@airdraft/plugin-auth 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+All notable changes to `@airdraft/plugin-auth` will be documented here.
+
+See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

package/dist/CredentialsProvider.d.ts

@@ -0,0 +1,49 @@
+import type { Role } from '@airdraft/auth';
+import type { AuthProvider } from './types.js';
+import type { UserStore } from './UserStore.js';
+export interface CredentialsProviderOptions {
+    userStore: UserStore;
+    /**
+     * AIRDRAFT_JWT_SECRET — must be ≥ 32 chars (C7).
+     * Defaults to `process.env.AIRDRAFT_JWT_SECRET` when omitted.
+     */
+    secret?: string;
+    /**
+     * Email-keyed role overrides. Config takes precedence over user store (C3).
+     * e.g. `{ 'alice@example.com': 'admin' }`
+     */
+    roles?: Record<string, Role>;
+    /**
+     * Base path for the CMS API (default: '/api/cms').
+     * Used to scope the refresh cookie path.
+     */
+    basePath?: string;
+}
+/**
+ * Email/password auth provider using scrypt hashing + HS256 JWT sessions.
+ *
+ * Registers four route handlers:
+ * - `POST /auth/login`   — verifies credentials, sets httpOnly cookies
+ * - `POST /auth/logout`  — clears cookies, blocklists the refresh token
+ * - `POST /auth/refresh` — rotates refresh token, issues new access token
+ * - `GET  /auth/me`      — returns the current user (from access JWT)
+ *
+ * Also registers:
+ * - `POST /auth/invite/:token` — accepts an invite and sets a password
+ *
+ * ```ts
+ * import { withAuth } from '@airdraft/plugin-auth'
+ * import { CredentialsProvider } from '@airdraft/plugin-auth'
+ * import { UserStore } from '@airdraft/plugin-auth'
+ *
+ * withAuth({
+ *   provider: CredentialsProvider({
+ *     userStore: UserStore.json(),
+ *     secret: process.env.AIRDRAFT_JWT_SECRET!,
+ *     roles: { 'alice@example.com': 'admin' },
+ *   })
+ * })
+ * ```
+ */
+export declare function CredentialsProvider(opts: CredentialsProviderOptions): AuthProvider;
+//# sourceMappingURL=CredentialsProvider.d.ts.map

package/dist/CredentialsProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialsProvider.d.ts","sourceRoot":"","sources":["../src/CredentialsProvider.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAY,IAAI,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAA;AAE/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AA0E/C,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,SAAS,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,YAAY,CA6UlF"}

package/dist/CredentialsProvider.js

@@ -0,0 +1,441 @@
+import { signAccessToken, signRefreshToken, verifyAccessToken, ACCESS_TOKEN_TTL, REFRESH_TOKEN_TTL, } from '@airdraft/auth';
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { refreshTokenBlocklist } from './blocklist.js';
+import { getRequestUser } from './withAuth.js';
+// ---------------------------------------------------------------------------
+// Cookie helpers
+// ---------------------------------------------------------------------------
+/**
+ * Builds an `airdraft_session` (access token) cookie string.
+ * httpOnly + SameSite=Strict (C6).
+ */
+function accessCookie(token, secure) {
+    const attrs = [
+        `airdraft_session=${encodeURIComponent(token)}`,
+        'HttpOnly',
+        'SameSite=Strict',
+        'Path=/',
+        `Max-Age=${ACCESS_TOKEN_TTL}`,
+        ...(secure ? ['Secure'] : []),
+    ];
+    return attrs.join('; ');
+}
+/**
+ * Builds an `airdraft_refresh` cookie string, scoped to the refresh endpoint.
+ * httpOnly + SameSite=Strict (C6).
+ */
+function refreshCookie(token, refreshPath, secure) {
+    const attrs = [
+        `airdraft_refresh=${encodeURIComponent(token)}`,
+        'HttpOnly',
+        'SameSite=Strict',
+        `Path=${refreshPath}`,
+        `Max-Age=${REFRESH_TOKEN_TTL}`,
+        ...(secure ? ['Secure'] : []),
+    ];
+    return attrs.join('; ');
+}
+function clearCookies(refreshPath) {
+    return [
+        `airdraft_session=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`,
+        `airdraft_refresh=; HttpOnly; SameSite=Strict; Path=${refreshPath}; Max-Age=0`,
+    ];
+}
+function parseCookie(header, name) {
+    if (!header)
+        return null;
+    for (const part of header.split(';')) {
+        const [key, ...rest] = part.trim().split('=');
+        if (key?.trim() === name)
+            return decodeURIComponent(rest.join('='));
+    }
+    return null;
+}
+function isSecure(req) {
+    try {
+        return new URL(req.url).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+// ---------------------------------------------------------------------------
+// CredentialsProvider  (C2, C5, C6, C8)
+// ---------------------------------------------------------------------------
+/**
+ * Email/password auth provider using scrypt hashing + HS256 JWT sessions.
+ *
+ * Registers four route handlers:
+ * - `POST /auth/login`   — verifies credentials, sets httpOnly cookies
+ * - `POST /auth/logout`  — clears cookies, blocklists the refresh token
+ * - `POST /auth/refresh` — rotates refresh token, issues new access token
+ * - `GET  /auth/me`      — returns the current user (from access JWT)
+ *
+ * Also registers:
+ * - `POST /auth/invite/:token` — accepts an invite and sets a password
+ *
+ * ```ts
+ * import { withAuth } from '@airdraft/plugin-auth'
+ * import { CredentialsProvider } from '@airdraft/plugin-auth'
+ * import { UserStore } from '@airdraft/plugin-auth'
+ *
+ * withAuth({
+ *   provider: CredentialsProvider({
+ *     userStore: UserStore.json(),
+ *     secret: process.env.AIRDRAFT_JWT_SECRET!,
+ *     roles: { 'alice@example.com': 'admin' },
+ *   })
+ * })
+ * ```
+ */
+export function CredentialsProvider(opts) {
+    const secret = opts.secret ?? process.env['AIRDRAFT_JWT_SECRET'] ?? '';
+    if (!secret || secret.length < 32) {
+        throw new Error('[airdraft] AIRDRAFT_JWT_SECRET must be at least 32 characters. ' +
+            'Generate one with: npx airdraft generate-secret');
+    }
+    const { userStore } = opts;
+    const configRoles = opts.roles ?? {};
+    const basePath = opts.basePath ?? '/api/cms';
+    const refreshPath = `${basePath}/auth/refresh`;
+    /** Resolves the effective role: config override > user store role. */
+    function resolveRole(email, storeRole) {
+        return configRoles[email.toLowerCase()] ?? storeRole;
+    }
+    // -------------------------------------------------------------------------
+    // verify — called on every protected request (C2)
+    // -------------------------------------------------------------------------
+    async function verify(req) {
+        const cookie = req.headers.get('cookie');
+        const rawToken = parseCookie(cookie, 'airdraft_session');
+        if (!rawToken)
+            return null;
+        const user = verifyAccessToken(rawToken, secret);
+        if (!user)
+            return null;
+        // Apply config role override (C3)
+        return { ...user, role: resolveRole(user.email, user.role) };
+    }
+    // -------------------------------------------------------------------------
+    // Route handlers
+    // -------------------------------------------------------------------------
+    /** POST /auth/login */
+    async function loginHandler(req) {
+        let body;
+        try {
+            body = (await req.json());
+        }
+        catch {
+            return json({ error: 'Invalid JSON body' }, 400);
+        }
+        if (typeof body.email !== 'string' || typeof body.password !== 'string') {
+            return json({ error: 'email and password are required' }, 400);
+        }
+        const record = await userStore.verifyPassword(body.email, body.password);
+        if (!record) {
+            return json({ error: 'Invalid email or password' }, 401);
+        }
+        const role = resolveRole(record.email, record.role);
+        const user = { id: record.id, email: record.email, name: record.name, role };
+        const accessToken = signAccessToken(user, secret);
+        const refreshToken = signRefreshToken();
+        const secure = isSecure(req);
+        return new Response(JSON.stringify({ user: { id: user.id, email: user.email, name: user.name, role } }), {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/json',
+                'Set-Cookie': [accessCookie(accessToken, secure), refreshCookie(refreshToken, refreshPath, secure)].join(', '),
+            },
+        });
+    }
+    /** POST /auth/logout */
+    async function logoutHandler(req) {
+        const cookie = req.headers.get('cookie');
+        const refreshToken = parseCookie(cookie, 'airdraft_refresh');
+        if (refreshToken) {
+            refreshTokenBlocklist.add(refreshToken);
+        }
+        const headers = new Headers({ 'Content-Type': 'application/json' });
+        for (const c of clearCookies(refreshPath)) {
+            headers.append('Set-Cookie', c);
+        }
+        return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
+    }
+    /** POST /auth/refresh — silent token rotation (C8) */
+    async function refreshHandler(req) {
+        const cookie = req.headers.get('cookie');
+        const oldRefresh = parseCookie(cookie, 'airdraft_refresh');
+        if (!oldRefresh || refreshTokenBlocklist.has(oldRefresh)) {
+            return json({ error: 'Invalid or expired refresh token' }, 401);
+        }
+        // Access token may be expired — get user identity from the access JWT anyway
+        const rawAccess = parseCookie(cookie, 'airdraft_session');
+        // Allow expired access tokens here — we're explicitly refreshing
+        let user = null;
+        if (rawAccess) {
+            // verifyAccessToken rejects expired tokens; parse manually for refresh
+            user = parseExpiredAccessToken(rawAccess, secret);
+        }
+        if (!user)
+            return json({ error: 'Cannot identify user for token refresh' }, 401);
+        // Blocklist the consumed refresh token (C8)
+        refreshTokenBlocklist.add(oldRefresh);
+        const role = resolveRole(user.email, user.role);
+        const refreshedUser = { ...user, role };
+        const newAccess = signAccessToken(refreshedUser, secret);
+        const newRefresh = signRefreshToken();
+        const secure = isSecure(req);
+        return new Response(JSON.stringify({ user: { id: user.id, email: user.email, name: user.name, role } }), {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/json',
+                'Set-Cookie': [
+                    accessCookie(newAccess, secure),
+                    refreshCookie(newRefresh, refreshPath, secure),
+                ].join(', '),
+            },
+        });
+    }
+    /** GET /auth/me */
+    async function meHandler(req) {
+        const user = await verify(req);
+        if (!user)
+            return json({ error: 'Not authenticated' }, 401);
+        return json({ user: { id: user.id, email: user.email, name: user.name, role: user.role } });
+    }
+    /** POST /auth/invite/:token */
+    async function inviteHandler(req) {
+        const url = new URL(req.url);
+        const segments = url.pathname.split('/');
+        const token = segments[segments.length - 1];
+        if (!token)
+            return json({ error: 'Missing invite token' }, 400);
+        let body;
+        try {
+            body = (await req.json());
+        }
+        catch {
+            return json({ error: 'Invalid JSON body' }, 400);
+        }
+        if (typeof body.password !== 'string' || body.password.length < 8) {
+            return json({ error: 'password must be at least 8 characters' }, 400);
+        }
+        try {
+            const record = await userStore.acceptInvite(token, body.password, typeof body.name === 'string' ? body.name : undefined);
+            return json({ user: { id: record.id, email: record.email, name: record.name, role: record.role } }, 201);
+        }
+        catch (err) {
+            return json({ error: err.message }, 400);
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Admin helpers
+    // -------------------------------------------------------------------------
+    /** Ensures the caller is authenticated as admin. Returns the user or an error Response.
+     * Uses the user already attached by `withAuth` middleware (supports any auth provider),
+     * falling back to direct JWT-cookie verification for callers outside middleware context.
+     */
+    async function requireAdmin(req) {
+        const actor = getRequestUser(req) ?? await verify(req);
+        if (!actor)
+            return json({ error: 'Not authenticated' }, 401);
+        if (actor.role !== 'admin')
+            return json({ error: 'Forbidden' }, 403);
+        return actor;
+    }
+    // -------------------------------------------------------------------------
+    // Admin: user management routes
+    // -------------------------------------------------------------------------
+    /** GET /auth/users */
+    async function listUsersHandler(req) {
+        const actorOrResp = await requireAdmin(req);
+        if (actorOrResp instanceof Response)
+            return actorOrResp;
+        const users = await userStore.list();
+        return json({
+            data: users.map((u) => ({
+                id: u.id,
+                email: u.email,
+                name: u.name,
+                role: resolveRole(u.email, u.role),
+                createdAt: u.createdAt,
+            })),
+        });
+    }
+    /** PATCH /auth/users/:id/role */
+    async function updateUserRoleHandler(req) {
+        const actorOrResp = await requireAdmin(req);
+        if (actorOrResp instanceof Response)
+            return actorOrResp;
+        const url = new URL(req.url);
+        const segments = url.pathname.split('/');
+        // …/users/:id/role → id is segments[-2]
+        const userId = segments[segments.length - 2];
+        if (!userId)
+            return json({ error: 'Missing user id' }, 400);
+        let body;
+        try {
+            body = (await req.json());
+        }
+        catch {
+            return json({ error: 'Invalid JSON body' }, 400);
+        }
+        if (!['admin', 'publisher', 'editor'].includes(body.role)) {
+            return json({ error: 'role must be admin, publisher, or editor' }, 400);
+        }
+        const users = await userStore.list();
+        const target = users.find((u) => u.id === userId);
+        if (!target)
+            return json({ error: 'User not found' }, 404);
+        const updated = await userStore.updateRole(target.email, body.role);
+        if (!updated)
+            return json({ error: 'User not found' }, 404);
+        return json({
+            data: {
+                id: updated.id,
+                email: updated.email,
+                name: updated.name,
+                role: resolveRole(updated.email, updated.role),
+                createdAt: updated.createdAt,
+            },
+        });
+    }
+    /** DELETE /auth/users/:id */
+    async function removeUserHandler(req) {
+        const actorOrResp = await requireAdmin(req);
+        if (actorOrResp instanceof Response)
+            return actorOrResp;
+        const url = new URL(req.url);
+        const segments = url.pathname.split('/');
+        const userId = segments[segments.length - 1];
+        if (!userId)
+            return json({ error: 'Missing user id' }, 400);
+        const users = await userStore.list();
+        const target = users.find((u) => u.id === userId);
+        if (!target)
+            return json({ error: 'User not found' }, 404);
+        await userStore.remove(target.email);
+        return new Response(null, { status: 204 });
+    }
+    // -------------------------------------------------------------------------
+    // Admin: invite management routes
+    // -------------------------------------------------------------------------
+    /** GET /auth/invites */
+    async function listInvitesHandler(req) {
+        const actorOrResp = await requireAdmin(req);
+        if (actorOrResp instanceof Response)
+            return actorOrResp;
+        const now = Math.floor(Date.now() / 1000);
+        const all = await userStore.listInvites();
+        const pending = all.filter((inv) => inv.expiresAt > now);
+        return json({ data: pending });
+    }
+    /** POST /auth/invites */
+    async function createInviteHandler(req) {
+        const actorOrResp = await requireAdmin(req);
+        if (actorOrResp instanceof Response)
+            return actorOrResp;
+        let body;
+        try {
+            body = (await req.json());
+        }
+        catch {
+            return json({ error: 'Invalid JSON body' }, 400);
+        }
+        if (typeof body.email !== 'string')
+            return json({ error: 'email is required' }, 400);
+        if (!['admin', 'publisher', 'editor'].includes(body.role)) {
+            return json({ error: 'role must be admin, publisher, or editor' }, 400);
+        }
+        try {
+            const invite = await userStore.createInvite(body.email, body.role);
+            return json({ data: invite }, 201);
+        }
+        catch (err) {
+            return json({ error: err.message }, 400);
+        }
+    }
+    /** DELETE /auth/invites/:token */
+    async function revokeInviteHandler(req) {
+        const actorOrResp = await requireAdmin(req);
+        if (actorOrResp instanceof Response)
+            return actorOrResp;
+        const url = new URL(req.url);
+        const segments = url.pathname.split('/');
+        const token = segments[segments.length - 1];
+        if (!token)
+            return json({ error: 'Missing invite token' }, 400);
+        await userStore.revokeInvite(token);
+        return new Response(null, { status: 204 });
+    }
+    /** Combined handler for /auth/invites — dispatches by HTTP method. */
+    async function invitesRouter(req) {
+        if (req.method === 'POST')
+            return createInviteHandler(req);
+        return listInvitesHandler(req);
+    }
+    function handlers() {
+        return [
+            // Public — these bypass the auth middleware (no valid session required to call them)
+            { path: '/auth/login', handler: loginHandler, public: true },
+            { path: '/auth/logout', handler: logoutHandler, public: true },
+            { path: '/auth/refresh', handler: refreshHandler, public: true },
+            { path: '/auth/me', handler: meHandler, public: true },
+            { path: '/auth/invite/:token', handler: inviteHandler, public: true },
+            // Private — go through middleware so getRequestUser() is populated
+            { path: '/auth/users', handler: listUsersHandler, public: false },
+            { path: '/auth/users/:id/role', handler: updateUserRoleHandler, public: false },
+            { path: '/auth/users/:id', handler: removeUserHandler, public: false },
+            { path: '/auth/invites', handler: invitesRouter, public: false },
+            { path: '/auth/invites/:token', handler: revokeInviteHandler, public: false },
+        ];
+    }
+    async function refresh(refreshToken) {
+        if (refreshTokenBlocklist.has(refreshToken))
+            return null;
+        return null; // without persistent refresh token storage, rely on the access cookie path above
+    }
+    return { verify, handlers, refresh };
+}
+// ---------------------------------------------------------------------------
+// Internal: parse expired access token (for refresh flow)
+// ---------------------------------------------------------------------------
+/**
+ * Verifies the signature of an HS256 JWT but ignores the `exp` claim.
+ * Used only in the refresh flow where the access token may be expired.
+ */
+function parseExpiredAccessToken(token, secret) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    const [header, payload, sig] = parts;
+    const expectedSig = createHmac('sha256', secret)
+        .update(`${header}.${payload}`)
+        .digest('base64url');
+    const a = Buffer.from(sig, 'ascii');
+    const b = Buffer.from(expectedSig, 'ascii');
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if (typeof parsed.email !== 'string' || typeof parsed.role !== 'string')
+            return null;
+        return {
+            id: typeof parsed.id === 'string' ? parsed.id : String(parsed.sub ?? parsed.email),
+            email: parsed.email,
+            name: typeof parsed.name === 'string' ? parsed.name : undefined,
+            role: parsed.role,
+            meta: parsed.meta,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=CredentialsProvider.js.map

package/dist/CredentialsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialsProvider.js","sourceRoot":"","sources":["../src/CredentialsProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,MAAe;IAClD,MAAM,KAAK,GAAG;QACZ,oBAAoB,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,iBAAiB;QACjB,QAAQ;QACR,WAAW,gBAAgB,EAAE;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,WAAmB,EAAE,MAAe;IACxE,MAAM,KAAK,GAAG;QACZ,oBAAoB,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,iBAAiB;QACjB,QAAQ,WAAW,EAAE;QACrB,WAAW,iBAAiB,EAAE;QAC9B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,OAAO;QACL,iEAAiE;QACjE,sDAAsD,WAAW,aAAa;KAC/E,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB,EAAE,IAAY;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAyBD,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAA;IACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,iDAAiD,CACpD,CAAA;IACH,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAA;IAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAA;IAC5C,MAAM,WAAW,GAAG,GAAG,QAAQ,eAAe,CAAA;IAE9C,sEAAsE;IACtE,SAAS,WAAW,CAAC,KAAa,EAAE,SAAe;QACjD,OAAQ,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAsB,IAAI,SAAS,CAAA;IAC5E,CAAC;IAED,4EAA4E;IAC5E,kDAAkD;IAClD,4EAA4E;IAC5E,KAAK,UAAU,MAAM,CAAC,GAAY;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1B,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,kCAAkC;QAClC,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IAC9D,CAAC;IAED,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAE5E,uBAAuB;IACvB,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,IAAI,IAA6C,CAAA;QACjD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4C,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAA;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,IAAI,GAAa,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;QACtF,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;QAEvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC5B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;YACvG,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CACtG,IAAI,CACL;aACF;SACF,CAAC,CAAA;IACJ,CAAC;IAED,wBAAwB;IACxB,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACnE,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;QACjC,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,sDAAsD;IACtD,KAAK,UAAU,cAAc,CAAC,GAAY;QACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAC1D,IAAI,CAAC,UAAU,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAA;QACjE,CAAC;QAED,6EAA6E;QAC7E,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QACzD,iEAAiE;QACjE,IAAI,IAAI,GAAoB,IAAI,CAAA;QAChC,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,IAAI,GAAG,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,CAAC,CAAA;QAEhF,4CAA4C;QAC5C,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAErC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,aAAa,GAAa,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;QACjD,MAAM,SAAS,GAAG,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,gBAAgB,EAAE,CAAA;QAErC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC5B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;YACvG,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE;oBACZ,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC;oBAC/B,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;iBAC/C,CAAC,IAAI,CAAC,IAAI,CAAC;aACb;SACF,CAAC,CAAA;IACJ,CAAC;IAED,mBAAmB;IACnB,KAAK,UAAU,SAAS,CAAC,GAAY;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC7F,CAAC;IAED,+BAA+B;IAC/B,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAA;QAE/D,IAAI,IAA4C,CAAA;QAChD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAA;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,CAAC,CAAA;QACvE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CACzC,KAAK,EACL,IAAI,CAAC,QAAQ,EACb,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CACtD,CAAA;YACD,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAC1G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,gBAAgB;IAChB,4EAA4E;IAE5E;;;OAGG;IACH,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,MAAM,MAAM,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAE5E,sBAAsB;IACtB,KAAK,UAAU,gBAAgB,CAAC,GAAY;QAC1C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,WAAW,YAAY,QAAQ;YAAE,OAAO,WAAW,CAAA;QACvD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;QACpC,OAAO,IAAI,CAAC;YACV,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;gBAClC,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;SACJ,CAAC,CAAA;IACJ,CAAC;IAED,iCAAiC;IACjC,KAAK,UAAU,qBAAqB,CAAC,GAAY;QAC/C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,WAAW,YAAY,QAAQ;YAAE,OAAO,WAAW,CAAA;QAEvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxC,wCAAwC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;QAE3D,IAAI,IAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QAE1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAY,CAAC,CAAA;QAC3E,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC;YACV,IAAI,EAAE;gBACJ,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC;gBAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B;SACF,CAAC,CAAA;IACJ,CAAC;IAED,6BAA6B;IAC7B,KAAK,UAAU,iBAAiB,CAAC,GAAY;QAC3C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,WAAW,YAAY,QAAQ;YAAE,OAAO,WAAW,CAAA;QAEvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;QAE3D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAA;QAE1D,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,4EAA4E;IAC5E,kCAAkC;IAClC,4EAA4E;IAE5E,wBAAwB;IACxB,KAAK,UAAU,kBAAkB,CAAC,GAAY;QAC5C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,WAAW,YAAY,QAAQ;YAAE,OAAO,WAAW,CAAA;QAEvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,CAAA;QACxD,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAChC,CAAC;IAED,yBAAyB;IACzB,KAAK,UAAU,mBAAmB,CAAC,GAAY;QAC7C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,WAAW,YAAY,QAAQ;YAAE,OAAO,WAAW,CAAA;QAEvD,IAAI,IAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwC,CAAA;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAA;QACpF,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAY,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,KAAK,UAAU,mBAAmB,CAAC,GAAY;QAC7C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,WAAW,YAAY,QAAQ;YAAE,OAAO,WAAW,CAAA;QAEvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAA;QAE/D,MAAM,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACnC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,sEAAsE;IACtE,KAAK,UAAU,aAAa,CAAC,GAAY;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;QAC1D,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;IAED,SAAS,QAAQ;QACf,OAAO;YACL,qFAAqF;YACrF,EAAE,IAAI,EAAE,aAAa,EAAW,OAAO,EAAE,YAAY,EAAI,MAAM,EAAE,IAAI,EAAE;YACvE,EAAE,IAAI,EAAE,cAAc,EAAU,OAAO,EAAE,aAAa,EAAG,MAAM,EAAE,IAAI,EAAE;YACvE,EAAE,IAAI,EAAE,eAAe,EAAS,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE;YACvE,EAAE,IAAI,EAAE,UAAU,EAAc,OAAO,EAAE,SAAS,EAAO,MAAM,EAAE,IAAI,EAAE;YACvE,EAAE,IAAI,EAAE,qBAAqB,EAAG,OAAO,EAAE,aAAa,EAAG,MAAM,EAAE,IAAI,EAAE;YACvE,mEAAmE;YACnE,EAAE,IAAI,EAAE,aAAa,EAAe,OAAO,EAAE,gBAAgB,EAAU,MAAM,EAAE,KAAK,EAAE;YACtF,EAAE,IAAI,EAAE,sBAAsB,EAAM,OAAO,EAAE,qBAAqB,EAAK,MAAM,EAAE,KAAK,EAAE;YACtF,EAAE,IAAI,EAAE,iBAAiB,EAAW,OAAO,EAAE,iBAAiB,EAAS,MAAM,EAAE,KAAK,EAAE;YACtF,EAAE,IAAI,EAAE,eAAe,EAAa,OAAO,EAAE,aAAa,EAAa,MAAM,EAAE,KAAK,EAAE;YACtF,EAAE,IAAI,EAAE,sBAAsB,EAAM,OAAO,EAAE,mBAAmB,EAAO,MAAM,EAAE,KAAK,EAAE;SACvF,CAAA;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,YAAoB;QACzC,IAAI,qBAAqB,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAA;QACxD,OAAO,IAAI,CAAA,CAAC,iFAAiF;IAC/F,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,uBAAuB,CAAC,KAAa,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAA;IAEpC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC7C,MAAM,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;SAC9B,MAAM,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAI,EAAE,OAAO,CAAC,CAAA;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;QACzG,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACpF,OAAO;YACL,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;YAClF,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,MAAM,CAAC,IAAY;YACzB,IAAI,EAAE,MAAM,CAAC,IAA2C;SACzD,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/GitHubOAuthProvider.d.ts

@@ -0,0 +1,49 @@
+import type { Role } from '@airdraft/auth';
+import type { AuthProvider } from './types.js';
+export interface GitHubOAuthProviderOptions {
+    clientId: string;
+    clientSecret: string;
+    /**
+     * AIRDRAFT_JWT_SECRET — must be ≥ 32 chars (C7).
+     * Defaults to `process.env.AIRDRAFT_JWT_SECRET`.
+     */
+    secret?: string;
+    /** Email-keyed role overrides (C3). */
+    roles?: Record<string, Role>;
+    /** Only these GitHub usernames may access the CMS. */
+    allowedUsers?: string[];
+    /** Only members of these GitHub orgs may access the CMS. */
+    allowedOrgs?: string[];
+    /**
+     * Default role for GitHub users not in `roles`.
+     * Defaults to 'editor'.
+     */
+    defaultRole?: Role;
+    /** Base path for the CMS API (default: '/api/cms'). */
+    basePath?: string;
+    /** OAuth callback URL (default: `{origin}{basePath}/auth/github/callback`). */
+    callbackUrl?: string;
+}
+/**
+ * GitHub OAuth2 provider for Airdraft CMS.
+ *
+ * Flow:
+ *   1. Browser hits `GET /auth/github`  → redirected to GitHub OAuth
+ *   2. GitHub redirects back to `GET /auth/github/callback?code=...&state=...`
+ *   3. Server exchanges code for token, fetches GitHub user, issues JWT
+ *
+ * CSRF protection: `state` param is a random nonce stored in a session cookie.
+ *
+ * ```ts
+ * withAuth({
+ *   provider: GitHubOAuthProvider({
+ *     clientId: process.env.GITHUB_CLIENT_ID!,
+ *     clientSecret: process.env.GITHUB_CLIENT_SECRET!,
+ *     secret: process.env.AIRDRAFT_JWT_SECRET!,
+ *     roles: { 'alice@example.com': 'admin' },
+ *   })
+ * })
+ * ```
+ */
+export declare function GitHubOAuthProvider(opts: GitHubOAuthProviderOptions): AuthProvider;
+//# sourceMappingURL=GitHubOAuthProvider.d.ts.map

package/dist/GitHubOAuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubOAuthProvider.d.ts","sourceRoot":"","sources":["../src/GitHubOAuthProvider.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAY,IAAI,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAA;AAyE/D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,IAAI,CAAA;IAClB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,YAAY,CAqLlF"}