@aotter/mantle 0.2.0-alpha.6 → 0.2.0-alpha.7

package/dist/auth/types.d.ts

@@ -1,440 +0,0 @@
-/** The auth contract: options for `createMantleAuth`, its sign-in methods, and the `MantleAuth` facade. */
-import type { OAuthProviderExtension, Scope } from "@better-auth/oauth-provider";
-import type { BetterAuthOptions, BetterAuthPlugin } from "better-auth";
-import type { EmailOTPOptions, GenericOAuthConfig, MagicLinkOptions } from "better-auth/plugins";
-import type { SocialProviders } from "better-auth/social-providers";
-import { decodeMemberCursor, encodeMemberCursor, type OAuthConsentInfo, type OAuthConsentRequest } from "../admin/consent.js";
-import type { AuthUserInfo, InviteUserResult, ListMembersArgs, MemberListResult, StaffUserInfo } from "../admin/identity.js";
-import type { DatabaseDriver, EmailSender } from "../core/index.js";
-import { STAFF_ROLES, type StaffRole } from "../spec/domain/index.js";
-export type { OAuthProviderExtension } from "@better-auth/oauth-provider";
-export type { AuthUserInfo, InviteUserResult, ListMembersArgs, MemberListResult, MemberUserInfo, StaffUserInfo } from "../admin/identity.js";
-export type BackgroundTaskRetainer = (promise: Promise<unknown>) => void;
-/** Per-request platform hooks a host passes into `MantleAuth.handler`. */
-export interface MantleAuthRequestContext {
-    /** Keeps Better Auth background work alive past the response, e.g. `ctx.waitUntil`. */
-    readonly waitUntil?: BackgroundTaskRetainer;
-}
-export type { OAuthConsentInfo, OAuthConsentRequest } from "../admin/consent.js";
-export { decodeMemberCursor, encodeMemberCursor, STAFF_ROLES, type StaffRole };
-/**
- * Set lookup for "is this role string a staff role?" — handlers/MCP
- * gating reach for this every request, so the Set form is worth the
- * one-time allocation over `STAFF_ROLES.includes(x)`.
- */
-export declare const STAFF_ROLE_SET: ReadonlySet<string>;
-/**
- * Provider id for the `kind: "social"` method — Better Auth's own
- * `socialProviders` block keys. The config flows through to Better
- * Auth as-is; no per-provider wiring in this adapter (beyond the
- * github `mapProfileToUser` shim).
- */
-export type SocialProviderId = keyof SocialProviders;
-type SocialAuthMethodConfig = {
-    [Provider in SocialProviderId]: {
-        readonly kind: "social";
-        readonly provider: Provider;
-        /** Native Better Auth options for this provider, including async factories. */
-        readonly options: NonNullable<SocialProviders[Provider]>;
-    };
-}[SocialProviderId];
-/**
- * Auth method config (discriminated union). Each `kind` is one auth
- * surface adopters can opt into; adding a new method = adding a new
- * union case here, not a new top-level key on `CreateMantleAuthOptions` —
- * per ADR-0014.
- *
- * `kind: "social"` is the OAuth-based bucket — `provider` discriminates
- * the upstream IDP. We use one case rather than one-per-provider so
- * adding (e.g.) Apple doesn't churn Mantle-owned fields; Better Auth's
- * provider-specific options remain natively typed under `options`.
- */
-export type AuthMethodConfig = SocialAuthMethodConfig | {
-    readonly kind: "oauth";
-    /** Human label surfaced by `/api/auth/methods` so the admin SPA
-     *  can render "Continue with Mantle Platform" without knowing
-     *  product-specific provider ids. */
-    readonly displayName?: string;
-    /** Native Better Auth generic OAuth configuration. */
-    readonly options: GenericOAuthConfig;
-} | {
-    readonly kind: "email-otp";
-    /** Transactional-email sender. SDK never owns body templates;
-     *  the locale is passed through so the sender can branch. */
-    readonly sender: EmailSender;
-    /** Native Better Auth options. Mantle owns the sender callback and
-     *  defaults OTP storage to a keyed HMAC of the code. */
-    readonly options?: Omit<EmailOTPOptions, "sendVerificationOTP">;
-    /** Fallback locale when the request carries no Accept-Language —
-     *  typically the site's canonical locale. BCP 47. Defaults to "en". */
-    readonly fallbackLocale?: string;
-} | {
-    readonly kind: "magic-link";
-    /** Transactional-email sender. The email body carries a single
-     *  clickable URL; Better Auth verifies the token when the user
-     *  lands on it. */
-    readonly sender: EmailSender;
-    /** Native Better Auth options. Mantle owns the sender callback and defaults storage to hashed. */
-    readonly options?: Omit<MagicLinkOptions, "sendMagicLink">;
-    /** Fallback locale when the request carries no Accept-Language. */
-    readonly fallbackLocale?: string;
-};
-/**
- * First-staff promotion rule. Decoupled from `methods[]` so switching
- * the bootstrap signal (e.g. `github-login` → `email`) doesn't touch
- * any method's options.
- *
- * Promotion fires on `user.create.after`, which Better Auth dispatches
- * **only on first user creation**. If the operator signs in via one
- * method (say GitHub) before the rule can match (say `match: "email"`
- * with a non-GitHub email), the user row is created and a later
- * sign-in via a different method on the SAME email reuses that row —
- * `create.after` does not re-fire and the owner role is never
- * assigned. Match key first; the linked second method inherits the
- * role via the shared `user.id`.
- *
- * `match: "github-login"` is also brittle when multiple social
- * methods are registered. Only the `github` provider's
- * `mapProfileToUser` shim populates `user.githubLogin`; if the
- * operator's first sign-in is via Google or another non-GitHub
- * social, `githubLogin` is null and the rule silently no-ops. For
- * mixed-social setups prefer `match: "email"`.
- */
-export type BootstrapOwnerRule = {
-    readonly match: "github-login";
-    readonly value: string;
-} | {
-    readonly match: "email";
-    readonly value: string;
-};
-export interface CrossSubDomainCookiesConfig {
-    readonly enabled: boolean;
-    readonly domain?: string;
-}
-export interface OAuthProviderConfig {
-    /** Provider scopes. Include `openid` to expose a real OIDC server. */
-    readonly scopes?: ReadonlyArray<Scope>;
-    /** Better Auth OAuth provider login page. Usually `/admin/sign-in`
-     *  or a platform owner sign-in route. */
-    readonly loginPage: string;
-    /** Page that calls `/oauth2/consent` after owner approval. */
-    readonly consentPage: string;
-    readonly allowDynamicClientRegistration?: boolean;
-    readonly allowUnauthenticatedClientRegistration?: boolean;
-    readonly clientRegistrationDefaultScopes?: ReadonlyArray<Scope>;
-    readonly clientRegistrationAllowedScopes?: ReadonlyArray<Scope>;
-    /** MCP resources still require a persisted user consent; do not bypass it. */
-    readonly cachedTrustedClients?: ReadonlySet<string>;
-    /** Protected resources this authorization server may issue tokens for. */
-    readonly resources?: ReadonlyArray<string>;
-    /** Resources linked to newly registered public clients. Does not bypass consent. */
-    readonly clientRegistrationDefaultResources?: ReadonlyArray<string>;
-    /** Turn this provider into the MCP authorization server for one canonical
-     *  resource. Cloudflare deployments must enable
-     *  `global_fetch_strictly_public` for CIMD fetches. */
-    readonly mcpResource?: string;
-    /** Additional `@better-auth/oauth-provider` extensions (token grants,
-     *  client authentication, metadata, claims). On the `mcpResource` branch
-     *  they follow Core's own claims extension; on the plain provider branch
-     *  they are the whole list. Core never inspects them. This is the seam for MCP
-     *  Enterprise-Managed Authorization: an ID-JAG extension such as
-     *  `@aotterclam/id-jag` plugs in here with the adopter's issuer and JWKS. */
-    readonly extensions?: ReadonlyArray<OAuthProviderExtension>;
-    readonly clientPrivileges?: (context: {
-        readonly headers: Headers;
-        readonly action: "create" | "read" | "update" | "delete" | "list" | "rotate" | "configure-client-credentials-scopes";
-        readonly user?: {
-            readonly id: string;
-            readonly email: string;
-        } & Record<string, unknown>;
-        readonly session?: {
-            readonly id: string;
-            readonly userId: string;
-        } & Record<string, unknown>;
-    }) => boolean | undefined | Promise<boolean | undefined>;
-}
-export interface RegisterOAuthClientInput {
-    /** Current owner/admin request headers. Better Auth enforces its
-     *  clientPrivileges hook against this session before persistence. */
-    readonly requestHeaders: ConstructorParameters<typeof Headers>[0];
-    readonly redirectUris: ReadonlyArray<string>;
-    readonly scope?: ReadonlyArray<string>;
-    readonly clientName?: string;
-    readonly clientUri?: string;
-    readonly logoUri?: string;
-    readonly contacts?: ReadonlyArray<string>;
-    readonly tosUri?: string;
-    readonly policyUri?: string;
-    readonly postLogoutRedirectUris?: ReadonlyArray<string>;
-    readonly tokenEndpointAuthMethod?: "none" | "client_secret_basic" | "client_secret_post";
-    readonly grantTypes?: ReadonlyArray<"authorization_code" | "client_credentials" | "refresh_token">;
-    readonly responseTypes?: ReadonlyArray<"code">;
-    readonly applicationType?: "web" | "native";
-    /** Not suitable for MCP clients: MCP access requires a persisted user consent. */
-    readonly skipConsent?: boolean;
-    readonly enableEndSession?: boolean;
-    readonly requirePKCE?: boolean;
-    readonly subjectType?: "public" | "pairwise";
-    readonly metadata?: Record<string, unknown>;
-}
-export interface RegisteredOAuthClient {
-    readonly clientId: string;
-    readonly clientSecret?: string;
-    readonly redirectUris: readonly string[];
-    readonly scope?: readonly string[];
-    readonly clientName?: string;
-    readonly clientUri?: string;
-    readonly tokenEndpointAuthMethod?: string;
-    readonly applicationType?: "web" | "native";
-}
-/**
- * Host-supplied cache for Better Auth session reads. Keys and TTL policy are
- * owned by this package; the host only stores what it is given. Implementations
- * are typically eventually consistent, so verification codes and rate limits
- * never use it.
- */
-export interface AuthSessionCache {
-    get(key: string): Promise<string | null>;
-    set(key: string, value: string, ttlSeconds?: number): Promise<void>;
-    delete(key: string): Promise<void>;
-}
-export interface CreateMantleAuthOptions {
-    /**
-     * Better Auth's database handle for the **same** store as `driver`.
-     * SQLite and PostgreSQL are supported; the host supplies a native Better Auth
-     * database handle and Mantle driver over the same connection store. The two
-     * handles must wrap one underlying store — splitting them splits
-     * schema migration from Better Auth's own reads.
-     */
-    readonly database: NonNullable<BetterAuthOptions["database"]>;
-    /** Mantle's port over that same store. Carries this package's own SQL and the
-     * Better Auth schema migration. */
-    readonly driver: DatabaseDriver;
-    /** Optional derivative session storage. The Mantle store must be prepared
-     * before cached Auth operations so keys can bind to its instance identity. */
-    readonly sessionCache?: AuthSessionCache;
-    readonly baseURL: string;
-    /** Better Auth route prefix. Defaults to `/api/auth`. Set this when
-     *  multiple auth instances live in one Worker, e.g. hosted platform
-     *  provider + site staff auth + launch GitHub auth. */
-    readonly basePath?: string;
-    /** Same-origin destination for auth failures. Defaults to `/`. */
-    readonly errorURL?: string;
-    readonly secret: string;
-    /** Registered auth methods. Boot fails fast when this and `plugins` are both empty. */
-    readonly methods: ReadonlyArray<AuthMethodConfig>;
-    /** Native Better Auth plugins for flows whose callbacks and UI are fully adopter-owned. */
-    readonly plugins?: ReadonlyArray<BetterAuthPlugin>;
-    /** Sends an English notification after Admin successfully assigns a staff role. */
-    readonly staffInvitationSender?: EmailSender;
-    /** First-user-becomes-owner rule. Without it, the `owner` role must
-     *  be assigned manually in the auth store. */
-    readonly bootstrapOwner?: BootstrapOwnerRule;
-    /** Better Auth's always-enabled rate limit. Email methods default to
-     *  10/minute, others to 100/minute; plugin-specific limits still apply. */
-    readonly rateLimit?: {
-        readonly window: number;
-        readonly max: number;
-    };
-    /** Additional Better Auth trusted origins. SDK still injects
-     *  provider-required origins such as Apple automatically. */
-    readonly trustedOrigins?: ReadonlyArray<string>;
-    /** Forwarded to Better Auth's `advanced.crossSubDomainCookies`.
-     *  Use only for trusted first-party app families. */
-    readonly crossSubDomainCookies?: CrossSubDomainCookiesConfig;
-    /** Forwarded to Better Auth's `advanced.cookiePrefix`. Set this
-     *  when multiple Better Auth apps share a parent cookie domain. */
-    readonly cookiePrefix?: string;
-    /** HTTPS-only __Host- cookies for isolation from sibling tenant domains.
-     * Incompatible with crossSubDomainCookies.enabled. Defaults to false. */
-    readonly hostOnlyCookies?: boolean;
-    /** Turn this Better Auth instance into an OAuth/OIDC provider.
-     *  Consumer sites should use `methods: [{ kind: "oauth", ... }]`
-     *  against its discovery document. */
-    readonly oauthProvider?: OAuthProviderConfig;
-    /** Forwarded to Better Auth's `account.accountLinking`. Omitted here,
-     *  Better Auth's own defaults apply: implicit linking is ON, so a social
-     *  sign-in whose provider reports a verified email lands on the existing
-     *  row with that email instead of creating a second one, and
-     *  `requireLocalEmailVerified` keeps that from happening while the local
-     *  row is still unverified. Set this to scope linking — `enabled: false`
-     *  or `disableImplicitLinking` to refuse it, `trustedProviders` to accept
-     *  a provider's word without `email_verified` (it does not bypass
-     *  `requireLocalEmailVerified`). Listing a provider asserts it verifies
-     *  the addresses it returns. */
-    readonly accountLinking?: NonNullable<NonNullable<BetterAuthOptions["account"]>["accountLinking"]>;
-    /**
-     * Host-trusted ingress headers used as Better Auth's rate-limit identity.
-     * Required and fail-closed: empty or missing refuses to boot. Pass only
-     * headers the host overwrites at the edge. Never default to
-     * client-controlled `X-Forwarded-For`. Cloudflare `createAuth` supplies
-     * `cf-connecting-ip`; Bun and Vercel hosts must pass their own header(s).
-     */
-    readonly ipAddressHeaders: ReadonlyArray<string>;
-}
-/**
- * Public-facing method descriptor exposed via `Auth.methods` and the
- * `GET /api/auth/methods` endpoint. The `social` kind carries the
- * upstream `provider` so the admin SPA can render a per-provider
- * button (label + future brand icon). Secrets, senders, and per-
- * provider extras stay private.
- */
-export type AuthMethodInfo = {
-    readonly kind: "email-otp";
-} | {
-    readonly kind: "magic-link";
-} | {
-    readonly kind: "social";
-    readonly provider: SocialProviderId;
-} | {
-    readonly kind: "oauth";
-    readonly providerId: string;
-    readonly displayName?: string;
-};
-/**
- * Linked-account row as exposed to consumers. Mirrors the BA `account`
- * table's identity columns; OAuth tokens and other secret-shaped
- * columns are intentionally excluded — callers should never need them
- * to render a "signed in via <provider>" list.
- */
-export interface LinkedAccountInfo {
-    readonly id: string;
-    readonly providerId: string;
-    readonly accountId: string;
-    readonly createdAt: Date;
-    readonly updatedAt: Date;
-}
-export interface ProviderAccessToken {
-    readonly accessToken: string;
-    readonly accessTokenExpiresAt?: Date;
-    readonly scopes: readonly string[];
-}
-export type OAuthAccessTokenVerification = {
-    readonly ok: true;
-    readonly userId: string;
-    readonly clientId: string | null;
-    readonly credentialId: string | null;
-    readonly scopes: readonly string[];
-} | {
-    readonly ok: false;
-    readonly status: 401 | 403;
-    readonly reason: "invalid-token" | "invalid-dpop-proof" | "insufficient-scope";
-    readonly missingScopes?: readonly string[];
-};
-export interface MantleAuth {
-    readonly basePath: string;
-    /** Better Auth's per-isolate context; Workers must anchor this before responding. */
-    readonly ready?: Promise<void>;
-    /** Canonical MCP protected resource when this Auth owns one. */
-    readonly mcpResource?: string;
-    /** Serve one Better Auth request. Pass `waitUntil` so background work
-     *  (OTP send, rate-limit cleanup) survives the response on Workers. */
-    readonly handler: (request: Request, context?: MantleAuthRequestContext) => Promise<Response>;
-    readonly getSession: (request: Request) => Promise<{
-        /** `createdAt` is when this sign-in happened: a sensitive action can require a recent one. */
-        session: {
-            id: string;
-            userId: string;
-            expiresAt: Date;
-            createdAt: Date;
-        };
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            image?: string | null;
-            role?: string | null;
-            /** The role came from the same uncached database read as this session. */
-            roleCurrent?: true;
-            githubLogin?: string | null;
-        };
-    } | null>;
-    /** Authoritative `user.role` lookup. Protected Admin, MCP, preview,
-     *  and HTTP Trigger calls use this on every request so custom Auth
-     *  session snapshots cannot retain revoked staff access. */
-    readonly getUserRole: (userId: string) => Promise<string | null>;
-    /** Read one Better Auth-owned user without coupling consumers to its SQL schema.
-     *  Optional so existing custom Auth implementations remain source-compatible. */
-    readonly getUser?: (userId: string) => Promise<AuthUserInfo | null>;
-    /** Retrieve (and, when expired, refresh) a linked provider token for
-     *  the user identified by the current local session request. Refresh
-     *  tokens and account rows are never returned. */
-    readonly getProviderAccessToken: (request: Request, providerId: string) => Promise<ProviderAccessToken>;
-    /** Verify a JWT access token against this Auth instance's issuer and
-     *  JWKS. Passing a Request also enforces DPoP proof binding and persistent
-     *  replay protection. Opaque tokens and remote introspection are not
-     *  supported. */
-    readonly verifyOAuthAccessToken: (tokenOrRequest: string | Request, options: {
-        readonly audience: string;
-        readonly scopes?: readonly string[];
-    }) => Promise<OAuthAccessTokenVerification>;
-    /** Secret-free client projection for the current consent redirect. */
-    readonly getOAuthConsentRequest: (request: Request) => Promise<OAuthConsentRequest | null>;
-    /** Submit the original signed query and return the validated client redirect. */
-    readonly completeOAuthConsent: (request: Request, accept: boolean) => Promise<string>;
-    /** User-facing OAuth grants. Optional so custom Auth facades stay compatible. */
-    readonly listOAuthConsents?: (userId: string) => Promise<readonly OAuthConsentInfo[]>;
-    /** Revoke every token and consent row for one user/client grant. */
-    readonly revokeOAuthConsent?: (userId: string, consentId: string) => Promise<boolean>;
-    /** Methods the consumer registered, in declaration order. The admin
-     *  SPA renders sign-in sections per this list. Secrets, senders, and
-     *  per-provider extras are intentionally excluded — UI doesn't need
-     *  them. `social` methods carry the upstream `provider` id for
-     *  per-provider rendering. */
-    readonly methods: ReadonlyArray<AuthMethodInfo>;
-    /** List a user's linked social/credential accounts. Ordered by
-     *  `createdAt` ascending so the UI can render "linked since" in a
-     *  stable order across reloads. Read-only — uses the underlying D1
-     *  binding directly, no Better Auth API call. */
-    readonly listLinkedAccounts: (userId: string) => Promise<readonly LinkedAccountInfo[]>;
-    /** Unlink a single account by `(userId, providerId)`. Returns true if
-     *  a row was deleted, false if no matching account existed. Does NOT
-     *  guard against unlinking the user's only sign-in method — the
-     *  caller knows their auth method mix and decides whether the
-     *  resulting state is sign-in-able. The runtime can't, because
-     *  email-OTP / magic-link sign-ins do not write to the `account`
-     *  table at all, so "rows left" is not a reliable indicator. */
-    readonly unlinkAccount: (userId: string, providerId: string) => Promise<boolean>;
-    /** List only users with a staff role, ordered by `createdAt`
-     *  ascending. End-user identities stay outside the team-management
-     *  surface. Owner-only enforcement is the mount layer's job. */
-    readonly listUsers: (request: Request) => Promise<readonly StaffUserInfo[]>;
-    /** List non-staff identities for the member-management surface. */
-    readonly listMembers: (args: ListMembersArgs) => Promise<MemberListResult>;
-    /** Assign or clear a user's staff role. `null` revokes staff access
-     *  (the row keeps existing — the user can still sign in, but every
-     *  staff-gated surface 403s). Returns false when no row matched.
-     *  Throws on a non-staff role string — programmer error, not an
-     *  operator input path (endpoints validate before calling). Does NOT
-     *  guard self-demotion; that's session-aware and lives in the mount
-     *  layer. */
-    readonly setUserRole: (request: Request, userId: string, role: StaffRole | null) => Promise<boolean>;
-    /** Invite a staff member by email: pre-create the user row
-     *  (`emailVerified: 0`) with the role already assigned, so the
-     *  invitee's FIRST sign-in with that email lands with the role in
-     *  effect — no second assignment step. Magic-link / email-OTP
-     *  sign-ins match the row by email. A social sign-in does NOT: the
-     *  row is unverified, and Better Auth's `requireLocalEmailVerified`
-     *  defaults to on, so linking is refused with `account not linked`
-     *  regardless of `accountLinking.trustedProviders` (unless the adopter
-     *  sets `accountLinking.requireLocalEmailVerified: false`) — an invitee
-     *  whose only credential is a social provider must verify by email once
-     *  before that provider attaches. Email is normalized (trim +
-     *  lowercase). Returns `exists` instead of throwing when the email
-     *  already has a row. */
-    readonly inviteUser: (request: Request, email: string, role: StaffRole) => Promise<InviteUserResult>;
-    readonly sendStaffInvitation?: (email: string, role: StaffRole) => Promise<void>;
-    /** Delete an invitation row. Guarded to rows nobody ever signed in
-     *  to (`emailVerified = 0` AND no linked `account` row) so a real
-     *  user with sessions/accounts can never be cascade-deleted through
-     *  this path. Returns false when the row didn't match the guard. */
-    readonly revokeInvite: (userId: string) => Promise<boolean>;
-    /** Delete a user; sessions and accounts cascade, and cached sessions are cleared when a session cache is configured. Pending email codes for its address are deleted too. A service stops running raw SQL against auth tables. */
-    readonly deleteUser: (userId: string) => Promise<boolean>;
-    /** Register an OAuth/OIDC client when `oauthProvider` is configured.
-     *  Uses Better Auth's own provider plugin endpoint and returns the
-     *  client secret only on creation. The caller must pass the current
-     *  owner/admin request headers so Better Auth can enforce privileges. */
-    readonly registerOAuthClient: (input: RegisterOAuthClientInput) => Promise<RegisteredOAuthClient>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,OAAO,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9H,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7H,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEtE,YAAY,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG7I,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAEzE,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAGD,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAC,kBAAkB,EAAC,WAAW,EAAC,KAAK,SAAS,EAAE,CAAC;AAC5E;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CAAwB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,eAAe,CAAC;AAErD,KAAK,sBAAsB,GAAG;KAC3B,QAAQ,IAAI,gBAAgB,GAAG;QAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5B,+EAA+E;QAC/E,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;KAC1D;CACF,CAAC,gBAAgB,CAAC,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;yCAEqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;iEAC6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;4DACwD;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;IAChE;2EACuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAC3D,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC;6CACyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAClD,QAAQ,CAAC,sCAAsC,CAAC,EAAE,OAAO,CAAC;IAC1D,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,QAAQ,CAAC,+BAA+B,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChE,8EAA8E;IAC9E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,kCAAkC,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpE;;2DAEuD;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;iFAK6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,MAAM,EACX,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,qCAAqC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAC1E,MAAM,EACN,OAAO,CACR,CAAC;KACH,KAAK,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC;yEACqE;IACrE,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxD,QAAQ,CAAC,uBAAuB,CAAC,EAC7B,MAAM,GACN,qBAAqB,GACrB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CACjC,oBAAoB,GAAG,oBAAoB,GAAG,eAAe,CAC9D,CAAC;IACF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5C,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9D;uCACmC;IACnC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;kFAC8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD,mFAAmF;IACnF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,WAAW,CAAC;IAC7C;kDAC8C;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C;+EAC2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;iEAC6D;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;yDACqD;IACrD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IAC7D;uEACmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;6EACyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;0CAEsC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAC7C;;;;;;;;;oCASgC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CACnC,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAC5D,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAClD;AAGD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAChE;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,MAAM,EACX,eAAe,GACf,oBAAoB,GACpB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C,CAAC;AAMN,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;2EACuE;IACvE,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9F,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QACjD,8FAA8F;QAC9F,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,IAAI,CAAC;YAAC,SAAS,EAAE,IAAI,CAAA;SAAE,CAAC;QAC1E,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YACrB,0EAA0E;YAC1E,WAAW,CAAC,EAAE,IAAI,CAAC;YACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;SAC7B,CAAC;KACH,GAAG,IAAI,CAAC,CAAC;IACV;;gEAE4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACjE;qFACiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACpE;;sDAEkD;IAClD,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC;;;qBAGiB;IACjB,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,cAAc,EAAE,MAAM,GAAG,OAAO,EAChC,OAAO,EAAE;QACP,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,KACE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,sBAAsB,EAAE,CAC/B,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,OAAO,KACZ,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,iFAAiF;IACjF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;IAC1C,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;kCAI8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAChD;;;qDAGiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IAC3C;;;;;;oEAMgE;IAChE,QAAQ,CAAC,aAAa,EAAE,CACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,KACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;oEAEgE;IAChE,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC5E,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E;;;;;;iBAMa;IACb,QAAQ,CAAC,WAAW,EAAE,CACpB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GAAG,IAAI,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;;;;;;;;;;;;6BAYyB;IACzB,QAAQ,CAAC,UAAU,EAAE,CACnB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,KACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF;;;wEAGoE;IACpE,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,kOAAkO;IAClO,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D;;;6EAGyE;IACzE,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,KAAK,EAAE,wBAAwB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACrC"}

package/dist/auth/types.js

@@ -1,10 +0,0 @@
-import { decodeMemberCursor, encodeMemberCursor } from "../admin/consent.js";
-import { STAFF_ROLES } from "../spec/domain/index.js";
-export { decodeMemberCursor, encodeMemberCursor, STAFF_ROLES };
-/**
- * Set lookup for "is this role string a staff role?" — handlers/MCP
- * gating reach for this every request, so the Set form is worth the
- * one-time allocation over `STAFF_ROLES.includes(x)`.
- */
-export const STAFF_ROLE_SET = new Set(STAFF_ROLES);
-//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAmD,MAAM,qBAAqB,CAAC;AAG9H,OAAO,EAAE,WAAW,EAAkB,MAAM,yBAAyB,CAAC;AAgBtE,OAAO,EAAE,kBAAkB,EAAC,kBAAkB,EAAC,WAAW,EAAiB,CAAC;AAC5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC"}

package/dist/bun/index.d.ts

@@ -1,21 +0,0 @@
-import { sqliteStorage } from '../d1/index.js';
-/** Serve the installed Admin bundle. Reject traversal and symlinks outside the supplied root. */
-export declare function bunAdminAssets(root: string): (path: string) => Promise<Response | null>;
-/** Structural bun:sqlite database. One native synchronous transaction per batch. */
-export interface BunSqliteDatabase {
-    prepare(sql: string): {
-        all(...binds: any[]): Record<string, unknown>[];
-    };
-    transaction<T>(run: () => T): {
-        immediate(): T;
-    };
-    readonly inTransaction: boolean;
-}
-/**
- * One native synchronous transaction per batch. Foreign keys are on, as on D1 (Better Auth's tables cascade). Better Auth holds
- * its own transactions open across awaits on the same handle: a batch waits for one to end, or it would become a savepoint
- * inside it and an acknowledged write could roll back with it. A batch itself never yields, so nothing interleaves with it.
- */
-export declare function bunSqliteDriver(db: BunSqliteDatabase): import('../core/driver.js').DatabaseDriver;
-export declare const bunSqliteStorage: (db: BunSqliteDatabase, options?: Parameters<typeof sqliteStorage>[1]) => import("../core/service.js").MantleStorageAdapter;
-//# sourceMappingURL=index.d.ts.map

package/dist/bun/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bun/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAevF;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAAC;IAC1E,WAAW,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;QAAE,SAAS,IAAI,CAAC,CAAA;KAAE,CAAC;IACjD,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AACD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,mBAAmB,EAAE,cAAc,CASjG;AACD,eAAO,MAAM,gBAAgB,GAAI,IAAI,iBAAiB,EAAE,UAAU,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,sDAAgD,CAAC"}

package/dist/bun/index.js

@@ -1,46 +0,0 @@
-import { sqliteStorage } from '../d1/index.js';
-import { resolve, sep } from 'node:path';
-/** Serve the installed Admin bundle. Reject traversal and symlinks outside the supplied root. */
-export function bunAdminAssets(root) {
-    const base = resolve(root);
-    return async (path) => {
-        let decoded;
-        try {
-            decoded = decodeURIComponent(path);
-        }
-        catch {
-            return null;
-        }
-        if (/[\u0000-\u001f]/.test(decoded))
-            return null;
-        const target = resolve(base, `.${decoded.startsWith('/') ? decoded : `/${decoded}`}`);
-        if (!target.startsWith(`${base}${sep}`))
-            return null;
-        const file = Bun.file(target);
-        if (!(await file.exists()))
-            return null;
-        const { realpath } = await import('node:fs/promises');
-        const physical = await realpath(target).catch(() => '');
-        if (!physical.startsWith(`${await realpath(base)}${sep}`))
-            return null;
-        return new Response(file);
-    };
-}
-/**
- * One native synchronous transaction per batch. Foreign keys are on, as on D1 (Better Auth's tables cascade). Better Auth holds
- * its own transactions open across awaits on the same handle: a batch waits for one to end, or it would become a savepoint
- * inside it and an acknowledged write could roll back with it. A batch itself never yields, so nothing interleaves with it.
- */
-export function bunSqliteDriver(db) {
-    db.prepare('PRAGMA foreign_keys = ON').all();
-    return {
-        async batch(statements) {
-            for (const deadline = Date.now() + 5_000; db.inTransaction; await new Promise((r) => setTimeout(r, 1)))
-                if (Date.now() > deadline)
-                    throw new Error('bun:sqlite: a transaction on this handle stayed open for 5 s');
-            return db.transaction(() => statements.map((s) => ({ rows: db.prepare(s.sql).all(...(s.binds ?? [])) }))).immediate();
-        },
-    };
-}
-export const bunSqliteStorage = (db, options) => sqliteStorage(bunSqliteDriver(db), options);
-//# sourceMappingURL=index.js.map

package/dist/bun/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/bun/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzC,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAClE,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,EAAqB;IACnD,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7C,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,UAAU;YACpB,KAAK,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,aAAa,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACxH,CAAC;KACF,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAAqB,EAAE,OAA6C,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC"}

package/dist/cli/emitModule.d.ts

@@ -1,7 +0,0 @@
-/**
- * `.mantle/generated/mantle.ts` (ADR-0032 amendment "mantle generate"): the plan from `plan.json`, the manifest types (`emitTypesFromManifests`)
- * namespace, and a typed Store and `MantleHandlers` over exactly this plan. Types only, apart from the `plan` import.
- */
-import { type LinkedManifestSet, type RuntimePlan } from "../spec/index.js";
-export declare function emitMantleModule(plan: RuntimePlan, linked: LinkedManifestSet): string;
-//# sourceMappingURL=emitModule.d.ts.map

package/dist/cli/emitModule.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"emitModule.d.ts","sourceRoot":"","sources":["../../src/cli/emitModule.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAoF,KAAK,iBAAiB,EAAkC,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA4C9L,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,GAAG,MAAM,CA+ErF"}