@aotter/mantle 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/cli/preset.js

@@ -1,353 +0,0 @@
-/**
- * The host service preset (ADR-0032 decision 6 and amendment "the service preset", ADR-0036): application-owned files
- * `mantle generate` writes once and never again, for either built-in dialect. Nothing here is compared by `--check`.
- */
-import { existsSync } from "node:fs";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { basename, dirname, join } from "node:path";
-import { toCloudflareCron } from "../spec/domain/service/CloudflareCron.js";
-/** The generated module, as `src/*.ts` imports it (a constant, so check:boundaries does not read it as this folder's import). */
-const MODULE = "../.mantle/generated/mantle.js";
-const OWNED = "// Written once by `mantle generate`; this file is yours now.";
-const json = (v) => `${JSON.stringify(v, null, 2)}\n`;
-/** `__proto__: fn` in an object literal sets the prototype instead of a handler, so it is computed. */
-const key = (s) => (s === "__proto__" ? '["__proto__"]' : /^[A-Za-z_$][\w$]*$/.test(s) ? s : JSON.stringify(s));
-function service({ identity, features, dialect, host }) {
-    const postgres = dialect === "postgres";
-    const bun = host === "bun";
-    const localOrigin = bun ? "http://127.0.0.1:3000" : "http://127.0.0.1:8787";
-    const localEnv = bun ? ".env" : ".dev.vars";
-    const mcp = features.includes("mcp");
-    // the staff surface needs someone to be staff, so it comes with an identity
-    const staffMcp = mcp && identity !== "none";
-    const admin = features.includes("admin");
-    const mantle = identity === "mantle";
-    const withEnv = mantle || admin;
-    const core = ["createMantle", ...(identity === "none" ? [] : ["withCaller"]), "type MantleRuntime", "type MantleService", "type Surface"];
-    const auth = mantle ? ["ConsoleEmailSender", "createAuthRoutes", "createCallerResolver", "createMantleAuth", "createSetupIncompleteAuth", "type MantleAuth"] : [];
-    const env = [...(bun ? [postgres ? "  readonly SQL: SQL;" : "  readonly DB: Database;"] : postgres ? ["  /** PostgreSQL through Hyperdrive; `wrangler dev` connects to its localConnectionString. */", "  readonly HYPERDRIVE: { readonly connectionString: string };"] : ["  readonly DB: D1Database;"]), ...(admin ? ["  /** The Admin SPA's files (`@aotter/mantle-ui/admin`), bound in wrangler.jsonc. */", bun ? "  readonly ASSETS: (path: string) => Promise<Response | null>;" : "  readonly ASSETS: Fetcher;"] : []), ...(mantle ? ["  readonly BETTER_AUTH_SECRET?: string;", "  readonly PUBLIC_ORIGIN?: string;", "  readonly ADMIN_EMAIL?: string;"] : [])];
-    const origin = mantle ? [`  const origin = env.PUBLIC_ORIGIN?.replace(/\\/+$/, "") ?? "${localOrigin}";`, "  const auth = createAuth(env, origin);"] : [];
-    const caller = mantle
-        ? [`  const resolver = createCallerResolver(auth${mcp ? ", { jwtBearer: { audience: `${origin}/mcp`, scopes: [\"mcp\"] } }" : ""});`, "  const authRoutes = createAuthRoutes(auth, { resolver });", "  const guard = (surface: Surface, options?: { resourceMetadata?: string }) => withCaller(resolver, surface, options);"]
-        : identity === "custom"
-            ? ["  const guard = (surface: Surface) => withCaller(resolveCaller, surface);"]
-            : ["  // no identity: every caller is anonymous", "  const guard = (surface: Surface) => (request: Request) => surface(request, { kind: \"anonymous\" });"];
-    const meta = mantle && mcp ? ["  const resourceMetadata = `${origin}/.well-known/oauth-protected-resource/mcp`;"] : [];
-    const adminOptions = [
-        'basePath: "/admin"',
-        bun ? "assets: env.ASSETS" : "assets: (path) => adminAsset(env.ASSETS, path)",
-        ...(mantle ? ["identity: { directory: auth, roles: auth, deleteUser: auth.deleteUser }"] : []),
-        ...(mcp ? [`site: { mcpEndpoints: { public: "/mcp", staff: ${staffMcp ? '"/mcp/staff"' : "null"} } }`] : []),
-    ];
-    const surfaces = [
-        ...(admin ? [`  ${identity === "custom" ? "// no AdminIdentity: Admin hides the user facets until src/identity.ts can list and manage users\n  " : ""}const admin = guard(createAdminSurface(runtime, { ${adminOptions.join(", ")} }));`] : []),
-        ...(mcp ? [`  const mcp = guard(createMcpSurface(runtime, { basePath: "/mcp", surface: "public"${meta.length ? ", resourceMetadata" : ""} })${meta.length ? ", { resourceMetadata }" : ""});`] : []),
-        // the staff tools for an MCP client with a token: the same audience as /mcp, and the staff surface's own role gate
-        ...(staffMcp ? ["  // MCP Apps hosts render each staff View's rows, and the operations on one row, in the chat",
-            `  const staffMcp = guard(createMcpSurface(runtime, { basePath: "/mcp/staff", surface: "staff", apps: { resources: [planApp(runtime.plan, { surface: "staff", html: mantleAppHtml })] }${meta.length ? ", resourceMetadata" : ""} })${meta.length ? ", { resourceMetadata }" : ""});`] : []),
-        "  // REST answers everything else: public Views under /api/views and the plan's HTTP Triggers",
-        '  const rest = guard(createRestSurface(runtime, { basePath: "/api" }));',
-    ];
-    const route = [
-        `  return async (request: Request${mantle ? ", waitUntil: (promise: Promise<unknown>) => void" : ""}): Promise<Response> => {`,
-        "    const { pathname } = new URL(request.url);",
-        "    const under = (base: string) => pathname === base || pathname.startsWith(`${base}/`);",
-        ...(mantle ? ["    // Better Auth's context is per isolate: the request that starts it waits for it, or the next one hangs on it; a failed start is mounted again",
-            "    await auth.ready?.catch((error) => {",
-            "      routes = undefined;",
-            "      throw error;",
-            "    });", "    const owned = await authRoutes(request, { waitUntil });", "    if (owned) return owned;"] : []),
-        ...(admin ? ['    if (under("/admin")) return admin(request);'] : []),
-        ...(staffMcp ? ['    if (under("/mcp/staff")) return staffMcp(request);'] : []),
-        ...(mcp ? ['    if (under("/mcp")) return mcp(request);'] : []),
-        "    return rest(request);",
-        "  };",
-    ];
-    return [
-        `${OWNED} It composes the service (ADR-0032 decision 6).`,
-        `import { ${core.join(", ")} } from "@aotter/mantle";`,
-        ...(admin ? ['import { createAdminSurface } from "@aotter/mantle/admin";'] : []),
-        ...(auth.length ? [`import { ${auth.join(", ")} } from "@aotter/mantle/auth";`] : []),
-        ...(bun
-            ? [postgres ? 'import type { SQL } from "bun";' : 'import type { Database } from "bun:sqlite";', `import { ${postgres ? 'bunPostgresStorage' : 'bunSqliteStorage'}${mantle ? (postgres ? ', bunDatabaseDriver, bunAuthDatabase' : ', bunSqliteDriver') : ''} } from "@aotter/mantle/bun";`]
-            : postgres
-                ? [`import { ${mantle ? "pgDatabaseDriver, pgPool, " : ""}postgresStorage, type PgClient, type PgConnect } from "@aotter/mantle/postgres";`, 'import pg from "pg";']
-                : [`import { ${mantle ? "d1Driver, " : ""}d1Storage } from "@aotter/mantle/cloudflare";`]),
-        ...(mcp ? [`import { createMcpSurface${staffMcp ? ", planApp" : ""} } from "@aotter/mantle/mcp";`] : []),
-        ...(staffMcp ? ['import { mantleAppHtml } from "@aotter/mantle-ui/mcp-app";'] : []),
-        'import { createRestSurface } from "@aotter/mantle/web";',
-        `import { plan } from "${MODULE}";`,
-        'import { handlers } from "./handlers.js";',
-        ...(identity === "custom" ? ['import { resolveCaller } from "./identity.js";'] : []),
-        "",
-        "export interface Env {",
-        ...env,
-        "}",
-        "",
-        ...(postgres && !bun ? [
-            "/** A client per operation: Hyperdrive keeps the pool, and a Worker's socket must not outlive its request. */",
-            'const connectTo = (env: Pick<Env, "HYPERDRIVE">): PgConnect => async () => {',
-            "  const client = new pg.Client({ connectionString: env.HYPERDRIVE.connectionString });",
-            "  await client.connect();",
-            "  return client as unknown as PgClient;",
-            "};",
-            "",
-        ] : []),
-        ...(mantle ? [
-            "/** One-time codes printed to the log are for local development: a deployed service picks its own sign-in method and sender. */",
-            "function createAuth(env: Env, origin: string): MantleAuth {",
-            "  // an unset PUBLIC_ORIGIN is not local: the fallback origin below is only for URLs, never for deciding to print codes",
-            "  const local = env.PUBLIC_ORIGIN !== undefined && /^http:\\/\\/(localhost|127\\.0\\.0\\.1|\\[::1\\])(:\\d+)?$/.test(origin);",
-            "  if (!local || !env.BETTER_AUTH_SECRET || !env.ADMIN_EMAIL)",
-            `    return createSetupIncompleteAuth({ message: "Sign-in is not configured: copy ${localEnv}.example to ${localEnv} locally, or choose a sign-in method in src/service.ts." });`,
-            "  return createMantleAuth({",
-            bun
-                ? postgres ? '    database: bunAuthDatabase(env.SQL), driver: bunDatabaseDriver(env.SQL), baseURL: origin, secret: env.BETTER_AUTH_SECRET,' : "    database: env.DB, driver: bunSqliteDriver(env.DB), baseURL: origin, secret: env.BETTER_AUTH_SECRET,"
-                : postgres
-                    ? "    database: pgPool(connectTo(env)), driver: pgDatabaseDriver(connectTo(env)), baseURL: origin, secret: env.BETTER_AUTH_SECRET,"
-                    : "    database: env.DB, driver: d1Driver(env.DB), baseURL: origin, secret: env.BETTER_AUTH_SECRET,",
-            '    methods: [{ kind: "email-otp", sender: new ConsoleEmailSender() }],',
-            '    bootstrapOwner: { match: "email", value: env.ADMIN_EMAIL },',
-            bun ? '    ipAddressHeaders: ["x-mantle-client-ip"],' : '    ipAddressHeaders: ["cf-connecting-ip"],',
-            // with Admin, its own consent page (Mantle UI); without, Core's plain one at /oauth/consent
-            ...(mcp ? [`    oauthProvider: { loginPage: "/admin/sign-in", consentPage: "${admin ? "/admin/oauth/consent" : "/oauth/consent"}", scopes: ["mcp"], mcpResource: \`\${origin}/mcp\` },`] : []),
-            "  });",
-            "}",
-            "",
-        ] : []),
-        ...(admin && !bun ? [
-            "/** A file of the Admin SPA, or null when it has none by that path. */",
-            "async function adminAsset(assets: Fetcher, path: string): Promise<Response | null> {",
-            '  const response = await assets.fetch(new URL(path, "http://assets/"));',
-            "  return response.ok ? response : null;",
-            "}",
-            "",
-        ] : []),
-        `function mount(runtime: MantleRuntime${withEnv ? ", env: Env" : ""}) {`,
-        ...origin, ...caller, ...meta, ...surfaces, ...route,
-        "}",
-        "",
-        "let routes: ReturnType<typeof mount> | undefined;",
-        "const service: MantleService<Env> = {",
-        "  handlers,",
-        mantle
-            ? "  fetch: (request, env, { runtime, waitUntil }) => (routes ??= mount(runtime, env))(request, waitUntil),"
-            : withEnv
-                ? "  fetch: (request, env, { runtime }) => (routes ??= mount(runtime, env))(request),"
-                : "  fetch: (request, _env, { runtime }) => (routes ??= mount(runtime))(request),",
-        "};",
-        "",
-        `export const mantle = createMantle(service, { plan, storage: (env) => ${bun ? (postgres ? "bunPostgresStorage(env.SQL)" : "bunSqliteStorage(env.DB)") : postgres ? "postgresStorage({ connect: connectTo(env) })" : "d1Storage(env.DB)"}, schedules: ${bun ? "false" : "true"} });`,
-        "",
-    ].join("\n");
-}
-function handlers(plan) {
-    const refs = [...new Set(Object.values(plan.procedures).flatMap((p) => ("ref" in p.handler ? [p.handler.ref] : [])))].sort();
-    return [
-        `${OWNED} \`MantleHandlers\` lists exactly the plan's handler refs.`,
-        `import type { MantleHandlers } from "${MODULE}";`,
-        "",
-        `export const handlers: MantleHandlers = {${refs.length ? "" : "};"}`,
-        ...(refs.length ? [...refs.map((r) => `  ${key(r)}: async () => {\n    throw new Error(${JSON.stringify(`not implemented: ${r}`)});\n  },`), "};"] : []),
-        "",
-    ].join("\n");
-}
-const IDENTITY = `${OWNED}
-import type { CallerResolver } from "@aotter/mantle";
-
-/**
- * Your service's users as Mantle callers (ADR-0032 decision 8). Read your session or token and return
- * \`{ caller: { kind: "user", subject, role, scopes, credential, credentialId, clientId } }\`; \`{ caller: { kind: "anonymous" } }\`
- * only when no credential was presented; \`{ invalid: true }\` when one was presented and failed.
- */
-export const resolveCaller: CallerResolver = async () => {
-  // TODO(mantle): until this is implemented every request fails, and never runs as anonymous.
-  throw new Error("src/identity.ts: resolveCaller is not implemented. Map your session or token to a Caller.");
-};
-`;
-const ENTRY = `${OWNED} The Cloudflare entry (ADR-0032 decision 6).
-import { waitUntil } from "cloudflare:workers";
-import { toCloudflareCron } from "@aotter/mantle/cloudflare";
-import { plan } from "${MODULE}";
-import { mantle, type Env } from "./service.js";
-
-// Cloudflare names a cron as wrangler.jsonc spells it; the plan's schedule Triggers are POSIX, and several spellings can share one
-const crons = new Map<string, string[]>();
-for (const t of Object.values(plan.triggers)) {
-  if (t.source.kind !== "schedule" || t.source.enabled === false) continue;
-  const cf = toCloudflareCron(t.source.cron);
-  const posix = crons.get(cf) ?? [];
-  if (!posix.includes(t.source.cron)) crons.set(cf, [...posix, t.source.cron]);
-}
-// not bound to one request, so a handler's ctx.waitUntil never lands on another request's finished context
-const ctx = { waitUntil };
-
-export default {
-  fetch: (request, env) => mantle.fetch(request, env, ctx),
-  async scheduled(controller, env) {
-    const posix = crons.get(controller.cron);
-    if (posix === undefined) throw new Error(\`No schedule Trigger runs on the Cloudflare cron '\${controller.cron}'\`);
-    const errors: unknown[] = [];
-    for (const cron of posix) {
-      try {
-        await mantle.invokeSchedule(cron, controller.scheduledTime, env, ctx);
-      } catch (error) {
-        errors.push(error);
-      }
-    }
-    if (errors.length) throw new AggregateError(errors, \`\${errors.length} cron spelling(s) failed for '\${controller.cron}'\`);
-  },
-} satisfies ExportedHandler<Env>;
-`;
-/** Where the Admin SPA's files are once `@aotter/mantle-ui` is installed. */
-const ADMIN_FILES = "node_modules/@aotter/mantle-ui/dist/admin";
-/** Where `wrangler dev` finds PostgreSQL; the deployed Worker uses the Hyperdrive config instead. */
-const LOCAL_PG = (name) => `postgres://postgres:postgres@127.0.0.1:5432/${name.replace(/-/g, "_")}`;
-function wrangler(root, plan, admin, dialect) {
-    const name = basename(root).toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "").slice(0, 63).replace(/-+$/, "") || "mantle-app";
-    const crons = [...new Set(Object.values(plan.triggers).flatMap((t) => (t.source.kind === "schedule" && t.source.enabled !== false ? [toCloudflareCron(t.source.cron)] : [])))].sort();
-    return json({
-        $schema: "node_modules/wrangler/config-schema.json", name, main: "src/index.ts", compatibility_date: "2026-09-01", compatibility_flags: ["nodejs_compat"],
-        ...(dialect === "postgres"
-            // `wrangler hyperdrive create <name> --caching-disabled --connection-string=...` prints the id: Mantle reads in transactions,
-            // which Hyperdrive never caches, but Better Auth's session reads are not, so caching stays off
-            ? { hyperdrive: [{ binding: "HYPERDRIVE", id: "REPLACE_WITH_HYPERDRIVE_CONFIG_ID", localConnectionString: LOCAL_PG(name) }] }
-            : { d1_databases: [{ binding: "DB", database_name: name }] }),
-        // the Worker answers every request (Admin serves the shell with its own headers); `none` keeps index.html fetchable by name
-        ...(admin ? { assets: { directory: ADMIN_FILES, binding: "ASSETS", run_worker_first: true, html_handling: "none" } } : {}),
-        ...(crons.length ? { triggers: { crons } } : {}),
-    });
-}
-const TSCONFIG = json({
-    compilerOptions: {
-        target: "ES2022", lib: ["ES2023"], module: "ESNext", moduleResolution: "Bundler", strict: true, noEmit: true, skipLibCheck: true, resolveJsonModule: true,
-        // node: `nodejs_compat` serves the node: modules @aotter/mantle/auth imports
-        types: ["@cloudflare/workers-types", "node"],
-    },
-    include: ["src/**/*.ts", ".mantle/generated/**/*.ts"],
-});
-const DEV_VARS = `# Copy to .dev.vars for local sign-in: one-time codes are printed to the wrangler log. Never deploy these values.
-PUBLIC_ORIGIN=http://127.0.0.1:8787
-ADMIN_EMAIL=you@example.com
-BETTER_AUTH_SECRET=replace-with-a-random-32-byte-secret
-`;
-/** The preset's files for this selection, by path. */
-export function presetFiles(root, selection, plan) {
-    return [
-        ["src/handlers.ts", handlers(plan)],
-        ...(selection.identity === "custom" ? [["src/identity.ts", IDENTITY]] : []),
-        ["src/index.ts", selection.host === "bun" ? bunEntry(selection) : ENTRY],
-        ...(selection.host === "bun" ? [] : ["wrangler.jsonc", "wrangler.json", "wrangler.toml"].some((f) => existsSync(join(root, f))) ? [] : [["wrangler.jsonc", wrangler(root, plan, selection.features.includes("admin"), selection.dialect)]]),
-        ["tsconfig.json", selection.host === "bun" ? TSCONFIG.replace('"@cloudflare/workers-types",', '"bun-types",').replace('"ES2023"', '"ES2023",\n      "DOM"') : TSCONFIG],
-        ...(selection.identity === "mantle" || selection.host === "bun" ? [[selection.host === "bun" ? ".env.example" : ".dev.vars.example", selection.host === "bun" ? bunEnv(selection) : DEV_VARS]] : []),
-        [".gitignore", "node_modules/\n.wrangler/\n.dev.vars\n.env\n*.sqlite\n*.sqlite-shm\n*.sqlite-wal\n"],
-        // last: its existence is what marks the preset as written, so a write that failed midway is completed by the rerun
-        ["src/service.ts", service(selection)],
-    ];
-}
-/**
- * Writes each preset file that does not exist, and none when `src/service.ts` does: the application then owns its composition.
- * Returns the paths written.
- */
-export async function writePreset(root, selection, plan) {
-    if (existsSync(join(root, "src/service.ts")))
-        return [];
-    const written = [];
-    for (const [path, text] of presetFiles(root, selection, plan)) {
-        try {
-            await mkdir(dirname(join(root, path)), { recursive: true });
-            await writeFile(join(root, path), text, { flag: "wx" });
-            written.push(path);
-        }
-        catch (err) {
-            const code = err.code;
-            if (code !== "EEXIST")
-                throw new Error(`cannot write ${path} (${code ?? "error"})`);
-        }
-    }
-    return written;
-}
-/** What the application-owned files may have drifted from: never written, only reported. */
-export async function presetWarnings(root, selection, selectionChanged, plan) {
-    if (!existsSync(join(root, "src/service.ts")))
-        return [];
-    const out = [];
-    if (selectionChanged)
-        out.push(`the selection changed but src/service.ts already exists and is yours: update its composition to identity '${selection.identity}' and features ${selection.features.join(", ") || "none"}`);
-    if (selection.host === "bun")
-        return out;
-    const wrangler = await readFile(join(root, "wrangler.jsonc"), "utf8").catch(() => undefined);
-    if (wrangler !== undefined) {
-        const declared = new Set([...(/"crons"\s*:\s*\[([^\]]*)\]/.exec(wrangler)?.[1] ?? "").matchAll(/"([^"]*)"/g)].map((m) => m[1]));
-        const wanted = new Set(Object.values(plan.triggers).flatMap((t) => (t.source.kind === "schedule" && t.source.enabled !== false ? [toCloudflareCron(t.source.cron)] : [])));
-        const missing = [...wanted].filter((c) => !declared.has(c));
-        const extra = [...declared].filter((c) => !wanted.has(c));
-        if (selection.dialect === "postgres" && !/"hyperdrive"\s*:/.test(wrangler))
-            out.push('wrangler.jsonc has no hyperdrive binding, which src/service.ts reads PostgreSQL through: add "hyperdrive": [{ "binding": "HYPERDRIVE", "id": "<config id>", "localConnectionString": "postgres://..." }]');
-        if (selection.dialect === "postgres" && wrangler.includes("REPLACE_WITH_HYPERDRIVE_CONFIG_ID"))
-            out.push("wrangler.jsonc's Hyperdrive id is still the placeholder: create the config with `wrangler hyperdrive create <name> --caching-disabled --connection-string=...` before deploying");
-        if (selection.features.includes("admin") && !/"binding"\s*:\s*"ASSETS"/.test(wrangler))
-            out.push('wrangler.jsonc binds no ASSETS, which src/service.ts serves the Admin console from: add "assets": { "directory": "node_modules/@aotter/mantle-ui/dist/admin", "binding": "ASSETS", "run_worker_first": true, "html_handling": "none" }');
-        if (missing.length || extra.length)
-            out.push(`wrangler.jsonc triggers.crons does not match the plan's schedule Triggers${missing.length ? `; add ${missing.map((c) => `"${c}"`).join(", ")}` : ""}${extra.length ? `; nothing runs on ${extra.map((c) => `"${c}"`).join(", ")}` : ""}`);
-    }
-    return out;
-}
-function bunEntry(selection) {
-    const pg = selection.dialect === 'postgres';
-    const admin = selection.features.includes('admin');
-    return `${OWNED} Bun owns the server, native database pool and background work.
-${pg ? 'import { SQL } from "bun";' : 'import { Database } from "bun:sqlite";'}
-${admin ? 'import { bunAdminAssets } from "@aotter/mantle/bun";\nimport { dirname } from "node:path";\nimport { fileURLToPath } from "node:url";\n' : ''}import { mantle, type Env } from "./service.js";
-
-${pg ? 'if (!process.env.DATABASE_URL || !/^postgres(?:ql)?:\\/\\//.test(process.env.DATABASE_URL)) throw new Error("DATABASE_URL must be a PostgreSQL URL");\nconst sql = new SQL(process.env.DATABASE_URL, { bigint: true, prepare: false });' : 'const db = new Database(process.env.DATABASE_FILE ?? "mantle.sqlite", { create: true });'}
-const env: Env = {
-  ${pg ? 'SQL: sql' : 'DB: db'},
-${admin ? '  ASSETS: bunAdminAssets(dirname(fileURLToPath(import.meta.resolve("@aotter/mantle-ui/admin/index.html")))),\n' : ''}${selection.identity === 'mantle' ? '  PUBLIC_ORIGIN: process.env.PUBLIC_ORIGIN, BETTER_AUTH_SECRET: process.env.BETTER_AUTH_SECRET, ADMIN_EMAIL: process.env.ADMIN_EMAIL,\n' : ''}};
-// the client is the socket's address; behind a proxy you list in TRUSTED_PROXIES, the address it appended to X-Forwarded-For
-const proxies = new Set((process.env.TRUSTED_PROXIES ?? "").split(",").map((s) => s.trim()).filter(Boolean));
-const pending = new Set<Promise<unknown>>();
-const waitUntil = (promise: Promise<unknown>) => {
-  const task = promise.catch(console.error).finally(() => pending.delete(task));
-  pending.add(task);
-};
-const server = Bun.serve({
-  hostname: process.env.HOST ?? "127.0.0.1", port: Number(process.env.PORT ?? 3000),
-  // never Bun's development error page: it shows the exception, the stack and paths to any client
-  development: false,
-  error(error) {
-    console.error(error);
-    return Response.json({ error: { code: "INTERNAL_ERROR", message: "An internal error occurred." } }, { status: 500 });
-  },
-  fetch(request, server) {
-    const headers = new Headers(request.headers);
-    headers.delete("x-mantle-client-ip");
-    const socket = server.requestIP(request)?.address?.replace(/^::ffff:/, "");
-    const forwarded = socket && proxies.has(socket) ? request.headers.get("x-forwarded-for")?.split(",").at(-1)?.trim() : undefined;
-    const ip = forwarded || socket;
-    if (ip) headers.set("x-mantle-client-ip", ip);
-    return mantle.fetch(new Request(request, { headers }), env, { waitUntil });
-  },
-});
-let stopping = false;
-const stop = async () => {
-  if (stopping) return;
-  stopping = true;
-  await server.stop();
-  while (pending.size) await Promise.allSettled([...pending]);
-  ${pg ? 'await sql.close({ timeout: 5 });' : 'db.close();'}
-};
-process.once("SIGINT", stop);
-process.once("SIGTERM", stop);
-console.log(\`Mantle: \${server.url}\`);
-`;
-}
-function bunEnv(selection) {
-    return `# Copy to .env for local development. Never deploy these values.
-${selection.dialect === 'postgres' ? 'DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/mantle_app' : 'DATABASE_FILE=mantle.sqlite'}
-PORT=3000
-# Behind a reverse proxy, list its addresses so each client keeps its own sign-in rate limit, e.g. TRUSTED_PROXIES=127.0.0.1
-# TRUSTED_PROXIES=
-${selection.identity === 'mantle' ? 'PUBLIC_ORIGIN=http://127.0.0.1:3000\nADMIN_EMAIL=you@example.com\nBETTER_AUTH_SECRET=replace-with-a-random-32-byte-secret\n' : ''}`;
-}
-//# sourceMappingURL=preset.js.map

package/dist/cli/preset.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"preset.js","sourceRoot":"","sources":["../../src/cli/preset.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAU5E,iIAAiI;AACjI,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAChD,MAAM,KAAK,GAAG,+DAA+D,CAAC;AAC9E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/D,uGAAuG;AACvG,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAExH,SAAS,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAmB;IACrE,MAAM,QAAQ,GAAG,OAAO,KAAK,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC;IAC3B,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,GAAG,IAAI,QAAQ,KAAK,MAAM,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,KAAK,QAAQ,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,IAAI,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC;IAC1I,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClK,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,+FAA+F,EAAE,+DAA+D,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sFAAsF,EAAE,GAAG,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yCAAyC,EAAE,oCAAoC,EAAE,kCAAkC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzoB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,gEAAgE,WAAW,IAAI,EAAE,yCAAyC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1J,MAAM,MAAM,GAAG,MAAM;QACnB,CAAC,CAAC,CAAC,+CAA+C,GAAG,CAAC,CAAC,CAAC,mEAAmE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,4DAA4D,EAAE,wHAAwH,CAAC;QAC7T,CAAC,CAAC,QAAQ,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,2EAA2E,CAAC;YAC/E,CAAC,CAAC,CAAC,6CAA6C,EAAE,wGAAwG,CAAC,CAAC;IAChK,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,kFAAkF,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,MAAM,YAAY,GAAG;QACnB,oBAAoB;QACpB,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gDAAgD;QAC7E,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,kDAAkD,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7G,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,sGAAsG,CAAC,CAAC,CAAC,EAAE,qDAAqD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/O,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sFAAsF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpM,mHAAmH;QACnH,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,+FAA+F;YAC7G,yLAAyL,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9R,+FAA+F;QAC/F,yEAAyE;KAC1E,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,mCAAmC,MAAM,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,EAAE,2BAA2B;QAC9H,gDAAgD;QAChD,2FAA2F;QAC3F,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oJAAoJ;YAChK,0CAA0C;YAC1C,2BAA2B;YAC3B,oBAAoB;YACpB,SAAS,EAAE,6DAA6D,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,2BAA2B;QAC3B,MAAM;KACP,CAAC;IACF,OAAO;QACL,GAAG,KAAK,iDAAiD;QACzD,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;QACtD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,GAAG;YACL,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,6CAA6C,EAAE,YAAY,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;YAC3R,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,kFAAkF,EAAE,sBAAsB,CAAC;gBACpK,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,+CAA+C,CAAC,CAAC;QAC5F,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,4BAA4B,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,yDAAyD;QACzD,yBAAyB,MAAM,IAAI;QACnC,2CAA2C;QAC3C,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,EAAE;QACF,wBAAwB;QACxB,GAAG,GAAG;QACN,GAAG;QACH,EAAE;QACF,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrB,+GAA+G;YAC/G,8EAA8E;YAC9E,wFAAwF;YACxF,2BAA2B;YAC3B,yCAAyC;YACzC,IAAI;YACJ,EAAE;SACH,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACX,iIAAiI;YACjI,6DAA6D;YAC7D,yHAAyH;YACzH,+HAA+H;YAC/H,8DAA8D;YAC9D,oFAAoF,QAAQ,eAAe,QAAQ,8DAA8D;YACjL,6BAA6B;YAC7B,GAAG;gBACD,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,8HAA8H,CAAC,CAAC,CAAC,yGAAyG;gBACvP,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,kIAAkI;oBACpI,CAAC,CAAC,kGAAkG;YACtG,yEAAyE;YACzE,iEAAiE;YACjE,GAAG,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,6CAA6C;YACrG,4FAA4F;YAC5F,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mEAAmE,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,gBAAgB,wDAAwD,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9L,OAAO;YACP,GAAG;YACH,EAAE;SACH,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAClB,wEAAwE;YACxE,sFAAsF;YACtF,yEAAyE;YACzE,yCAAyC;YACzC,GAAG;YACH,EAAE;SACH,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,wCAAwC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK;QACxE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK;QACpD,GAAG;QACH,EAAE;QACF,mDAAmD;QACnD,uCAAuC;QACvC,aAAa;QACb,MAAM;YACJ,CAAC,CAAC,0GAA0G;YAC5G,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,oFAAoF;gBACtF,CAAC,CAAC,gFAAgF;QACtF,IAAI;QACJ,EAAE;QACF,yEAAyE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,mBAAmB,gBAAgB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM;QACpR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAiB;IACjC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7H,OAAO;QACL,GAAG,KAAK,4DAA4D;QACpE,wCAAwC,MAAM,IAAI;QAClD,EAAE;QACF,4CAA4C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxJ,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAG,GAAG,KAAK;;;;;;;;;;;;CAYxB,CAAC;AAEF,MAAM,KAAK,GAAG,GAAG,KAAK;;;wBAGE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8B7B,CAAC;AAEF,6EAA6E;AAC7E,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAEhE,qGAAqG;AACrG,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,+CAA+C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AAE5G,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAiB,EAAE,KAAc,EAAE,OAAmC;IACpG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC;IAC9I,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtL,OAAO,IAAI,CAAC;QACV,OAAO,EAAE,0CAA0C,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC,eAAe,CAAC;QACzJ,GAAG,CAAC,OAAO,KAAK,UAAU;YACxB,8HAA8H;YAC9H,+FAA+F;YAC/F,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,mCAAmC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAC7H,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,4HAA4H;QAC5H,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE;QACf,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI;QACzJ,6EAA6E;QAC7E,KAAK,EAAE,CAAC,2BAA2B,EAAE,MAAM,CAAC;KAC7C;IACD,OAAO,EAAE,CAAC,aAAa,EAAE,2BAA2B,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG;;;;CAIhB,CAAC;AAEF,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAA0B,EAAE,IAAiB;IACrF,OAAO;QACL,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,QAAQ,CAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAqB,CAAC,CAAC;QAC/P,CAAC,eAAe,EAAE,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvK,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,EAAE,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxN,CAAC,YAAY,EAAE,oFAAoF,CAAC;QACpG,mHAAmH;QACnH,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAA0B,EAAE,IAAiB;IAC3F,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,SAA0B,EAAE,gBAAyB,EAAE,IAAiB;IACzH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,gBAAgB;QAAE,GAAG,CAAC,IAAI,CAAC,6GAA6G,SAAS,CAAC,QAAQ,kBAAkB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IAC3N,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACjI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3K,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,SAAS,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,0MAA0M,CAAC,CAAC;QACjS,IAAI,SAAS,CAAC,OAAO,KAAK,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,iLAAiL,CAAC,CAAC;QAC5R,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,wOAAwO,CAAC,CAAC;QAC3U,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,4EAA4E,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1R,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,SAA0B;IAC1C,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC;IAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,GAAG,KAAK;EACf,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wCAAwC;EAC5E,KAAK,CAAC,CAAC,CAAC,yIAAyI,CAAC,CAAC,CAAC,EAAE;;EAEtJ,EAAE,CAAC,CAAC,CAAC,yOAAyO,CAAC,CAAC,CAAC,0FAA0F;;IAEzU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;EAC5B,KAAK,CAAC,CAAC,CAAC,gHAAgH,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,yIAAyI,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgC9S,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,aAAa;;;;;CAK1D,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,SAA0B;IACxC,OAAO;EACP,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,qEAAqE,CAAC,CAAC,CAAC,6BAA6B;;;;EAIxI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,6HAA6H,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzK,CAAC"}

package/dist/cloudflare/index.d.ts

@@ -1,21 +0,0 @@
-/** `@aotter/mantle/cloudflare`: the D1 driver. Structural types, so this needs no `@cloudflare/workers-types`. */
-import type { DatabaseDriver } from "../core/driver.js";
-import type { SiteDefaults } from "../spec/domain/index.js";
-interface D1PreparedStatement {
-    bind(...values: unknown[]): D1PreparedStatement;
-}
-interface D1Database {
-    prepare(sql: string): D1PreparedStatement;
-    batch(statements: D1PreparedStatement[]): Promise<{
-        results?: Record<string, unknown>[];
-    }[]>;
-}
-export declare function d1Driver(db: D1Database): DatabaseDriver;
-/** D1 storage for `createMantle`: `storage: (env) => d1Storage(env.DB)`. */
-export declare const d1Storage: (db: D1Database, options?: {
-    timeZone?: string;
-    site?: SiteDefaults;
-}) => import("../core/service.js").MantleStorageAdapter;
-export { r2MediaStorage, type R2MediaStorageOptions } from "./r2Media.js";
-export { toCloudflareCron } from "../spec/domain/service/CloudflareCron.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,UAAU,mBAAmB;IAAG,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;CAAE;AACjF,UAAU,UAAU;IAClB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC1C,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC9F;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,cAAc,CAOvD;AAED,4EAA4E;AAC5E,eAAO,MAAM,SAAS,GAAI,IAAI,UAAU,EAAE,UAAU;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,sDAAkE,CAAC;AACjK,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/cloudflare/index.js

@@ -1,14 +0,0 @@
-import { sqliteStorage } from "../d1/index.js";
-export function d1Driver(db) {
-    return {
-        async batch(statements) {
-            const out = await db.batch(statements.map((s) => db.prepare(s.sql).bind(...(s.binds ?? []))));
-            return out.map((r) => ({ rows: r.results ?? [] }));
-        },
-    };
-}
-/** D1 storage for `createMantle`: `storage: (env) => d1Storage(env.DB)`. */
-export const d1Storage = (db, options) => sqliteStorage(d1Driver(db), { ...options, maxBindings: 100 });
-export { r2MediaStorage } from "./r2Media.js";
-export { toCloudflareCron } from "../spec/domain/service/CloudflareCron.js";
-//# sourceMappingURL=index.js.map

package/dist/cloudflare/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAS/C,MAAM,UAAU,QAAQ,CAAC,EAAc;IACrC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,UAAU;YACpB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9F,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAc,EAAE,OAAoD,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;AACjK,OAAO,EAAE,cAAc,EAA8B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC"}

package/dist/cloudflare/r2Media.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"r2Media.d.ts","sourceRoot":"","sources":["../../src/cloudflare/r2Media.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,iBAAiB,CAAC;AAElE,UAAU,MAAM;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClD;AACD,UAAU,QAAQ;IAChB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE;QAAE,YAAY,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrJ,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AACD,gDAAgD;AAChD,UAAU,QAAQ;IAChB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC;QAAC,GAAG,EAAE;YAAE,SAAS,EAAE,IAAI,CAAC;YAAC,OAAO,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/G;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAOD,wBAAgB,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,qBAAqB,GAAG,YAAY,CAoD5G"}

package/dist/cloudflare/r2Media.js

@@ -1,69 +0,0 @@
-/**
- * `MediaStorage` on R2, public bucket only. The binding reads, copies and deletes objects; it cannot presign, so the PUT
- * URLs are SigV4 query-signed by the host's S3 client (`new AwsClient({ accessKeyId, secretAccessKey, region: "auto", service: "s3" })` from `aws4fetch`).
- * Reads bypass the Worker: `publicBase` is the bucket's custom domain or `pub-<hash>.r2.dev`.
- *
- * A presigned PUT binds neither the type nor the size, and it stays usable until it expires. So uploads land under `uploads/`,
- * commit checks each object through the binding and copies it to its public key, which no upload URL names, and a rejected
- * group is deleted by the use case (`deleteObject` on each upload key).
- */
-import { DiagnosticError, makeDiagnostic } from "../spec/kernel/index.js";
-const EXT = { "image/png": "png", "image/jpeg": "jpg", "image/webp": "webp", "image/avif": "avif", "image/gif": "gif" };
-const UPLOADS = "uploads/";
-const fail = (code, message, value) => new DiagnosticError(makeDiagnostic({ code, phase: "runtime", severity: "error", path: "media/r2", message, ...(value === undefined ? {} : { value }) }));
-export function r2MediaStorage({ bucket, signer, endpoint, publicBase }) {
-    if (!publicBase)
-        throw fail("MEDIA_NOT_CONFIGURED", "R2 media storage needs publicBase, the bucket's public URL");
-    const base = publicBase.replace(/\/+$/, "");
-    const s3 = endpoint.replace(/\/+$/, "");
-    return {
-        async createUpload({ uploadGroupId, purpose, variants, now, expiresAt }) {
-            const ttl = Math.max(60, Math.floor((expiresAt - now) / 1000));
-            return {
-                capabilities: await Promise.all(variants.map(async (v) => {
-                    // server-made keys, one directory per asset so its variants list together
-                    const storageKey = `${UPLOADS}${purpose}/${uploadGroupId}/${v.role}.${EXT[v.mimeType] ?? "bin"}`;
-                    const target = new URL(`${s3}/${storageKey}`);
-                    target.searchParams.set("X-Amz-Expires", String(ttl));
-                    const { url } = await signer.sign(target.href, { method: "PUT", aws: { signQuery: true, service: "s3" } });
-                    return { mimeType: v.mimeType, role: v.role, method: "PUT", uploadUrl: url, storageKey, requiredHeaders: { "Content-Type": v.mimeType } };
-                })),
-            };
-        },
-        async commitUpload({ uploadGroupId, filename, variants, alt, caption, now }) {
-            // every variant is checked before any is published, so a rejected group publishes nothing
-            const heads = [];
-            for (const spec of variants) {
-                const o = await bucket.head(spec.storageKey);
-                if (!o)
-                    throw fail("MEDIA_OBJECT_NOT_FOUND", `variant ${spec.role} of '${uploadGroupId}' was not uploaded`, uploadGroupId);
-                const mime = o.httpMetadata?.contentType ?? "application/octet-stream";
-                if (mime !== spec.mimeType)
-                    throw fail("MEDIA_MIME_REJECTED", `the stored ${spec.role} is ${mime}, not ${spec.mimeType}`, mime);
-                if (o.size > spec.maxBytes)
-                    throw fail("MEDIA_VARIANT_SIZE_EXCEEDED", `the stored ${spec.role} is ${o.size} bytes, more than ${spec.maxBytes}`, o.size);
-                heads.push(o);
-            }
-            const out = [];
-            for (const [i, spec] of variants.entries()) {
-                const key = spec.storageKey.slice(UPLOADS.length);
-                const o = await bucket.get(spec.storageKey);
-                // an upload URL may PUT again between the check and the copy: the copy must be what was checked
-                if (!o || o.size !== heads[i].size || o.httpMetadata?.contentType !== spec.mimeType) {
-                    await o?.body.cancel().catch(() => undefined);
-                    await Promise.allSettled(out.map((v) => bucket.delete(v.storageKey)));
-                    throw fail("MEDIA_OBJECT_NOT_FOUND", `variant ${spec.role} of '${uploadGroupId}' changed during commit`, uploadGroupId);
-                }
-                await bucket.put(key, o.body, {
-                    httpMetadata: { contentType: spec.mimeType },
-                    customMetadata: { ...o.customMetadata, committedAt: String(now), role: spec.role, uploadGroupId, filename, ...(alt ? { alt } : {}), ...(caption ? { caption } : {}) },
-                });
-                await bucket.delete(spec.storageKey);
-                out.push({ mimeType: spec.mimeType, publicUrl: `${base}/${key}`, storageKey: key, byteSize: o.size, role: spec.role });
-            }
-            return { id: uploadGroupId, variants: out, createdAt: now, metadata: { filename }, ...(alt !== undefined ? { alt } : {}), ...(caption !== undefined ? { caption } : {}) };
-        },
-        deleteObject: ({ storageKey }) => bucket.delete(storageKey),
-    };
-}
-//# sourceMappingURL=r2Media.js.map

package/dist/cloudflare/r2Media.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"r2Media.js","sourceRoot":"","sources":["../../src/cloudflare/r2Media.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAuB,MAAM,yBAAyB,CAAC;AA2B/F,MAAM,GAAG,GAA2B,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChJ,MAAM,OAAO,GAAG,UAAU,CAAC;AAC3B,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,OAAe,EAAE,KAAe,EAAE,EAAE,CACtE,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAE3J,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAyB;IAC5F,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,CAAC,sBAAsB,EAAE,4DAA4D,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;YACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAC/D,OAAO;gBACL,YAAY,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;oBACvD,0EAA0E;oBAC1E,MAAM,UAAU,GAAG,GAAG,OAAO,GAAG,OAAO,IAAI,aAAa,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;oBACjG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;oBAC9C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3G,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAc,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACrJ,CAAC,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACzE,0FAA0F;YAC1F,MAAM,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC7C,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,CAAC,wBAAwB,EAAE,WAAW,IAAI,CAAC,IAAI,QAAQ,aAAa,oBAAoB,EAAE,aAAa,CAAC,CAAC;gBAC3H,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,IAAI,0BAA0B,CAAC;gBACvE,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,CAAC,qBAAqB,EAAE,cAAc,IAAI,CAAC,IAAI,OAAO,IAAI,SAAS,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;gBAChI,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ;oBAAE,MAAM,IAAI,CAAC,6BAA6B,EAAE,cAAc,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,qBAAqB,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACxJ,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,GAAG,GAAmB,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,gGAAgG;gBAChG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACrF,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC9C,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBACtE,MAAM,IAAI,CAAC,wBAAwB,EAAE,WAAW,IAAI,CAAC,IAAI,QAAQ,aAAa,yBAAyB,EAAE,aAAa,CAAC,CAAC;gBAC1H,CAAC;gBACD,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE;oBAC5B,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC5C,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;iBACtK,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACrC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5K,CAAC;QAED,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/core/caller.d.ts

@@ -1,35 +0,0 @@
-/** Caller identity (ADR-0032 decision 8). Mantle never owns the user or the auth; a resolver produces the Caller. */
-import type { StaffRole } from "../spec/domain/index.js";
-export type CredentialKind = "session" | "oauth" | "api-key" | "personal-token";
-export type Caller = {
-    readonly kind: "anonymous";
-} | {
-    readonly kind: "user";
-    /** Application subject key: opaque, stable, unique across issuers. Never an email. */
-    readonly subject: string;
-    /** Informational. */
-    readonly issuer?: string;
-    readonly role: StaffRole | null;
-    readonly scopes: readonly string[];
-    readonly credential: CredentialKind;
-    /** Opaque record id or token JTI, never the raw credential. */
-    readonly credentialId: string | null;
-    readonly clientId: string | null;
-} | {
-    readonly kind: "system";
-    readonly reason: string;
-};
-/**
- * Resolves the Caller once per request, at the service's entry. `invalid` is answered 401 before any
- * surface runs and is never anonymous; only "no credential presented" is.
- */
-export type CallerResolver = (request: Request) => Promise<{
-    readonly caller: Caller;
-} | {
-    readonly invalid: true;
-    readonly challenge?: string; /** 403 for a valid token that lacks a scope (RFC 6750 insufficient_scope); 401 otherwise. */
-    readonly status?: 401 | 403;
-}>;
-/** Host code only; no wire produces one. Satisfies no `requires.auth` predicate, bypasses caller scope and nothing else. */
-export declare const systemCaller: (reason: string) => Caller;
-//# sourceMappingURL=caller.d.ts.map

package/dist/core/caller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../src/core/caller.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEhF,MAAM,MAAM,MAAM,GACd;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qBAAqB;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,6FAA6F;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC,CAAC;AAE7Q,4HAA4H;AAC5H,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAAsC,CAAC"}

package/dist/core/caller.js

@@ -1,3 +0,0 @@
-/** Host code only; no wire produces one. Satisfies no `requires.auth` predicate, bypasses caller scope and nothing else. */
-export const systemCaller = (reason) => ({ kind: "system", reason });
-//# sourceMappingURL=caller.js.map

package/dist/core/caller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../src/core/caller.ts"],"names":[],"mappings":"AA4BA,4HAA4H;AAC5H,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC"}

package/dist/core/createMantle.d.ts

@@ -1,22 +0,0 @@
-import type { RuntimePlan } from "../spec/domain/index.js";
-import type { MantleService, MantleStorageAdapter } from "./service.js";
-interface WaitUntil {
-    waitUntil(promise: Promise<unknown>): void;
-}
-export interface MantleOptions<Env> {
-    /** The sealed plan the CLI compiled (`mantle generate` emits it beside `src/service.ts`). ADR-0032 decision 6 leaves it out of the signature. */
-    readonly plan: RuntimePlan;
-    readonly storage: (env: Env) => MantleStorageAdapter;
-    /** Set when the entry wires schedules; boot fails for an enabled schedule Trigger without it. */
-    readonly schedules?: boolean;
-    /** Refuses to boot when the plan is not the one Cloud compiled. */
-    readonly expectedFingerprint?: string;
-}
-export interface Mantle<Env> {
-    fetch(request: Request, env: Env, ctx?: WaitUntil): Promise<Response>;
-    invokeSchedule(cron: string, scheduledTime: number, env: Env, ctx?: WaitUntil): Promise<void>;
-    runDeferredHook(message: unknown, env: Env, ctx?: WaitUntil): Promise<void>;
-}
-export declare function createMantle<Env>(service: MantleService<Env>, options: MantleOptions<Env>): Mantle<Env>;
-export {};
-//# sourceMappingURL=createMantle.d.ts.map

package/dist/core/createMantle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createMantle.d.ts","sourceRoot":"","sources":["../../src/core/createMantle.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAM3D,OAAO,KAAK,EAAiB,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEvF,UAAU,SAAS;IACjB,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa,CAAC,GAAG;IAChC,iJAAiJ;IACjJ,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,oBAAoB,CAAC;IACrD,iGAAiG;IACjG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,MAAM,CAAC,GAAG;IACzB,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AA6BD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAqEvG"}