@we8/cms 0.1.1 → 0.2.0

package/README.md

@@ -1,12 +1,28 @@
 # @we8/cms
 
 `@we8/cms` is the core headless CMS of the we8 package: a Hono application
-carrying the content, forms, analytics, media, and SEO modules, with embedded
-Better Auth for sign-in and the `/v1` public API that every frontend consumes.
-It is single-site by construction (one site, one worker, one database, one
-bucket), it validates public pk and sk API keys itself, and it owns the AEO
-backend that is a headline feature of 0.1: llms.txt publishing,
-answer-oriented content fields, AEO check endpoints, and crawler attribution.
+carrying the content, forms, analytics, media, and SEO modules behind the `/v1`
+public API that every frontend consumes. It is single-site by construction (one
+site, one worker, one database, one bucket), it validates public pk and sk API
+keys itself, and it owns the AEO backend that is its headline feature: llms.txt
+publishing, answer-oriented content fields, AEO check endpoints, and crawler
+attribution.
+
+**Auth is not built in.** The CMS knows what an owner may do and what a member
+may do; who somebody is comes from a provider your worker registers in one
+line. [`@we8/auth`](https://www.npmjs.com/package/@we8/auth) is the embedded
+one (Better Auth over your own D1, email and password), and it is what
+`npm create we8` composes. Register nothing and every `/v1/admin/*` request is
+refused: an unconfigured deploy is a locked site, never an open one.
+
+```ts
+import cms, { registerAdminAuth } from '@we8/cms';
+import { embeddedAdminAuth } from '@we8/auth';
+
+registerAdminAuth(embeddedAdminAuth);
+
+export default cms;
+```
 
 ## Requirements
 
@@ -14,10 +30,12 @@ answer-oriented content fields, AEO check endpoints, and crawler attribution.
   (what `npm create we8` sets up), or with your own Worker config.
 - Bindings: a D1 database as `DB`, an R2 bucket as `MEDIA`, and optionally
   static assets as `ASSETS` for the admin portal.
-- Secrets: `BETTER_AUTH_SECRET` is required; the admin API refuses every
-  request without it. `TURNSTILE_SECRET` is optional.
-- Runtime dependencies, bundled at deploy: `hono`, `better-auth`,
-  `drizzle-orm`, `zod`. Node 20 or newer for the tooling around it.
+- An admin auth provider, registered by your worker. `@we8/auth` is the
+  embedded one and requires the secret `BETTER_AUTH_SECRET`.
+- Secrets: `TURNSTILE_SECRET` is optional, and only enforced for forms that
+  enable Turnstile.
+- Runtime dependencies, bundled at deploy: `hono` and `zod`. Node 20 or newer
+  for the tooling around it.
 ## Local development
 
 ```sh
@@ -37,6 +55,14 @@ curl -H "X-We8-Key: pk_live_000000000000000000000000000000000000000000000000" \
   http://localhost:8787/v1/posts
 ```
 
+`npm run dev` runs the composed worker in `dev/index.ts`, which registers the
+embedded provider, so local development behaves like a scaffolded project.
+`npm run db:migrate` applies both migration directories: this package's, and
+the one `@we8/auth` ships.
+
+`GET /v1/auth/mode` says which mode a worker is in (`embedded`, `external`, or
+`none`) and whether the first account can still be created.
+
 Create the owner account by signing up once; the endpoint closes as soon as an
 account exists.
 
@@ -64,13 +90,48 @@ no bundle behind the binding.
 
 ## Bindings
 
-`DB` (D1) and `MEDIA` (R2), plus the vars `SITE_URL` and `CMS_VERSION` and the
-secret `BETTER_AUTH_SECRET`. `AUTH_URL`, `TURNSTILE_SECRET`, `EMAIL_MODE`, and
-`EMAIL_FROM` are optional, and `ASSETS` is the optional static-asset binding
-that carries the admin portal.
+`DB` (D1) and `MEDIA` (R2), plus the vars `SITE_URL` and `CMS_VERSION`.
+`TURNSTILE_SECRET`, `EMAIL_MODE`, and `EMAIL_FROM` are optional, and `ASSETS`
+is the optional static-asset binding that carries the admin portal. An auth
+provider adds its own: `@we8/auth` requires `BETTER_AUTH_SECRET` and takes an
+optional `AUTH_URL`.
+
+## Upgrading from 0.1
+
+0.2 makes auth optional, and that is the whole breaking change. The core no
+longer embeds Better Auth; a provider is composed in `src/index.ts` instead.
+
+1. Update every `@we8/*` dependency to `^0.2.0`. To keep exactly the 0.1
+   behavior, add `@we8/auth` and register it in your worker entry:
+
+   ```ts
+   import cms, { registerAdminAuth, registerEmailSender } from '@we8/cms';
+   import { embeddedAdminAuth } from '@we8/auth';
+   import { cloudflareEmailSender } from '@we8/cloudflare';
+
+   registerAdminAuth(embeddedAdminAuth);
+   registerEmailSender(cloudflareEmailSender);
+
+   export default cms;
+   ```
+
+2. Run `npm run db:migrate` (locally, then `db:migrate:remote`). The auth
+   tables now belong to `@we8/auth`, whose migrations are written to be safe
+   on a database that already carries them: existing users, sessions, and
+   content are untouched.
+3. Run `npx we8-cloudflare doctor`. It knows the auth modes and names
+   anything still missing.
+4. Optionally, refresh the project's agent skill: `npx we8-cloudflare skill`.
+
+A worker that registers no provider refuses every `/v1/admin/*` request with
+a 403 explaining the two ways forward. To run without `@we8/auth`, compose
+`cloudflareAccessAdminAuth()` or `perimeterAdminAuth({ acknowledged: true })`
+from `@we8/cloudflare` instead; their README documents both.
 
 ## More
 
+- [`@we8/auth`](https://www.npmjs.com/package/@we8/auth): the embedded admin
+  sign-in, as its own package.
 - [`create-we8`](https://www.npmjs.com/package/create-we8): the fastest path
   from nothing to a working site; the README it writes into your project
   carries every step.

package/dist/env.d.ts

@@ -3,9 +3,13 @@ import { type SiteSettings, type SiteSettingsUpdateInput } from './shared/index.
  * Everything this worker consumes from its environment. One site, one
  * database, one bucket: there is no tenant id, no dispatch namespace, and no
  * control plane, because there is nothing above this worker to belong to.
+ *
+ * Nothing about signing in appears here. An admin auth provider names its own
+ * requirements and narrows this environment itself; `@we8/auth` adds
+ * `BETTER_AUTH_SECRET` and `AUTH_URL` to the list a deployment must set.
  */
 export interface Bindings {
-    /** The site's D1 database. Content, forms, analytics, auth, and keys all live here. */
+    /** The site's D1 database. Content, forms, analytics, and keys all live here. */
     DB: D1Database;
     /** The site's R2 bucket, holding uploaded media bytes. */
     MEDIA: R2Bucket;
@@ -19,19 +23,6 @@ export interface Bindings {
     SITE_URL: string;
     /** The version string reported by /v1/health. Set from the package version at deploy time. */
     CMS_VERSION: string;
-    /**
-     * The secret Better Auth signs sessions with. A deployment MUST set this;
-     * `wrangler secret put BETTER_AUTH_SECRET` in production, `.dev.vars`
-     * locally. Sign-in is refused when it is missing rather than falling back to
-     * a default, because a predictable session secret is a forged session.
-     */
-    BETTER_AUTH_SECRET?: string;
-    /**
-     * The origin Better Auth builds its own URLs from and trusts as an origin.
-     * Defaults to SITE_URL, which is correct when the CMS and the site share an
-     * origin; set it when the admin lives somewhere else.
-     */
-    AUTH_URL?: string;
     /** Optional. Only enforced for forms with settings.turnstileEnabled. */
     TURNSTILE_SECRET?: string;
     /**

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAExG;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,uFAAuF;IACvF,EAAE,EAAE,UAAU,CAAC;IACf,0DAA0D;IAC1D,KAAK,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAiBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBjG;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,uBAAuB,EAC9B,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED,mEAAmE;AACnE,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,KAAK,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAExG;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,iFAAiF;IACjF,EAAE,EAAE,UAAU,CAAC;IACf,0DAA0D;IAC1D,KAAK,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAiBD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiBjG;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,uBAAuB,EAC9B,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED,mEAAmE;AACnE,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAmD,MAAM,mBAAmB,CAAC;AAmDxG,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,sFAAsF;AACtF,IAAI,KAAK,GAA8B,IAAI,CAAC;AAO5C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACxE,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACzB,OAAO,CAAC,sCAAsC,CAAC;SAC/C,GAAG,EAAkB,CAAC;IAEzB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAc,EACd,KAA8B,EAC9B,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAElE,MAAM,EAAE,CAAC,KAAK,CACZ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC1C,EAAE;SACC,OAAO,CAAC,mEAAmE,CAAC;SAC5E,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACpC,CACF,CAAC;IAEF,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,0BAA0B;IACxC,KAAK,GAAG,IAAI,CAAC;AACf,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAmD,MAAM,mBAAmB,CAAC;AA0CxG,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,sFAAsF;AACtF,IAAI,KAAK,GAA8B,IAAI,CAAC;AAO5C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACxE,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACzB,OAAO,CAAC,sCAAsC,CAAC;SAC/C,GAAG,EAAkB,CAAC;IAEzB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAc,EACd,KAA8B,EAC9B,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAElE,MAAM,EAAE,CAAC,KAAK,CACZ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAC1C,EAAE;SACC,OAAO,CAAC,mEAAmE,CAAC;SAC5E,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CACpC,CACF,CAAC;IAEF,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,qBAAqB,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,0BAA0B;IACxC,KAAK,GAAG,IAAI,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -8,7 +8,23 @@ import { type RequestIdVariables } from './middleware/request-id.js';
  * without reaching into the package's internals. A scaffolded project calls
  * `registerEmailSender(cloudflareEmailSender)` at module scope and is done.
  */
-export { registerEmailSender, type EmailMessage, type EmailSender, type EmailSenderFactory, } from './lib/email.js';
+export { registerEmailSender, resolveEmailSender, sendBestEffort, type EmailMessage, type EmailSender, type EmailSenderFactory, } from './lib/email.js';
+/**
+ * The admin auth seam, and everything a provider needs to speak this worker's
+ * language: the registration itself, the gate the core mounts on
+ * `/v1/admin/*`, the owner check, the error envelope, per-route CORS, and the
+ * input validator. A provider that claims routes of its own reuses these
+ * rather than restating them, so there is one admin policy and one wire
+ * contract however a site signs in.
+ */
+export { ADMIN_AUTH_NOT_CONFIGURED, EMBEDDED_PROVIDER_NAME, adminAuthMode, adminAuthProvider, normalizeRole, registerAdminAuth, type AdminAuthMode, type AdminAuthProvider, type AdminIdentity, type FirstRunState, } from './lib/admin-auth.js';
+export { adminAuth, requireOwner, type AuthContext, type AuthVariables } from './middleware/auth.js';
+export { corsMiddleware, type CorsKind } from './middleware/cors.js';
+export { HttpError, errorBoundary, notFoundHandler } from './lib/errors.js';
+export { buildPasswordResetEmail } from './lib/notify.js';
+export { parseOrThrow } from './lib/validate.js';
+export { ok, err, USER_ROLES, type ErrorCode, type UserRole } from './shared/index.js';
+export type { Bindings } from './env.js';
 type Variables = RequestIdVariables & AuthVariables & KeyVariables;
 export declare const app: Hono<{
     Bindings: Bindings;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAItD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAe,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAqBhF;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAExB,KAAK,SAAS,GAAG,kBAAkB,GAAG,aAAa,GAAG,YAAY,CAAC;AAKnE,eAAO,MAAM,GAAG;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;;;;;AA+I5E,wBASsC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAItD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAa,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrE,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAqBhF;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;GAOG;AACH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACvF,YAAY,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,KAAK,SAAS,GAAG,kBAAkB,GAAG,aAAa,GAAG,YAAY,CAAC;AAKnE,eAAO,MAAM,GAAG;cAAwB,QAAQ;eAAa,SAAS;yCAAK,CAAC;;;;;AA4J5E,wBASsC"}

package/dist/index.js

@@ -1,14 +1,13 @@
 import { Hono } from 'hono';
 import { createMiddleware } from 'hono/factory';
 import { ok } from './shared/index.js';
-import { AUTH_BASE_PATH, createAuth, isBootstrapOpen } from './auth/auth.js';
-import { usersAdminRoutes } from './auth/routes.admin.js';
+import { adminAuthMode, adminAuthProvider } from './lib/admin-auth.js';
 import { getSettings } from './env.js';
 import { HttpError, errorBoundary, notFoundHandler } from './lib/errors.js';
 import { runRetentionCleanup } from './lib/retention.js';
 import { keysAdminRoutes } from './keys/routes.admin.js';
 import { publicApiAuth } from './keys/middleware.js';
-import { sessionAuth } from './middleware/auth.js';
+import { adminAuth } from './middleware/auth.js';
 import { corsMiddleware } from './middleware/cors.js';
 import { moduleGate } from './middleware/module-gate.js';
 import { requestId } from './middleware/request-id.js';
@@ -36,7 +35,22 @@ import { siteDocumentsPublicRoutes } from './modules/site-documents/routes.publi
  * without reaching into the package's internals. A scaffolded project calls
  * `registerEmailSender(cloudflareEmailSender)` at module scope and is done.
  */
-export { registerEmailSender, } from './lib/email.js';
+export { registerEmailSender, resolveEmailSender, sendBestEffort, } from './lib/email.js';
+/**
+ * The admin auth seam, and everything a provider needs to speak this worker's
+ * language: the registration itself, the gate the core mounts on
+ * `/v1/admin/*`, the owner check, the error envelope, per-route CORS, and the
+ * input validator. A provider that claims routes of its own reuses these
+ * rather than restating them, so there is one admin policy and one wire
+ * contract however a site signs in.
+ */
+export { ADMIN_AUTH_NOT_CONFIGURED, EMBEDDED_PROVIDER_NAME, adminAuthMode, adminAuthProvider, normalizeRole, registerAdminAuth, } from './lib/admin-auth.js';
+export { adminAuth, requireOwner } from './middleware/auth.js';
+export { corsMiddleware } from './middleware/cors.js';
+export { HttpError, errorBoundary, notFoundHandler } from './lib/errors.js';
+export { buildPasswordResetEmail } from './lib/notify.js';
+export { parseOrThrow } from './lib/validate.js';
+export { ok, err, USER_ROLES } from './shared/index.js';
 // Named export as well as default, so tests can call app.request(...) directly:
 // the default export is the plain {fetch, scheduled} object Cloudflare's module
 // Worker format expects, which has no .request() of its own.
@@ -51,37 +65,33 @@ app.onError(errorBoundary);
 app.notFound(async (c) => (await serveSpaShell(c.req.raw, c.env)) ?? notFoundHandler(c));
 app.use('*', requestId);
 // ---------------------------------------------------------------------------
-// Embedded auth
+// Provider-owned routes
 // ---------------------------------------------------------------------------
 /**
- * Public sign-up is open exactly once, to create the first user, who becomes
- * the owner. After that this closes and further accounts are created by the
- * owner through /v1/admin/users.
+ * First refusal for the registered admin auth provider.
  *
- * Gating at the HTTP layer rather than through the library's own disableSignUp
- * is deliberate: the flag is static, the condition is not, and the owner's
- * account-creation route needs the same underlying sign-up path to stay open
- * server-side. One rule, applied where the request arrives.
+ * A sign-in endpoint cannot sit behind a sign-in check, so this runs ahead of
+ * every gate below it. The embedded provider in `@we8/auth` answers here for
+ * `/api/auth/*` and for the site-user routes under `/v1/admin/users`;
+ * returning null passes the request back untouched, which is what every
+ * provider does for every path it does not own, and what happens on every
+ * request when no provider is registered at all.
  */
-const bootstrapGate = createMiddleware(async (c, next) => {
-    if (!(await isBootstrapOpen(c.env.DB))) {
-        throw new HttpError('forbidden', 'sign-up is closed; ask an owner for an account');
+const providerRoutes = createMiddleware(async (c, next) => {
+    const provider = adminAuthProvider();
+    if (provider?.handleRoute) {
+        const response = await provider.handleRoute(c.req.raw, c.env);
+        if (response)
+            return response;
     }
     await next();
 });
-app.use(`${AUTH_BASE_PATH}/*`, corsMiddleware('admin'));
-app.use(`${AUTH_BASE_PATH}/sign-up/*`, bootstrapGate);
-app.all(`${AUTH_BASE_PATH}/*`, async (c) => {
-    if (!c.env.BETTER_AUTH_SECRET) {
-        throw new HttpError('internal', 'BETTER_AUTH_SECRET is not configured');
-    }
-    return createAuth(c.env).handler(c.req.raw);
-});
+app.use('*', providerRoutes);
 // ---------------------------------------------------------------------------
 // Gates
 // ---------------------------------------------------------------------------
 app.use('/v1/*', publicApiAuth);
-app.use('/v1/admin/*', corsMiddleware('admin'), sessionAuth);
+app.use('/v1/admin/*', corsMiddleware('admin'), adminAuth);
 // ---------------------------------------------------------------------------
 // Meta
 // ---------------------------------------------------------------------------
@@ -90,6 +100,25 @@ app.get('/v1/health', async (c) => {
     const settings = await getSettings(c.env.DB);
     return c.json(ok({ cmsVersion: c.env.CMS_VERSION, modules: settings.modules }));
 });
+/**
+ * How this site signs its admin in, so a portal never has to guess.
+ *
+ * Keyless and unauthenticated by necessity: the screen that asks this question
+ * is the one nobody has signed in to yet. It reveals only what a sign-in page
+ * displays anyway, which is why it can be answered before a key exists.
+ *
+ * `mode` is `embedded` when @we8/auth is composed, `external` for any other
+ * provider, and `none` when nothing is registered, in which case every
+ * /v1/admin request is refused. `signUp` is `open` only while the provider
+ * still offers a first-account flow, which is what makes the portal's
+ * first-run screen a read rather than a probe against the sign-up route.
+ */
+app.use('/v1/auth/mode', corsMiddleware('publicRead'));
+app.get('/v1/auth/mode', async (c) => {
+    const provider = adminAuthProvider();
+    const signUp = provider?.firstRun ? await provider.firstRun(c.env) : 'closed';
+    return c.json(ok({ mode: adminAuthMode(), provider: provider?.name ?? null, signUp }));
+});
 // Self-describing API: keyless, so any developer can read the contract before
 // they have a key. Not module-gated either; it documents whatever is enabled
 // and is cheap and static.
@@ -156,7 +185,6 @@ app.route('/v1/documents', siteDocumentsPublicRoutes);
 app.route('/v1/admin/documents', siteDocumentsAdminRoutes);
 app.route('/v1/admin/aeo', aeoAdminRoutes);
 app.route('/v1/admin/keys', keysAdminRoutes);
-app.route('/v1/admin/users', usersAdminRoutes);
 export default {
     fetch: app.fetch,
     // The daily retention sweep. The schedule is configured in wrangler.jsonc's

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAiB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAsB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,SAAS,EAA2B,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF;;;;GAIG;AACH,OAAO,EACL,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AAIxB,gFAAgF;AAChF,gFAAgF;AAChF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgD,CAAC;AAE5E,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAE3B;;;;;GAKG;AACH,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAExB,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,gBAAgB,CAAyB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC/E,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gDAAgD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACxD,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,YAAY,EAAE,aAAa,CAAC,CAAC;AAEtD,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAChC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;AAE7D,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AACpD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,2BAA2B;AAC3B,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AACnD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,cAAc,EAAE,2BAA2B;QAC3C,eAAe,EAAE,qBAAqB;KACvC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,4BAA4B;AAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACpD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACtD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAE9C,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAClD,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACjD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACrD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3D,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AAE5D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAElD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC5C,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;AAC9C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AACjD,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AACnD,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AAElC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAC/C,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;AAE3D,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;AAC/C,wEAAwE;AACxE,gFAAgF;AAChF,+EAA+E;AAC/E,oCAAoC;AACpC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AAE7C,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/C,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAErD,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;AACtD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;AAE3D,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AAC3C,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;AAC7C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/C,eAAe;IACb,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,4EAA4E;IAC5E,kBAAkB;IAClB,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI;QACpC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;CACkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAiB,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAsB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,SAAS,EAA2B,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6CAA6C,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF;;;;GAIG;AACH,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,GAIf,MAAM,gBAAgB,CAAC;AAExB;;;;;;;GAOG;AACH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,iBAAiB,GAKlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAwC,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,cAAc,EAAiB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAiC,MAAM,mBAAmB,CAAC;AAKvF,gFAAgF;AAChF,gFAAgF;AAChF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgD,CAAC;AAE5E,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAE3B;;;;;GAKG;AACH,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzF,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAExB,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,gBAAgB,CAAyB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChF,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAE7B,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAChC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;AAE3D,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AACpD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AACvD,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6EAA6E;AAC7E,2BAA2B;AAC3B,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AAC1D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;AACnD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,cAAc,EAAE,2BAA2B;QAC3C,eAAe,EAAE,qBAAqB;KACvC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,4BAA4B;AAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAChD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACpD,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACtD,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;AAE9C,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAClD,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACjD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACrD,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3D,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AAE5D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAElD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC5C,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;AAC9C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AACjD,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AACnD,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AAElC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAC/C,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;AAE3D,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;AAC/C,wEAAwE;AACxE,gFAAgF;AAChF,+EAA+E;AAC/E,oCAAoC;AACpC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;AAE7C,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAC1C,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/C,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAErD,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;AACtD,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;AAE3D,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;AAC3C,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;AAE7C,eAAe;IACb,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,4EAA4E;IAC5E,kBAAkB;IAClB,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI;QACpC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;CACkC,CAAC"}

package/dist/keys/middleware.d.ts

@@ -26,8 +26,8 @@ export declare const publicKeyAuth: import("hono").MiddlewareHandler<{
  * Each one is keyless because its reader cannot hold a key. A crawler fetching
  * the sitemap has no credential to present; an image in published HTML cannot
  * carry a rotating secret without every historical page breaking on the next
- * rotation; health and the OpenAPI document exist to be discovered before
- * anyone has a key at all.
+ * rotation; health, the OpenAPI document, and the auth mode exist to be read
+ * before anyone has a key at all, by a portal nobody has signed in to yet.
  *
  * Treat the media exemption as irreversible: once keyless media URLs are in
  * published content, re-gating them breaks that content permanently.

package/dist/keys/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/keys/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1C,MAAM,MAAM,YAAY,GAAG;IACzB,kFAAkF;IAClF,OAAO,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa;cAAgC,QAAQ;eAAa,YAAY;wBAe1F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO9E;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa;cAAgC,QAAQ;eAAa,YAAY;wBAa1F,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;cAAgC,QAAQ;eAAa,YAAY;wBAO7F,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/keys/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1C,MAAM,MAAM,YAAY,GAAG;IACzB,kFAAkF;IAClF,OAAO,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa;cAAgC,QAAQ;eAAa,YAAY;wBAe1F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ9E;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa;cAAgC,QAAQ;eAAa,YAAY;wBAa1F,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;cAAgC,QAAQ;eAAa,YAAY;wBAO7F,CAAC"}

package/dist/keys/middleware.js

@@ -32,8 +32,8 @@ export const publicKeyAuth = createMiddleware(async (c, next) => {
  * Each one is keyless because its reader cannot hold a key. A crawler fetching
  * the sitemap has no credential to present; an image in published HTML cannot
  * carry a rotating secret without every historical page breaking on the next
- * rotation; health and the OpenAPI document exist to be discovered before
- * anyone has a key at all.
+ * rotation; health, the OpenAPI document, and the auth mode exist to be read
+ * before anyone has a key at all, by a portal nobody has signed in to yet.
  *
  * Treat the media exemption as irreversible: once keyless media URLs are in
  * published content, re-gating them breaks that content permanently.
@@ -46,6 +46,8 @@ export function isKeylessPublicRoute(method, pathname) {
         return true;
     if (pathname === '/v1/openapi.json')
         return true;
+    if (pathname === '/v1/auth/mode')
+        return true;
     if (pathname === '/v1/sitemap.xml')
         return true;
     return pathname.startsWith('/v1/media/');

package/dist/keys/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/keys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAC3C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,QAAQ,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAC3C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACpD,IAAI,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAChE,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAC9C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/keys/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAC3C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,QAAQ,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAC3C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC7C,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACpD,IAAI,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAChE,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAC9C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC"}

package/dist/lib/admin-auth.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The admin auth seam.
+ *
+ * The core of this CMS does not know how anybody signs in. It knows what an
+ * `owner` may do and what a `member` may do, and it knows that no request
+ * reaches `/v1/admin/*` without an identity; WHO somebody is comes from a
+ * provider a composed worker registers here, exactly the way `registerEmailSender`
+ * supplies a transport.
+ *
+ * Three shapes of deployment come out of one interface:
+ *
+ * - **embedded**: `@we8/auth` runs Better Auth over the site's own D1 and
+ *   claims `/api/auth/*`. This is the default a scaffolded project gets and
+ *   behaves as the CMS always has.
+ * - **external**: a provider that reads an identity someone else established,
+ *   for instance a Cloudflare Access assertion at the perimeter.
+ * - **none**: nothing registered. Every admin request is refused. An
+ *   unconfigured deploy is a locked site, never an open one.
+ */
+import type { UserRole } from '../shared/index.js';
+/**
+ * Who the provider says this request is. `email` is optional because not every
+ * identity source has one; it is what publish history is attributed to, and
+ * falls back to nothing rather than to a fabricated address.
+ */
+export interface AdminIdentity {
+    userId: string;
+    role: UserRole;
+    email?: string | null;
+}
+/** Whether a provider still offers a way to create the very first account. */
+export type FirstRunState = 'open' | 'closed';
+export interface AdminAuthProvider {
+    /**
+     * The provider's name, which is also what `GET /v1/auth/mode` reports a mode
+     * from: `embedded` is the shipped Better Auth provider, anything else is an
+     * external identity source.
+     */
+    name: string;
+    /**
+     * Resolves the request to an identity, or null when it carries none. Throw an
+     * `HttpError` to say something more specific than "not signed in", for
+     * instance that the provider itself is misconfigured.
+     */
+    resolve(request: Request, env: unknown): Promise<AdminIdentity | null>;
+    /**
+     * Lets the provider own routes of its own: the embedded provider serves
+     * `/api/auth/*` and the site-user management under `/v1/admin/users` this
+     * way. Return null to decline the request, which passes it back to the core
+     * untouched.
+     *
+     * This runs BEFORE the core's own gates, because a sign-in endpoint cannot
+     * sit behind a sign-in check. A provider that claims a path under
+     * `/v1/admin/` therefore takes on the admin gate for it; the shipped
+     * embedded provider mounts the core's own `adminAuth` and `requireOwner` on
+     * its routes rather than inventing a second policy.
+     */
+    handleRoute?(request: Request, env: unknown): Promise<Response | null>;
+    /**
+     * Whether a first-account flow is available right now. The portal reads this
+     * through `/v1/auth/mode` so its first-run screen never has to probe a
+     * sign-up route to find out.
+     */
+    firstRun?(env: unknown): Promise<FirstRunState>;
+}
+/** What `GET /v1/auth/mode` reports. */
+export type AdminAuthMode = 'embedded' | 'external' | 'none';
+/** The name the shipped `@we8/auth` provider registers under. */
+export declare const EMBEDDED_PROVIDER_NAME = "embedded";
+/**
+ * The refusal a request to `/v1/admin/*` gets when nothing is registered.
+ *
+ * Exported as a constant so a test, a doctor, or an operator's grep can match
+ * it exactly, and so the two ways forward are stated in the one place they are
+ * true.
+ */
+export declare const ADMIN_AUTH_NOT_CONFIGURED = "admin auth is not configured: install @we8/auth and call registerAdminAuth(embeddedAdminAuth), or register a provider for the perimeter this admin sits behind";
+/**
+ * Registers the admin auth provider. A composed worker calls this once at
+ * module scope, before any request is served; passing `null` unregisters,
+ * which is what a test of the refusal wants.
+ */
+export declare function registerAdminAuth(provider: AdminAuthProvider | null): void;
+/** The registered provider, or null when the site is running unconfigured. */
+export declare function adminAuthProvider(): AdminAuthProvider | null;
+/** The mode the registered provider puts this site in. */
+export declare function adminAuthMode(): AdminAuthMode;
+/**
+ * Normalizes whatever a provider hands back into one of the two roles.
+ * Anything unrecognized, absent, or empty reads as `member`: least privilege,
+ * so a row written by hand, a claim from a misconfigured identity provider, or
+ * a leftover from a botched migration cannot grant ownership.
+ */
+export declare function normalizeRole(role: unknown): UserRole;
+//# sourceMappingURL=admin-auth.d.ts.map

package/dist/lib/admin-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.d.ts","sourceRoot":"","sources":["../../src/lib/admin-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvE;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACjD;AAED,wCAAwC;AACxC,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7D,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,mKAC4H,CAAC;AAInK;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,IAAI,iBAAiB,GAAG,IAAI,CAE5D;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,aAAa,CAG7C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAErD"}

package/dist/lib/admin-auth.js

@@ -0,0 +1,58 @@
+/**
+ * The admin auth seam.
+ *
+ * The core of this CMS does not know how anybody signs in. It knows what an
+ * `owner` may do and what a `member` may do, and it knows that no request
+ * reaches `/v1/admin/*` without an identity; WHO somebody is comes from a
+ * provider a composed worker registers here, exactly the way `registerEmailSender`
+ * supplies a transport.
+ *
+ * Three shapes of deployment come out of one interface:
+ *
+ * - **embedded**: `@we8/auth` runs Better Auth over the site's own D1 and
+ *   claims `/api/auth/*`. This is the default a scaffolded project gets and
+ *   behaves as the CMS always has.
+ * - **external**: a provider that reads an identity someone else established,
+ *   for instance a Cloudflare Access assertion at the perimeter.
+ * - **none**: nothing registered. Every admin request is refused. An
+ *   unconfigured deploy is a locked site, never an open one.
+ */
+/** The name the shipped `@we8/auth` provider registers under. */
+export const EMBEDDED_PROVIDER_NAME = 'embedded';
+/**
+ * The refusal a request to `/v1/admin/*` gets when nothing is registered.
+ *
+ * Exported as a constant so a test, a doctor, or an operator's grep can match
+ * it exactly, and so the two ways forward are stated in the one place they are
+ * true.
+ */
+export const ADMIN_AUTH_NOT_CONFIGURED = 'admin auth is not configured: install @we8/auth and call registerAdminAuth(embeddedAdminAuth), or register a provider for the perimeter this admin sits behind';
+let registered = null;
+/**
+ * Registers the admin auth provider. A composed worker calls this once at
+ * module scope, before any request is served; passing `null` unregisters,
+ * which is what a test of the refusal wants.
+ */
+export function registerAdminAuth(provider) {
+    registered = provider;
+}
+/** The registered provider, or null when the site is running unconfigured. */
+export function adminAuthProvider() {
+    return registered;
+}
+/** The mode the registered provider puts this site in. */
+export function adminAuthMode() {
+    if (!registered)
+        return 'none';
+    return registered.name === EMBEDDED_PROVIDER_NAME ? 'embedded' : 'external';
+}
+/**
+ * Normalizes whatever a provider hands back into one of the two roles.
+ * Anything unrecognized, absent, or empty reads as `member`: least privilege,
+ * so a row written by hand, a claim from a misconfigured identity provider, or
+ * a leftover from a botched migration cannot grant ownership.
+ */
+export function normalizeRole(role) {
+    return role === 'owner' ? 'owner' : 'member';
+}
+//# sourceMappingURL=admin-auth.js.map

package/dist/lib/admin-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth.js","sourceRoot":"","sources":["../../src/lib/admin-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAuDH,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,gKAAgK,CAAC;AAEnK,IAAI,UAAU,GAA6B,IAAI,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAkC;IAClE,UAAU,GAAG,QAAQ,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC;IAC/B,OAAO,UAAU,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC"}

package/dist/middleware/auth.d.ts

@@ -12,23 +12,31 @@ export type AuthVariables = {
     auth: AuthContext;
 };
 /**
- * Session gating for /v1/admin/*.
+ * The gate on /v1/admin/*.
  *
  * This is the seam where managed we8 and this package genuinely differ. There,
  * a control-plane proxy signs an internal HMAC and the engine trusts the
- * identity headers riding along with it. Here there is no proxy: the Better
- * Auth session cookie on the request IS the identity, resolved against this
- * worker's own database, and the user and role it yields are injected into
- * exactly the place the engine's header trust used to fill.
+ * identity headers riding along with it. Here there is no proxy, and no
+ * assumption about how anybody signed in either: the registered admin auth
+ * provider resolves the request to an identity, and the user and role it
+ * yields are injected into exactly the place the engine's header trust used to
+ * fill. What that identity may then do is decided here and nowhere else.
  *
- * A public API key never reaches the admin surface. A publishable key travels
- * in browser code, so if presenting one could reach /v1/admin/*, every visitor
- * to the site could read the submission inbox and rewrite content. Any request
- * carrying a key on an admin route is rejected outright rather than merely
- * failing the session check, so the boundary is explicit rather than
- * incidental.
+ * With no provider registered the request is refused outright. That is the
+ * secure default and the reason the refusal is a 403 rather than a 401: a 401
+ * invites a credential, and there is no credential that would help. Nothing
+ * about this site's configuration admits anyone to the admin API, so the
+ * honest answer is that the door does not open, plus the two ways to give it a
+ * lock (see ADMIN_AUTH_NOT_CONFIGURED).
+ *
+ * A public API key never reaches the admin surface, whatever the mode. A
+ * publishable key travels in browser code, so if presenting one could reach
+ * /v1/admin/*, every visitor to the site could read the submission inbox and
+ * rewrite content. Any request carrying a key on an admin route is rejected
+ * before the provider is even consulted, so the boundary is explicit rather
+ * than incidental.
  */
-export declare const sessionAuth: import("hono").MiddlewareHandler<{
+export declare const adminAuth: import("hono").MiddlewareHandler<{
     Bindings: Bindings;
     Variables: AuthVariables;
 }, string, {}, Response>;
@@ -39,7 +47,7 @@ export declare const sessionAuth: import("hono").MiddlewareHandler<{
  * people's personal data. Everything else in the admin API is open to a
  * member, because a member is an editor.
  *
- * Only mounted behind sessionAuth, so the request is already authenticated;
+ * Only mounted behind adminAuth, so the request is already authenticated;
  * this narrows which authenticated user.
  */
 export declare function requireOwner(c: Context, next: () => Promise<void>): Promise<void>;

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAI1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iFAAiF;IACjF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,WAAW;cAAgC,QAAQ;eAAa,aAAa;wBA0BzF,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjF"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAQ1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,MAAM,WAAW,GAAG;IACxB,kFAAkF;IAClF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iFAAiF;IACjF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS;cAAgC,QAAQ;eAAa,aAAa;wBAwBvF,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjF"}

package/dist/middleware/auth.js

@@ -1,42 +1,48 @@
 import { createMiddleware } from 'hono/factory';
 import { HttpError } from '../lib/errors.js';
-import { createAuth, normalizeRole } from '../auth/auth.js';
+import { ADMIN_AUTH_NOT_CONFIGURED, adminAuthProvider, normalizeRole, } from '../lib/admin-auth.js';
 import { extractApiKey } from '../keys/service.js';
 /**
- * Session gating for /v1/admin/*.
+ * The gate on /v1/admin/*.
  *
  * This is the seam where managed we8 and this package genuinely differ. There,
  * a control-plane proxy signs an internal HMAC and the engine trusts the
- * identity headers riding along with it. Here there is no proxy: the Better
- * Auth session cookie on the request IS the identity, resolved against this
- * worker's own database, and the user and role it yields are injected into
- * exactly the place the engine's header trust used to fill.
+ * identity headers riding along with it. Here there is no proxy, and no
+ * assumption about how anybody signed in either: the registered admin auth
+ * provider resolves the request to an identity, and the user and role it
+ * yields are injected into exactly the place the engine's header trust used to
+ * fill. What that identity may then do is decided here and nowhere else.
  *
- * A public API key never reaches the admin surface. A publishable key travels
- * in browser code, so if presenting one could reach /v1/admin/*, every visitor
- * to the site could read the submission inbox and rewrite content. Any request
- * carrying a key on an admin route is rejected outright rather than merely
- * failing the session check, so the boundary is explicit rather than
- * incidental.
+ * With no provider registered the request is refused outright. That is the
+ * secure default and the reason the refusal is a 403 rather than a 401: a 401
+ * invites a credential, and there is no credential that would help. Nothing
+ * about this site's configuration admits anyone to the admin API, so the
+ * honest answer is that the door does not open, plus the two ways to give it a
+ * lock (see ADMIN_AUTH_NOT_CONFIGURED).
+ *
+ * A public API key never reaches the admin surface, whatever the mode. A
+ * publishable key travels in browser code, so if presenting one could reach
+ * /v1/admin/*, every visitor to the site could read the submission inbox and
+ * rewrite content. Any request carrying a key on an admin route is rejected
+ * before the provider is even consulted, so the boundary is explicit rather
+ * than incidental.
  */
-export const sessionAuth = createMiddleware(async (c, next) => {
+export const adminAuth = createMiddleware(async (c, next) => {
     if (extractApiKey(c) !== undefined) {
         throw new HttpError('forbidden', 'API keys cannot access admin routes');
     }
-    if (!c.env.BETTER_AUTH_SECRET) {
-        // Refusing beats guessing: with no secret configured, any session this
-        // worker validated would be one it could not have signed.
-        throw new HttpError('unauthorized', 'authentication is not configured');
+    const provider = adminAuthProvider();
+    if (!provider) {
+        throw new HttpError('forbidden', ADMIN_AUTH_NOT_CONFIGURED);
     }
-    const auth = createAuth(c.env);
-    const session = await auth.api.getSession({ headers: c.req.raw.headers });
-    if (!session) {
+    const identity = await provider.resolve(c.req.raw, c.env);
+    if (!identity) {
         throw new HttpError('unauthorized', 'sign in required');
     }
     c.set('auth', {
-        userId: session.user.id,
-        user: session.user.email,
-        role: normalizeRole(session.user.role),
+        userId: identity.userId,
+        user: identity.email ?? null,
+        role: normalizeRole(identity.role),
     });
     await next();
 });
@@ -47,7 +53,7 @@ export const sessionAuth = createMiddleware(async (c, next) => {
  * people's personal data. Everything else in the admin API is open to a
  * member, because a member is an editor.
  *
- * Only mounted behind sessionAuth, so the request is already authenticated;
+ * Only mounted behind adminAuth, so the request is already authenticated;
  * this narrows which authenticated user.
  */
 export function requireOwner(c, next) {

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAenD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CACzC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC9B,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;QACZ,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;QACxB,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;KACvC,CAAC,CAAC;IAEH,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,IAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA4B,CAAC;IACtD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAenD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CACvC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE;QACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;QAC5B,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC;IAEH,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,IAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA4B,CAAC;IACtD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/modules/openapi/spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/modules/openapi/spec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqczE"}
+{"version":3,"file":"spec.d.ts","sourceRoot":"","sources":["../../../src/modules/openapi/spec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgezE"}

package/dist/modules/openapi/spec.js

@@ -339,6 +339,32 @@ export function buildOpenApiSpec(siteUrl) {
                     },
                 },
             },
+            '/v1/auth/mode': {
+                get: {
+                    tags: ['meta'],
+                    summary: 'How this site signs its admin in (keyless)',
+                    description: 'Keyless because the screen that asks is the one nobody has signed in to ' +
+                        'yet. `mode` is "embedded" when @we8/auth is composed, "external" for any ' +
+                        'other identity provider, and "none" when nothing is registered, in which ' +
+                        'case every /v1/admin request is refused. `signUp` is "open" only while a ' +
+                        'first-account flow is still available.',
+                    security: [],
+                    responses: {
+                        '200': {
+                            description: 'The mode.',
+                            content: {
+                                'application/json': {
+                                    schema: okEnvelope({
+                                        mode: { type: 'string', enum: ['embedded', 'external', 'none'] },
+                                        provider: { type: ['string', 'null'] },
+                                        signUp: { type: 'string', enum: ['open', 'closed'] },
+                                    }),
+                                },
+                            },
+                        },
+                    },
+                },
+            },
             '/v1/openapi.json': {
                 get: {
                     tags: ['meta'],

package/dist/modules/openapi/spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/modules/openapi/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,UAAU,GAAG,CAAC,SAAkC,EAAE,WAAqB,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC;QAC7B,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,SAAS,EAAE;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,OAAO;YAChB,WAAW,EACT,yEAAyE;gBACzE,yEAAyE;gBACzE,qEAAqE;gBACrE,0EAA0E;SAC7E;QACD,yEAAyE;QACzE,iDAAiD;QACjD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QACpD,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QAClC,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,6BAA6B,EAAE;YAC/D,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;YAC5D,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE;YAClD,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,2BAA2B,EAAE;YAC/D,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE;YAC1D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,wBAAwB,EAAE;YACtD,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE;SACtD;QACD,KAAK,EAAE;YACL,WAAW,EAAE;gBACX,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,sBAAsB;oBAC/B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;wBAClF;4BACE,IAAI,EAAE,UAAU;4BAChB,EAAE,EAAE,OAAO;4BACX,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;yBAClE;wBACD,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE;wBAChF,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBAC7D,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;qBACzD;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,4BAA4B;4BACzC,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;wCACtE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qCAC3B,CAAC;iCACH;6BACF;yBACF;qBACF;iBACF;aACF;YACD,kBAAkB,EAAE;gBAClB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,8BAA8B;oBACvC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,kDAAkD;4BAC/D,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,IAAI,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE;wCAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE;wCAC1E,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE;qCACvD,CAAC;iCACH;6BACF;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,uBAAuB,EAAE;gBACvB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,iCAAiC;oBAC1C,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,WAAW,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE;oBAC7D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;iBAC5D;aACF;YACD,uBAAuB,EAAE;gBACvB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,iCAAiC;oBAC1C,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,WAAW,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE;oBAC7D,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,qBAAqB;4BAClC,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qCAC/B,CAAC;iCACH;6BACF;yBACF;qBACF;iBACF;aACF;YACD,oBAAoB,EAAE;gBACpB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,uBAAuB;oBAChC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,aAAa;4BAC1B,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE,CAAC;iCACxE;6BACF;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,UAAU,EAAE;gBACV,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,wCAAwC;oBACjD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,kBAAkB;4BAC/B,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;iCAC7E;6BACF;yBACF;qBACF;iBACF;aACF;YACD,sBAAsB,EAAE;gBACtB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,6CAA6C;oBACtD,WAAW,EACT,0EAA0E;wBAC1E,6DAA6D;oBAC/D,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,MAAM;4BACZ,EAAE,EAAE,MAAM;4BACV,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE;yBAC5D;qBACF;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,eAAe;4BAC5B,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;iCACjF;6BACF;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,iCAAiC,EAAE;gBACjC,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,OAAO,CAAC;oBACf,OAAO,EAAE,eAAe;oBACxB,WAAW,EACT,wEAAwE;wBACxE,uEAAuE;oBACzE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACzF,WAAW,EAAE;wBACX,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,UAAU,EAAE;wCACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;wCAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC9B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qCACnC;oCACD,oBAAoB,EAAE,IAAI;iCAC3B;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,gEAAgE;4BAC7E,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;iCAC/D;6BACF;yBACF;qBACF;iBACF;aACF;YACD,kBAAkB,EAAE;gBAClB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,OAAO,EAAE,gCAAgC;oBACzC,WAAW,EAAE;wBACX,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;oCACnC,UAAU,EAAE;wCACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qCAC7B;iCACF;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;iBAC5D;aACF;YACD,oBAAoB,EAAE;gBACpB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,OAAO,EAAE,kCAAkC;oBAC3C,WAAW,EAAE;wBACX,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC;oCAC/D,UAAU,EAAE;wCACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE;wCAC1D,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qCACjC;iCACF;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;iBAC5D;aACF;YACD,iBAAiB,EAAE;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,OAAO,CAAC;oBACf,OAAO,EAAE,0CAA0C;oBACnD,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACrF,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,oBAAoB;4BACjC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;yBACrE;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,gEAAgE;oBAChE,yCAAyC;oBACzC,OAAO,EAAE,uBAAuB;oBAChC,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE;qBAC3E;iBACF;aACF;YACD,WAAW,EAAE;gBACX,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,2CAA2C;oBACpD,WAAW,EACT,wEAAwE;wBACxE,qEAAqE;wBACrE,wEAAwE;wBACxE,2EAA2E;oBAC7E,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE;wBACtE,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,YAAY,EAAE;gBACZ,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,0CAA0C;oBACnD,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,SAAS;4BACtB,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;qCACvE,CAAC;iCACH;6BACF;yBACF;qBACF;iBACF;aACF;YACD,kBAAkB,EAAE;gBAClB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,iCAAiC;oBAC1C,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,WAAW;4BACxB,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;yBAChE;qBACF;iBACF;aACF;SACF;QACD,UAAU,EAAE;YACV,eAAe,EAAE;gBACf,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,2DAA2D;iBACzE;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,kEAAkE;wBAClE,sEAAsE;wBACtE,qDAAqD;iBACxD;aACF;YACD,aAAa,EAAE;gBACb,SAAS,EAAE;oBACT,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,QAAQ,EAAE,CAAC,WAAW,CAAC;gCACvB,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;6BAC9C;yBACF;qBACF;iBACF;aACF;YACD,SAAS,EAAE;gBACT,EAAE,EAAE;oBACF,WAAW,EAAE,UAAU;oBACvB,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,QAAQ,EAAE,CAAC,IAAI,CAAC;gCAChB,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;6BACtD;yBACF;qBACF;iBACF;gBACD,QAAQ,EAAE;oBACR,WAAW,EAAE,YAAY;oBACzB,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;gCACjC,UAAU,EAAE;oCACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;oCACtC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iCACzB;6BACF;yBACF;qBACF;iBACF;aACF;YACD,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gDAAgD;oBAC7D,UAAU,EAAE;wBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;wBAC/C,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE;wBAC3D,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACjD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC3C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACjD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC9C,aAAa,EAAE;4BACb,IAAI,EAAE,QAAQ;4BACd,QAAQ,EAAE,IAAI;4BACd,WAAW,EACT,oEAAoE;yBACvE;wBACD,eAAe,EAAE;4BACf,IAAI,EAAE,QAAQ;4BACd,QAAQ,EAAE,IAAI;4BACd,WAAW,EAAE,gEAAgE;yBAC9E;wBACD,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBACvD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wBAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC/C,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wBAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qBAC/B;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC7C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC7C,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACvC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE;qBAChF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../../../src/modules/openapi/spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,UAAU,GAAG,CAAC,SAAkC,EAAE,WAAqB,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC;QAC7B,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,SAAS,EAAE;KACpE,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,OAAO;YAChB,WAAW,EACT,yEAAyE;gBACzE,yEAAyE;gBACzE,qEAAqE;gBACrE,0EAA0E;SAC7E;QACD,yEAAyE;QACzE,iDAAiD;QACjD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QACpD,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QAClC,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,6BAA6B,EAAE;YAC/D,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;YAC5D,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE;YAClD,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,2BAA2B,EAAE;YAC/D,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,0BAA0B,EAAE;YAC1D,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,wBAAwB,EAAE;YACtD,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE;SACtD;QACD,KAAK,EAAE;YACL,WAAW,EAAE;gBACX,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,sBAAsB;oBAC/B,UAAU,EAAE;wBACV,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE;wBAClF;4BACE,IAAI,EAAE,UAAU;4BAChB,EAAE,EAAE,OAAO;4BACX,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;yBAClE;wBACD,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE;wBAChF,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBAC7D,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;qBACzD;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,4BAA4B;4BACzC,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;wCACtE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qCAC3B,CAAC;iCACH;6BACF;yBACF;qBACF;iBACF;aACF;YACD,kBAAkB,EAAE;gBAClB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,8BAA8B;oBACvC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,kDAAkD;4BAC/D,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,IAAI,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE;wCAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE;wCAC1E,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE;qCACvD,CAAC;iCACH;6BACF;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,uBAAuB,EAAE;gBACvB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,iCAAiC;oBAC1C,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,WAAW,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE;oBAC7D,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;iBAC5D;aACF;YACD,uBAAuB,EAAE;gBACvB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,iCAAiC;oBAC1C,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,WAAW,EAAE,EAAE,IAAI,EAAE,sCAAsC,EAAE;oBAC7D,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,qBAAqB;4BAClC,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qCAC/B,CAAC;iCACH;6BACF;yBACF;qBACF;iBACF;aACF;YACD,oBAAoB,EAAE;gBACpB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,OAAO,EAAE,uBAAuB;oBAChC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACtF,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,aAAa;4BAC1B,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE,CAAC;iCACxE;6BACF;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,UAAU,EAAE;gBACV,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,wCAAwC;oBACjD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,kBAAkB;4BAC/B,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;iCAC7E;6BACF;yBACF;qBACF;iBACF;aACF;YACD,sBAAsB,EAAE;gBACtB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,6CAA6C;oBACtD,WAAW,EACT,0EAA0E;wBAC1E,6DAA6D;oBAC/D,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,MAAM;4BACZ,EAAE,EAAE,MAAM;4BACV,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE;yBAC5D;qBACF;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,eAAe;4BAC5B,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;iCACjF;6BACF;yBACF;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,iCAAiC,EAAE;gBACjC,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,OAAO,CAAC;oBACf,OAAO,EAAE,eAAe;oBACxB,WAAW,EACT,wEAAwE;wBACxE,uEAAuE;oBACzE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACzF,WAAW,EAAE;wBACX,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,UAAU,EAAE;wCACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;wCAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC9B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qCACnC;oCACD,oBAAoB,EAAE,IAAI;iCAC3B;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,gEAAgE;4BAC7E,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;iCAC/D;6BACF;yBACF;qBACF;iBACF;aACF;YACD,kBAAkB,EAAE;gBAClB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,OAAO,EAAE,gCAAgC;oBACzC,WAAW,EAAE;wBACX,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;oCACnC,UAAU,EAAE;wCACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;qCAC7B;iCACF;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;iBAC5D;aACF;YACD,oBAAoB,EAAE;gBACpB,IAAI,EAAE;oBACJ,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,OAAO,EAAE,kCAAkC;oBAC3C,WAAW,EAAE;wBACX,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,kBAAkB,EAAE;gCAClB,MAAM,EAAE;oCACN,IAAI,EAAE,QAAQ;oCACd,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC;oCAC/D,UAAU,EAAE;wCACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE;wCAC1D,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wCAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qCACjC;iCACF;6BACF;yBACF;qBACF;oBACD,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,EAAE;iBAC5D;aACF;YACD,iBAAiB,EAAE;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,OAAO,CAAC;oBACf,OAAO,EAAE,0CAA0C;oBACnD,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;oBACrF,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,oBAAoB;4BACjC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;yBACrE;wBACD,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,iBAAiB,EAAE;gBACjB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,gEAAgE;oBAChE,yCAAyC;oBACzC,OAAO,EAAE,uBAAuB;oBAChC,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,EAAE;qBAC3E;iBACF;aACF;YACD,WAAW,EAAE;gBACX,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,2CAA2C;oBACpD,WAAW,EACT,wEAAwE;wBACxE,qEAAqE;wBACrE,wEAAwE;wBACxE,2EAA2E;oBAC7E,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE;wBACtE,KAAK,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE;qBACnD;iBACF;aACF;YACD,YAAY,EAAE;gBACZ,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,0CAA0C;oBACnD,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,SAAS;4BACtB,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wCAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;qCACvE,CAAC;iCACH;6BACF;yBACF;qBACF;iBACF;aACF;YACD,eAAe,EAAE;gBACf,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,4CAA4C;oBACrD,WAAW,EACT,0EAA0E;wBAC1E,2EAA2E;wBAC3E,2EAA2E;wBAC3E,2EAA2E;wBAC3E,wCAAwC;oBAC1C,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,WAAW;4BACxB,OAAO,EAAE;gCACP,kBAAkB,EAAE;oCAClB,MAAM,EAAE,UAAU,CAAC;wCACjB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;wCAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;wCACtC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;qCACrD,CAAC;iCACH;6BACF;yBACF;qBACF;iBACF;aACF;YACD,kBAAkB,EAAE;gBAClB,GAAG,EAAE;oBACH,IAAI,EAAE,CAAC,MAAM,CAAC;oBACd,OAAO,EAAE,iCAAiC;oBAC1C,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE;wBACT,KAAK,EAAE;4BACL,WAAW,EAAE,WAAW;4BACxB,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;yBAChE;qBACF;iBACF;aACF;SACF;QACD,UAAU,EAAE;YACV,eAAe,EAAE;gBACf,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,QAAQ;oBACZ,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,2DAA2D;iBACzE;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,WAAW,EACT,kEAAkE;wBAClE,sEAAsE;wBACtE,qDAAqD;iBACxD;aACF;YACD,aAAa,EAAE;gBACb,SAAS,EAAE;oBACT,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,QAAQ,EAAE,CAAC,WAAW,CAAC;gCACvB,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;6BAC9C;yBACF;qBACF;iBACF;aACF;YACD,SAAS,EAAE;gBACT,EAAE,EAAE;oBACF,WAAW,EAAE,UAAU;oBACvB,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,QAAQ,EAAE,CAAC,IAAI,CAAC;gCAChB,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;6BACtD;yBACF;qBACF;iBACF;gBACD,QAAQ,EAAE;oBACR,WAAW,EAAE,YAAY;oBACzB,OAAO,EAAE;wBACP,kBAAkB,EAAE;4BAClB,MAAM,EAAE;gCACN,IAAI,EAAE,QAAQ;gCACd,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;gCACjC,UAAU,EAAE;oCACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE;oCACtC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACzB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iCACzB;6BACF;yBACF;qBACF;iBACF;aACF;YACD,OAAO,EAAE;gBACP,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,gDAAgD;oBAC7D,UAAU,EAAE;wBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;wBAC/C,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE;wBAC3D,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACjD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBAClD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC3C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACjD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC9C,aAAa,EAAE;4BACb,IAAI,EAAE,QAAQ;4BACd,QAAQ,EAAE,IAAI;4BACd,WAAW,EACT,oEAAoE;yBACvE;wBACD,eAAe,EAAE;4BACf,IAAI,EAAE,QAAQ;4BACd,QAAQ,EAAE,IAAI;4BACd,WAAW,EAAE,gEAAgE;yBAC9E;wBACD,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBACvD,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wBAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC/C,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wBAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;qBAC/B;iBACF;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC7C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC7C,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACvC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE;qBAChF;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@we8/cms",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "license": "MIT",
   "homepage": "https://we8.io",
   "type": "module",
-  "description": "The core we8 headless CMS: content, forms, analytics, media, and SEO modules behind a single-site /v1 API with embedded auth.",
+  "description": "The core we8 headless CMS: content, forms, analytics, media, and SEO modules behind a single-site /v1 API, with a pluggable admin auth seam.",
   "keywords": [
     "we8",
     "cms",
@@ -19,6 +19,7 @@
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
+      "@we8/source": "./src/index.ts",
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     }
@@ -36,7 +37,7 @@
     "typecheck": "tsc -p tsconfig.json",
     "test": "vitest run",
     "dev": "wrangler dev",
-    "db:migrate": "wrangler d1 migrations apply DB --local",
+    "db:migrate": "wrangler d1 migrations apply DB --local && wrangler d1 migrations apply DB --local --config wrangler.auth-migrations.jsonc",
     "db:seed": "wrangler d1 execute DB --local --file=./seed/local.sql",
     "admin:bundle": "node scripts/bundle-admin.mjs",
     "prepack": "npm run build"
@@ -45,14 +46,13 @@
     "access": "public"
   },
   "dependencies": {
-    "better-auth": "^1.7.1",
-    "drizzle-orm": "^0.45.2",
     "hono": "^4.12.27",
     "zod": "^3.24.1"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.18.0",
     "@cloudflare/workers-types": "^5.20260705.1",
+    "@we8/auth": "*",
     "vitest": "^4.1.9",
     "wrangler": "^4.107.0"
   },

package/migrations/0007_auth.sql

@@ -1,81 +0,0 @@
--- 0007: the embedded Better Auth schema, as a plain migration under this
--- package's own numbering rather than ORM migration tooling. Additive only.
---
--- Canonical source of the field list: Better Auth's own model definitions for
--- the four core tables. No auth plugin is enabled, so there are no plugin
--- columns here and nothing unused: `role` is this package's own additional
--- field, carrying 'owner' or 'member'. A Drizzle mirror of these exact columns
--- lives at src/auth/schema.ts so the Drizzle adapter can build typed queries;
--- the two are kept in lockstep by hand. To regenerate a reference schema after
--- a Better Auth version bump, run the CLI against the auth config:
---   npx @better-auth/cli@latest generate --config src/auth/auth.ts
---
--- Column-type decisions: the Drizzle adapter passes native Date and boolean
--- values straight through, so date fields are INTEGER unix-second timestamps
--- (Drizzle `mode: 'timestamp'`) and boolean fields are INTEGER 0/1 (Drizzle
--- `mode: 'boolean'`). Ids are Better Auth's own generated TEXT strings. Column
--- names are Better Auth's default camelCase, so they intentionally differ from
--- the snake_case convention of this package's own tables: these four are owned
--- end to end by the library.
-
-CREATE TABLE user (
-  id TEXT PRIMARY KEY,
-  name TEXT NOT NULL,
-  email TEXT NOT NULL UNIQUE,
-  emailVerified INTEGER NOT NULL DEFAULT 0,
-  image TEXT,
-  createdAt INTEGER NOT NULL,
-  updatedAt INTEGER NOT NULL,
-  -- The site role: 'owner' for the first user created, 'member' for everyone
-  -- after. Assigned server-side on user creation and never writable through
-  -- the auth API, so a member cannot promote themselves.
-  role TEXT
-);
-
-CREATE TABLE session (
-  id TEXT PRIMARY KEY,
-  expiresAt INTEGER NOT NULL,
-  token TEXT NOT NULL UNIQUE,
-  createdAt INTEGER NOT NULL,
-  updatedAt INTEGER NOT NULL,
-  ipAddress TEXT,
-  userAgent TEXT,
-  userId TEXT NOT NULL REFERENCES user (id) ON DELETE CASCADE
-);
-
-CREATE INDEX idx_session_user ON session (userId);
-
-CREATE TABLE account (
-  id TEXT PRIMARY KEY,
-  -- Who vouches for this identity. For an email and password login it is the
-  -- local credential issuer; for a future social login it is that provider.
-  -- (issuer, accountId) is the identity's unique key.
-  issuer TEXT NOT NULL,
-  accountId TEXT NOT NULL,
-  providerId TEXT NOT NULL,
-  userId TEXT NOT NULL REFERENCES user (id) ON DELETE CASCADE,
-  accessToken TEXT,
-  refreshToken TEXT,
-  idToken TEXT,
-  accessTokenExpiresAt INTEGER,
-  refreshTokenExpiresAt INTEGER,
-  scope TEXT,
-  -- The password hash for the email and password credential account.
-  password TEXT,
-  createdAt INTEGER NOT NULL,
-  updatedAt INTEGER NOT NULL
-);
-
-CREATE INDEX idx_account_user ON account (userId);
-CREATE UNIQUE INDEX idx_account_issuer_account ON account (issuer, accountId);
-
-CREATE TABLE verification (
-  id TEXT PRIMARY KEY,
-  identifier TEXT NOT NULL,
-  value TEXT NOT NULL,
-  expiresAt INTEGER NOT NULL,
-  createdAt INTEGER NOT NULL,
-  updatedAt INTEGER NOT NULL
-);
-
-CREATE INDEX idx_verification_identifier ON verification (identifier);