@aotter/mantle 0.2.0-alpha.6 → 0.2.0-alpha.7

package/dist/admin/identity.d.ts

@@ -1,62 +0,0 @@
-/**
- * `AdminIdentity` (ADR-0032 decision 8): what Admin may ask an identity provider for. Every member is optional and Admin hides
- * what is absent, so an identity that only signs people in (a custom resolver) needs none of it. Display names come from
- * `directory`, never from a Store join.
- */
-/** A user as the staff-management surface sees them: identity columns only, never a password hash or ban metadata. */
-export interface StaffUserInfo {
-    readonly id: string;
-    readonly email: string;
-    readonly name: string;
-    readonly role: string | null;
-    readonly githubLogin: string | null;
-    /** `false` with no linked account is a pending invitation (it already carries its staff role). */
-    readonly emailVerified: boolean;
-    readonly createdAt: Date;
-}
-export type MemberUserInfo = Pick<StaffUserInfo, "id" | "email" | "name" | "emailVerified" | "createdAt">;
-export interface ListMembersArgs {
-    readonly search?: string;
-    readonly cursor?: string;
-    readonly cursorDirection?: "forward" | "backward";
-    readonly limit: number;
-}
-export interface MemberListResult {
-    readonly items: readonly MemberUserInfo[];
-    readonly previousCursor: string | null;
-    readonly nextCursor: string | null;
-}
-/** A stable, secret-free user projection for a service's own code. */
-export interface AuthUserInfo extends StaffUserInfo {
-    readonly image: string | null;
-}
-/** `exists` carries the prior row's id, so Admin can point at the existing user instead of failing bare. */
-export type InviteUserResult = {
-    readonly kind: "created";
-    readonly id: string;
-} | {
-    readonly kind: "exists";
-    readonly id: string;
-};
-/** Members that take the `Request` act as the signed-in owner who sent it, so the identity provider authorizes them too. */
-export interface AdminIdentity {
-    readonly directory?: {
-        getUser?(userId: string): Promise<AuthUserInfo | null>;
-        /** Only users with a staff role, oldest first. */
-        listUsers(request: Request): Promise<readonly StaffUserInfo[]>;
-        /** Everyone else, for the member-management surface. */
-        listMembers(args: ListMembersArgs): Promise<MemberListResult>;
-    };
-    readonly roles?: {
-        /** `null` revokes staff access (the user can still sign in, but every staff-gated surface refuses). False when no row matched. */
-        setUserRole(request: Request, userId: string, role: "owner" | "editor" | "contributor" | null): Promise<boolean>;
-        /** Pre-creates an unverified user that already holds the role, so the invitee's first sign-in lands with it. */
-        inviteUser(request: Request, email: string, role: "owner" | "editor" | "contributor"): Promise<InviteUserResult>;
-        /** Only an invitation nobody ever signed in to; a real user is never deleted through it. */
-        revokeInvite(userId: string): Promise<boolean>;
-        sendStaffInvitation?(email: string, role: "owner" | "editor" | "contributor"): Promise<void>;
-    };
-    /** Account deletion: the identity provider owns its users, so services stop running raw SQL against its tables. */
-    deleteUser?(userId: string): Promise<boolean>;
-}
-//# sourceMappingURL=identity.d.ts.map

package/dist/admin/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/admin/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,sHAAsH;AACtH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,eAAe,GAAG,WAAW,CAAC,CAAC;AAE1G,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,sEAAsE;AACtE,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,4GAA4G;AAC5G,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpI,4HAA4H;AAC5H,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QACvD,kDAAkD;QAClD,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;QAC/D,wDAAwD;QACxD,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;KAC/D,CAAC;IACF,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,kIAAkI;QAClI,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACjH,gHAAgH;QAChH,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjH,4FAA4F;QAC5F,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,mBAAmB,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9F,CAAC;IACF,mHAAmH;IACnH,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C"}

package/dist/admin/identity.js

@@ -1,7 +0,0 @@
-/**
- * `AdminIdentity` (ADR-0032 decision 8): what Admin may ask an identity provider for. Every member is optional and Admin hides
- * what is absent, so an identity that only signs people in (a custom resolver) needs none of it. Display names come from
- * `directory`, never from a Store join.
- */
-export {};
-//# sourceMappingURL=identity.js.map

package/dist/admin/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/admin/identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/admin/index.d.ts

@@ -1,7 +0,0 @@
-export * from "./consent.js";
-export * from "./createAdminSurface.js";
-export * from "./identity.js";
-export * from "./extensions.js";
-export { developerConsole, type DeveloperConsoleSnapshot } from "./developerConsole.js";
-export * from "./design.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,KAAK,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACxF,cAAc,aAAa,CAAC"}

package/dist/admin/index.js

@@ -1,7 +0,0 @@
-export * from "./consent.js";
-export * from "./createAdminSurface.js";
-export * from "./identity.js";
-export * from "./extensions.js";
-export { developerConsole } from "./developerConsole.js";
-export * from "./design.js";
-//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAiC,MAAM,uBAAuB,CAAC;AACxF,cAAc,aAAa,CAAC"}

package/dist/admin/procedureFlow.d.ts

@@ -1,38 +0,0 @@
-/** A static projection of authored SQL IR. CASE chooses values; WHERE filters rows, not control flow. */
-import { type JsonSchema, type SqlNode } from '../spec/domain/index.js';
-export declare function procedureFlow(stmts: readonly SqlNode[], relations?: (stmts: readonly SqlNode[]) => {
-    reads: Set<string>;
-    writes: Set<string>;
-}): {
-    index: number;
-    logic: SqlLogicNode;
-    operation: string;
-    table: any;
-    mode: "set" | "read" | "row";
-    reads: string[];
-    writes: string[];
-    filter: string | null;
-    returns: any;
-    cases: any;
-}[];
-/** A syntax/data dependency tree, never a promise of SQL evaluation order or short-circuit execution. */
-export interface SqlLogicNode {
-    kind: string;
-    label: string;
-    children: SqlLogicNode[];
-    column?: {
-        name: string;
-        relation?: string;
-    };
-    relation?: {
-        name: string;
-        alias?: string;
-    };
-}
-export declare function sqlLogic(node: SqlNode): SqlLogicNode;
-/** Necessary enum predicates for a declared row target; a display hint, never authorization. */
-export declare function requiredEnumStates(stmts: readonly SqlNode[], target: string, schema: JsonSchema): Array<{
-    field: string;
-    value: string;
-}>;
-//# sourceMappingURL=procedureFlow.d.ts.map

package/dist/admin/procedureFlow.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"procedureFlow.d.ts","sourceRoot":"","sources":["../../src/admin/procedureFlow.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAY,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAgClF,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,KAAK;IAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE;;;;;;;;;;;IA0B9I;AAED,yGAAyG;AACzG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACtD,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAmDpD;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBzI"}

package/dist/admin/procedureFlow.js

@@ -1,188 +0,0 @@
-/** A static projection of authored SQL IR. CASE chooses values; WHERE filters rows, not control flow. */
-import { classify } from '../spec/domain/index.js';
-/** Display only constructs we can spell exactly. Other expressions stay explicitly opaque beside the authored SQL. */
-function expression(node) {
-    if (!node)
-        return 'NULL';
-    if (node.ColumnRef)
-        return node.ColumnRef.fields.map((f) => f.String ? f.String.sval : '*').join('.');
-    const c = node.A_Const;
-    if (c) {
-        if (c.isnull)
-            return 'NULL';
-        if (c.sval)
-            return `'${c.sval.sval.replace(/'/g, "''")}'`;
-        if (c.ival)
-            return String(c.ival.ival ?? 0);
-        if (c.fval)
-            return c.fval.fval;
-        if (c.boolval)
-            return c.boolval.boolval ? 'TRUE' : 'FALSE';
-    }
-    const e = node.A_Expr;
-    if (e?.kind === 'AEXPR_OP' && e.name?.length === 1) {
-        const operand = (v) => v.A_Expr || v.BoolExpr ? `(${expression(v)})` : expression(v);
-        const op = e.name[0].String.sval;
-        if (!e.lexpr && e.rexpr)
-            return `${op}(${expression(e.rexpr)})`;
-        if (e.lexpr && e.rexpr)
-            return `${operand(e.lexpr)} ${op} ${operand(e.rexpr)}`;
-    }
-    if (node.BoolExpr) {
-        const b = node.BoolExpr;
-        if (b.boolop === 'NOT_EXPR')
-            return `NOT (${expression(b.args[0])})`;
-        return b.args.map((a) => `(${expression(a)})`).join(b.boolop === 'AND_EXPR' ? ' AND ' : ' OR ');
-    }
-    throw new Error('opaque');
-}
-const sql = (node) => {
-    try {
-        return expression(node);
-    }
-    catch {
-        return '[SQL expression — see authored SQL]';
-    }
-};
-export function procedureFlow(stmts, relations) {
-    return stmts.map((stmt, index) => {
-        const [operation, body] = Object.entries(stmt)[0];
-        const assignments = operation === 'UpdateStmt' ? body.targetList ?? [] : [];
-        const dependencies = relations?.([stmt]);
-        return {
-            index,
-            logic: sqlLogic(stmt),
-            operation: operation.replace('Stmt', '').toUpperCase(),
-            table: body.relation?.relname ?? null,
-            mode: operation === 'MergeStmt' ? 'set' : classify(stmt),
-            reads: [...(dependencies?.reads ?? [])].sort(),
-            writes: [...(dependencies?.writes ?? [])].sort(),
-            filter: body.whereClause ? sql(body.whereClause) : body.selectStmt?.SelectStmt?.whereClause ? sql(body.selectStmt.SelectStmt.whereClause) : null,
-            returns: (body.returningClause?.exprs ?? []).map((t) => sql(t.ResTarget.val)),
-            cases: assignments.flatMap(({ ResTarget: target }) => {
-                const c = target.val?.CaseExpr;
-                if (!c)
-                    return [];
-                return [{
-                        field: target.name,
-                        branches: (c.args ?? []).map(({ CaseWhen: w }) => ({ condition: c.arg ? `(${sql(c.arg)}) = (${sql(w.expr)})` : sql(w.expr), value: sql(w.result) })),
-                        otherwise: sql(c.defresult),
-                    }];
-            }),
-        };
-    });
-}
-const branch = (kind, label, children = []) => ({ kind, label, children });
-export function sqlLogic(node) {
-    const list = (items = []) => items.map(sqlLogic);
-    const clause = (label, value) => value ? [branch('clause', label, [sqlLogic(value)])] : [];
-    const group = (label, values) => values?.length ? [branch('clause', label, list(values))] : [];
-    if (node.ColumnRef) {
-        const names = node.ColumnRef.fields.map((f) => f.String?.sval);
-        const result = branch('value', sql(node));
-        if (names.every((n) => typeof n === 'string') && names.length <= 2)
-            result.column = { name: names.at(-1), ...(names.length === 2 ? { relation: names[0] } : {}) };
-        return result;
-    }
-    if (node.BoolExpr) {
-        const b = node.BoolExpr;
-        return branch('predicate', b.boolop === 'AND_EXPR' ? 'AND · all conditions' : b.boolop === 'OR_EXPR' ? 'OR · any condition' : 'NOT', list(b.args));
-    }
-    if (node.A_Expr) {
-        const e = node.A_Expr;
-        const names = { AEXPR_OP_ANY: `${e.name?.[0]?.String?.sval} ANY`, AEXPR_OP_ALL: `${e.name?.[0]?.String?.sval} ALL`, AEXPR_BETWEEN_SYM: 'BETWEEN SYMMETRIC', AEXPR_NOT_BETWEEN_SYM: 'NOT BETWEEN SYMMETRIC', AEXPR_IN: e.name?.[0]?.String?.sval === '<>' ? 'NOT IN' : 'IN', AEXPR_BETWEEN: 'BETWEEN', AEXPR_NOT_BETWEEN: 'NOT BETWEEN', AEXPR_DISTINCT: 'IS DISTINCT FROM', AEXPR_NOT_DISTINCT: 'IS NOT DISTINCT FROM', AEXPR_LIKE: e.name?.[0]?.String?.sval === '!~~' ? 'NOT LIKE' : 'LIKE', AEXPR_ILIKE: e.name?.[0]?.String?.sval === '!~~*' ? 'NOT ILIKE' : 'ILIKE', AEXPR_NULLIF: 'NULLIF' };
-        return branch('expression', names[e.kind] ?? e.name?.map((n) => n.String.sval).join('.') ?? e.kind, [e.lexpr, e.rexpr].filter(Boolean).map(sqlLogic));
-    }
-    if (node.NullTest)
-        return branch('predicate', node.NullTest.nulltesttype === 'IS_NOT_NULL' ? 'IS NOT NULL' : 'IS NULL', [sqlLogic(node.NullTest.arg)]);
-    if (node.BooleanTest)
-        return branch('predicate', node.BooleanTest.booltesttype.replaceAll('_', ' '), [sqlLogic(node.BooleanTest.arg)]);
-    if (node.CaseExpr) {
-        const c = node.CaseExpr;
-        return branch('case', c.arg ? 'CASE · match value' : 'CASE · first TRUE condition', [...clause('Value', c.arg), ...(c.args ?? []).map((w, i) => branch('when', `WHEN ${i + 1}`, [branch('predicate', 'Condition', [sqlLogic(w.CaseWhen.expr)]), branch('value', 'THEN', [sqlLogic(w.CaseWhen.result)])])), branch('value', 'ELSE', [c.defresult ? sqlLogic(c.defresult) : branch('value', 'NULL')])]);
-    }
-    if (node.SubLink) {
-        const s = node.SubLink;
-        return branch('subquery', s.subLinkType === 'ANY_SUBLINK' ? 'IN' : s.subLinkType.replace('_SUBLINK', ''), [...clause('Compared value', s.testexpr), sqlLogic(s.subselect)]);
-    }
-    if (node.FuncCall) {
-        const f = node.FuncCall;
-        return branch('function', f.funcname.map((n) => n.String.sval).join('.') + (f.agg_distinct ? ' · DISTINCT' : '') + (f.agg_star ? '(*)' : ''), [...list(f.args), ...group('Aggregate ORDER BY', f.agg_order), ...clause('FILTER', f.agg_filter), ...clause('OVER', f.over ? { WindowDef: f.over } : undefined)]);
-    }
-    if (node.CoalesceExpr)
-        return branch('function', 'COALESCE · first non-NULL value', list(node.CoalesceExpr.args));
-    if (node.MinMaxExpr)
-        return branch('function', node.MinMaxExpr.op === 'IS_GREATEST' ? 'GREATEST' : 'LEAST', list(node.MinMaxExpr.args));
-    if (node.TypeCast) {
-        const t = node.TypeCast;
-        return branch('cast', `CAST → ${t.typeName.names.map((n) => n.String.sval).join('.')}${t.typeName.typmods?.length ? t.typeName.names.at(-1)?.String?.sval === 'numeric' ? `(${t.typeName.typmods.map(sql).join(', ')})` : ' · type modifiers: see authored SQL' : ''}`, [sqlLogic(t.arg)]);
-    }
-    if (node.List)
-        return branch('list', 'Values', list(node.List.items));
-    if (node.ResTarget)
-        return branch('output', node.ResTarget.name ?? 'Output', node.ResTarget.val ? [sqlLogic(node.ResTarget.val)] : []);
-    if (node.SortBy)
-        return branch('order', `${(node.SortBy.sortby_dir ?? 'SORTBY_DEFAULT').replace('SORTBY_', '')} · ${(node.SortBy.sortby_nulls ?? 'SORTBY_NULLS_DEFAULT').replace('SORTBY_', '')}`, [sqlLogic(node.SortBy.node)]);
-    if (node.RangeVar)
-        return { ...branch('table', node.RangeVar.relname + (node.RangeVar.alias ? ` AS ${node.RangeVar.alias.aliasname}` : '')), relation: { name: node.RangeVar.relname, ...(node.RangeVar.alias ? { alias: node.RangeVar.alias.aliasname } : {}) } };
-    if (node.RangeSubselect)
-        return branch('subquery', `${node.RangeSubselect.lateral ? 'LATERAL ' : ''}${node.RangeSubselect.alias?.aliasname ?? 'Subquery'}`, [sqlLogic(node.RangeSubselect.subquery)]);
-    if (node.JoinExpr) {
-        const j = node.JoinExpr;
-        return branch('join', `${j.jointype.replace('JOIN_', '')} JOIN`, [sqlLogic(j.larg), sqlLogic(j.rarg), ...clause('ON', j.quals), ...group('USING', j.usingClause)]);
-    }
-    if (node.WindowDef) {
-        const w = node.WindowDef;
-        return branch('window', `Window${w.name ? ` ${w.name}` : ''} · ${w.frameOptions & 4 ? 'ROWS' : 'RANGE'} frame (see authored SQL)`, [...group('PARTITION BY', w.partitionClause), ...group('ORDER BY', w.orderClause), ...clause('Frame start', w.startOffset), ...clause('Frame end', w.endOffset)]);
-    }
-    if (node.CommonTableExpr)
-        return branch('cte', node.CommonTableExpr.ctename, [sqlLogic(node.CommonTableExpr.ctequery)]);
-    const key = ['SelectStmt', 'UpdateStmt', 'InsertStmt', 'DeleteStmt'].find((k) => node[k]);
-    if (key) {
-        const b = node[key];
-        const children = [...group(b.withClause?.recursive ? 'WITH RECURSIVE' : 'WITH', b.withClause?.ctes), ...(b.relation ? [branch('target', 'Target', [sqlLogic({ RangeVar: b.relation })])] : []), ...group(key === 'UpdateStmt' ? 'SET' : 'SELECT', b.targetList), ...group('FROM', b.fromClause ?? b.usingClause), ...clause('WHERE · keep TRUE rows', b.whereClause), ...group('GROUP BY', b.groupClause), ...clause('HAVING · keep TRUE groups', b.havingClause), ...group('ORDER BY', b.sortClause), ...clause('LIMIT', b.limitCount), ...group('VALUES', b.valuesLists), ...group('Columns', b.cols), ...clause('Source SELECT', b.selectStmt), ...group('RETURNING', b.returningClause?.exprs)];
-        if (b.distinctClause)
-            children.push(branch('clause', b.distinctClause.some((n) => n && Object.keys(n).length) ? 'DISTINCT ON' : 'DISTINCT', list(b.distinctClause.filter((n) => n && Object.keys(n).length))));
-        if (b.op && b.op !== 'SETOP_NONE')
-            children.push(branch('set', b.op.replace('SETOP_', '') + (b.all ? ' ALL' : ''), [sqlLogic({ SelectStmt: b.larg }), sqlLogic({ SelectStmt: b.rarg })]));
-        if (b.onConflictClause) {
-            const c = b.onConflictClause;
-            children.push(branch('conflict', `ON CONFLICT · ${c.action.replace('ONCONFLICT_', '')}`, [...group('Conflict columns', c.infer?.indexElems), ...group('SET', c.targetList), ...clause('WHERE', c.whereClause)]));
-        }
-        return branch('statement', key.replace('Stmt', '').toUpperCase(), children);
-    }
-    if (node.String)
-        return branch('value', node.String.sval);
-    if (node.IndexElem)
-        return branch('column', node.IndexElem.name);
-    const rendered = sql(node);
-    return branch(rendered.startsWith('[SQL') ? 'opaque' : 'value', rendered.startsWith('[SQL') ? `${Object.keys(node)[0]} · see authored SQL` : rendered);
-}
-/** Necessary enum predicates for a declared row target; a display hint, never authorization. */
-export function requiredEnumStates(stmts, target, schema) {
-    const writes = procedureFlow(stmts).filter((s) => s.table?.toLowerCase() === target.toLowerCase() && s.operation === 'UPDATE');
-    if (writes.length !== 1 || writes[0].mode !== 'row')
-        return [];
-    const tree = writes[0].logic;
-    const relation = tree.children.find((c) => c.label === 'Target')?.children[0]?.relation;
-    const filter = tree.children.find((c) => c.label.startsWith('WHERE'))?.children[0];
-    const required = (n) => n.kind === 'predicate' && n.label.startsWith('AND ·') ? n.children.flatMap(required) : [n];
-    return (filter ? required(filter) : []).flatMap((n) => {
-        if (n.kind !== 'expression' || n.label !== '=' || n.children.length !== 2)
-            return [];
-        const match = (column, literal) => {
-            const ref = column.column;
-            if (!ref || ref.relation && ref.relation.toLowerCase() !== (relation?.alias ?? target).toLowerCase() || literal.column || literal.kind !== 'value' || !/^'.*'$/.test(literal.label))
-                return [];
-            const field = Object.keys(schema.properties ?? {}).find((k) => k.toLowerCase() === ref.name.toLowerCase());
-            if (!field)
-                return [];
-            const value = literal.label.slice(1, -1).replace(/''/g, "'");
-            const property = schema.properties[field];
-            const options = property.enum ?? property.oneOf?.map((o) => o.const);
-            return Array.isArray(options) && options.includes(value) ? [{ field, value }] : [];
-        };
-        return [...match(n.children[0], n.children[1]), ...match(n.children[1], n.children[0])];
-    });
-}
-//# sourceMappingURL=procedureFlow.js.map

package/dist/admin/procedureFlow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"procedureFlow.js","sourceRoot":"","sources":["../../src/admin/procedureFlow.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,QAAQ,EAAiC,MAAM,yBAAyB,CAAC;AAElF,sHAAsH;AACtH,SAAS,UAAU,CAAC,IAAyB;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/G,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC;QACN,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;QAC1D,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO,GAAG,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,QAAQ,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,IAAyB,EAAU,EAAE;IAChD,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,qCAAqC,CAAC;IAAC,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,KAAyB,EAAE,SAAsF;IAC7I,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;QACnD,MAAM,WAAW,GAAG,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,YAAY,GAAG,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,OAAO;YACL,KAAK;YACL,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;YACrB,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;YACtD,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI;YACrC,IAAI,EAAE,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxD,KAAK,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;YAC9C,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;YAChJ,OAAO,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtF,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAW,EAAE,EAAE;gBAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAC/B,IAAI,CAAC,CAAC;oBAAE,OAAO,EAAE,CAAC;gBAClB,OAAO,CAAC;wBACN,KAAK,EAAE,MAAM,CAAC,IAAI;wBAClB,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAW,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;wBAC7J,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;qBAC5B,CAAC,CAAC;YACL,CAAC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,WAA2B,EAAE,EAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzH,MAAM,UAAU,QAAQ,CAAC,IAAa;IACpC,MAAM,IAAI,GAAG,CAAC,QAAmB,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,KAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxH,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,MAA6B,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5K,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAAC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IACnM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,MAAM,KAAK,GAA2B,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QAC3lB,OAAO,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjK,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvJ,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzZ,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QAAC,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC1N,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3T,CAAC;IACD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC,UAAU,EAAE,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAClH,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACxI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAAC,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACpV,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvI,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjO,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACnQ,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,IAAI,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAAC,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACnN,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAAC,OAAO,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,2BAA2B,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACvV,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,CAAC,wBAAwB,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,CAAC,2BAA2B,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;QACpqB,IAAI,CAAC,CAAC,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACjO,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1L,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3Q,OAAO,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACzJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,KAAyB,EAAE,MAAc,EAAE,MAAkB;IAC9F,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;IAC/H,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACxF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,CAAC,CAAe,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjJ,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACpD,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,CAAC,MAAoB,EAAE,OAAqB,EAAE,EAAE;YAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC/L,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3G,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAW,CAAC,KAAK,CAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1F,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,CAAC,CAAC;QACF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/ConsoleEmailSender.d.ts

@@ -1,15 +0,0 @@
-import type { EmailSender, EmailSendArgs } from "../core/index.js";
-/**
- * Dev convenience: writes the email to `console.log` instead of
- * sending it. Use this in `wrangler dev` to read OTP codes off the
- * Worker logs without wiring a real sender.
- *
- * **Never wire this in production.** Boot diagnostics will not stop
- * you — Better Auth is happy to call `sender.send()` either way —
- * but real recipients won't get the email. Wrap in an env-gated
- * factory at the adapter wiring site.
- */
-export declare class ConsoleEmailSender implements EmailSender {
-    send(args: EmailSendArgs): Promise<void>;
-}
-//# sourceMappingURL=ConsoleEmailSender.d.ts.map

package/dist/auth/ConsoleEmailSender.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ConsoleEmailSender.d.ts","sourceRoot":"","sources":["../../src/auth/ConsoleEmailSender.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,WAAW;IAC9C,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ/C"}

package/dist/auth/ConsoleEmailSender.js

@@ -1,19 +0,0 @@
-/**
- * Dev convenience: writes the email to `console.log` instead of
- * sending it. Use this in `wrangler dev` to read OTP codes off the
- * Worker logs without wiring a real sender.
- *
- * **Never wire this in production.** Boot diagnostics will not stop
- * you — Better Auth is happy to call `sender.send()` either way —
- * but real recipients won't get the email. Wrap in an env-gated
- * factory at the adapter wiring site.
- */
-export class ConsoleEmailSender {
-    async send(args) {
-        const { to, subject, text, locale, category } = args;
-        console.log(`[ConsoleEmailSender] ${category ?? "email"} → ${to} (${locale})\n` +
-            `  subject: ${subject}\n` +
-            `  body: ${text}`);
-    }
-}
-//# sourceMappingURL=ConsoleEmailSender.js.map

package/dist/auth/ConsoleEmailSender.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ConsoleEmailSender.js","sourceRoot":"","sources":["../../src/auth/ConsoleEmailSender.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAC7B,KAAK,CAAC,IAAI,CAAC,IAAmB;QAC5B,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,wBAAwB,QAAQ,IAAI,OAAO,MAAM,EAAE,KAAK,MAAM,KAAK;YACjE,cAAc,OAAO,IAAI;YACzB,WAAW,IAAI,EAAE,CACpB,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/appleClientSecret.d.ts

@@ -1,75 +0,0 @@
-/**
- * Helper for the Sign In with Apple `clientSecret` field.
- *
- * Apple's "client secret" is **not** an OAuth client secret — it is
- * an ES256-signed JWT the relying party generates from:
- *
- *   - Team ID  (Apple Developer team identifier, 10 chars)
- *   - Key ID   (the Sign-In key id, 10 chars; visible in Apple Developer)
- *   - Private key (the `.p8` file Apple lets you download once)
- *   - Audience (typically the Services ID — same as the Better Auth
- *     `clientId` you pass for `provider: "apple"`)
- *
- * The JWT lives at most 180 days per Apple's policy. This helper
- * defaults to 30 days; **the adopter is responsible for regenerating
- * the JWT before it expires** (e.g. on deploy, or via a scheduled
- * worker). A long-lived Cloudflare isolate can outlive the default,
- * and Apple will reject signin attempts with an expired secret —
- * don't rely on isolate restart cadence for rotation.
- *
- * Built on `crypto.subtle` (native to Workers) — no `node:crypto`, no
- * JWT deps.
- *
- * # Adopter usage
- *
- * ```ts
- * const appleSecret = await appleClientSecret({
- *   teamId: env.APPLE_TEAM_ID,
- *   keyId: env.APPLE_KEY_ID,
- *   privateKey: env.APPLE_PRIVATE_KEY,  // contents of the .p8 file
- *   audience: env.APPLE_SERVICES_ID,    // your Services ID
- * });
- * const auth = createMantleAuth({
- *   // Host-trusted ingress header(s). Cloudflare createAuth() wraps this
- *   // constructor and supplies the platform header automatically.
- *   ipAddressHeaders: ["x-real-ip"],
- *   methods: [{
- *     kind: "social",
- *     provider: "apple",
- *     options: {
- *       clientId: env.APPLE_SERVICES_ID,
- *       clientSecret: appleSecret,
- *     },
- *   }],
- *   // ...
- * });
- * ```
- *
- * `env.APPLE_PRIVATE_KEY` is the multi-line PEM contents of the `.p8`
- * file (set via `wrangler secret put APPLE_PRIVATE_KEY` — paste the
- * whole file when prompted). The helper also accepts the bare
- * base64-encoded DER if the PEM wrapping doesn't survive your secret
- * pipeline.
- */
-export interface AppleClientSecretArgs {
-    /** Apple Developer team identifier (10 chars). */
-    readonly teamId: string;
-    /** Sign-In key id (10 chars). */
-    readonly keyId: string;
-    /**
-     * `.p8` file contents — either PEM-wrapped
-     * (`-----BEGIN PRIVATE KEY-----\n…\n-----END PRIVATE KEY-----`)
-     * or just the base64 of the DER.
-     */
-    readonly privateKey: string;
-    /** Typically the Services ID — same string you pass for `clientId`. */
-    readonly audience: string;
-    /**
-     * JWT lifetime in seconds. Apple caps at 180 days
-     * (`180 * 24 * 60 * 60 = 15552000`); the default here is 30 days.
-     * The helper rejects values above Apple's cap.
-     */
-    readonly expiresInSeconds?: number;
-}
-export declare function appleClientSecret(args: AppleClientSecretArgs): Promise<string>;
-//# sourceMappingURL=appleClientSecret.d.ts.map

package/dist/auth/appleClientSecret.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"appleClientSecret.d.ts","sourceRoot":"","sources":["../../src/auth/appleClientSecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAMD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAoCjB"}

package/dist/auth/appleClientSecret.js

@@ -1,116 +0,0 @@
-/**
- * Helper for the Sign In with Apple `clientSecret` field.
- *
- * Apple's "client secret" is **not** an OAuth client secret — it is
- * an ES256-signed JWT the relying party generates from:
- *
- *   - Team ID  (Apple Developer team identifier, 10 chars)
- *   - Key ID   (the Sign-In key id, 10 chars; visible in Apple Developer)
- *   - Private key (the `.p8` file Apple lets you download once)
- *   - Audience (typically the Services ID — same as the Better Auth
- *     `clientId` you pass for `provider: "apple"`)
- *
- * The JWT lives at most 180 days per Apple's policy. This helper
- * defaults to 30 days; **the adopter is responsible for regenerating
- * the JWT before it expires** (e.g. on deploy, or via a scheduled
- * worker). A long-lived Cloudflare isolate can outlive the default,
- * and Apple will reject signin attempts with an expired secret —
- * don't rely on isolate restart cadence for rotation.
- *
- * Built on `crypto.subtle` (native to Workers) — no `node:crypto`, no
- * JWT deps.
- *
- * # Adopter usage
- *
- * ```ts
- * const appleSecret = await appleClientSecret({
- *   teamId: env.APPLE_TEAM_ID,
- *   keyId: env.APPLE_KEY_ID,
- *   privateKey: env.APPLE_PRIVATE_KEY,  // contents of the .p8 file
- *   audience: env.APPLE_SERVICES_ID,    // your Services ID
- * });
- * const auth = createMantleAuth({
- *   // Host-trusted ingress header(s). Cloudflare createAuth() wraps this
- *   // constructor and supplies the platform header automatically.
- *   ipAddressHeaders: ["x-real-ip"],
- *   methods: [{
- *     kind: "social",
- *     provider: "apple",
- *     options: {
- *       clientId: env.APPLE_SERVICES_ID,
- *       clientSecret: appleSecret,
- *     },
- *   }],
- *   // ...
- * });
- * ```
- *
- * `env.APPLE_PRIVATE_KEY` is the multi-line PEM contents of the `.p8`
- * file (set via `wrangler secret put APPLE_PRIVATE_KEY` — paste the
- * whole file when prompted). The helper also accepts the bare
- * base64-encoded DER if the PEM wrapping doesn't survive your secret
- * pipeline.
- */
-const DEFAULT_EXPIRES_IN_SECONDS = 30 * 24 * 60 * 60; // 30 days
-const APPLE_MAX_EXPIRES_IN_SECONDS = 180 * 24 * 60 * 60; // 180 days
-const APPLE_TOKEN_AUDIENCE_ISSUER = "https://appleid.apple.com";
-export async function appleClientSecret(args) {
-    const expiresIn = args.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS;
-    if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
-        // `Number.isFinite` filters NaN / Infinity — without it, NaN slips
-        // through `<= 0` and lands as `exp: NaN` → JSON serialises null
-        // → Apple rejects opaquely. Catch at the boundary with a clear msg.
-        throw new Error("appleClientSecret: expiresInSeconds must be a positive finite number");
-    }
-    if (expiresIn > APPLE_MAX_EXPIRES_IN_SECONDS) {
-        throw new Error(`appleClientSecret: expiresInSeconds ${expiresIn} exceeds Apple's 180-day max (${APPLE_MAX_EXPIRES_IN_SECONDS}).`);
-    }
-    const now = Math.floor(Date.now() / 1000);
-    const header = { alg: "ES256", kid: args.keyId };
-    const payload = {
-        iss: args.teamId,
-        iat: now,
-        exp: now + expiresIn,
-        aud: APPLE_TOKEN_AUDIENCE_ISSUER,
-        sub: args.audience,
-    };
-    const headerB64 = base64UrlEncode(textEncoder.encode(JSON.stringify(header)));
-    const payloadB64 = base64UrlEncode(textEncoder.encode(JSON.stringify(payload)));
-    const signingInput = `${headerB64}.${payloadB64}`;
-    const key = await importApplePrivateKey(args.privateKey);
-    const signature = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key, textEncoder.encode(signingInput));
-    return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
-}
-const textEncoder = new TextEncoder();
-const PEM_MARKERS_RE = /-----(?:BEGIN|END) [^-]+-----/g;
-async function importApplePrivateKey(input) {
-    const der = decodePrivateKeyToDer(input);
-    return crypto.subtle.importKey("pkcs8", der, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
-}
-function decodePrivateKeyToDer(input) {
-    // Strip PEM markers + all whitespace; tolerate the bare-base64 path too.
-    const body = input.replace(PEM_MARKERS_RE, "").replace(/\s+/g, "");
-    if (body.length === 0) {
-        throw new Error("appleClientSecret: privateKey is empty after stripping the PEM wrapper.");
-    }
-    try {
-        return base64ToBytes(body);
-    }
-    catch {
-        throw new Error("appleClientSecret: privateKey is not valid base64 — paste the contents of your .p8 file (PEM or base64).");
-    }
-}
-function base64UrlEncode(bytes) {
-    let bin = "";
-    for (let i = 0; i < bytes.length; i++)
-        bin += String.fromCharCode(bytes[i]);
-    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64ToBytes(b64) {
-    const bin = atob(b64);
-    const out = new Uint8Array(bin.length);
-    for (let i = 0; i < bin.length; i++)
-        out[i] = bin.charCodeAt(i);
-    return out;
-}
-//# sourceMappingURL=appleClientSecret.js.map

package/dist/auth/appleClientSecret.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appleClientSecret.js","sourceRoot":"","sources":["../../src/auth/appleClientSecret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAuBH,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAChE,MAAM,4BAA4B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AACpE,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEhE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,4BAA4B,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,uCAAuC,SAAS,iCAAiC,4BAA4B,IAAI,CAClH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,SAAS;QACpB,GAAG,EAAE,2BAA2B;QAChC,GAAG,EAAE,IAAI,CAAC,QAAQ;KACnB,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,eAAe,CAChC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAC5C,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAClC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CACjC,CAAC;IACF,OAAO,GAAG,YAAY,IAAI,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,KAAK,UAAU,qBAAqB,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,OAAO,EACP,GAAG,EACH,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,yEAAyE;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0GAA0G,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}