@aotter/mantle 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/auth/buildAuth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"buildAuth.d.ts","sourceRoot":"","sources":["../../src/auth/buildAuth.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAKrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAiBlF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,2CAAkD,CAAC;AA2BvF,wBAAgB,SAAS,CAAC,MAAM,EAAE,uBAAuB;;;;;;;;;;;;;;;;;;;yBA0JtC,OAAO,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA/F2B,CAAC;;;;;;;;;6BAOjC,CAAC;6BACd,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAoBiD,CAAC;;;;;;;;;;;;yBAIrB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAsCzB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAmES,CAAC;qCAChB,CAAC;;;;;;;;;iCASD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA0BoB,CAAC;qCAEb,CAAC;;;;;;;;;iCAKR,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCApS8T,CAAC;;;;;;;;;yCAI3T,CAAC;;;;;;;;;;;;;;;yCAUwB,CAAA;yCAC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAuCI,CAAC;qCACgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAiCO,CAAC;qCACf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAgFb,CAAC;qCACpB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA0B8C,CAAC;qCACxB,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAkEiB,CAAC;qCACN,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAgCS,CAAC;qCAEnB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA8ByS,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAyzC,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAAo6B,CAAC;6BAA8C,CAAC;;;;;;;;;;;;;;;6BAAuY,CAAC;6BAA8C,CAAC;;;;;;;;;yBAA0O,CAAC;;;;;;;;;;;;;;;;;;qCAAksB,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAi0C,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAgzC,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAi2C,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA3P1rQ,CAAC;qCACN,CAAC;;;;;;;;;iCAS2B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA0BI,CAAC;;;;;;;;;;;;;;;;;kCAaP,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCA0M2kP,CAAC;yCAAoD,CAAC;;;;;;;;;yCAAoW,CAAC;yCAAoD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAAgmD,CAAC;;oCAAiF,CAAC;;;0CAAoJ,CAAC;;2CAA4F,CAAC;+CAA4D,CAAC;;;;;qCAAqL,CAAC;gCAA4C,CAAC;;;;qDAAkM,CAAC;gEAA+F,CAAC;qCAAyF,CAAC;oCAAgD,CAAC;6BAA2C,CAAC;0BAAsC,CAAC;mCAA+C,CAAC;0DAAsE,CAAC;qEAAoG,CAAC;sCAA0F,CAAC;6DAAyE,CAAC;wEAAuG,CAAC;;8DAAoK,CAAC;qDAAkE,CAAC;4CAAyD,CAAC;oDAAiE,CAAC;iDAA8D,CAAC;;;;;;;;;;;;;;;;;;;;sCAA2qB,CAAC;uCAAkC,CAAC;qCAAgC,CAAC;;;;;;;;;sCAAoO,CAAC;uCAAkC,CAAC;qCAAgC,CAAC;;;;;;;;;;uCAAoQ,CAAC;qCAAgC,CAAC;;;;;;;;;;sCAAqQ,CAAC;qCAAgC,CAAC;;;;;;;;;;;;sCAA4S,CAAC;uCAAkC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA+3D,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA+hD,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDAAk3G,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAqpT,CAAC;;;sCAAiF,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAupnB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAw/M,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;qCAAgxB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAwyC,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAkkF,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAw5D,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;qCAAuyB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA80B,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;qCAAisB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;qCAAwsB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA63B,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA1+3C,CAAC;sBAA4P,CAAC;;;;;;;;;;;qBAA8Q,CAAC;;kBAAwH,CAAC;sBAA4P,CAAC;;;;;;;;;;;;qBAAuR,CAAC;;kBAAwH,CAAC;sBAAuK,CAAC;qBAA0M,CAAC;;;;kBAAmL,CAAC;sBAAkQ,CAAC;;;;;;;;;;;;qBAA0R,CAAC;;kBAAuK,CAAC;sBAA+P,CAAC;;;;;;;;;;;;;qBAAmS,CAAC;;kBAA8H,CAAC;sBAA6K,CAAC;qBAAmN,CAAC;;;;kBAAyL,CAAC;sBAAkQ,CAAC;;;;;;;;;;;;;;;;;qBAAgQ,CAAC;;kBAA6I,CAAC;sBAA8P,CAAC;;;;;;;;;;;;;;;;;;qBAAmS,CAAC;;kBAA8H,CAAC;sBAA8K,CAAC;qBAAoN,CAAC;;;;kBAAmM,CAAC;sBAA4Q,CAAC;;;;;;;;;;qBAA8S,CAAC;;kBAAwI,CAAC;sBAA4Q,CAAC;;;;;;;;;;;qBAAuT,CAAC;;kBAAwI,CAAC;sBAAuL,CAAC;qBAAkO,CAAC;;;;;;;;;iKAAntY,CAAC;;;;;;;;mBAxC73rB,MAAM;mBAGN,MAAM,SAAS,MAAM,QAAQ,MAAM;sBAOhC,MAAM;;;;;;;;;;;;;;;;;GA6B7B"}

package/dist/auth/buildAuth.js

@@ -1,311 +0,0 @@
-/** One Better Auth instance from `CreateMantleAuthOptions`: plugins, staff roles, database hooks and the session cache. */
-import { cimd } from "@better-auth/cimd";
-import { mcp } from "@better-auth/mcp";
-import { oauthProvider } from "@better-auth/oauth-provider";
-import { betterAuth } from "better-auth";
-import { admin, jwt } from "better-auth/plugins";
-import { createAccessControl } from "better-auth/plugins/access";
-import { defaultStatements } from "better-auth/plugins/admin/access";
-import { genericOAuth } from "better-auth/plugins/generic-oauth";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { STAFF_ROLES } from "../spec/domain/index.js";
-import { dbOf, readStoreInstanceId } from "./db.js";
-import { buildEmailOTPPlugin, buildGenericOAuthProviders, buildMagicLinkPlugin, buildOAuthProviderOptions, buildSocialProviders, buildTrustedOriginsFor, guardGithubLoginProfile, hasEmailAuthSurface, methodsRequireSameSiteNone, normalizeAuthBasePath, normalizeAuthErrorURL, pickSingleton, resolveClientIpHeaders, shouldPromoteToOwner, validateBootstrap } from "./methods.js";
-// Better Auth 1.7.7 initializes its shared stores asynchronously. Seed them
-// before any request can be canceled; the accessor-identity regression test
-// pins this version-specific integration to the stores Better Auth uses.
-const betterAuthGlobalKey = Symbol.for("better-auth:global");
-const betterAuthGlobals = globalThis;
-const betterAuthGlobal = betterAuthGlobals[betterAuthGlobalKey] ??= {
-    version: "",
-    epoch: 0,
-    context: {},
-};
-betterAuthGlobal.context.requestStateAsyncStorage ??= new AsyncLocalStorage();
-betterAuthGlobal.context.endpointContextAsyncStorage ??= new AsyncLocalStorage();
-betterAuthGlobal.context.adapterAsyncStorage ??= new AsyncLocalStorage();
-/**
- * Request-scoped retention for Better Auth's fire-and-forget work. Better Auth
- * hands `advanced.backgroundTasks.handler` a bare promise with no request in
- * sight; the handler reads the retainer the current `handler()` call stored
- * here and registers the promise with it. On Workers that retainer is
- * `ExecutionContext.waitUntil` — without it the OTP send and the rate-limit
- * cleanup can be cancelled the moment the response is returned (#976).
- */
-export const backgroundTaskRetention = new AsyncLocalStorage();
-const ac = createAccessControl(defaultStatements);
-const ownerAc = ac.newRole({
-    user: defaultStatements.user,
-    session: defaultStatements.session,
-});
-const editorAc = ac.newRole({
-    user: ["list", "ban", "get", "update"],
-    session: ["list", "revoke"],
-});
-const contributorAc = ac.newRole({
-    user: ["list", "get"],
-    session: [],
-});
-const userAc = ac.newRole({
-    user: [],
-    session: [],
-});
-export function buildAuth(config) {
-    const db = dbOf(config.driver);
-    const ipAddressHeaders = resolveClientIpHeaders(config.ipAddressHeaders);
-    if (config.hostOnlyCookies && (new URL(config.baseURL).protocol !== "https:" || config.crossSubDomainCookies?.enabled)) {
-        throw new Error("createMantleAuth: hostOnlyCookies requires HTTPS and cannot share cookies across subdomains.");
-    }
-    if (config.methods.length === 0 && !config.plugins?.length) {
-        throw new Error("createMantleAuth: methods[] is empty — register an AuthMethodConfig or native Better Auth plugin so staff can sign in.");
-    }
-    if (config.bootstrapOwner) {
-        validateBootstrap(config.bootstrapOwner, config.methods);
-    }
-    const socialProviders = buildSocialProviders(config.methods);
-    const genericOAuthProviders = buildGenericOAuthProviders(config.methods);
-    const bootstrap = config.bootstrapOwner;
-    const emailOtpMethod = pickSingleton(config.methods, "email-otp");
-    const magicLinkMethod = pickSingleton(config.methods, "magic-link");
-    const providerOptions = config.oauthProvider
-        ? buildOAuthProviderOptions(config.oauthProvider)
-        : null;
-    // Workers may not set NODE_ENV. Explicitly enable the provider's route
-    // limits too (notably anonymous DCR: 5/minute).
-    // ponytail: memory limits are per isolate; use an ingress rate-limit rule
-    // when a deployment needs a distributed abuse quota.
-    const hasEmailMethod = hasEmailAuthSurface(config.methods, config.plugins);
-    const rateLimit = {
-        window: 60,
-        max: hasEmailMethod ? 10 : 100,
-        ...config.rateLimit,
-        enabled: true,
-        storage: "memory",
-    };
-    // `trustedOrigins`: per-provider auto-origins (Apple needs
-    // `https://appleid.apple.com`) plus adopter-owned first-party
-    // origins for flows such as hosted auth across trusted subdomains.
-    const trustedOrigins = buildTrustedOriginsFor(config.methods, config.trustedOrigins);
-    const sdkPlugins = [
-        admin({
-            defaultRole: "user",
-            adminRoles: [...STAFF_ROLES],
-            ac,
-            roles: {
-                owner: ownerAc,
-                editor: editorAc,
-                contributor: contributorAc,
-                user: userAc,
-            },
-        }),
-        ...(genericOAuthProviders.length > 0
-            ? [
-                genericOAuth({
-                    config: genericOAuthProviders,
-                }),
-            ]
-            : []),
-        ...(emailOtpMethod ? [buildEmailOTPPlugin(emailOtpMethod, config.secret)] : []),
-        ...(magicLinkMethod ? [buildMagicLinkPlugin(magicLinkMethod)] : []),
-        ...(config.oauthProvider && providerOptions
-            ? [
-                jwt(),
-                config.oauthProvider.mcpResource
-                    ? mcp({
-                        ...providerOptions,
-                        resource: config.oauthProvider.mcpResource,
-                        extensions: [
-                            {
-                                claims: {
-                                    accessToken: ({ referenceId }) => ({ mantle_consent_id: referenceId ?? null }),
-                                },
-                            },
-                            ...(config.oauthProvider.extensions ?? []),
-                        ],
-                    })
-                    : oauthProvider({
-                        ...providerOptions,
-                        ...(config.oauthProvider.extensions
-                            ? { extensions: [...config.oauthProvider.extensions] }
-                            : {}),
-                    }),
-                ...(config.oauthProvider.mcpResource
-                    ? [
-                        cimd({
-                            // Cloudflare's `global_fetch_strictly_public` flag is the
-                            // runtime network boundary: resolution and connection stay
-                            // on the public Internet. Better Auth owns timeout, limits,
-                            // validation, caching, and redirect rejection above it.
-                            // Workers does not implement `redirect: "error"`; `manual`
-                            // exposes 3xx responses so Better Auth can reject them.
-                            fetchClientMetadataResource: (input, init) => fetch(input, { ...init, redirect: "manual" }),
-                            metadataProfile: "mcp-2026-07-28",
-                        }),
-                    ]
-                    : []),
-            ]
-            : []),
-    ];
-    const plugins = [...sdkPlugins, ...(config.plugins ?? [])];
-    const pluginIds = new Set();
-    for (const plugin of plugins) {
-        if (pluginIds.has(plugin.id)) {
-            throw new Error(`createMantleAuth: Better Auth plugin '${plugin.id}' is registered more than once. Remove the duplicate plugin.`);
-        }
-        pluginIds.add(plugin.id);
-    }
-    // `user.additionalFields`: SDK owns `githubLogin` only.
-    const userConfig = {
-        additionalFields: {
-            githubLogin: {
-                type: "string",
-                required: false,
-                // Better Auth applies `input: false` to trusted provider profiles too.
-                // Database hooks below keep this field provider-only instead.
-                input: true,
-            },
-        },
-    };
-    // `advanced`: SDK owns `backgroundTasks`. Apple auto-injects
-    // `defaultCookieAttributes.sameSite: "none"` because Apple's
-    // `form_post` callback is cross-site and a `lax` cookie won't ride
-    // it (Better Auth's default raises a state-mismatch).
-    const appleNeedsCrossSite = methodsRequireSameSiteNone(config.methods);
-    const advancedConfig = {
-        // Mantle converges lazily. Better Auth 1.7.7's automatic check runs at
-        // construction, before those tables exist. Keep its explicit schema check
-        // and run it in prepareAuth after convergence, before any auth operation.
-        database: { validateSchema: false },
-        // Host adapter supplies the trusted ingress header(s). Never default to XFF.
-        ipAddress: { ipAddressHeaders: [...ipAddressHeaders] },
-        ...(appleNeedsCrossSite
-            ? {
-                // Browsers require `secure: true` whenever `sameSite: "none"`.
-                defaultCookieAttributes: { secure: true, sameSite: "none" },
-            }
-            : {}),
-        ...(config.crossSubDomainCookies
-            ? { crossSubDomainCookies: config.crossSubDomainCookies }
-            : {}),
-        ...(config.cookiePrefix ? { cookiePrefix: config.cookiePrefix } : {}),
-        ...(config.hostOnlyCookies ? {
-            // Better Auth prepends __Secure- otherwise. Secure is set explicitly below.
-            useSecureCookies: false,
-            cookiePrefix: `__Host-${config.cookiePrefix || "better-auth"}`,
-            crossSubDomainCookies: { enabled: false },
-            defaultCookieAttributes: { secure: true, path: "/", ...(appleNeedsCrossSite ? { sameSite: "none" } : {}) },
-        } : {}),
-        // Fire-and-forget hook closes the user-existence timing oracle
-        // on OTP send — see § "Auth as contract" notes in ADR-0014.
-        backgroundTasks: {
-            handler: (p) => {
-                const settled = p.then(() => undefined, (err) => {
-                    // eslint-disable-next-line no-console
-                    console.error("[better-auth backgroundTask]", err);
-                });
-                // Registered with the request's retainer when the host supplied one;
-                // otherwise the work simply runs detached as before.
-                backgroundTaskRetention.getStore()?.(settled);
-            },
-        },
-    };
-    // `databaseHooks`: SDK owns `user.create.after` for bootstrap-owner
-    // promotion (when `bootstrapOwner` is configured).
-    const sdkUserCreateAfter = async (user) => {
-        if (!bootstrap)
-            return;
-        const u = user;
-        if (!shouldPromoteToOwner(bootstrap, u))
-            return;
-        // Atomic check-then-promote: the `NOT EXISTS` is a GLOBAL guard —
-        // it asks "does any user already hold a staff role?". The whole
-        // statement runs as one database op, so two concurrent first signups
-        // can't both win: the loser's UPDATE finds a staff user in the
-        // subquery and silently writes zero rows.
-        const placeholders = STAFF_ROLES.map(() => "?").join(",");
-        const promoted = (await db.all(`UPDATE "user" SET role = ? WHERE id = ? AND NOT EXISTS (SELECT 1 FROM "user" WHERE role IN (${placeholders})) RETURNING id`, "owner", u.id, ...STAFF_ROLES)).length;
-        if (promoted === 0) {
-            // Operator-visible signal that the rule matched but a prior
-            // staff user already exists — otherwise the silent no-op makes a
-            // misconfigured bootstrap rule indistinguishable from a working
-            // first-promotion.
-            console.warn(`[bootstrap] user ${u.id} matched bootstrapOwner rule but promotion was blocked — a staff user already exists.`);
-        }
-    };
-    const databaseHooks = {
-        user: {
-            create: {
-                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
-                after: sdkUserCreateAfter,
-            },
-            update: {
-                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
-            },
-        },
-        verification: {
-            create: {
-                before: async (verification) => {
-                    if (!config.oauthProvider?.mcpResource)
-                        return;
-                    let value;
-                    try {
-                        value = JSON.parse(verification.value);
-                    }
-                    catch {
-                        return; // OTPs and other verification values are not OAuth grants.
-                    }
-                    if (value?.type !== "authorization_code" || typeof value.userId !== "string" ||
-                        typeof value.query?.client_id !== "string")
-                        return;
-                    const consent = await db.first('SELECT id FROM "oauthConsent" WHERE "userId" = ? AND "clientId" = ? LIMIT 1', value.userId, value.query.client_id);
-                    // Better Auth carries referenceId from this code through every
-                    // refresh rotation. Never rebind an old lineage to a new consent.
-                    return { data: { value: JSON.stringify({ ...value, referenceId: consent?.id ?? "" }) } };
-                },
-            },
-        },
-    };
-    const sessionCache = config.sessionCache;
-    let storeInstanceId;
-    const cacheKey = async (key) => {
-        storeInstanceId ??= readStoreInstanceId(config.driver)
-            .catch((error) => { storeInstanceId = undefined; throw error; });
-        return `better-auth:${await storeInstanceId}:${key}`;
-    };
-    const secondaryStorage = sessionCache ? {
-        get: async (key) => key.startsWith("verification:")
-            ? Promise.resolve(null)
-            : sessionCache.get(await cacheKey(key)),
-        set: async (key, value, ttl) => key.startsWith("verification:")
-            ? Promise.resolve()
-            : sessionCache.set(await cacheKey(key), value, ttl ? Math.max(60, Math.ceil(ttl)) : undefined),
-        delete: async (key) => key.startsWith("verification:")
-            ? Promise.resolve()
-            : sessionCache.delete(await cacheKey(key)),
-        // Verification and rate limiting stay in the primary store / memory below. Fail loudly if
-        // Better Auth starts routing either atomic operation through this adapter.
-        getAndDelete: async () => { throw new Error("Better Auth KV getAndDelete is disabled"); },
-        increment: async () => { throw new Error("Better Auth KV increment is disabled"); },
-    } : undefined;
-    return betterAuth({
-        database: config.database,
-        secondaryStorage,
-        session: { storeSessionInDatabase: true },
-        verification: { storeInDatabase: true },
-        secret: config.secret,
-        baseURL: config.baseURL,
-        basePath: normalizeAuthBasePath(config.basePath),
-        onAPIError: { errorURL: normalizeAuthErrorURL(config.errorURL, config.baseURL) },
-        socialProviders,
-        ...(config.accountLinking
-            ? { account: { accountLinking: config.accountLinking } }
-            : {}),
-        user: userConfig,
-        rateLimit,
-        trustedOrigins,
-        advanced: advancedConfig,
-        plugins,
-        databaseHooks,
-    });
-}
-//# sourceMappingURL=buildAuth.js.map

package/dist/auth/buildAuth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"buildAuth.js","sourceRoot":"","sources":["../../src/auth/buildAuth.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EAAwB,mBAAmB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE5Y,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,UAEzB,CAAC;AACF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,KAAK;IAClE,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,EAAE;CACZ,CAAC;AACF,gBAAgB,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI,iBAAiB,EAAE,CAAC;AAC9E,gBAAgB,CAAC,OAAO,CAAC,2BAA2B,KAAK,IAAI,iBAAiB,EAAE,CAAC;AACjF,gBAAgB,CAAC,OAAO,CAAC,mBAAmB,KAAK,IAAI,iBAAiB,EAAE,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,iBAAiB,EAA0B,CAAC;AAQvF,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAElD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC,IAAI;IAC5B,OAAO,EAAE,iBAAiB,CAAC,OAAO;CACnC,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IACtC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC5B,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;IACxB,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,MAA+B;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wHAAwH,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa;QAC1C,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,uEAAuE;IACvE,gDAAgD;IAChD,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;QAC9B,GAAG,MAAM,CAAC,SAAS;QACnB,OAAO,EAAE,IAAa;QACtB,OAAO,EAAE,QAAiB;KAC3B,CAAC;IAEF,2DAA2D;IAC3D,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC;YACJ,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC;YAC5B,EAAE;YACF,KAAK,EAAE;gBACL,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,aAAa;gBAC1B,IAAI,EAAE,MAAM;aACb;SACF,CAAC;QACF,GAAG,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,CAAC;oBACX,MAAM,EAAE,qBAAqB;iBAC9B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,eAAe;YACzC,CAAC,CAAC;gBACE,GAAG,EAAE;gBACL,MAAM,CAAC,aAAa,CAAC,WAAW;oBAC9B,CAAC,CAAC,GAAG,CAAC;wBACF,GAAG,eAAe;wBAClB,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW;wBAC1C,UAAU,EAAE;4BACV;gCACE,MAAM,EAAE;oCACN,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC;iCAC/E;6BACF;4BACD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;yBAC3C;qBACF,CAAC;oBACJ,CAAC,CAAC,aAAa,CAAC;wBACZ,GAAG,eAAe;wBAClB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU;4BACjC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;4BACtD,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW;oBAClC,CAAC,CAAC;wBACE,IAAI,CAAC;4BACH,0DAA0D;4BAC1D,2DAA2D;4BAC3D,4DAA4D;4BAC5D,wDAAwD;4BACxD,2DAA2D;4BAC3D,wDAAwD;4BACxD,2BAA2B,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC3C,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;4BAC/C,eAAe,EAAE,gBAAgB;yBAClC,CAAC;qBACH;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,EAAE,8DAA8D,CAAC,CAAC;QACpI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,MAAM,UAAU,GAAG;QACjB,gBAAgB,EAAE;YAChB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,QAAQ,EAAE,KAAK;gBACf,uEAAuE;gBACvE,8DAA8D;gBAC9D,KAAK,EAAE,IAAI;aACZ;SACF;KACF,CAAC;IAEF,6DAA6D;IAC7D,6DAA6D;IAC7D,mEAAmE;IACnE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG;QACrB,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE;QACnC,6EAA6E;QAC7E,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE;QACtD,GAAG,CAAC,mBAAmB;YACrB,CAAC,CAAC;gBACE,+DAA+D;gBAC/D,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,qBAAqB;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YAC3B,4EAA4E;YAC5E,gBAAgB,EAAE,KAAK;YACvB,YAAY,EAAE,UAAU,MAAM,CAAC,YAAY,IAAI,aAAa,EAAE;YAC9D,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpH,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,4DAA4D;QAC5D,eAAe,EAAE;YACf,OAAO,EAAE,CAAC,CAAmB,EAAE,EAAE;gBAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC9C,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;gBACH,qEAAqE;gBACrE,qDAAqD;gBACrD,uBAAuB,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;SACF;KACF,CAAC;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAa,EAAiB,EAAE;QAChE,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,CAAC,GAAG,IAIT,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC;YAAE,OAAO;QAEhD,kEAAkE;QAClE,gEAAgE;QAChE,qEAAqE;QACrE,+DAA+D;QAC/D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,+FAA+F,YAAY,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACpM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,4DAA4D;YAC5D,iEAAiE;YACjE,gEAAgE;YAChE,mBAAmB;YACnB,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,uFAAuF,CAAC,CAAC;QAChI,CAAC;IACH,CAAC,CAAC;IACF,MAAM,aAAa,GAAuC;QACxD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAuC,EAAE,OAAwB,EAAE,EAAE,CAClF,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;gBACxD,KAAK,EAAE,kBAAkB;aAC1B;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAuC,EAAE,OAAwB,EAAE,EAAE,CAClF,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;aACzD;SACF;QACD,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;oBAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW;wBAAE,OAAO;oBAC/C,IAAI,KAAK,CAAC;oBACV,IAAI,CAAC;wBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAEpC,CAAC;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,2DAA2D;oBACrE,CAAC;oBACD,IAAI,KAAK,EAAE,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;wBACxE,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,KAAK,QAAQ;wBAAE,OAAO;oBACvD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAiB,6EAA6E,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACnK,+DAA+D;oBAC/D,kEAAkE;oBAClE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3F,CAAC;aACF;SACF;KACF,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,IAAI,eAA4C,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;QACtD,eAAe,KAAK,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;aACnD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,eAAe,GAAG,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,eAAe,MAAM,eAAe,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YACzD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YACtF,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;YACnB,CAAC,CAAC,YAAY,CAAC,GAAG,CACd,MAAM,QAAQ,CAAC,GAAG,CAAC,EACnB,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/C;QACL,MAAM,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAC5D,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;YACnB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,0FAA0F;QAC1F,2EAA2E;QAC3E,YAAY,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC;QACzF,SAAS,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;KACpF,CAAC,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB;QAChB,OAAO,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChD,UAAU,EAAE,EAAE,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;QAChF,eAAe;QACf,GAAG,CAAC,MAAM,CAAC,cAAc;YACvB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,UAAU;QAChB,SAAS;QACT,cAAc;QACd,QAAQ,EAAE,cAAc;QACxB,OAAO;QACP,aAAa;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/callerResolver.d.ts

@@ -1,48 +0,0 @@
-import type { OAuthAccessTokenVerification } from "./types.js";
-import type { CallerResolver, CredentialKind } from "../core/index.js";
-/** The three things the resolver needs of a Better Auth facade; a custom facade only has to provide these. */
-export interface AuthLike {
-    getSession(request: Request): Promise<{
-        session: {
-            id: string;
-        };
-        user: {
-            id: string;
-            role?: string | null; /** the role came from the same uncached read */
-            roleCurrent?: true;
-        };
-    } | null>;
-    getUserRole(userId: string): Promise<string | null>;
-    verifyOAuthAccessToken(tokenOrRequest: string | Request, options: {
-        audience: string;
-        scopes?: readonly string[];
-    }): Promise<OAuthAccessTokenVerification>;
-}
-export type ConsumerCredentialResolution = {
-    readonly kind: "not-handled";
-} | {
-    readonly kind: "invalid";
-} | {
-    readonly kind: "verified";
-    readonly credential: {
-        readonly credential: Extract<CredentialKind, "api-key" | "personal-token">;
-        readonly credentialId: string | null;
-        /** The application subject key. A machine credential names its own stable one (say `key:<id>`): every Caller has a subject. */
-        readonly subject: string;
-        readonly clientId?: string | null;
-        readonly scopes?: readonly string[];
-    };
-};
-export interface CallerResolverOptions {
-    /** Where a service recognises and verifies its own credential formats; Core never stores or issues them. */
-    readonly credentialResolver?: (request: Request) => ConsumerCredentialResolution | Promise<ConsumerCredentialResolution>;
-    /** Enables OAuth access tokens, verified against the Auth's issuer and JWKS. `scopes` is a server-wide floor. */
-    readonly jwtBearer?: {
-        readonly audience: string;
-        readonly scopes?: readonly string[];
-    };
-    /** Informational, copied to `Caller.issuer`. */
-    readonly issuer?: string;
-}
-export declare function createCallerResolver(auth: AuthLike, options?: CallerResolverOptions): CallerResolver;
-//# sourceMappingURL=callerResolver.d.ts.map

package/dist/auth/callerResolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"callerResolver.d.ts","sourceRoot":"","sources":["../../src/auth/callerResolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,KAAK,EAAU,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE/E,8GAA8G;AAC9G,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,gDAAgD;YAAC,WAAW,CAAC,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3L,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5J;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAC;QAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,+HAA+H;QAC/H,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,4GAA4G;IAC5G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzH,iHAAiH;IACjH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACxF,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAKD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAsCxG"}

package/dist/auth/callerResolver.js

@@ -1,49 +0,0 @@
-/**
- * `CallerResolver` for a Better Auth identity (ADR-0032 decision 8). Precedence: a service's own credential, an OAuth access
- * token (Bearer or DPoP), the cookie session. A presented credential that fails never falls back to a session cookie, and only
- * "no credential presented" is anonymous. The role is read fresh on every request so a revoked staff role cannot linger in a
- * session snapshot.
- */
-import { STAFF_ROLES } from "../spec/domain/index.js";
-const STAFF = new Set(STAFF_ROLES);
-const invalid = (challenge, status) => ({ invalid: true, challenge, ...(status ? { status } : {}) });
-export function createCallerResolver(auth, options = {}) {
-    const user = async (subject, credential, credentialId, clientId, scopes, role) => {
-        const current = role !== undefined ? role : await auth.getUserRole(subject);
-        return {
-            kind: "user", subject, ...(options.issuer ? { issuer: options.issuer } : {}),
-            role: current && STAFF.has(current) ? current : null, scopes, credential, credentialId, clientId,
-        };
-    };
-    return async (request) => {
-        if (options.credentialResolver) {
-            const r = await options.credentialResolver(request);
-            if (r.kind === "invalid")
-                return invalid('Bearer error="invalid_token"');
-            if (r.kind === "verified") {
-                const c = r.credential;
-                return { caller: await user(c.subject, c.credential, c.credentialId, c.clientId ?? null, c.scopes ?? []) };
-            }
-        }
-        const authorization = request.headers.get("authorization");
-        if (authorization !== null) {
-            // MCP clients use DPoP (sender-constrained) tokens; the verifier checks the proof
-            const m = /^(Bearer|DPoP) ([^\s]+)$/i.exec(authorization);
-            if (!m || !options.jwtBearer)
-                return invalid('Bearer error="invalid_token"');
-            const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer";
-            const v = await auth.verifyOAuthAccessToken(request, { audience: options.jwtBearer.audience, scopes: options.jwtBearer.scopes });
-            if (!v.ok) {
-                const error = v.reason === "invalid-dpop-proof" ? "invalid_dpop_proof" : v.reason === "insufficient-scope" ? "insufficient_scope" : "invalid_token";
-                const scope = v.missingScopes?.length ? `, scope="${v.missingScopes.join(" ")}"` : "";
-                return invalid(`${scheme} error="${error}"${scope}`, v.status);
-            }
-            return { caller: await user(v.userId, "oauth", v.credentialId, v.clientId, v.scopes) };
-        }
-        const session = await auth.getSession(request);
-        if (!session)
-            return { caller: { kind: "anonymous" } };
-        return { caller: await user(session.user.id, "session", session.session.id, null, [], session.user.roleCurrent ? (session.user.role ?? null) : undefined) };
-    };
-}
-//# sourceMappingURL=callerResolver.js.map

package/dist/auth/callerResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"callerResolver.js","sourceRoot":"","sources":["../../src/auth/callerResolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAkB,MAAM,yBAAyB,CAAC;AAmCtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;AAC3C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,MAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAElI,MAAM,UAAU,oBAAoB,CAAC,IAAc,EAAE,UAAiC,EAAE;IACtF,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,UAA0B,EAAE,YAA2B,EAAE,QAAuB,EAAE,MAAyB,EAAE,IAAoB,EAAmB,EAAE;QACzL,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ;SAChH,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7G,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,kFAAkF;YAClF,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YACjI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;gBACpJ,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,OAAO,OAAO,CAAC,GAAG,MAAM,WAAW,KAAK,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9J,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/createAuthRoutes.d.ts

@@ -1,22 +0,0 @@
-/**
- * The auth routes a service mounts once (ADR-0032 decision 8): Better Auth under its base path, the OAuth discovery metadata Better
- * Auth serves natively (RFC 8414 and RFC 9728), `{basePath}/methods`, and the consent routes under `/oauth`. Only the consent routes
- * need a Caller, so only they run behind `withCaller`: a token request authenticating its client with HTTP Basic would otherwise be
- * refused before Better Auth saw it. A consent is given or revoked by the signed-in person only, never by a bearer token.
- */
-import type { CallerResolver } from "../core/index.js";
-import type { MantleAuth, MantleAuthRequestContext } from "./types.js";
-export type AuthRoutesAuth = Pick<MantleAuth, "basePath" | "handler" | "methods" | "getOAuthConsentRequest" | "completeOAuthConsent" | "listOAuthConsents" | "revokeOAuthConsent">;
-export interface AuthRoutesOptions {
-    /** Resolves the Caller of the consent routes; usually `createCallerResolver(auth)`. */
-    readonly resolver: CallerResolver;
-    /**
-     * Where `GET /oauth/consents` sends the browser, e.g. Admin's connected-apps page. Without it, that route answers a plain HTML
-     * page, as `GET /oauth/consent` does, so OAuth works on a service without Admin. Point `oauthProvider.consentPage` at Admin's own
-     * page, `/admin/oauth/consent`, to use it for consent.
-     */
-    readonly connectedAppsPage?: string;
-}
-/** The service's auth entry: a Response for a path it owns, `null` for any other. */
-export declare function createAuthRoutes(auth: AuthRoutesAuth, options: AuthRoutesOptions): (request: Request, context?: MantleAuthRequestContext) => Promise<Response | null>;
-//# sourceMappingURL=createAuthRoutes.d.ts.map

package/dist/auth/createAuthRoutes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createAuthRoutes.d.ts","sourceRoot":"","sources":["../../src/auth/createAuthRoutes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,kBAAkB,CAAC;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAGvE,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,wBAAwB,GAAG,sBAAsB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;AAEnL,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAOD,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAWrK"}

package/dist/auth/createAuthRoutes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createAuthRoutes.js","sourceRoot":"","sources":["../../src/auth/createAuthRoutes.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAenD,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC;AACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,0BAA0B,EAAE,6BAA6B,CAAC,CAAC,CAAC;AAC7G,MAAM,UAAU,GAAG,8EAA8E,CAAC;AAElG,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,IAAoB,EAAE,OAA0B;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,GAAG,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9J,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxG,sHAAsH;QACtH,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpI,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,IAAoB,EAAE,OAA0B;IACtE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACjG,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/F,IAAI,KAAK,KAAK,yBAAyB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACxF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,4CAA4C;YACxH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpH,mHAAmH;YACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3H,MAAM,MAAM,GAAG,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,IAAI,CAAC,MAAM,IAAI,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClJ,2FAA2F;YAC3F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,iBAAiB;gBAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1G,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACvF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,KAAK,6BAA6B,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACvE,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACzF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED,6HAA6H;AAE7H;;;GAGG;AACH,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,GAAG,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,aAAa,EAAE,wBAAwB,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM;YACxJ,yBAAyB,EAAE,2GAA2G;SACvI;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,GAAG;IACR,EAAE,EAAE;QACF,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG;QACzG,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,8HAA8H;QACvJ,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,gFAAgF;QAChO,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,sHAAsH,EAAE,KAAK,EAAE,+BAA+B,EAAE,MAAM,EAAE,YAAY;KACxN;IACD,OAAO,EAAE;QACP,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK;QAC7F,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,iDAAiD;QAC1E,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,6BAA6B;QAC9H,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,2CAA2C,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM;KAClH;CACO,CAAC;AAGX,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACjF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACtD,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,6GAA6G,KAAK,UAAU;IACnK,8PAA8P,IAAI,uBAAuB,CAAC;AAE5R,SAAS,WAAW,CAAC,CAAS,EAAE,KAAiC;IAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACf,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,WAAW,MAAM,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrC,0FAA0F;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC1I,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAChG,MAAM,CAAC,CAAC,SAAS,UAAU,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,mDAAmD;QAChM,kDAAkD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,4DAA4D,CAAC,CAAC,OAAO,YAAY;QACxJ,sDAAsD,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,QAAqC;IACzE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACf,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5E,gBAAgB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,6DAA6D;QAC3H,iDAAiD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,MAAM,4BAA4B,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvI,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,OAAO,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/dist/auth/createMantleAuth.d.ts

@@ -1,3 +0,0 @@
-import { type CreateMantleAuthOptions, type MantleAuth } from "./types.js";
-export declare function createMantleAuth(config: CreateMantleAuthOptions): MantleAuth;
-//# sourceMappingURL=createMantleAuth.d.ts.map

package/dist/auth/createMantleAuth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createMantleAuth.d.ts","sourceRoot":"","sources":["../../src/auth/createMantleAuth.ts"],"names":[],"mappings":"AAWA,OAAO,EAAuB,KAAK,uBAAuB,EAAE,KAAK,UAAU,EAAkB,MAAM,YAAY,CAAC;AAIhH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,uBAAuB,GAAG,UAAU,CAme5E"}