@aotter/mantle 0.2.0-alpha.6 → 0.2.0-alpha.8

package/dist/auth/buildAuth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"buildAuth.d.ts","sourceRoot":"","sources":["../../src/auth/buildAuth.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAKrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAiBlF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,2CAAkD,CAAC;AA2BvF,wBAAgB,SAAS,CAAC,MAAM,EAAE,uBAAuB;;;;;;;;;;;;;;;;;;;yBA2JtC,OAAO,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAhG2B,CAAC;;;;;;;;;6BAIrD,CAAA;6BACA,CAAH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAsB6C,CAAC;;;;;;;;;;;;yBAIvB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAqCD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAkES,CAAC;qCAGjC,CAAN;;;;;;;;;iCAKmD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA6BE,CAAA;qCACX,CAAC;;;;;;;;;iCAMhC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAlSoU,CAAC;;;;;;;;;yCAI3T,CAAC;;;;;;;;;;;;;;;yCAUwB,CAAA;yCAC3B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAuCI,CAAC;qCACgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAiCO,CAAC;qCACf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA6ExB,CAAC;qCAEJ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAyBH,CAAC;qCAEA,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAiEJ,CAAC;qCACQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA+BmD,CAAC;qCAEjE,CAAH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAmC0J,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAyzC,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAAo6B,CAAC;6BAA8C,CAAC;;;;;;;;;;;;;;;6BAAuY,CAAC;6BAA8C,CAAC;;;;;;;;;yBAA0O,CAAC;;;;;;;;;;;;;;;;;;qCAAksB,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAi0C,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAgzC,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAi2C,CAAC;qCAAkD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA5P1gQ,CAAC;qCACN,CAAC;;;;;;;;;iCAS2B,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA0BI,CAAC;;;;;;;;;;;;;;;;;kCAWrB,CAAT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCA6Mm7O,CAAC;yCAAoD,CAAC;;;;;;;;;yCAAoW,CAAC;yCAAoD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAAgmD,CAAC;;oCAAiF,CAAC;;;0CAAoJ,CAAC;;2CAA4F,CAAC;+CAA4D,CAAC;;;;;qCAAqL,CAAC;gCAA4C,CAAC;;;;qDAAkM,CAAC;gEAA+F,CAAC;qCAAyF,CAAC;oCAAgD,CAAC;6BAA2C,CAAC;0BAAsC,CAAC;mCAA+C,CAAC;0DAAsE,CAAC;qEAAoG,CAAC;sCAA0F,CAAC;6DAAyE,CAAC;wEAAuG,CAAC;;8DAAoK,CAAC;qDAAkE,CAAC;4CAAyD,CAAC;oDAAiE,CAAC;iDAA8D,CAAC;;;;;;;;;;;;;;;;;;;;sCAA2qB,CAAC;uCAAkC,CAAC;qCAAgC,CAAC;;;;;;;;;sCAAoO,CAAC;uCAAkC,CAAC;qCAAgC,CAAC;;;;;;;;;;uCAAoQ,CAAC;qCAAgC,CAAC;;;;;;;;;;sCAAqQ,CAAC;qCAAgC,CAAC;;;;;;;;;;;;sCAA4S,CAAC;uCAAkC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA+3D,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA+hD,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDAAk3G,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAAqpT,CAAC;;;sCAAiF,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAupnB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAw/M,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;qCAAgxB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAwyC,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAkkF,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAAw5D,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;qCAAuyB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA80B,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;qCAAisB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;qCAAwsB,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAA63B,CAAC;qCAAkD,CAAC;;;;;;;;;iCAA8Q,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA1+3C,CAAC;sBAA4P,CAAC;;;;;;;;;;;qBAA8Q,CAAC;;kBAAwH,CAAC;sBAA4P,CAAC;;;;;;;;;;;;qBAAuR,CAAC;;kBAAwH,CAAC;sBAAuK,CAAC;qBAA0M,CAAC;;;;kBAAmL,CAAC;sBAAkQ,CAAC;;;;;;;;;;;;qBAA0R,CAAC;;kBAAuK,CAAC;sBAA+P,CAAC;;;;;;;;;;;;;qBAAmS,CAAC;;kBAA8H,CAAC;sBAA6K,CAAC;qBAAmN,CAAC;;;;kBAAyL,CAAC;sBAAkQ,CAAC;;;;;;;;;;;;;;;;;qBAAgQ,CAAC;;kBAA6I,CAAC;sBAA8P,CAAC;;;;;;;;;;;;;;;;;;qBAAmS,CAAC;;kBAA8H,CAAC;sBAA8K,CAAC;qBAAoN,CAAC;;;;kBAAmM,CAAC;sBAA4Q,CAAC;;;;;;;;;;qBAA8S,CAAC;;kBAAwI,CAAC;sBAA4Q,CAAC;;;;;;;;;;;qBAAuT,CAAC;;kBAAwI,CAAC;sBAAuL,CAAC;qBAAkO,CAAC;;;;;;;;;iKAAntY,CAAC;;;;;;;;mBAxC7srB,MAAM;mBAGN,MAAM,SAAS,MAAM,QAAQ,MAAM;sBAOhC,MAAM;;;;;;;;;;;;;;;;;GA6B7B"}

package/dist/auth/buildAuth.js

@@ -1,312 +0,0 @@
-/** One Better Auth instance from `CreateMantleAuthOptions`: plugins, staff roles, database hooks and the session cache. */
-import { cimd } from "@better-auth/cimd";
-import { mcp } from "@better-auth/mcp";
-import { oauthProvider } from "@better-auth/oauth-provider";
-import { betterAuth } from "better-auth";
-import { admin, jwt } from "better-auth/plugins";
-import { createAccessControl } from "better-auth/plugins/access";
-import { defaultStatements } from "better-auth/plugins/admin/access";
-import { genericOAuth } from "better-auth/plugins/generic-oauth";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { STAFF_ROLES } from "../spec/domain/index.js";
-import { dbOf, readStoreInstanceId } from "./db.js";
-import { buildEmailOTPPlugin, buildGenericOAuthProviders, buildMagicLinkPlugin, buildOAuthProviderOptions, buildSocialProviders, buildTrustedOriginsFor, guardGithubLoginProfile, hasEmailAuthSurface, methodsRequireSameSiteNone, normalizeAuthBasePath, normalizeAuthErrorURL, pickSingleton, resolveClientIpHeaders, shouldPromoteToOwner, validateBootstrap } from "./methods.js";
-// Better Auth 1.7.7 initializes its shared stores asynchronously. Seed them
-// before any request can be canceled; the accessor-identity regression test
-// pins this version-specific integration to the stores Better Auth uses.
-const betterAuthGlobalKey = Symbol.for("better-auth:global");
-const betterAuthGlobals = globalThis;
-const betterAuthGlobal = betterAuthGlobals[betterAuthGlobalKey] ??= {
-    version: "",
-    epoch: 0,
-    context: {},
-};
-betterAuthGlobal.context.requestStateAsyncStorage ??= new AsyncLocalStorage();
-betterAuthGlobal.context.endpointContextAsyncStorage ??= new AsyncLocalStorage();
-betterAuthGlobal.context.adapterAsyncStorage ??= new AsyncLocalStorage();
-/**
- * Request-scoped retention for Better Auth's fire-and-forget work. Better Auth
- * hands `advanced.backgroundTasks.handler` a bare promise with no request in
- * sight; the handler reads the retainer the current `handler()` call stored
- * here and registers the promise with it. On Workers that retainer is
- * `ExecutionContext.waitUntil` — without it the OTP send and the rate-limit
- * cleanup can be cancelled the moment the response is returned (#976).
- */
-export const backgroundTaskRetention = new AsyncLocalStorage();
-const ac = createAccessControl(defaultStatements);
-const ownerAc = ac.newRole({
-    user: defaultStatements.user,
-    session: defaultStatements.session,
-});
-const editorAc = ac.newRole({
-    user: ["list", "ban", "get", "update"],
-    session: ["list", "revoke"],
-});
-const contributorAc = ac.newRole({
-    user: ["list", "get"],
-    session: [],
-});
-const userAc = ac.newRole({
-    user: [],
-    session: [],
-});
-export function buildAuth(config) {
-    const db = dbOf(config.driver);
-    const ipAddressHeaders = resolveClientIpHeaders(config.ipAddressHeaders);
-    if (config.hostOnlyCookies && (new URL(config.baseURL).protocol !== "https:" || config.crossSubDomainCookies?.enabled)) {
-        throw new Error("createMantleAuth: hostOnlyCookies requires HTTPS and cannot share cookies across subdomains.");
-    }
-    if (config.methods.length === 0 && !config.plugins?.length) {
-        throw new Error("createMantleAuth: methods[] is empty — register an AuthMethodConfig or native Better Auth plugin so staff can sign in.");
-    }
-    if (config.bootstrapOwner) {
-        validateBootstrap(config.bootstrapOwner, config.methods);
-    }
-    const socialProviders = buildSocialProviders(config.methods);
-    const genericOAuthProviders = buildGenericOAuthProviders(config.methods);
-    const bootstrap = config.bootstrapOwner;
-    const emailOtpMethod = pickSingleton(config.methods, "email-otp");
-    const magicLinkMethod = pickSingleton(config.methods, "magic-link");
-    const providerOptions = config.oauthProvider
-        ? buildOAuthProviderOptions(config.oauthProvider)
-        : null;
-    // Workers may not set NODE_ENV. Explicitly enable the provider's route
-    // limits too (notably anonymous DCR: 5/minute).
-    // ponytail: memory limits are per isolate; use an ingress rate-limit rule
-    // when a deployment needs a distributed abuse quota.
-    const hasEmailMethod = hasEmailAuthSurface(config.methods, config.plugins);
-    const rateLimit = {
-        window: 60,
-        max: hasEmailMethod ? 10 : 100,
-        ...config.rateLimit,
-        enabled: true,
-        storage: "memory",
-    };
-    // `trustedOrigins`: per-provider auto-origins (Apple needs
-    // `https://appleid.apple.com`) plus adopter-owned first-party
-    // origins for flows such as hosted auth across trusted subdomains.
-    const trustedOrigins = buildTrustedOriginsFor(config.methods, config.trustedOrigins);
-    const sdkPlugins = [
-        admin({
-            defaultRole: "user",
-            adminRoles: [...STAFF_ROLES],
-            ac,
-            roles: {
-                owner: ownerAc,
-                editor: editorAc,
-                contributor: contributorAc,
-                user: userAc,
-            },
-        }),
-        ...(genericOAuthProviders.length > 0
-            ? [
-                genericOAuth({
-                    config: genericOAuthProviders,
-                }),
-            ]
-            : []),
-        ...(emailOtpMethod ? [buildEmailOTPPlugin(emailOtpMethod, config.secret)] : []),
-        ...(magicLinkMethod ? [buildMagicLinkPlugin(magicLinkMethod)] : []),
-        ...(config.oauthProvider && providerOptions
-            ? [
-                // the plugin would otherwise sign a `set-auth-jwt` header on every session request; Mantle discards it (no consumer reads it)
-                jwt({ disableSettingJwtHeader: true }),
-                config.oauthProvider.mcpResource
-                    ? mcp({
-                        ...providerOptions,
-                        resource: config.oauthProvider.mcpResource,
-                        extensions: [
-                            {
-                                claims: {
-                                    accessToken: ({ referenceId }) => ({ mantle_consent_id: referenceId ?? null }),
-                                },
-                            },
-                            ...(config.oauthProvider.extensions ?? []),
-                        ],
-                    })
-                    : oauthProvider({
-                        ...providerOptions,
-                        ...(config.oauthProvider.extensions
-                            ? { extensions: [...config.oauthProvider.extensions] }
-                            : {}),
-                    }),
-                ...(config.oauthProvider.mcpResource
-                    ? [
-                        cimd({
-                            // Cloudflare's `global_fetch_strictly_public` flag is the
-                            // runtime network boundary: resolution and connection stay
-                            // on the public Internet. Better Auth owns timeout, limits,
-                            // validation, caching, and redirect rejection above it.
-                            // Workers does not implement `redirect: "error"`; `manual`
-                            // exposes 3xx responses so Better Auth can reject them.
-                            fetchClientMetadataResource: (input, init) => fetch(input, { ...init, redirect: "manual" }),
-                            metadataProfile: "mcp-2026-07-28",
-                        }),
-                    ]
-                    : []),
-            ]
-            : []),
-    ];
-    const plugins = [...sdkPlugins, ...(config.plugins ?? [])];
-    const pluginIds = new Set();
-    for (const plugin of plugins) {
-        if (pluginIds.has(plugin.id)) {
-            throw new Error(`createMantleAuth: Better Auth plugin '${plugin.id}' is registered more than once. Remove the duplicate plugin.`);
-        }
-        pluginIds.add(plugin.id);
-    }
-    // `user.additionalFields`: SDK owns `githubLogin` only.
-    const userConfig = {
-        additionalFields: {
-            githubLogin: {
-                type: "string",
-                required: false,
-                // Better Auth applies `input: false` to trusted provider profiles too.
-                // Database hooks below keep this field provider-only instead.
-                input: true,
-            },
-        },
-    };
-    // `advanced`: SDK owns `backgroundTasks`. Apple auto-injects
-    // `defaultCookieAttributes.sameSite: "none"` because Apple's
-    // `form_post` callback is cross-site and a `lax` cookie won't ride
-    // it (Better Auth's default raises a state-mismatch).
-    const appleNeedsCrossSite = methodsRequireSameSiteNone(config.methods);
-    const advancedConfig = {
-        // Mantle converges lazily. Better Auth 1.7.7's automatic check runs at
-        // construction, before those tables exist. Keep its explicit schema check
-        // and run it in prepareAuth after convergence, before any auth operation.
-        database: { validateSchema: false },
-        // Host adapter supplies the trusted ingress header(s). Never default to XFF.
-        ipAddress: { ipAddressHeaders: [...ipAddressHeaders] },
-        ...(appleNeedsCrossSite
-            ? {
-                // Browsers require `secure: true` whenever `sameSite: "none"`.
-                defaultCookieAttributes: { secure: true, sameSite: "none" },
-            }
-            : {}),
-        ...(config.crossSubDomainCookies
-            ? { crossSubDomainCookies: config.crossSubDomainCookies }
-            : {}),
-        ...(config.cookiePrefix ? { cookiePrefix: config.cookiePrefix } : {}),
-        ...(config.hostOnlyCookies ? {
-            // Better Auth prepends __Secure- otherwise. Secure is set explicitly below.
-            useSecureCookies: false,
-            cookiePrefix: `__Host-${config.cookiePrefix || "better-auth"}`,
-            crossSubDomainCookies: { enabled: false },
-            defaultCookieAttributes: { secure: true, path: "/", ...(appleNeedsCrossSite ? { sameSite: "none" } : {}) },
-        } : {}),
-        // Fire-and-forget hook closes the user-existence timing oracle
-        // on OTP send — see § "Auth as contract" notes in ADR-0014.
-        backgroundTasks: {
-            handler: (p) => {
-                const settled = p.then(() => undefined, (err) => {
-                    // eslint-disable-next-line no-console
-                    console.error("[better-auth backgroundTask]", err);
-                });
-                // Registered with the request's retainer when the host supplied one;
-                // otherwise the work simply runs detached as before.
-                backgroundTaskRetention.getStore()?.(settled);
-            },
-        },
-    };
-    // `databaseHooks`: SDK owns `user.create.after` for bootstrap-owner
-    // promotion (when `bootstrapOwner` is configured).
-    const sdkUserCreateAfter = async (user) => {
-        if (!bootstrap)
-            return;
-        const u = user;
-        if (!shouldPromoteToOwner(bootstrap, u))
-            return;
-        // Atomic check-then-promote: the `NOT EXISTS` is a GLOBAL guard —
-        // it asks "does any user already hold a staff role?". The whole
-        // statement runs as one database op, so two concurrent first signups
-        // can't both win: the loser's UPDATE finds a staff user in the
-        // subquery and silently writes zero rows.
-        const placeholders = STAFF_ROLES.map(() => "?").join(",");
-        const promoted = (await db.returning(`UPDATE "user" SET role = ? WHERE id = ? AND NOT EXISTS (SELECT 1 FROM "user" WHERE role IN (${placeholders})) RETURNING id`, "owner", u.id, ...STAFF_ROLES)).length;
-        if (promoted === 0) {
-            // Operator-visible signal that the rule matched but a prior
-            // staff user already exists — otherwise the silent no-op makes a
-            // misconfigured bootstrap rule indistinguishable from a working
-            // first-promotion.
-            console.warn(`[bootstrap] user ${u.id} matched bootstrapOwner rule but promotion was blocked — a staff user already exists.`);
-        }
-    };
-    const databaseHooks = {
-        user: {
-            create: {
-                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
-                after: sdkUserCreateAfter,
-            },
-            update: {
-                before: async (user, context) => guardGithubLoginProfile(user, context, config.methods),
-            },
-        },
-        verification: {
-            create: {
-                before: async (verification) => {
-                    if (!config.oauthProvider?.mcpResource)
-                        return;
-                    let value;
-                    try {
-                        value = JSON.parse(verification.value);
-                    }
-                    catch {
-                        return; // OTPs and other verification values are not OAuth grants.
-                    }
-                    if (value?.type !== "authorization_code" || typeof value.userId !== "string" ||
-                        typeof value.query?.client_id !== "string")
-                        return;
-                    const consent = await db.first('SELECT id FROM "oauthConsent" WHERE "userId" = ? AND "clientId" = ? LIMIT 1', value.userId, value.query.client_id);
-                    // Better Auth carries referenceId from this code through every
-                    // refresh rotation. Never rebind an old lineage to a new consent.
-                    return { data: { value: JSON.stringify({ ...value, referenceId: consent?.id ?? "" }) } };
-                },
-            },
-        },
-    };
-    const sessionCache = config.sessionCache;
-    let storeInstanceId;
-    const cacheKey = async (key) => {
-        storeInstanceId ??= readStoreInstanceId(config.driver)
-            .catch((error) => { storeInstanceId = undefined; throw error; });
-        return `better-auth:${await storeInstanceId}:${key}`;
-    };
-    const secondaryStorage = sessionCache ? {
-        get: async (key) => key.startsWith("verification:")
-            ? Promise.resolve(null)
-            : sessionCache.get(await cacheKey(key)),
-        set: async (key, value, ttl) => key.startsWith("verification:")
-            ? Promise.resolve()
-            : sessionCache.set(await cacheKey(key), value, ttl ? Math.max(60, Math.ceil(ttl)) : undefined),
-        delete: async (key) => key.startsWith("verification:")
-            ? Promise.resolve()
-            : sessionCache.delete(await cacheKey(key)),
-        // Verification and rate limiting stay in the primary store / memory below. Fail loudly if
-        // Better Auth starts routing either atomic operation through this adapter.
-        getAndDelete: async () => { throw new Error("Better Auth KV getAndDelete is disabled"); },
-        increment: async () => { throw new Error("Better Auth KV increment is disabled"); },
-    } : undefined;
-    return betterAuth({
-        database: config.database,
-        secondaryStorage,
-        session: { storeSessionInDatabase: true },
-        verification: { storeInDatabase: true },
-        secret: config.secret,
-        baseURL: config.baseURL,
-        basePath: normalizeAuthBasePath(config.basePath),
-        onAPIError: { errorURL: normalizeAuthErrorURL(config.errorURL, config.baseURL) },
-        socialProviders,
-        ...(config.accountLinking
-            ? { account: { accountLinking: config.accountLinking } }
-            : {}),
-        user: userConfig,
-        rateLimit,
-        trustedOrigins,
-        advanced: advancedConfig,
-        plugins,
-        databaseHooks,
-    });
-}
-//# sourceMappingURL=buildAuth.js.map

package/dist/auth/buildAuth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"buildAuth.js","sourceRoot":"","sources":["../../src/auth/buildAuth.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EAAwB,mBAAmB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE5Y,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,UAEzB,CAAC;AACF,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,KAAK;IAClE,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,EAAE;CACZ,CAAC;AACF,gBAAgB,CAAC,OAAO,CAAC,wBAAwB,KAAK,IAAI,iBAAiB,EAAE,CAAC;AAC9E,gBAAgB,CAAC,OAAO,CAAC,2BAA2B,KAAK,IAAI,iBAAiB,EAAE,CAAC;AACjF,gBAAgB,CAAC,OAAO,CAAC,mBAAmB,KAAK,IAAI,iBAAiB,EAAE,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,iBAAiB,EAA0B,CAAC;AAQvF,MAAM,EAAE,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;AAElD,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IACzB,IAAI,EAAE,iBAAiB,CAAC,IAAI;IAC5B,OAAO,EAAE,iBAAiB,CAAC,OAAO;CACnC,CAAC,CAAC;AACH,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IACtC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC5B,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;IACxB,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,MAA+B;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,wHAAwH,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,MAAM,CAAC,aAAa;QAC1C,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,uEAAuE;IACvE,gDAAgD;IAChD,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG;QAChB,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG;QAC9B,GAAG,MAAM,CAAC,SAAS;QACnB,OAAO,EAAE,IAAa;QACtB,OAAO,EAAE,QAAiB;KAC3B,CAAC;IAEF,2DAA2D;IAC3D,8DAA8D;IAC9D,mEAAmE;IACnE,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAErF,MAAM,UAAU,GAAG;QACjB,KAAK,CAAC;YACJ,WAAW,EAAE,MAAM;YACnB,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC;YAC5B,EAAE;YACF,KAAK,EAAE;gBACL,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,aAAa;gBAC1B,IAAI,EAAE,MAAM;aACb;SACF,CAAC;QACF,GAAG,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC;YAClC,CAAC,CAAC;gBACE,YAAY,CAAC;oBACX,MAAM,EAAE,qBAAqB;iBAC9B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,eAAe;YACzC,CAAC,CAAC;gBACE,8HAA8H;gBAC9H,GAAG,CAAC,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,aAAa,CAAC,WAAW;oBAC9B,CAAC,CAAC,GAAG,CAAC;wBACF,GAAG,eAAe;wBAClB,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,WAAW;wBAC1C,UAAU,EAAE;4BACV;gCACE,MAAM,EAAE;oCACN,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC;iCAC/E;6BACF;4BACD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;yBAC3C;qBACF,CAAC;oBACJ,CAAC,CAAC,aAAa,CAAC;wBACZ,GAAG,eAAe;wBAClB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU;4BACjC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;4BACtD,CAAC,CAAC,EAAE,CAAC;qBACR,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW;oBAClC,CAAC,CAAC;wBACE,IAAI,CAAC;4BACH,0DAA0D;4BAC1D,2DAA2D;4BAC3D,4DAA4D;4BAC5D,wDAAwD;4BACxD,2DAA2D;4BAC3D,wDAAwD;4BACxD,2BAA2B,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC3C,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;4BAC/C,eAAe,EAAE,gBAAgB;yBAClC,CAAC;qBACH;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,EAAE,8DAA8D,CAAC,CAAC;QACpI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,MAAM,UAAU,GAAG;QACjB,gBAAgB,EAAE;YAChB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAiB;gBACvB,QAAQ,EAAE,KAAK;gBACf,uEAAuE;gBACvE,8DAA8D;gBAC9D,KAAK,EAAE,IAAI;aACZ;SACF;KACF,CAAC;IAEF,6DAA6D;IAC7D,6DAA6D;IAC7D,mEAAmE;IACnE,sDAAsD;IACtD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG;QACrB,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE;QACnC,6EAA6E;QAC7E,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC,EAAE;QACtD,GAAG,CAAC,mBAAmB;YACrB,CAAC,CAAC;gBACE,+DAA+D;gBAC/D,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE;aACrE;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,qBAAqB;YAC9B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YAC3B,4EAA4E;YAC5E,gBAAgB,EAAE,KAAK;YACvB,YAAY,EAAE,UAAU,MAAM,CAAC,YAAY,IAAI,aAAa,EAAE;YAC9D,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACzC,uBAAuB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpH,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,+DAA+D;QAC/D,4DAA4D;QAC5D,eAAe,EAAE;YACf,OAAO,EAAE,CAAC,CAAmB,EAAE,EAAE;gBAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;oBAC9C,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;gBACrD,CAAC,CAAC,CAAC;gBACH,qEAAqE;gBACrE,qDAAqD;gBACrD,uBAAuB,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;SACF;KACF,CAAC;IAEF,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAa,EAAiB,EAAE;QAChE,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,CAAC,GAAG,IAIT,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC;YAAE,OAAO;QAEhD,kEAAkE;QAClE,gEAAgE;QAChE,qEAAqE;QACrE,+DAA+D;QAC/D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,+FAA+F,YAAY,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1M,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,4DAA4D;YAC5D,iEAAiE;YACjE,gEAAgE;YAChE,mBAAmB;YACnB,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,uFAAuF,CAAC,CAAC;QAChI,CAAC;IACH,CAAC,CAAC;IACF,MAAM,aAAa,GAAuC;QACxD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAuC,EAAE,OAAwB,EAAE,EAAE,CAClF,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;gBACxD,KAAK,EAAE,kBAAkB;aAC1B;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,IAAuC,EAAE,OAAwB,EAAE,EAAE,CAClF,uBAAuB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;aACzD;SACF;QACD,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;oBAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW;wBAAE,OAAO;oBAC/C,IAAI,KAAK,CAAC;oBACV,IAAI,CAAC;wBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAEpC,CAAC;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,CAAC,2DAA2D;oBACrE,CAAC;oBACD,IAAI,KAAK,EAAE,IAAI,KAAK,oBAAoB,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;wBACxE,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,KAAK,QAAQ;wBAAE,OAAO;oBACvD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAiB,6EAA6E,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACnK,+DAA+D;oBAC/D,kEAAkE;oBAClE,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3F,CAAC;aACF;SACF;KACF,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,IAAI,eAA4C,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;QACtD,eAAe,KAAK,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;aACnD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,eAAe,GAAG,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,eAAe,MAAM,eAAe,IAAI,GAAG,EAAE,CAAC;IACvD,CAAC,CAAC;IACF,MAAM,gBAAgB,GAAG,YAAY,CAAC,CAAC,CAAC;QACtC,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YACzD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,GAAG,EAAE,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YACtF,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;YACnB,CAAC,CAAC,YAAY,CAAC,GAAG,CACd,MAAM,QAAQ,CAAC,GAAG,CAAC,EACnB,KAAK,EACL,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/C;QACL,MAAM,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAC5D,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;YACnB,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,0FAA0F;QAC1F,2EAA2E;QAC3E,YAAY,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC;QACzF,SAAS,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;KACpF,CAAC,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB;QAChB,OAAO,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChD,UAAU,EAAE,EAAE,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;QAChF,eAAe;QACf,GAAG,CAAC,MAAM,CAAC,cAAc;YACvB,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,EAAE,UAAU;QAChB,SAAS;QACT,cAAc;QACd,QAAQ,EAAE,cAAc;QACxB,OAAO;QACP,aAAa;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/callerResolver.d.ts

@@ -1,52 +0,0 @@
-import type { OAuthAccessTokenVerification } from "./types.js";
-import type { CallerResolver, CredentialKind } from "../core/index.js";
-/** The three things the resolver needs of a Better Auth facade; a custom facade only has to provide these. */
-export interface AuthLike {
-    getSession(request: Request): Promise<{
-        session: {
-            id: string;
-        };
-        user: {
-            id: string;
-            email?: string;
-            name?: string;
-            image?: string | null;
-            githubLogin?: string | null;
-            role?: string | null; /** the role came from the same uncached read */
-            roleCurrent?: true;
-        };
-    } | null>;
-    getUserRole(userId: string): Promise<string | null>;
-    verifyOAuthAccessToken(tokenOrRequest: string | Request, options: {
-        audience: string;
-        scopes?: readonly string[];
-    }): Promise<OAuthAccessTokenVerification>;
-}
-export type ConsumerCredentialResolution = {
-    readonly kind: "not-handled";
-} | {
-    readonly kind: "invalid";
-} | {
-    readonly kind: "verified";
-    readonly credential: {
-        readonly credential: Extract<CredentialKind, "api-key" | "personal-token">;
-        readonly credentialId: string | null;
-        /** The application subject key. A machine credential names its own stable one (say `key:<id>`): every Caller has a subject. */
-        readonly subject: string;
-        readonly clientId?: string | null;
-        readonly scopes?: readonly string[];
-    };
-};
-export interface CallerResolverOptions {
-    /** Where a service recognises and verifies its own credential formats; Core never stores or issues them. */
-    readonly credentialResolver?: (request: Request) => ConsumerCredentialResolution | Promise<ConsumerCredentialResolution>;
-    /** Enables OAuth access tokens, verified against the Auth's issuer and JWKS. `scopes` is a server-wide floor. */
-    readonly jwtBearer?: {
-        readonly audience: string;
-        readonly scopes?: readonly string[];
-    };
-    /** Informational, copied to `Caller.issuer`. */
-    readonly issuer?: string;
-}
-export declare function createCallerResolver(auth: AuthLike, options?: CallerResolverOptions): CallerResolver;
-//# sourceMappingURL=callerResolver.d.ts.map

package/dist/auth/callerResolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"callerResolver.d.ts","sourceRoot":"","sources":["../../src/auth/callerResolver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,KAAK,EAAU,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG/E,8GAA8G;AAC9G,MAAM,WAAW,QAAQ;IACvB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,gDAAgD;YAAC,WAAW,CAAC,EAAE,IAAI,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC9Q,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACpD,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5J;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAC;QAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,+HAA+H;QAC/H,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,4GAA4G;IAC5G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,4BAA4B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzH,iHAAiH;IACjH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACxF,gDAAgD;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAKD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAwCxG"}

package/dist/auth/callerResolver.js

@@ -1,52 +0,0 @@
-/**
- * `CallerResolver` for a Better Auth identity (ADR-0032 decision 8). Precedence: a service's own credential, an OAuth access
- * token (Bearer or DPoP), the cookie session. A presented credential that fails never falls back to a session cookie, and only
- * "no credential presented" is anonymous. The role is read fresh on every request so a revoked staff role cannot linger in a
- * session snapshot.
- */
-import { STAFF_ROLES } from "../spec/domain/index.js";
-import { rememberSessionUser } from "../core/sessionUser.js";
-const STAFF = new Set(STAFF_ROLES);
-const invalid = (challenge, status) => ({ invalid: true, challenge, ...(status ? { status } : {}) });
-export function createCallerResolver(auth, options = {}) {
-    const user = async (subject, credential, credentialId, clientId, scopes, role) => {
-        const current = role !== undefined ? role : await auth.getUserRole(subject);
-        return {
-            kind: "user", subject, ...(options.issuer ? { issuer: options.issuer } : {}),
-            role: current && STAFF.has(current) ? current : null, scopes, credential, credentialId, clientId,
-        };
-    };
-    return async (request) => {
-        if (options.credentialResolver) {
-            const r = await options.credentialResolver(request);
-            if (r.kind === "invalid")
-                return invalid('Bearer error="invalid_token"');
-            if (r.kind === "verified") {
-                const c = r.credential;
-                return { caller: await user(c.subject, c.credential, c.credentialId, c.clientId ?? null, c.scopes ?? []) };
-            }
-        }
-        const authorization = request.headers.get("authorization");
-        if (authorization !== null) {
-            // MCP clients use DPoP (sender-constrained) tokens; the verifier checks the proof
-            const m = /^(Bearer|DPoP) ([^\s]+)$/i.exec(authorization);
-            if (!m || !options.jwtBearer)
-                return invalid('Bearer error="invalid_token"');
-            const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer";
-            const v = await auth.verifyOAuthAccessToken(request, { audience: options.jwtBearer.audience, scopes: options.jwtBearer.scopes });
-            if (!v.ok) {
-                const error = v.reason === "invalid-dpop-proof" ? "invalid_dpop_proof" : v.reason === "insufficient-scope" ? "insufficient_scope" : "invalid_token";
-                const scope = v.missingScopes?.length ? `, scope="${v.missingScopes.join(" ")}"` : "";
-                return invalid(`${scheme} error="${error}"${scope}`, v.status);
-            }
-            return { caller: await user(v.userId, "oauth", v.credentialId, v.clientId, v.scopes) };
-        }
-        const session = await auth.getSession(request);
-        if (!session)
-            return { caller: { kind: "anonymous" } };
-        const caller = await user(session.user.id, "session", session.session.id, null, [], session.user.roleCurrent ? (session.user.role ?? null) : undefined);
-        const { email, name, image, githubLogin } = session.user;
-        return { caller: email === undefined && name === undefined ? caller : rememberSessionUser(caller, { email: email ?? "", name: name ?? "", image: image ?? null, githubLogin: githubLogin ?? null }) };
-    };
-}
-//# sourceMappingURL=callerResolver.js.map

package/dist/auth/callerResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"callerResolver.js","sourceRoot":"","sources":["../../src/auth/callerResolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAkB,MAAM,yBAAyB,CAAC;AAGtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAiC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;AAC3C,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,MAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAElI,MAAM,UAAU,oBAAoB,CAAC,IAAc,EAAE,UAAiC,EAAE;IACtF,MAAM,IAAI,GAAG,KAAK,EAAE,OAAe,EAAE,UAA0B,EAAE,YAA2B,EAAE,QAAuB,EAAE,MAAyB,EAAE,IAAoB,EAAmB,EAAE;QACzL,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ;SAChH,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;gBACvB,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7G,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,kFAAkF;YAClF,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClE,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YACjI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;gBACpJ,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,OAAO,OAAO,CAAC,GAAG,MAAM,WAAW,KAAK,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxJ,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;IACxM,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/createAuthRoutes.d.ts

@@ -1,22 +0,0 @@
-/**
- * The auth routes a service mounts once (ADR-0032 decision 8): Better Auth under its base path, the OAuth discovery metadata Better
- * Auth serves natively (RFC 8414 and RFC 9728), `{basePath}/methods`, and the consent routes under `/oauth`. Only the consent routes
- * need a Caller, so only they run behind `withCaller`: a token request authenticating its client with HTTP Basic would otherwise be
- * refused before Better Auth saw it. A consent is given or revoked by the signed-in person only, never by a bearer token.
- */
-import type { CallerResolver } from "../core/index.js";
-import type { MantleAuth, MantleAuthRequestContext } from "./types.js";
-export type AuthRoutesAuth = Pick<MantleAuth, "basePath" | "handler" | "methods" | "getOAuthConsentRequest" | "completeOAuthConsent" | "listOAuthConsents" | "revokeOAuthConsent">;
-export interface AuthRoutesOptions {
-    /** Resolves the Caller of the consent routes; usually `createCallerResolver(auth)`. */
-    readonly resolver: CallerResolver;
-    /**
-     * Where `GET /oauth/consents` sends the browser, e.g. Admin's connected-apps page. Without it, that route answers a plain HTML
-     * page, as `GET /oauth/consent` does, so OAuth works on a service without Admin. Point `oauthProvider.consentPage` at Admin's own
-     * page, `/admin/oauth/consent`, to use it for consent.
-     */
-    readonly connectedAppsPage?: string;
-}
-/** The service's auth entry: a Response for a path it owns, `null` for any other. */
-export declare function createAuthRoutes(auth: AuthRoutesAuth, options: AuthRoutesOptions): (request: Request, context?: MantleAuthRequestContext) => Promise<Response | null>;
-//# sourceMappingURL=createAuthRoutes.d.ts.map

package/dist/auth/createAuthRoutes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createAuthRoutes.d.ts","sourceRoot":"","sources":["../../src/auth/createAuthRoutes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,kBAAkB,CAAC;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAGvE,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,wBAAwB,GAAG,sBAAsB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;AAEnL,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAOD,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAWrK"}

package/dist/auth/createAuthRoutes.js

@@ -1,129 +0,0 @@
-import { withCaller } from "../core/withCaller.js";
-const PRIVATE = { "cache-control": "private, no-store" };
-const CONSENT = new Set(["GET /oauth/consent", "GET /oauth/consent/data", "POST /oauth/consent"]);
-const CONSENTS = new Set(["GET /oauth/consents", "GET /oauth/consents/data", "POST /oauth/consents/revoke"]);
-const WELL_KNOWN = /^\/\.well-known\/(oauth-authorization-server|oauth-protected-resource)(\/|$)/;
-/** The service's auth entry: a Response for a path it owns, `null` for any other. */
-export function createAuthRoutes(auth, options) {
-    const base = auth.basePath.replace(/\/+$/, "");
-    const consent = withCaller(options.resolver, consentSurface(auth, options));
-    return async (request, context) => {
-        const { pathname } = new URL(request.url);
-        if (pathname === `${base}/methods` && request.method === "GET")
-            return Response.json({ methods: auth.methods }, { headers: { "cache-control": "no-store" } });
-        if (pathname.startsWith(`${base}/`) || WELL_KNOWN.test(pathname))
-            return auth.handler(request, context);
-        // only an owned route resolves a caller: `/oauth/callback/github` and the rest are the service's, whatever they carry
-        const route = `${request.method} ${pathname}`;
-        return CONSENT.has(route) || (CONSENTS.has(route) && auth.listOAuthConsents && auth.revokeOAuthConsent) ? consent(request) : null;
-    };
-}
-function consentSurface(auth, options) {
-    const { listOAuthConsents: list, revokeOAuthConsent: revoke } = auth;
-    return async (request, caller) => {
-        const { pathname } = new URL(request.url);
-        const route = `${request.method} ${pathname}`;
-        const person = caller.kind === "user" && caller.credential === "session" ? caller.subject : null;
-        const locale = /zh[-_]tw/i.test(request.headers.get("accept-language") ?? "") ? "zh-TW" : "en";
-        if (route === "GET /oauth/consent/data") {
-            if (!person)
-                return Response.json({ consent: null }, { status: 401, headers: PRIVATE });
-            const model = await auth.getOAuthConsentRequest(request).catch(() => null); // an invalid signed query stays secret-free
-            return Response.json({ consent: model }, { status: model ? 200 : 400, headers: PRIVATE });
-        }
-        if (route === "GET /oauth/consent") {
-            const model = await auth.getOAuthConsentRequest(request).catch(() => null);
-            return html(consentHtml(locale, model), model ? 200 : 400);
-        }
-        if (route === "POST /oauth/consent") {
-            if (!person)
-                return new Response("sign in to answer this request", { status: 401 });
-            const body = await request.text();
-            const decision = new URLSearchParams(body).get("decision");
-            if (decision !== "approve" && decision !== "deny")
-                return new Response("invalid consent decision", { status: 400 });
-            // the redirect is the one Better Auth validated against the client's registration; nothing in the request names it
-            const location = await auth.completeOAuthConsent(new Request(request, { body }), decision === "approve").catch(() => null);
-            const target = location && URL.canParse(location) ? new URL(location) : null;
-            if (!target || /^(javascript|data|vbscript|blob):$/i.test(target.protocol))
-                return new Response("invalid authorization request", { status: 400 });
-            // the parsed form, so a browser cannot read `https:\\evil.test` differently from the check
-            return new Response(null, { status: 302, headers: { location: target.href, ...PRIVATE } });
-        }
-        if (!list || !revoke)
-            return new Response("not found", { status: 404 });
-        if (route === "GET /oauth/consents") {
-            if (options.connectedAppsPage)
-                return new Response(null, { status: 302, headers: { location: options.connectedAppsPage } });
-            if (!person)
-                return new Response("sign in to see your connected apps", { status: 401, headers: PRIVATE });
-            return html(connectedAppsHtml(locale, await list(person)), 200);
-        }
-        if (route === "GET /oauth/consents/data") {
-            if (!person)
-                return Response.json({ consents: [] }, { status: 401, headers: PRIVATE });
-            return Response.json({ consents: await list(person) }, { headers: PRIVATE });
-        }
-        if (route === "POST /oauth/consents/revoke") {
-            if (!person)
-                return new Response("sign in to revoke a connection", { status: 401 });
-            const id = new URLSearchParams(await request.text()).get("consent_id");
-            if (!id)
-                return new Response("invalid consent id", { status: 400 });
-            if (!await revoke(person, id))
-                return new Response("consent not found", { status: 404 });
-            return new Response(null, { status: 303, headers: { location: "/oauth/consents" } });
-        }
-        return new Response("not found", { status: 404 });
-    };
-}
-// ---- the pages a service without Admin shows: Admin is an optional subpath (ADR-0032 decision 13), OAuth is not tied to it
-/**
- * No `form-action`: browsers check it against every redirect of a form's navigation, so a callback that redirects again
- * (www.cursor.com answers 308 to cursor.com) would hang the approval. The page runs no script and escapes every value.
- */
-function html(body, status) {
-    return new Response(body, {
-        status,
-        headers: {
-            ...PRIVATE, "content-type": "text/html; charset=UTF-8", "referrer-policy": "same-origin", "x-content-type-options": "nosniff", "x-frame-options": "DENY",
-            "content-security-policy": "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'",
-        },
-    });
-}
-const T = {
-    en: {
-        lang: "en", title: "Authorize", eyebrow: "Connect an MCP client", heading: (c) => `Connect ${c}?`,
-        body: (c) => `${c} will be able to use this site's tools through MCP. What it can view or change is still limited by your account permissions.`,
-        returnsTo: "Returns to", scopes: "Requested access", approve: "Connect", deny: "Cancel", invalid: "Invalid authorization request", invalidBody: "Missing or malformed consent payload. Return to your MCP client and try again.",
-        apps: "MCP connections", appsBody: "These MCP clients can use this site's tools. Every action is still checked against your current account permissions.", empty: "No MCP clients are connected.", revoke: "Disconnect",
-    },
-    "zh-TW": {
-        lang: "zh-Hant-TW", title: "授權", eyebrow: "連結 MCP 客戶端", heading: (c) => `要連結 ${c} 嗎？`,
-        body: (c) => `${c} 將能透過 MCP 使用這個網站提供的工具；它能查看或變更哪些內容，仍會依照你的帳號權限決定。`,
-        returnsTo: "完成後返回", scopes: "要求的權限", approve: "連結", deny: "取消", invalid: "無效的授權請求", invalidBody: "缺少或格式錯誤的授權資訊，請返回 MCP 客戶端重試。",
-        apps: "MCP 連線", appsBody: "這些 MCP 客戶端可以使用網站提供的工具；每次操作仍會依照你當下的帳號權限檢查。", empty: "目前沒有已連結的 MCP 客戶端。", revoke: "中斷連線",
-    },
-};
-const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
-const page = (l, title, main) => `<!doctype html><html lang="${T[l].lang}"><head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><title>${title}</title>` +
-    `<style>:root{color-scheme:light dark;font:1rem/1.5 system-ui,sans-serif}body{margin:0;padding:2rem 1rem}main{max-width:32rem;margin:10vh auto}code{overflow-wrap:anywhere}button{font:inherit;padding:.5rem 1rem;cursor:pointer}</style></head><body><main>${main}</main></body></html>`;
-function consentHtml(l, model) {
-    const t = T[l];
-    if (!model)
-        return page(l, t.title, `<p>${t.eyebrow}</p><h1>${t.invalid}</h1><p>${t.invalidBody}</p>`);
-    const client = esc(model.clientName);
-    // where the answer goes and what is asked, so a look-alike client name cannot hide either
-    const host = URL.canParse(model.redirectUri) ? new URL(model.redirectUri).host || new URL(model.redirectUri).protocol : model.redirectUri;
-    return page(l, t.title, `<p>${t.eyebrow}</p><h1>${t.heading(client)}</h1><p>${t.body(client)}</p>` +
-        `<p>${t.returnsTo} <code>${esc(host)}</code></p><p>${t.scopes}</p><ul>${model.scopes.map((sc) => `<li><code>${esc(sc)}</code></li>`).join("")}</ul><form method="post" action="/oauth/consent">` +
-        `<input type="hidden" name="oauth_query" value="${esc(model.oauthQuery)}"/><button type="submit" name="decision" value="approve">${t.approve}</button> ` +
-        `<button type="submit" name="decision" value="deny">${t.deny}</button></form>`);
-}
-function connectedAppsHtml(l, consents) {
-    const t = T[l];
-    const apps = consents.length === 0 ? `<p>${t.empty}</p>` : consents.map((c) => `<section><h2>${esc(c.clientName)}</h2><code>${esc(c.clientId)}</code><form method="post" action="/oauth/consents/revoke">` +
-        `<input type="hidden" name="consent_id" value="${esc(c.id)}"/><button type="submit">${t.revoke}</button></form></section>`).join("");
-    return page(l, t.apps, `<h1>${t.apps}</h1><p>${t.appsBody}</p>${apps}`);
-}
-//# sourceMappingURL=createAuthRoutes.js.map