAAG,CAAC,mBAAmB;YACrB,CAAC,CAAC;gBACE,+DAA+D;gBAC/D,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,qBAAqB;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YAC3B,4EAA4E;YAC5E,gBAAgB,EAAE,KAAK;YACvB,YAAY,EAAE,UAAU,MAAM,CAAC,YAAY,IAAI,aAAa,EAAE;YAC9D,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpH,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,4DAA4D;QAC5D,eAAe,EAAE;YACf,OAAO,EAAE,CAAC,CAAmB,EAAE,EAAE;gBAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC9C,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;gBACH,qEAAqE;gBACrE,qDAAqD;gBACrD,uBAAuB,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;SACF;KACF,CAAC;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAa,EAAiB,EAAE;QAChE,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,CAAC,GAAG,IAIT,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC;YAAE,OAAO;QAEhD,kEAAkE;QAClE,gEAAgE;QAChE,qEAAqE;QACrE,+DAA+D;QAC/D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,+FAA+F,YAAY,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACpM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,4DAA4D;YAC5D,iEAAiE;YACjE,gEAAgE;YAChE,mBAAmB;YACnB,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,uFAAuF,CAAC,CAAC;QAChI,CAAC;IACH,CAAC,CAAC;IACF,MAAM,aAAa,GAAuC;QACxD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAuC,EAAE,OAAwB,EAAE,EAAE,CAClF,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;gBACxD,KAAK,EAAE,kBAAkB;aAC1B;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAuC,EAAE,OAAwB,EAAE,EAAE,CAClF,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;aACzD;SACF;QACD,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;oBAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW;wBAAE,OAAO;oBAC/C,IAAI,KAAK,CAAC;oBACV,IAAI,CAAC;wBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAEpC,CAAC;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,2DAA2D;oBACrE,CAAC;oBACD,IAAI,KAAK,EAAE,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;wBACxE,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,KAAK,QAAQ;wBAAE,OAAO;oBACvD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAiB,6EAA6E,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACnK,+DAA+D;oBAC/D,kEAAkE;oBAClE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3F,CAAC;aACF;SACF;KACF,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,IAAI,eAA4C,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;QACtD,eAAe,KAAK,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;aACnD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,eAAe,GAAG,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,eAAe,MAAM,eAAe,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YACzD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YACtF,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;YACnB,CAAC,CAAC,YAAY,CAAC,GAAG,CACd,MAAM,QAAQ,CAAC,GAAG,CAAC,EACnB,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/C;QACL,MAAM,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAC5D,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;YACnB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,0FAA0F;QAC1F,2EAA2E;QAC3E,YAAY,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC;QACzF,SAAS,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;KACpF,CAAC,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB;QAChB,OAAO,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChD,UAAU,EAAE,EAAE,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;QAChF,eAAe;QACf,GAAG,CAAC,MAAM,CAAC,cAAc;YACvB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,UAAU;QAChB,SAAS;QACT,cAAc;QACd,QAAQ,EAAE,cAAc;QACxB,OAAO;QACP,aAAa;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/callerResolver.d.ts

@@ -0,0 +1,48 @@
+import type { OAuthAccessTokenVerification } from "./types.js";
+import type { CallerResolver, CredentialKind } from "../core/index.js";
+/** The three things the resolver needs of a Better Auth facade; a custom facade only has to provide these. */
+export interface AuthLike {
+    getSession(request: Request): Promise<{
+        session: {
+            id: string;
+        };
+        user: {
+            id: string;
+            role?: string | null; /** the role came from the same uncached read */
+            roleCurrent?: true;
+        };
+    } | null>;
+    getUserRole(userId: string): Promise<string | null>;
+    verifyOAuthAccessToken(tokenOrRequest: string | Request, options: {
+        audience: string;
+        scopes?: readonly string[];
+    }): Promise<OAuthAccessTokenVerification>;
+}
+export type ConsumerCredentialResolution = {
+    readonly kind: "not-handled";
+} | {
+    readonly kind: "invalid";
+} | {
+    readonly kind: "verified";
+    readonly credential: {
+        readonly credential: Extract<CredentialKind, "api-key" | "personal-token">;
+        readonly credentialId: string | null;
+        /** The application subject key. A machine credential names its own stable one (say `key:<id>`): every Caller has a subject. */
+        readonly subject: string;
+        readonly clientId?: string | null;
+        readonly scopes?: readonly string[];
+    };
+};
+export interface CallerResolverOptions {
+    /** Where a service recognises and verifies its own credential formats; Core never stores or issues them. */
+    readonly credentialResolver?: (request: Request) => ConsumerCredentialResolution | Promise<ConsumerCredentialResolution>;
+    /** Enables OAuth access tokens, verified against the Auth's issuer and JWKS. `scopes` is a server-wide floor. */
+    readonly jwtBearer?: {
+        readonly audience: string;
+        readonly scopes?: readonly string[];
+    };
+    /** Informational, copied to `Caller.issuer`. */
+    readonly issuer?: string;
+}
+export declare function createCallerResolver(auth: AuthLike, options?: CallerResolverOptions): CallerResolver;
+//# sourceMappingURL=callerResolver.d.ts.map

package/dist/auth/callerResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callerResolver.d.ts","sourceRoot":"","sources":["../../src/auth/callerResolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,KAAK,EAAU,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE/E,8GAA8G;AAC9G,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,gDAAgD;YAAC,WAAW,CAAC,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3L,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5J;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAC;QAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,+HAA+H;QAC/H,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,4GAA4G;IAC5G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzH,iHAAiH;IACjH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACxF,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAKD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAsCxG"}

package/dist/auth/callerResolver.js

@@ -0,0 +1,49 @@
+/**
+ * `CallerResolver` for a Better Auth identity (ADR-0032 decision 8). Precedence: a service's own credential, an OAuth access
+ * token (Bearer or DPoP), the cookie session. A presented credential that fails never falls back to a session cookie, and only
+ * "no credential presented" is anonymous. The role is read fresh on every request so a revoked staff role cannot linger in a
+ * session snapshot.
+ */
+import { STAFF_ROLES } from "../spec/domain/index.js";
+const STAFF = new Set(STAFF_ROLES);
+const invalid = (challenge, status) => ({ invalid: true, challenge, ...(status ? { status } : {}) });
+export function createCallerResolver(auth, options = {}) {
+    const user = async (subject, credential, credentialId, clientId, scopes, role) => {
+        const current = role !== undefined ? role : await auth.getUserRole(subject);
+        return {
+            kind: "user", subject, ...(options.issuer ? { issuer: options.issuer } : {}),
+            role: current && STAFF.has(current) ? current : null, scopes, credential, credentialId, clientId,
+        };
+    };
+    return async (request) => {
+        if (options.credentialResolver) {
+            const r = await options.credentialResolver(request);
+            if (r.kind === "invalid")
+                return invalid('Bearer error="invalid_token"');
+            if (r.kind === "verified") {
+                const c = r.credential;
+                return { caller: await user(c.subject, c.credential, c.credentialId, c.clientId ?? null, c.scopes ?? []) };
+            }
+        }
+        const authorization = request.headers.get("authorization");
+        if (authorization !== null) {
+            // MCP clients use DPoP (sender-constrained) tokens; the verifier checks the proof
+            const m = /^(Bearer|DPoP) ([^\s]+)$/i.exec(authorization);
+            if (!m || !options.jwtBearer)
+                return invalid('Bearer error="invalid_token"');
+            const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer";
+            const v = await auth.verifyOAuthAccessToken(request, { audience: options.jwtBearer.audience, scopes: options.jwtBearer.scopes });
+            if (!v.ok) {
+                const error = v.reason === "invalid-dpop-proof" ? "invalid_dpop_proof" : v.reason === "insufficient-scope" ? "insufficient_scope" : "invalid_token";
+                const scope = v.missingScopes?.length ? `, scope="${v.missingScopes.join(" ")}"` : "";
+                return invalid(`${scheme} error="${error}"${scope}`, v.status);
+            }
+            return { caller: await user(v.userId, "oauth", v.credentialId, v.clientId, v.scopes) };
+        }
+        const session = await auth.getSession(request);
+        if (!session)
+            return { caller: { kind: "anonymous" } };
+        return { caller: await user(session.user.id, "session", session.session.id, null, [], session.user.roleCurrent ? (session.user.role ?? null) : undefined) };
+    };
+}
+//# sourceMappingURL=callerResolver.js.map

package/dist/auth/callerResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callerResolver.js","sourceRoot":"","sources":["../../src/auth/callerResolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAkB,MAAM,yBAAyB,CAAC;AAmCtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;AAC3C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,MAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAElI,MAAM,UAAU,oBAAoB,CAAC,IAAc,EAAE,UAAiC,EAAE;IACtF,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,UAA0B,EAAE,YAA2B,EAAE,QAAuB,EAAE,MAAyB,EAAE,IAAoB,EAAmB,EAAE;QACzL,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ;SAChH,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7G,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,kFAAkF;YAClF,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YACjI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;gBACpJ,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,OAAO,OAAO,CAAC,GAAG,MAAM,WAAW,KAAK,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9J,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/createAuthRoutes.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The auth routes a service mounts once (ADR-0032 decision 8): Better Auth under its base path, the OAuth discovery metadata Better
+ * Auth serves natively (RFC 8414 and RFC 9728), `{basePath}/methods`, and the consent routes under `/oauth`. Only the consent routes
+ * need a Caller, so only they run behind `withCaller`: a token request authenticating its client with HTTP Basic would otherwise be
+ * refused before Better Auth saw it. A consent is given or revoked by the signed-in person only, never by a bearer token.
+ */
+import type { CallerResolver } from "../core/index.js";
+import type { MantleAuth, MantleAuthRequestContext } from "./types.js";
+export type AuthRoutesAuth = Pick<MantleAuth, "basePath" | "handler" | "methods" | "getOAuthConsentRequest" | "completeOAuthConsent" | "listOAuthConsents" | "revokeOAuthConsent">;
+export interface AuthRoutesOptions {
+    /** Resolves the Caller of the consent routes; usually `createCallerResolver(auth)`. */
+    readonly resolver: CallerResolver;
+    /**
+     * Where `GET /oauth/consents` sends the browser, e.g. Admin's connected-apps page. Without it, that route answers a plain HTML
+     * page, as `GET /oauth/consent` does, so OAuth works on a service without Admin. Point `oauthProvider.consentPage` at Admin's own
+     * page to use it for consent.
+     */
+    readonly connectedAppsPage?: string;
+}
+/** The service's auth entry: a Response for a path it owns, `null` for any other. */
+export declare function createAuthRoutes(auth: AuthRoutesAuth, options: AuthRoutesOptions): (request: Request, context?: MantleAuthRequestContext) => Promise<Response | null>;
+//# sourceMappingURL=createAuthRoutes.d.ts.map

package/dist/auth/createAuthRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createAuthRoutes.d.ts","sourceRoot":"","sources":["../../src/auth/createAuthRoutes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,kBAAkB,CAAC;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAGvE,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,wBAAwB,GAAG,sBAAsB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;AAEnL,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAOD,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAWrK"}

package/dist/auth/createAuthRoutes.js

@@ -0,0 +1,128 @@
+import { withCaller } from "../core/withCaller.js";
+const PRIVATE = { "cache-control": "private, no-store" };
+const CONSENT = new Set(["GET /oauth/consent", "GET /oauth/consent/data", "POST /oauth/consent"]);
+const CONSENTS = new Set(["GET /oauth/consents", "GET /oauth/consents/data", "POST /oauth/consents/revoke"]);
+const WELL_KNOWN = /^\/\.well-known\/(oauth-authorization-server|oauth-protected-resource)(\/|$)/;
+/** The service's auth entry: a Response for a path it owns, `null` for any other. */
+export function createAuthRoutes(auth, options) {
+    const base = auth.basePath.replace(/\/+$/, "");
+    const consent = withCaller(options.resolver, consentSurface(auth, options));
+    return async (request, context) => {
+        const { pathname } = new URL(request.url);
+        if (pathname === `${base}/methods` && request.method === "GET")
+            return Response.json({ methods: auth.methods }, { headers: { "cache-control": "no-store" } });
+        if (pathname.startsWith(`${base}/`) || WELL_KNOWN.test(pathname))
+            return auth.handler(request, context);
+        // only an owned route resolves a caller: `/oauth/callback/github` and the rest are the service's, whatever they carry
+        const route = `${request.method} ${pathname}`;
+        return CONSENT.has(route) || (CONSENTS.has(route) && auth.listOAuthConsents && auth.revokeOAuthConsent) ? consent(request) : null;
+    };
+}
+function consentSurface(auth, options) {
+    const { listOAuthConsents: list, revokeOAuthConsent: revoke } = auth;
+    return async (request, caller) => {
+        const { pathname } = new URL(request.url);
+        const route = `${request.method} ${pathname}`;
+        const person = caller.kind === "user" && caller.credential === "session" ? caller.subject : null;
+        const locale = /zh[-_]tw/i.test(request.headers.get("accept-language") ?? "") ? "zh-TW" : "en";
+        if (route === "GET /oauth/consent/data") {
+            if (!person)
+                return Response.json({ consent: null }, { status: 401, headers: PRIVATE });
+            const model = await auth.getOAuthConsentRequest(request).catch(() => null); // an invalid signed query stays secret-free
+            return Response.json({ consent: model }, { status: model ? 200 : 400, headers: PRIVATE });
+        }
+        if (route === "GET /oauth/consent") {
+            const model = await auth.getOAuthConsentRequest(request).catch(() => null);
+            return html(consentHtml(locale, model), model ? 200 : 400, model?.redirectUri);
+        }
+        if (route === "POST /oauth/consent") {
+            if (!person)
+                return new Response("sign in to answer this request", { status: 401 });
+            const body = await request.text();
+            const decision = new URLSearchParams(body).get("decision");
+            if (decision !== "approve" && decision !== "deny")
+                return new Response("invalid consent decision", { status: 400 });
+            // the redirect is the one Better Auth validated against the client's registration; nothing in the request names it
+            const location = await auth.completeOAuthConsent(new Request(request, { body }), decision === "approve").catch(() => null);
+            const target = location && URL.canParse(location) ? new URL(location) : null;
+            if (!target || /^(javascript|data|vbscript|blob):$/i.test(target.protocol))
+                return new Response("invalid authorization request", { status: 400 });
+            // the parsed form, so a browser cannot read `https:\\evil.test` differently from the check
+            return new Response(null, { status: 302, headers: { location: target.href, ...PRIVATE } });
+        }
+        if (!list || !revoke)
+            return new Response("not found", { status: 404 });
+        if (route === "GET /oauth/consents") {
+            if (options.connectedAppsPage)
+                return new Response(null, { status: 302, headers: { location: options.connectedAppsPage } });
+            if (!person)
+                return new Response("sign in to see your connected apps", { status: 401, headers: PRIVATE });
+            return html(connectedAppsHtml(locale, await list(person)), 200);
+        }
+        if (route === "GET /oauth/consents/data") {
+            if (!person)
+                return Response.json({ consents: [] }, { status: 401, headers: PRIVATE });
+            return Response.json({ consents: await list(person) }, { headers: PRIVATE });
+        }
+        if (route === "POST /oauth/consents/revoke") {
+            if (!person)
+                return new Response("sign in to revoke a connection", { status: 401 });
+            const id = new URLSearchParams(await request.text()).get("consent_id");
+            if (!id)
+                return new Response("invalid consent id", { status: 400 });
+            if (!await revoke(person, id))
+                return new Response("consent not found", { status: 404 });
+            return new Response(null, { status: 303, headers: { location: "/oauth/consents" } });
+        }
+        return new Response("not found", { status: 404 });
+    };
+}
+// ---- the pages a service without Admin shows: Admin is an optional subpath (ADR-0032 decision 13), OAuth is not tied to it
+/** A form's redirect is held to `form-action` too, so the client's callback origin is allowed. */
+function html(body, status, redirectUri) {
+    const callback = redirectUri && URL.canParse(redirectUri) ? new URL(redirectUri) : null;
+    const action = callback ? `'self' ${callback.origin === "null" ? callback.protocol : callback.origin}` : "'self'";
+    return new Response(body, {
+        status,
+        headers: {
+            ...PRIVATE, "content-type": "text/html; charset=UTF-8", "referrer-policy": "same-origin", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
+            "content-security-policy": `default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; form-action ${action}; frame-ancestors 'none'; base-uri 'none'`,
+        },
+    });
+}
+const T = {
+    en: {
+        lang: "en", title: "Authorize", eyebrow: "Connect an MCP client", heading: (c) => `Connect ${c}?`,
+        body: (c) => `${c} will be able to use this site's tools through MCP. What it can view or change is still limited by your account permissions.`,
+        returnsTo: "Returns to", scopes: "Requested access", approve: "Connect", deny: "Cancel", invalid: "Invalid authorization request", invalidBody: "Missing or malformed consent payload. Return to your MCP client and try again.",
+        apps: "MCP connections", appsBody: "These MCP clients can use this site's tools. Every action is still checked against your current account permissions.", empty: "No MCP clients are connected.", revoke: "Disconnect",
+    },
+    "zh-TW": {
+        lang: "zh-Hant-TW", title: "授權", eyebrow: "連結 MCP 客戶端", heading: (c) => `要連結 ${c} 嗎？`,
+        body: (c) => `${c} 將能透過 MCP 使用這個網站提供的工具；它能查看或變更哪些內容，仍會依照你的帳號權限決定。`,
+        returnsTo: "完成後返回", scopes: "要求的權限", approve: "連結", deny: "取消", invalid: "無效的授權請求", invalidBody: "缺少或格式錯誤的授權資訊，請返回 MCP 客戶端重試。",
+        apps: "MCP 連線", appsBody: "這些 MCP 客戶端可以使用網站提供的工具；每次操作仍會依照你當下的帳號權限檢查。", empty: "目前沒有已連結的 MCP 客戶端。", revoke: "中斷連線",
+    },
+};
+const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+const page = (l, title, main) => `<!doctype html><html lang="${T[l].lang}"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><title>${title}</title>` +
+    `<style>:root{color-scheme:light dark;font:1rem/1.5 system-ui,sans-serif}body{margin:0;padding:2rem 1rem}main{max-width:32rem;margin:10vh auto}code{overflow-wrap:anywhere}button{font:inherit;padding:.5rem 1rem;cursor:pointer}</style></head><body><main>${main}</main></body></html>`;
+function consentHtml(l, model) {
+    const t = T[l];
+    if (!model)
+        return page(l, t.title, `<p>${t.eyebrow}</p><h1>${t.invalid}</h1><p>${t.invalidBody}</p>`);
+    const client = esc(model.clientName);
+    // where the answer goes and what is asked, so a look-alike client name cannot hide either
+    const host = URL.canParse(model.redirectUri) ? new URL(model.redirectUri).host || new URL(model.redirectUri).protocol : model.redirectUri;
+    return page(l, t.title, `<p>${t.eyebrow}</p><h1>${t.heading(client)}</h1><p>${t.body(client)}</p>` +
+        `<p>${t.returnsTo} <code>${esc(host)}</code></p><p>${t.scopes}</p><ul>${model.scopes.map((sc) => `<li><code>${esc(sc)}</code></li>`).join("")}</ul><form method="post" action="/oauth/consent">` +
+        `<input type="hidden" name="oauth_query" value="${esc(model.oauthQuery)}"/><button type="submit" name="decision" value="approve">${t.approve}</button> ` +
+        `<button type="submit" name="decision" value="deny">${t.deny}</button></form>`);
+}
+function connectedAppsHtml(l, consents) {
+    const t = T[l];
+    const apps = consents.length === 0 ? `<p>${t.empty}</p>` : consents.map((c) => `<section><h2>${esc(c.clientName)}</h2><code>${esc(c.clientId)}</code><form method="post" action="/oauth/consents/revoke">` +
+        `<input type="hidden" name="consent_id" value="${esc(c.id)}"/><button type="submit">${t.revoke}</button></form></section>`).join("");
+    return page(l, t.apps, `<h1>${t.apps}</h1><p>${t.appsBody}</p>${apps}`);
+}
+//# sourceMappingURL=createAuthRoutes.js.map