@aotter/mantle 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/auth/methods.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../src/auth/methods.ts"],"names":[],"mappings":"AAAA,sIAAsI;AACtI,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAInF,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAoB,MAAM,YAAY,CAAC;AAC9G,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAc1E;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,GACzC,SAAS,MAAM,EAAE,CAWnB;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAO3F;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAiBzE;AAwBD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,iBAAiB,CAAC,iBAAiB,CAAC,CAyBtC;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,kBAAkB,EAAE,CA0BtB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK7E;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA3BjF,CAAC;;;;;;;;;yBAKK,CAAC;yBACN,CAAC;;;;;;;;;;EAyCd;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,EACxD,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAvBd,CAAF;;;;;;;;;;;;qBAMkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAqFjB,CAAA;iCAAkD,CAAC;;;;;;;;;6BAMlB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAsCjB,CAAC;iCACM,CAAC;;;;;;;;;6BAS2B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA7I5D;AAID,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,OAAO,GAAE,aAAa,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAM,GACnD,OAAO,CAGT;AAED,gFAAgF;AAChF,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,IAAI,CAcN;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7E,OAAO,CAQT;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD,GAAG,IAAI,CAAC;AAET,wEAAwE;AACxE,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACvC,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAAG,SAAS,CAY/D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,gBAAgB,CAAC,MAAM,CAAC,EAC9D,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,GAAG,SAAS,CAUpD;AAeD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACxC,UAAU,GAAE,aAAa,CAAC,MAAM,CAAM,GACrC,MAAM,EAAE,CAKV;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,GACvC,OAAO,CAET;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,mBAAmB,GAC1B,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CA+CrC"}

package/dist/auth/methods.js

@@ -1,321 +0,0 @@
-import { splitSetCookieHeader } from "better-auth/cookies";
-import { emailOTP, magicLink } from "better-auth/plugins";
-import { signInCodeEmail, signInLinkEmail } from "./emailTemplates.js";
-export function normalizeAuthBasePath(basePath) {
-    if (basePath === undefined)
-        return "/api/auth";
-    const trimmed = basePath.trim();
-    if (trimmed === "")
-        return "/api/auth";
-    if (!trimmed.startsWith("/")) {
-        throw new Error("createMantleAuth: basePath must start with '/'.");
-    }
-    if (trimmed === "/") {
-        throw new Error("createMantleAuth: basePath must not be '/'.");
-    }
-    if (trimmed.endsWith("/")) {
-        return trimmed.replace(/\/+$/, "");
-    }
-    return trimmed;
-}
-/** @internal exported for unit tests; not part of the public API. */
-export function resolveClientIpHeaders(headers) {
-    const resolved = (headers ?? [])
-        .map((header) => header.trim())
-        .filter((header) => header.length > 0);
-    if (resolved.length === 0) {
-        throw new Error("createMantleAuth: ipAddressHeaders is required and must name at least one host-trusted ingress header. " +
-            "Do not default to client-controlled X-Forwarded-For. Host adapters must pass the header(s) their ingress overwrites.");
-    }
-    return resolved;
-}
-export function normalizeAuthErrorURL(errorURL, baseURL) {
-    const base = new URL(baseURL);
-    const resolved = new URL(errorURL ?? "/", base);
-    if (resolved.origin !== base.origin) {
-        throw new Error("createMantleAuth: errorURL must be same-origin with baseURL.");
-    }
-    return `${resolved.pathname}${resolved.search}`;
-}
-export function normalizeAuthResponseCookies(response) {
-    const setCookie = response.headers.get("set-cookie");
-    if (!setCookie)
-        return response;
-    const values = response.headers.getSetCookie?.() ??
-        [setCookie];
-    const cookies = values.flatMap(splitSetCookieHeader);
-    if (cookies.length < 2)
-        return response;
-    const headers = new Headers(response.headers);
-    headers.delete("set-cookie");
-    for (const cookie of cookies)
-        headers.append("set-cookie", cookie);
-    return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers,
-    });
-}
-function withGithubLogin(options) {
-    return typeof options === "function"
-        ? async () => withGithubLoginMapper(await options())
-        : withGithubLoginMapper(options);
-}
-function withGithubLoginMapper(options) {
-    const developerMapper = options.mapProfileToUser;
-    return {
-        ...options,
-        mapProfileToUser: async (profile) => ({
-            ...(developerMapper ? await developerMapper(profile) : {}),
-            githubLogin: profile.login,
-        }),
-    };
-}
-export function buildSocialProviders(methods) {
-    const out = {};
-    // Duplicate-provider guard: catch the case where two `social`
-    // methods declare the same `provider` id. Better Auth would
-    // silently keep the latter (Record overwrite); for SDK adopters —
-    // and especially for the upcoming feature-overlay path where a
-    // feature can contribute auth methods into the same starter's
-    // `methods[]` array — that silent overwrite is a footgun. Throw at
-    // construction with a clear message so the conflict surfaces
-    // before the first sign-in.
-    const seenProviders = new Set();
-    for (const method of methods) {
-        if (method.kind !== "social")
-            continue;
-        if (seenProviders.has(method.provider)) {
-            throw new Error(`createMantleAuth: social provider '${method.provider}' is registered more than once; ` +
-                `each provider can have only one methods[] entry. Remove the redundant entry or pick a different provider.`);
-        }
-        seenProviders.add(method.provider);
-        out[method.provider] = method.provider === "github"
-            ? withGithubLogin(method.options)
-            : method.options;
-    }
-    return out;
-}
-export function buildGenericOAuthProviders(methods) {
-    const seenProviderIds = new Set();
-    const socialProviderIds = new Set(methods.flatMap((method) => method.kind === "social" ? [method.provider] : []));
-    const out = [];
-    for (const method of methods) {
-        if (method.kind !== "oauth")
-            continue;
-        if (socialProviderIds.has(method.options.providerId)) {
-            throw new Error(`createMantleAuth: OAuth providerId '${method.options.providerId}' conflicts with a registered social provider id. Provider ids must be unique across methods[].`);
-        }
-        if (seenProviderIds.has(method.options.providerId)) {
-            throw new Error(`createMantleAuth: OAuth provider '${method.options.providerId}' is registered more than once; ` +
-                `each providerId can have only one methods[] entry.`);
-        }
-        seenProviderIds.add(method.options.providerId);
-        if (!method.options.discoveryUrl && !(method.options.authorizationUrl && method.options.tokenUrl)) {
-            throw new Error(`createMantleAuth: OAuth provider '${method.options.providerId}' needs either discoveryUrl or both authorizationUrl and tokenUrl.`);
-        }
-        out.push(method.options);
-    }
-    return out;
-}
-/**
- * First tag off `Accept-Language`, quality values ignored. Locale
- * contract lives in `EmailSender.ts`.
- */
-export function pickLocale(req, fallback) {
-    const header = req?.headers.get("accept-language");
-    if (!header)
-        return fallback;
-    const first = header.split(",")[0]?.split(";")[0]?.trim();
-    return first && first.length > 0 ? first : fallback;
-}
-const MAGIC_LINK_DEFAULT_EXPIRES_SECONDS = 900;
-export function buildMagicLinkPlugin(method) {
-    const fallback = method.fallbackLocale ?? "en";
-    return magicLink({
-        storeToken: "hashed",
-        expiresIn: MAGIC_LINK_DEFAULT_EXPIRES_SECONDS,
-        ...method.options,
-        // Returned synchronously — same fire-and-forget contract as
-        // email-otp via `advanced.backgroundTasks.handler`. The body
-        // carries the click-URL; SDK doesn't ship a template, the
-        // sender can render plain text or richer HTML.
-        sendMagicLink: (data, ctx) => {
-            const locale = pickLocale(ctx?.request, fallback);
-            return method.sender.send({
-                to: data.email,
-                ...signInLinkEmail(data.url),
-                locale,
-                category: "auth.magic-link.sign-in",
-            });
-        },
-    });
-}
-export function buildEmailOTPPlugin(method, secret) {
-    const fallback = method.fallbackLocale ?? "en";
-    return emailOTP({
-        storeOTP: { hash: (otp) => hashEmailOtp(secret, otp) },
-        ...method.options,
-        // Return synchronously — the promise is fire-and-forget via the
-        // `advanced.backgroundTasks.handler` we wire in `buildAuth`. For
-        // `email-verification` / `forget-password` types Better Auth only
-        // calls this when the user exists, so awaiting would leak account
-        // existence through response latency. See Better Auth's own
-        // sendVerificationOTP docstring + reviewer finding in PR #161.
-        sendVerificationOTP: (data, ctx) => {
-            const locale = pickLocale(ctx?.request, fallback);
-            return method.sender.send({
-                to: data.email,
-                ...signInCodeEmail(data.otp),
-                locale,
-                category: `auth.email-otp.${data.type}`,
-            });
-        },
-    });
-}
-const EMAIL_AUTH_PLUGIN_IDS = new Set(["email-otp", "magic-link"]);
-/** Exported for the adapters' unit tests; not part of the supported API. */
-export function hasEmailAuthSurface(methods, plugins = []) {
-    return methods.some((method) => method.kind === "email-otp" || method.kind === "magic-link")
-        || plugins.some((plugin) => EMAIL_AUTH_PLUGIN_IDS.has(plugin.id));
-}
-/** HMAC-SHA-256(secret, otp) as unpadded base64url. Exported for tests only. */
-export async function hashEmailOtp(secret, otp) {
-    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-    const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(otp)));
-    let binary = "";
-    for (const byte of mac)
-        binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
-}
-/**
- * Cross-check bootstrap rule against registered methods. Catches the
- * silent-no-op case where the rule's discriminator can never match
- * any signal a registered method actually produces — e.g.
- * `match: "github-login"` with no `github` provider registered. Throws
- * at construction so vibe-coders see the mistake before the first
- * sign-in attempt.
- *
- * `match: "email"` is permissive — every Better Auth method that
- * creates a user populates `email`, including GitHub (via the
- * upstream profile). No registration constraint to enforce.
- */
-export function validateBootstrap(rule, methods) {
-    if (rule.match === "github-login") {
-        const hasGithub = methods.some((method) => (method.kind === "social" && method.provider === "github") ||
-            (method.kind === "oauth" && method.options.providerId === "github"));
-        if (!hasGithub) {
-            throw new Error("createMantleAuth: bootstrapOwner.match='github-login' but no GitHub provider is registered. " +
-                "Register social GitHub or a trusted OAuth providerId='github', or switch to email matching.");
-        }
-    }
-}
-export function shouldPromoteToOwner(rule, user) {
-    const target = rule.value.trim().toLowerCase();
-    switch (rule.match) {
-        case "github-login":
-            return !!user.githubLogin && user.githubLogin.toLowerCase() === target;
-        case "email":
-            return !!user.email && user.email.toLowerCase() === target;
-    }
-}
-/** Keep provider-owned GitHub logins off user-controlled auth paths. */
-export function guardGithubLoginProfile(user, context, methods) {
-    if (!("githubLogin" in user))
-        return undefined;
-    const providerId = context?.path === "/callback/:id" ? context.params?.id : null;
-    const trusted = typeof providerId === "string" && methods.some((method) => method.kind === "social"
-        ? context?.path === "/callback/:id" && method.provider === "github" && providerId === "github"
-        : method.kind === "oauth" &&
-            context?.path === "/callback/:id" &&
-            method.options.providerId === providerId &&
-            Boolean(method.options.mapProfileToUser));
-    return trusted ? undefined : { data: { githubLogin: null } };
-}
-/**
- * Find the at-most-one method of `kind`. Throws when adopters register
- * the same kind twice — Better Auth's plugin layer accepts duplicates
- * silently, which would mask the intent at boot. One helper covers
- * every singleton-shaped method (email-otp, magic-link, future ones).
- */
-export function pickSingleton(methods, kind) {
-    const matches = methods.filter((m) => m.kind === kind);
-    if (matches.length > 1) {
-        throw new Error(`createMantleAuth: more than one \`${kind}\` method registered. Combine into one.`);
-    }
-    return matches[0];
-}
-/**
- * Origins each registered social provider needs in
- * `trustedOrigins`. Adding a provider that demands an extra
- * `trustedOrigins` entry = adding a row here. Apple is the only one
- * in 1.6.9 that hard-requires this; if Better Auth ever drops the
- * requirement, the entry stays harmless (Better Auth dedupes).
- */
-const SOCIAL_PROVIDER_TRUSTED_ORIGINS = {
-    apple: ["https://appleid.apple.com"],
-};
-export function buildTrustedOriginsFor(methods, configured = []) {
-    const origins = methods.flatMap((m) => m.kind === "social" ? SOCIAL_PROVIDER_TRUSTED_ORIGINS[m.provider] ?? [] : []);
-    return [...new Set([...origins, ...configured])];
-}
-/**
- * Apple uses `response_mode=form_post` — Apple POSTs cross-site to
- * our callback. The OAuth state cookie must have `sameSite: "none"`
- * (and `secure: true`, which browsers require alongside) or the
- * cookie won't ride the POST and Better Auth raises a state mismatch.
- * Other providers don't need this. We only auto-set when Apple is
- * registered AND the adopter hasn't already specified
- * `defaultCookieAttributes.sameSite` themselves.
- */
-export function methodsRequireSameSiteNone(methods) {
-    return methods.some((m) => m.kind === "social" && m.provider === "apple");
-}
-export function buildOAuthProviderOptions(config) {
-    return {
-        loginPage: config.loginPage,
-        consentPage: config.consentPage,
-        ...(config.scopes ? { scopes: [...config.scopes] } : {}),
-        ...(config.resources
-            ? { resources: [...config.resources] }
-            : {}),
-        ...(config.clientRegistrationDefaultResources
-            ? { clientRegistrationDefaultResources: [...config.clientRegistrationDefaultResources] }
-            : {}),
-        ...(config.mcpResource
-            ? {
-                clientRegistrationClientSecretExpiration: "90d",
-                allowPublicClientPrelogin: true,
-            }
-            : {}),
-        ...(config.allowDynamicClientRegistration !== undefined
-            ? { allowDynamicClientRegistration: config.allowDynamicClientRegistration }
-            : {}),
-        ...(config.allowUnauthenticatedClientRegistration !== undefined
-            ? {
-                allowUnauthenticatedClientRegistration: config.allowUnauthenticatedClientRegistration,
-            }
-            : {}),
-        ...(config.clientRegistrationDefaultScopes
-            ? {
-                clientRegistrationDefaultScopes: [
-                    ...config.clientRegistrationDefaultScopes,
-                ],
-            }
-            : {}),
-        ...(config.clientRegistrationAllowedScopes
-            ? {
-                clientRegistrationAllowedScopes: [
-                    ...config.clientRegistrationAllowedScopes,
-                ],
-            }
-            : {}),
-        ...(config.cachedTrustedClients
-            ? { cachedTrustedClients: new Set(config.cachedTrustedClients) }
-            : {}),
-        ...(config.clientPrivileges
-            ? { clientPrivileges: config.clientPrivileges }
-            : {}),
-    };
-}
-//# sourceMappingURL=methods.js.map

package/dist/auth/methods.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../src/auth/methods.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAA2B,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGvE,MAAM,UAAU,qBAAqB,CAAC,QAA4B;IAChE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB,CACpC,OAA0C;IAE1C,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,yGAAyG;YACvG,sHAAsH,CACzH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAA4B,EAAE,OAAe;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAkB;IAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,MAAM,MAAM,GACT,QAAQ,CAAC,OAAuD,CAAC,YAAY,EAAE,EAAE;QAClF,CAAC,SAAS,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAOD,SAAS,eAAe,CAAC,OAA+C;IACtE,OAAO,OAAO,OAAO,KAAK,UAAU;QAClC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA4B;IACzD,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACjD,OAAO;QACL,GAAG,OAAO;QACV,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YACpC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,WAAW,EAAE,OAAO,CAAC,KAAK;SAC3B,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAwC;IAExC,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,8DAA8D;IAC9D,4DAA4D;IAC5D,kEAAkE;IAClE,+DAA+D;IAC/D,8DAA8D;IAC9D,mEAAmE;IACnE,6DAA6D;IAC7D,4BAA4B;IAC5B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,sCAAsC,MAAM,CAAC,QAAQ,kCAAkC;gBACrF,2GAA2G,CAC9G,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACjD,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,OAAO,GAAsB,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CACpD,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACzB,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAClD,CACF,CAAC;IACF,MAAM,GAAG,GAAkD,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACtC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,OAAO,CAAC,UAAU,iGAAiG,CAAC,CAAC;QACrL,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,CAAC,OAAO,CAAC,UAAU,kCAAkC;gBAC9F,oDAAoD,CACvD,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,OAAO,CAAC,UAAU,oEAAoE,CAAC,CAAC;QACtJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAwB,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAE/C,MAAM,UAAU,oBAAoB,CAAC,MAAyD;IAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,OAAO,SAAS,CAAC;QACf,UAAU,EAAE,QAAQ;QACpB,SAAS,EAAE,kCAAkC;QAC7C,GAAG,MAAM,CAAC,OAAO;QACjB,4DAA4D;QAC5D,6DAA6D;QAC7D,0DAA0D;QAC1D,+CAA+C;QAC/C,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC5B,MAAM;gBACN,QAAQ,EAAE,yBAAyB;aACpC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAwD,EACxD,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC;IAC/C,OAAO,QAAQ,CAAC;QACd,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACtD,GAAG,MAAM,CAAC,OAAO;QACjB,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,mBAAmB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACxB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC5B,MAAM;gBACN,QAAQ,EAAE,kBAAkB,IAAI,CAAC,IAAI,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAEnE,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,OAAwC,EACxC,UAAkD,EAAE;IAEpD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC;WACvF,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjG,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,GAAG;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAwB,EACxB,OAAwC;IAExC,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAC5B,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC1D,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CACtE,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8FAA8F;gBAC5F,6FAA6F,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,IAA8E;IAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,cAAc;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACzE,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IAC/D,CAAC;AACH,CAAC;AAOD,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CACrC,IAAuC,EACvC,OAAwB,EACxB,OAAwC;IAExC,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACxE,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,KAAK,QAAQ;QAC9F,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YACvB,OAAO,EAAE,IAAI,KAAK,eAAe;YACjC,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU;YACxC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAC7C,CAAC;IACF,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAwC,EACxC,IAAO;IAEP,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAC5B,CAAC,CAAC,EAA+C,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CACpE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,yCAAyC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,+BAA+B,GAEjC;IACF,KAAK,EAAE,CAAC,2BAA2B,CAAC;CACrC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,OAAwC,EACxC,aAAoC,EAAE;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7E,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAwC;IAExC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAA2B;IAE3B,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE;YACtC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,kCAAkC;YAC3C,CAAC,CAAC,EAAE,kCAAkC,EAAE,CAAC,GAAG,MAAM,CAAC,kCAAkC,CAAC,EAAE;YACxF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC;gBACE,wCAAwC,EAAE,KAAK;gBAC/C,yBAAyB,EAAE,IAAI;aAChC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,8BAA8B,KAAK,SAAS;YACrD,CAAC,CAAC,EAAE,8BAA8B,EAAE,MAAM,CAAC,8BAA8B,EAAE;YAC3E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,sCAAsC,KAAK,SAAS;YAC7D,CAAC,CAAC;gBACE,sCAAsC,EACpC,MAAM,CAAC,sCAAsC;aAChD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,+BAA+B;YACxC,CAAC,CAAC;gBACE,+BAA+B,EAAE;oBAC/B,GAAG,MAAM,CAAC,+BAA+B;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,+BAA+B;YACxC,CAAC,CAAC;gBACE,+BAA+B,EAAE;oBAC/B,GAAG,MAAM,CAAC,+BAA+B;iBAC1C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,oBAAoB;YAC7B,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/dist/auth/oauthTokens.d.ts

@@ -1,24 +0,0 @@
-/** OAuth access tokens: JWT and DPoP verification, provider tokens, and the registered-client projection. */
-import { verifyJwsAccessToken, type DpopReplayStore } from "better-auth/oauth2";
-import type { DatabaseDriver } from "../core/index.js";
-import type { OAuthAccessTokenVerification, ProviderAccessToken, RegisteredOAuthClient } from "./types.js";
-export declare function getProviderAccessTokenForRequest(api: {
-    getAccessToken(input: {
-        headers: Headers;
-        body: {
-            accountId: string;
-        };
-    }): Promise<unknown>;
-}, request: Request, accountId: string, providerId: string): Promise<ProviderAccessToken>;
-/** A JSON array of strings as the store returns it: JSON text on SQLite, an already decoded array from PostgreSQL's jsonb. */
-export declare function parseStoredStringArray(value: unknown): string[] | null;
-export declare function assertActiveUserGrant(driver: DatabaseDriver, claims: Record<string, unknown>, audience: string): Promise<void>;
-type LocalJwksFetcher = Exclude<Parameters<typeof verifyJwsAccessToken>[1]["jwksFetch"], string>;
-export declare function verifyOAuthJwtWithLocalJwks(token: string, audience: string, issuer: string, jwksFetch: LocalJwksFetcher, jwksCacheKey?: object): Promise<Record<string, unknown>>;
-export declare function verifyOAuthJwt(tokenOrRequest: string | Request, options: {
-    readonly audience: string;
-    readonly scopes?: readonly string[];
-}, verify: ((token: string, audience: string) => Promise<Record<string, unknown>>) | null, getDpopReplayStore?: () => Promise<DpopReplayStore>): Promise<OAuthAccessTokenVerification>;
-export declare function mapRegisteredOAuthClient(value: unknown): RegisteredOAuthClient;
-export {};
-//# sourceMappingURL=oauthTokens.d.ts.map

package/dist/auth/oauthTokens.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthTokens.d.ts","sourceRoot":"","sources":["../../src/auth/oauthTokens.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAyE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACvJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,KAAK,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC3G,wBAAsB,gCAAgC,CACpD,GAAG,EAAE;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,IAAI,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB,EACD,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAqB9B;AAUD,8HAA8H;AAC9H,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAUtE;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED,KAAK,gBAAgB,GAAG,OAAO,CAC7B,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EACvD,MAAM,CACP,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,gBAAgB,EAC3B,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMlC;AAED,wBAAsB,cAAc,CAClC,cAAc,EAAE,MAAM,GAAG,OAAO,EAChC,OAAO,EAAE;IACP,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,EACD,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,EACtF,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,GAClD,OAAO,CAAC,4BAA4B,CAAC,CAwDvC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CA4B9E"}

package/dist/auth/oauthTokens.js

@@ -1,146 +0,0 @@
-/** OAuth access tokens: JWT and DPoP verification, provider tokens, and the registered-client projection. */
-import { enforceDpopBinding, isDpopBindingError, parseAccessTokenAuthorization, verifyJwsAccessToken } from "better-auth/oauth2";
-import { dbOf } from "./db.js";
-export async function getProviderAccessTokenForRequest(api, request, accountId, providerId) {
-    const value = (await api.getAccessToken({
-        headers: request.headers,
-        body: { accountId },
-    }));
-    if (typeof value?.accessToken !== "string") {
-        throw new Error(`getProviderAccessToken: provider '${providerId}' returned no access token.`);
-    }
-    return {
-        accessToken: value.accessToken,
-        ...(value.accessTokenExpiresAt instanceof Date
-            ? { accessTokenExpiresAt: value.accessTokenExpiresAt }
-            : {}),
-        scopes: Array.isArray(value.scopes)
-            ? value.scopes.filter((scope) => typeof scope === "string")
-            : [],
-    };
-}
-function scopesFromClaim(value) {
-    if (typeof value === "string")
-        return value.split(/\s+/).filter(Boolean);
-    if (Array.isArray(value)) {
-        return value.filter((scope) => typeof scope === "string");
-    }
-    return [];
-}
-/** A JSON array of strings as the store returns it: JSON text on SQLite, an already decoded array from PostgreSQL's jsonb. */
-export function parseStoredStringArray(value) {
-    if (typeof value !== "string" && !Array.isArray(value))
-        return null;
-    try {
-        const parsed = typeof value === "string" ? JSON.parse(value) : value;
-        return Array.isArray(parsed) && parsed.every((item) => typeof item === "string")
-            ? parsed
-            : null;
-    }
-    catch {
-        return null;
-    }
-}
-export async function assertActiveUserGrant(driver, claims, audience) {
-    const db = dbOf(driver);
-    const userId = claims["sub"];
-    const clientId = claims["azp"];
-    const sessionId = claims["sid"];
-    const consentId = claims["mantle_consent_id"];
-    if (typeof userId !== "string" ||
-        typeof clientId !== "string" ||
-        typeof sessionId !== "string" ||
-        typeof consentId !== "string" || !consentId) {
-        throw new Error("OAuth token is not bound to a user session.");
-    }
-    const result = await db.first('SELECT c.resources, c.scopes FROM "oauthConsent" AS c ' +
-        'JOIN session AS s ON s.id = ? AND s."userId" = c."userId" AND s."expiresAt" > ? ' +
-        'WHERE c.id = ? AND c."userId" = ? AND c."clientId" = ?', sessionId, new Date().toISOString(), consentId, userId, clientId);
-    const tokenScopes = scopesFromClaim(claims["scope"]);
-    const resources = parseStoredStringArray(result?.resources);
-    const scopes = parseStoredStringArray(result?.scopes);
-    const active = resources?.includes(audience) === true && scopes !== null &&
-        tokenScopes.every((scope) => scopes.includes(scope));
-    if (!active)
-        throw new Error("OAuth authorization grant is no longer active.");
-}
-export function verifyOAuthJwtWithLocalJwks(token, audience, issuer, jwksFetch, jwksCacheKey) {
-    return verifyJwsAccessToken(token, {
-        jwksFetch,
-        ...(jwksCacheKey ? { jwksCacheKey } : {}),
-        verifyOptions: { audience, issuer },
-    });
-}
-export async function verifyOAuthJwt(tokenOrRequest, options, verify, getDpopReplayStore) {
-    const request = typeof tokenOrRequest === "string" ? null : tokenOrRequest;
-    const authorization = parseAccessTokenAuthorization(request?.headers.get("authorization") ?? `Bearer ${tokenOrRequest}`);
-    const token = authorization?.token;
-    // JWT compact serialization has exactly three non-empty parts.
-    // Reject opaque tokens before any network/JWKS work.
-    if (!verify ||
-        !token ||
-        token.split(".").length !== 3 ||
-        token.split(".").some((part) => part.length === 0)) {
-        return { ok: false, status: 401, reason: "invalid-token" };
-    }
-    try {
-        const claims = await verify(token, options.audience);
-        await enforceDpopBinding({
-            payload: claims,
-            authorization,
-            proofJwt: request?.headers.get("dpop"),
-            method: request?.method ?? "GET",
-            url: request?.url ?? options.audience,
-            ...(request && authorization.scheme === "DPoP" && getDpopReplayStore
-                ? { replayStore: await getDpopReplayStore() }
-                : {}),
-        });
-        if (typeof claims["sub"] !== "string" || claims["sub"].length === 0) {
-            return { ok: false, status: 401, reason: "invalid-token" };
-        }
-        const scopes = scopesFromClaim(claims["scope"]);
-        const missingScopes = (options.scopes ?? []).filter((scope) => !scopes.includes(scope));
-        if (missingScopes.length > 0) {
-            return {
-                ok: false,
-                status: 403,
-                reason: "insufficient-scope",
-                missingScopes,
-            };
-        }
-        return {
-            ok: true,
-            userId: claims["sub"],
-            clientId: typeof claims["azp"] === "string" ? claims["azp"] : null,
-            credentialId: typeof claims["jti"] === "string" ? claims["jti"] : null,
-            scopes,
-        };
-    }
-    catch (error) {
-        if (isDpopBindingError(error)) {
-            return { ok: false, status: 401, reason: "invalid-dpop-proof" };
-        }
-        return { ok: false, status: 401, reason: "invalid-token" };
-    }
-}
-export function mapRegisteredOAuthClient(value) {
-    const row = value;
-    if (!row.client_id || !Array.isArray(row.redirect_uris)) {
-        throw new Error("registerOAuthClient: Better Auth returned an invalid client.");
-    }
-    return {
-        clientId: row.client_id,
-        ...(row.client_secret && row.token_endpoint_auth_method !== "none"
-            ? { clientSecret: row.client_secret }
-            : {}),
-        redirectUris: row.redirect_uris,
-        ...(row.scope ? { scope: row.scope.split(" ").filter(Boolean) } : {}),
-        ...(row.client_name ? { clientName: row.client_name } : {}),
-        ...(row.client_uri ? { clientUri: row.client_uri } : {}),
-        ...(row.token_endpoint_auth_method
-            ? { tokenEndpointAuthMethod: row.token_endpoint_auth_method }
-            : {}),
-        ...(row.application_type ? { applicationType: row.application_type } : {}),
-    };
-}
-//# sourceMappingURL=oauthTokens.js.map

package/dist/auth/oauthTokens.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthTokens.js","sourceRoot":"","sources":["../../src/auth/oauthTokens.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,oBAAoB,EAAwB,MAAM,oBAAoB,CAAC;AAEvJ,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAG/B,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,GAKC,EACD,OAAgB,EAChB,SAAiB,EACjB,UAAkB;IAElB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,cAAc,CAAC;QACtC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,EAAE,SAAS,EAAE;KACpB,CAAC,CAID,CAAC;IACF,IAAI,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,6BAA6B,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,oBAAoB,YAAY,IAAI;YAC5C,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC5E,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9E,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAC9E,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAsB,EACtB,MAA+B,EAC/B,QAAgB;IAEhB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAA0C,wDAAwD;QACzH,kFAAkF;QAClF,wDAAwD,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QACtE,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACjF,CAAC;AAOD,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,QAAgB,EAChB,MAAc,EACd,SAA2B,EAC3B,YAAqB;IAErB,OAAO,oBAAoB,CAAC,KAAK,EAAE;QACjC,SAAS;QACT,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,cAAgC,EAChC,OAGC,EACD,MAAsF,EACtF,kBAAmD;IAEnD,MAAM,OAAO,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3E,MAAM,aAAa,GAAG,6BAA6B,CACjD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,UAAU,cAAc,EAAE,CACpE,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,EAAE,KAAK,CAAC;IACnC,+DAA+D;IAC/D,qDAAqD;IACrD,IACE,CAAC,MAAM;QACP,CAAC,KAAK;QACN,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAC7B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,kBAAkB,CAAC;YACvB,OAAO,EAAE,MAAM;YACf,aAAa;YACb,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK;YAChC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ;YACrC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,IAAI,kBAAkB;gBAClE,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,kBAAkB,EAAE,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CACnC,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,oBAAoB;gBAC5B,aAAa;aACd,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;YACrB,QAAQ,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YAClE,YAAY,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,MAAM,GAAG,GAAG,KASX,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,0BAA0B,KAAK,MAAM;YAChE,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,0BAA0B;YAChC,CAAC,CAAC,EAAE,uBAAuB,EAAE,GAAG,CAAC,0BAA0B,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/auth/setupIncomplete.d.ts

@@ -1,16 +0,0 @@
-/** The fail-closed `MantleAuth` for a service whose sign-in is not configured yet. */
-import type { MantleAuth } from "./types.js";
-export interface SetupIncompleteAuthOptions {
-    readonly basePath?: string;
-    readonly message?: string;
-    readonly response?: () => Response | Promise<Response>;
-}
-/**
- * Safe Auth facade for first-deploy/bootstrap windows where an
- * adopter's public Worker should boot before staff sign-in providers
- * have been provisioned. Auth-gated routes should still be blocked by
- * the consumer; this facade never authenticates anyone.
- */
-export declare function createSetupIncompleteAuth(options?: SetupIncompleteAuthOptions): MantleAuth;
-/** Pin the session-bound Better Auth request and secret-minimizing response mapping. */
-//# sourceMappingURL=setupIncomplete.d.ts.map

package/dist/auth/setupIncomplete.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"setupIncomplete.d.ts","sourceRoot":"","sources":["../../src/auth/setupIncomplete.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAGtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,UAAU,CA4CZ;AAED,wFAAwF"}

package/dist/auth/setupIncomplete.js

@@ -1,50 +0,0 @@
-/** The fail-closed `MantleAuth` for a service whose sign-in is not configured yet. */
-import { normalizeAuthBasePath } from "./methods.js";
-/**
- * Safe Auth facade for first-deploy/bootstrap windows where an
- * adopter's public Worker should boot before staff sign-in providers
- * have been provisioned. Auth-gated routes should still be blocked by
- * the consumer; this facade never authenticates anyone.
- */
-export function createSetupIncompleteAuth(options = {}) {
-    const basePath = normalizeAuthBasePath(options.basePath);
-    const message = options.message ?? "Auth is not configured yet.";
-    const response = options.response ??
-        (() => Response.json({ error: "setup_incomplete", message }, { status: 503, headers: { "cache-control": "private, no-store" } }));
-    const auth = {
-        basePath,
-        handler: async () => response(),
-        getSession: async () => null,
-        getUserRole: async () => null,
-        getUser: async () => null,
-        getProviderAccessToken: async () => {
-            throw new Error(message);
-        },
-        verifyOAuthAccessToken: async () => ({
-            ok: false,
-            status: 401,
-            reason: "invalid-token",
-        }),
-        getOAuthConsentRequest: async () => null,
-        completeOAuthConsent: async () => {
-            throw new Error(message);
-        },
-        methods: [],
-        listLinkedAccounts: async () => [],
-        unlinkAccount: async () => false,
-        listUsers: async () => [],
-        listMembers: async () => ({ items: [], previousCursor: null, nextCursor: null }),
-        setUserRole: async () => false,
-        inviteUser: async () => {
-            throw new Error(message);
-        },
-        revokeInvite: async () => false,
-        deleteUser: async () => false,
-        registerOAuthClient: async () => {
-            throw new Error(message);
-        },
-    };
-    return auth;
-}
-/** Pin the session-bound Better Auth request and secret-minimizing response mapping. */
-//# sourceMappingURL=setupIncomplete.js.map

package/dist/auth/setupIncomplete.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"setupIncomplete.js","sourceRoot":"","sources":["../../src/auth/setupIncomplete.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AASrD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;IACjE,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,GAAG,EAAE,CACJ,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,mBAAmB,EAAE,EAAE,CACnE,CAAC,CAAC;IACP,MAAM,IAAI,GAAe;QACvB,QAAQ;QACR,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE;QAC/B,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAC5B,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAC7B,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACzB,sBAAsB,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,eAAe;SACxB,CAAC;QACF,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACxC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAC/B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,EAAE;QACX,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QAClC,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAChC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;QACzB,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAChF,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAC9B,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAC/B,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAC7B,mBAAmB,EAAE,KAAK,IAAI,EAAE;YAC9B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF"}