@contentrail/cloudflare 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ContentRail contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,104 @@
-# Temporary Holding Version
+# `@contentrail/cloudflare`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Server-only Cloudflare Worker publishing API with **Cloudflare Access** authentication and per-site authorization.
+
+**Do not import from browser code.** Git/R2 credentials and Access verification settings stay in Worker secret bindings.
+
+## Requirements
+
+- Node.js **≥ 22** (Workers / Node-compatible server runtime)
+- Depends on `@contentrail/core`, `@contentrail/publisher`, and `jose`
+
+## Install
+
+### Monorepo
+
+```sh
+pnpm install
+pnpm --filter @contentrail/cloudflare build
+```
+
+### From npm (upcoming `0.2.0` after authorized publish)
+
+```sh
+pnpm add @contentrail/core@0.2.0 @contentrail/publisher@0.2.0 @contentrail/cloudflare@0.2.0 zod@^4.6.7
+```
+
+## ADR 011b summary
+
+- Authentication is pluggable; Access JWT is the first adapter.
+- Authorization is separate and default-deny per `siteId`.
+- Client requests never choose repository/bucket/prefix — only a configured `destinationRef` on the server.
+
+## Endpoints
+
+| Method | Path                                           | Auth         | Purpose                                                |
+| ------ | ---------------------------------------------- | ------------ | ------------------------------------------------------ |
+| `GET`  | `/health`                                      | No           | Liveness; no secrets                                   |
+| `GET`  | `/v1/sites`                                    | Yes          | Sites the identity may access (no destination secrets) |
+| `GET`  | `/v1/sites/:siteId/config`                     | Yes          | Editor-safe site metadata                              |
+| `GET`  | `/v1/sites/:siteId/collections/:name/content`  | Yes (`read`) | Active published snapshot (`?entryId=` optional)       |
+| `POST` | `/v1/sites/:siteId/collections/:name/validate` | Yes          | Validate entries                                       |
+| `POST` | `/v1/sites/:siteId/collections/:name/publish`  | Yes          | Publish via `@contentrail/publisher`                   |
+| `GET`  | `/v1/sites/:siteId/collections/:name/status`   | Yes          | Active version + retained versions                     |
+| `POST` | `/v1/sites/:siteId/collections/:name/rollback` | Yes          | Activate a prior version                               |
+
+Publication success and rebuild status remain distinct fields in publish responses. Content reads use server `destinationRef` only and return the **active** published snapshot for that site/collection (ADR 018). Responses never include `destinationRef`, credentials, or inactive version bodies.
+
+**Snapshot size:** `GET .../content` returns the full active entry set (optional `?entryId=`). This is acceptable for small/medium collections. Very large catalogues may hit Worker response or memory limits — pagination is deferred; use `entryId` or keep collections bounded for now.
+
+## Configure Cloudflare Access
+
+1. Create an Access application for the Worker hostname.
+2. Note the application **AUD** tag and team domain (`<team>.cloudflareaccess.com`).
+3. Bind Worker secrets (names only — never commit values):
+
+```text
+CONTENTRAIL_ACCESS_TEAM_DOMAIN
+CONTENTRAIL_ACCESS_AUD
+# Plus existing publisher secrets, e.g. R2_* or GITHUB_TOKEN
+```
+
+4. Map identities to sites in Worker configuration (subjects/emails → permissions).
+
+## Example wiring
+
+```ts
+import {
+  createCloudflareAccessAuthenticator,
+  createPublishFetchHandler,
+  createSiteAuthorizer,
+} from "@contentrail/cloudflare";
+
+export default {
+  fetch: createPublishFetchHandler({
+    authenticator: createCloudflareAccessAuthenticator({
+      teamDomain: env.CONTENTRAIL_ACCESS_TEAM_DOMAIN,
+      audience: env.CONTENTRAIL_ACCESS_AUD,
+    }),
+    authorizer: createSiteAuthorizer({
+      sites: {
+        demo: {
+          destinationRef: "r2:sites/demo",
+          permissions: ["read", "publish", "status", "rollback", "validate"],
+          allowedEmails: ["owner@example.com"],
+        },
+      },
+    }),
+    collections: { articles },
+    corsAllowedOrigins: ["https://editor.example"],
+    getPublisher: (siteId, destinationRef) =>
+      createPublisherForBinding(env, destinationRef),
+  }),
+};
+```
+
+## Deferred
+
+- File uploads (not required for Phase 4 JSON publishing)
+- Live production deploy verification
+- Editor UI (Phase 5)
+
+## Credential rotation
+
+Rotate Access application secrets / allowed identity lists in the Cloudflare dashboard, then update Worker bindings. Revoke by removing the identity from Access policies and from ContentRail site grants.

package/dist/api/handler.d.ts

@@ -0,0 +1,22 @@
+import { type ContentCollection } from "@contentrail/core";
+import { type ContentPublisher } from "@contentrail/publisher";
+import type { Authenticator } from "../auth/types.js";
+import type { SiteAuthorizer } from "../authz/sites.js";
+export interface PublishApiOptions {
+    readonly authenticator: Authenticator;
+    readonly authorizer: SiteAuthorizer;
+    /** Resolve a publisher for a site using server-side bindings only. */
+    readonly getPublisher: (siteId: string, destinationRef: string) => ContentPublisher;
+    /** Collections available to the API; keyed by collection name. */
+    readonly collections: Readonly<Record<string, ContentCollection>>;
+    readonly corsAllowedOrigins?: readonly string[];
+    readonly maxBodyBytes?: number;
+    /** Optional safe logger — must not log tokens or full content payloads. */
+    readonly log?: (event: Record<string, unknown>) => void;
+}
+/**
+ * Creates a Cloudflare Worker-compatible `fetch` handler for ContentRail publishing.
+ * Server-only. Does not expose provider credentials.
+ */
+export declare function createPublishFetchHandler(options: PublishApiOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=handler.d.ts.map

package/dist/api/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/api/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAiB,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AAGxE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,CACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,KACnB,gBAAgB,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACzD;AAMD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,GACzB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAiRzC"}

package/dist/api/handler.js

@@ -0,0 +1,408 @@
+import { validateEntry } from "@contentrail/core";
+import { PublishConflictError, PublishError, } from "@contentrail/publisher";
+import { applyCors, getRequestId, jsonResponse, readJsonBody } from "./http.js";
+const DEFAULT_MAX_BODY = 256_000;
+/** Caps publish/validate entry lists independently of nested JSON field bounds. */
+const DEFAULT_MAX_PUBLISH_ENTRIES = 500;
+/**
+ * Creates a Cloudflare Worker-compatible `fetch` handler for ContentRail publishing.
+ * Server-only. Does not expose provider credentials.
+ */
+export function createPublishFetchHandler(options) {
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY;
+    const corsAllowedOrigins = options.corsAllowedOrigins ?? [];
+    return async (request) => {
+        const requestId = getRequestId(request);
+        const respond = (status, body) => applyCors(jsonResponse(status, body, { requestId }), request, corsAllowedOrigins);
+        if (request.method === "OPTIONS") {
+            return applyCors(new Response(null, {
+                status: 204,
+                headers: { "x-request-id": requestId },
+            }), request, corsAllowedOrigins);
+        }
+        const url = new URL(request.url);
+        if (request.method === "GET" && url.pathname === "/health") {
+            return respond(200, { ok: true, service: "contentrail-publish-api" });
+        }
+        const auth = await options.authenticator.authenticate(request);
+        if (!auth.ok) {
+            options.log?.({
+                level: "warn",
+                requestId,
+                event: "auth_failed",
+                code: auth.code,
+            });
+            return respond(401, {
+                error: { code: auth.code, message: auth.message },
+                requestId,
+            });
+        }
+        if (request.method === "GET" && url.pathname === "/v1/sites") {
+            return respond(200, {
+                sites: options.authorizer.listAccessibleSites(auth.identity),
+            });
+        }
+        const siteMatch = /^\/v1\/sites\/([^/]+)(?:\/(.*))?$/.exec(url.pathname);
+        if (siteMatch === null) {
+            return respond(404, {
+                error: { code: "NOT_FOUND", message: "Unknown route." },
+                requestId,
+            });
+        }
+        const siteId = decodeURIComponent(siteMatch[1]);
+        const rest = siteMatch[2] ?? "";
+        if (request.method === "GET" && rest === "config") {
+            const authz = options.authorizer.authorize(auth.identity, siteId, "status");
+            if (!authz.ok) {
+                return respond(authz.status, {
+                    error: { code: authz.code, message: authz.message },
+                    requestId,
+                });
+            }
+            return respond(200, {
+                siteId,
+                permissions: authz.binding.permissions,
+                collections: Object.keys(options.collections),
+                // Never return destinationRef or credentials.
+            });
+        }
+        const collectionMatch = /^collections\/([^/]+)\/(validate|publish|status|rollback|content)$/.exec(rest);
+        if (collectionMatch === null) {
+            return respond(404, {
+                error: { code: "NOT_FOUND", message: "Unknown site route." },
+                requestId,
+            });
+        }
+        const collectionName = decodeURIComponent(collectionMatch[1]);
+        const action = collectionMatch[2];
+        const permission = permissionFor(action);
+        const authz = options.authorizer.authorize(auth.identity, siteId, permission);
+        if (!authz.ok) {
+            return respond(authz.status, {
+                error: { code: authz.code, message: authz.message },
+                requestId,
+            });
+        }
+        const collection = options.collections[collectionName];
+        if (collection === undefined || collection.name !== collectionName) {
+            return respond(404, {
+                error: { code: "COLLECTION_NOT_FOUND", message: "Unknown collection." },
+                requestId,
+            });
+        }
+        const publisher = options.getPublisher(siteId, authz.binding.destinationRef);
+        try {
+            if (action === "content") {
+                if (request.method !== "GET") {
+                    return respond(405, {
+                        error: { code: "METHOD_NOT_ALLOWED", message: "Use GET." },
+                        requestId,
+                    });
+                }
+                const snapshot = await publisher.readActiveContent(siteId, collectionName);
+                if (snapshot === null) {
+                    return respond(200, {
+                        siteId,
+                        collection: collectionName,
+                        version: null,
+                        publicationId: null,
+                        createdAt: null,
+                        entries: [],
+                    });
+                }
+                const entryIdFilter = url.searchParams.get("entryId");
+                const entries = entryIdFilter === null
+                    ? snapshot.entries
+                    : snapshot.entries.filter((entry) => entry.id === entryIdFilter);
+                if (entryIdFilter !== null && entries.length === 0) {
+                    return respond(404, {
+                        error: { code: "ENTRY_NOT_FOUND", message: "Entry not found." },
+                        requestId,
+                    });
+                }
+                return respond(200, {
+                    siteId,
+                    collection: collectionName,
+                    version: snapshot.version,
+                    publicationId: snapshot.publicationId,
+                    createdAt: snapshot.createdAt,
+                    entries,
+                });
+            }
+            if (action === "status") {
+                if (request.method !== "GET") {
+                    return respond(405, {
+                        error: { code: "METHOD_NOT_ALLOWED", message: "Use GET." },
+                        requestId,
+                    });
+                }
+                const status = await publisher.getStatus(siteId, collectionName);
+                return respond(200, { siteId, collection: collectionName, ...status });
+            }
+            if (request.method !== "POST") {
+                return respond(405, {
+                    error: { code: "METHOD_NOT_ALLOWED", message: "Use POST." },
+                    requestId,
+                });
+            }
+            const body = await readJsonBody(request, maxBodyBytes);
+            if (!body.ok) {
+                return respond(body.status, {
+                    error: { code: body.code, message: body.message },
+                    requestId,
+                });
+            }
+            if (action === "validate" || action === "publish") {
+                const parsed = parsePublishBody(body.value);
+                if (!parsed.ok) {
+                    return respond(400, {
+                        error: { code: parsed.code, message: parsed.message },
+                        requestId,
+                    });
+                }
+                if (action === "validate") {
+                    for (const entry of parsed.entries) {
+                        const result = validateEntry(collection, entry.data);
+                        if (!result.success) {
+                            return respond(400, {
+                                error: {
+                                    code: "VALIDATION",
+                                    message: result.error.message,
+                                    issues: result.error.issues,
+                                    entryId: entry.id,
+                                },
+                                requestId,
+                            });
+                        }
+                    }
+                    return respond(200, { ok: true, siteId, collection: collectionName });
+                }
+                const result = await publisher.publish({
+                    siteId,
+                    collection,
+                    expectedVersion: parsed.expectedVersion,
+                    entries: parsed.entries,
+                    ...(parsed.idempotencyKey !== undefined
+                        ? { idempotencyKey: parsed.idempotencyKey }
+                        : {}),
+                    ...(parsed.publicationId !== undefined
+                        ? { publicationId: parsed.publicationId }
+                        : {}),
+                    ...(parsed.message !== undefined ? { message: parsed.message } : {}),
+                });
+                options.log?.({
+                    level: "info",
+                    requestId,
+                    event: "publish_success",
+                    siteId,
+                    collection: collectionName,
+                    version: result.version,
+                    rebuild: result.rebuild.state,
+                });
+                return respond(200, publicPublishResult(result));
+            }
+            if (action === "rollback") {
+                const parsed = parseRollbackBody(body.value);
+                if (!parsed.ok) {
+                    return respond(400, {
+                        error: { code: parsed.code, message: parsed.message },
+                        requestId,
+                    });
+                }
+                const result = await publisher.rollback({
+                    siteId,
+                    collectionName,
+                    targetVersion: parsed.targetVersion,
+                    expectedVersion: parsed.expectedVersion,
+                });
+                return respond(200, publicPublishResult(result));
+            }
+            return respond(404, {
+                error: { code: "NOT_FOUND", message: "Unknown action." },
+                requestId,
+            });
+        }
+        catch (error) {
+            return mapPublishError(error, respond, requestId, options.log);
+        }
+    };
+}
+function permissionFor(action) {
+    if (action === "validate") {
+        return "validate";
+    }
+    if (action === "publish") {
+        return "publish";
+    }
+    if (action === "rollback") {
+        return "rollback";
+    }
+    if (action === "content") {
+        return "read";
+    }
+    return "status";
+}
+function publicPublishResult(result) {
+    return {
+        success: true,
+        publicationId: result.publicationId,
+        version: result.version,
+        previousVersion: result.previousVersion,
+        provider: result.provider,
+        rebuild: result.rebuild,
+        idempotentReplay: result.idempotentReplay,
+        manifest: {
+            collection: result.manifest.collection,
+            version: result.manifest.version,
+            entryIds: result.manifest.entryIds,
+            createdAt: result.manifest.createdAt,
+        },
+    };
+}
+function parsePublishBody(value) {
+    if (value === null || typeof value !== "object") {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: "JSON object required.",
+        };
+    }
+    const record = value;
+    if (!("expectedVersion" in record)) {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: 'Field "expectedVersion" is required (string or null).',
+        };
+    }
+    if (record.expectedVersion !== null &&
+        typeof record.expectedVersion !== "string") {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: 'Field "expectedVersion" must be a string or null.',
+        };
+    }
+    if (!Array.isArray(record.entries)) {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: 'Field "entries" must be an array.',
+        };
+    }
+    if (record.entries.length > DEFAULT_MAX_PUBLISH_ENTRIES) {
+        return {
+            ok: false,
+            code: "PAYLOAD_TOO_LARGE",
+            message: `Field "entries" exceeds ${DEFAULT_MAX_PUBLISH_ENTRIES} items.`,
+        };
+    }
+    const entries = [];
+    for (const entry of record.entries) {
+        if (entry === null || typeof entry !== "object") {
+            return {
+                ok: false,
+                code: "INVALID_BODY",
+                message: "Each entry must be an object.",
+            };
+        }
+        const item = entry;
+        if (typeof item.id !== "string" || !("data" in item)) {
+            return {
+                ok: false,
+                code: "INVALID_BODY",
+                message: 'Each entry requires string "id" and "data".',
+            };
+        }
+        entries.push({ id: item.id, data: item.data });
+    }
+    return {
+        ok: true,
+        expectedVersion: record.expectedVersion,
+        entries,
+        ...(typeof record.idempotencyKey === "string"
+            ? { idempotencyKey: record.idempotencyKey }
+            : {}),
+        ...(typeof record.publicationId === "string"
+            ? { publicationId: record.publicationId }
+            : {}),
+        ...(typeof record.message === "string" ? { message: record.message } : {}),
+    };
+}
+function parseRollbackBody(value) {
+    if (value === null || typeof value !== "object") {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: "JSON object required.",
+        };
+    }
+    const record = value;
+    if (typeof record.targetVersion !== "string") {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: 'Field "targetVersion" is required.',
+        };
+    }
+    if (!("expectedVersion" in record)) {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: 'Field "expectedVersion" is required.',
+        };
+    }
+    if (record.expectedVersion !== null &&
+        typeof record.expectedVersion !== "string") {
+        return {
+            ok: false,
+            code: "INVALID_BODY",
+            message: 'Field "expectedVersion" must be a string or null.',
+        };
+    }
+    return {
+        ok: true,
+        targetVersion: record.targetVersion,
+        expectedVersion: record.expectedVersion,
+    };
+}
+function mapPublishError(error, respond, requestId, log) {
+    if (error instanceof PublishConflictError) {
+        return respond(409, {
+            error: {
+                code: "CONFLICT",
+                message: error.message,
+                currentVersion: error.currentVersion ?? null,
+                expectedVersion: error.expectedVersion ?? null,
+            },
+            requestId,
+        });
+    }
+    if (error instanceof PublishError) {
+        const status = error.code === "VALIDATION"
+            ? 400
+            : error.code === "PATH_ESCAPE"
+                ? 400
+                : error.code === "NOT_FOUND"
+                    ? 404
+                    : error.code === "CREDENTIALS"
+                        ? 500
+                        : 502;
+        log?.({
+            level: "error",
+            requestId,
+            event: "publish_error",
+            code: error.code,
+        });
+        return respond(status, {
+            error: { code: error.code, message: error.message },
+            requestId,
+        });
+    }
+    log?.({ level: "error", requestId, event: "unhandled_error" });
+    return respond(500, {
+        error: { code: "INTERNAL", message: "Unexpected server error." },
+        requestId,
+    });
+}
+//# sourceMappingURL=handler.js.map

package/dist/api/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/api/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,YAAY,GAGb,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAkBhF,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,mFAAmF;AACnF,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA0B;IAE1B,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAC9D,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAE5D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE,CAChD,SAAS,CACP,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,EACzC,OAAO,EACP,kBAAkB,CACnB,CAAC;QAEJ,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,SAAS,CACd,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE;aACvC,CAAC,EACF,OAAO,EACP,kBAAkB,CACnB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,EAAE,CAAC;gBACZ,KAAK,EAAE,MAAM;gBACb,SAAS;gBACT,KAAK,EAAE,aAAa;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;gBACjD,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7D,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC7D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE;gBACvD,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CACxC,IAAI,CAAC,QAAQ,EACb,MAAM,EACN,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE;oBAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;oBACnD,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,MAAM;gBACN,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;gBACtC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBAC7C,8CAA8C;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GACnB,oEAAoE,CAAC,IAAI,CACvE,IAAI,CACL,CAAC;QACJ,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBAC5D,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAKnB,CAAC;QACd,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CACxC,IAAI,CAAC,QAAQ,EACb,MAAM,EACN,UAAU,CACX,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE;gBAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBACnD,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnE,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvE,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CACpC,MAAM,EACN,KAAK,CAAC,OAAO,CAAC,cAAc,CAC7B,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC7B,OAAO,OAAO,CAAC,GAAG,EAAE;wBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE;wBAC1D,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAChD,MAAM,EACN,cAAc,CACf,CAAC;gBACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,OAAO,OAAO,CAAC,GAAG,EAAE;wBAClB,MAAM;wBACN,UAAU,EAAE,cAAc;wBAC1B,OAAO,EAAE,IAAI;wBACb,aAAa,EAAE,IAAI;wBACnB,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,EAAE;qBACZ,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACtD,MAAM,OAAO,GACX,aAAa,KAAK,IAAI;oBACpB,CAAC,CAAC,QAAQ,CAAC,OAAO;oBAClB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;gBACrE,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACnD,OAAO,OAAO,CAAC,GAAG,EAAE;wBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE;wBAC/D,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,MAAM;oBACN,UAAU,EAAE,cAAc;oBAC1B,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC7B,OAAO,OAAO,CAAC,GAAG,EAAE;wBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE;wBAC1D,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACjE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE;oBAC3D,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE;oBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;oBACjD,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,OAAO,OAAO,CAAC,GAAG,EAAE;wBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;wBACrD,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnC,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;wBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;4BACpB,OAAO,OAAO,CAAC,GAAG,EAAE;gCAClB,KAAK,EAAE;oCACL,IAAI,EAAE,YAAY;oCAClB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;oCAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;oCAC3B,OAAO,EAAE,KAAK,CAAC,EAAE;iCAClB;gCACD,SAAS;6BACV,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBACD,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;gBACxE,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;oBACrC,MAAM;oBACN,UAAU;oBACV,eAAe,EAAE,MAAM,CAAC,eAAe;oBACvC,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;wBACrC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;wBACpC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;wBACzC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE,CAAC,CAAC;gBAEH,OAAO,CAAC,GAAG,EAAE,CAAC;oBACZ,KAAK,EAAE,MAAM;oBACb,SAAS;oBACT,KAAK,EAAE,iBAAiB;oBACxB,MAAM;oBACN,UAAU,EAAE,cAAc;oBAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;iBAC9B,CAAC,CAAC;gBAEH,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,CAAC;YAED,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,OAAO,OAAO,CAAC,GAAG,EAAE;wBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;wBACrD,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC;oBACtC,MAAM;oBACN,cAAc;oBACd,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,CAAC;YAED,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE;gBACxD,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAkE;IAElE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAqB;IAChD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,QAAQ,EAAE;YACR,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;YACtC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;YAClC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAUtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uBAAuB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,CAAC,CAAC,iBAAiB,IAAI,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uDAAuD;SACjE,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,EAC1C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mDAAmD;SAC7D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mCAAmC;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,2BAA2B,2BAA2B,SAAS;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,+BAA+B;aACzC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,KAAgC,CAAC;QAC9C,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,6CAA6C;aACvD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,OAAO;QACP,GAAG,CAAC,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;YAC3C,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IAOvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uBAAuB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,oCAAoC;SAC9C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,iBAAiB,IAAI,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,sCAAsC;SAChD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,EAC1C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,mDAAmD;SAC7D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,OAAoD,EACpD,SAAiB,EACjB,GAA8C;IAE9C,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE;gBACL,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;gBAC5C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;aAC/C;YACD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,YAAY;YACzB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;gBAC5B,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;oBAC1B,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;wBAC5B,CAAC,CAAC,GAAG;wBACL,CAAC,CAAC,GAAG,CAAC;QAChB,GAAG,EAAE,CAAC;YACJ,KAAK,EAAE,OAAO;YACd,SAAS;YACT,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,EAAE;YACrB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;YACnD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE;QAChE,SAAS;KACV,CAAC,CAAC;AACL,CAAC"}

package/dist/api/http.d.ts

@@ -0,0 +1,16 @@
+export declare function jsonResponse(status: number, body: unknown, init?: {
+    requestId: string;
+    headers?: HeadersInit;
+}): Response;
+export declare function getRequestId(request: Request): string;
+export declare function readJsonBody(request: Request, maxBytes: number): Promise<{
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+}>;
+export declare function applyCors(response: Response, request: Request, allowedOrigins: readonly string[]): Response;
+//# sourceMappingURL=http.d.ts.map

package/dist/api/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAA;CAE/C,GACA,QAAQ,CAKV;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAErD;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CACN;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAC/D,CA6CA;AAED,wBAAgB,SAAS,CACvB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,QAAQ,CAcV"}

package/dist/api/http.js

@@ -0,0 +1,69 @@
+import { randomUUID } from "node:crypto";
+export function jsonResponse(status, body, init = {
+    requestId: randomUUID(),
+}) {
+    const headers = new Headers(init.headers);
+    headers.set("content-type", "application/json; charset=utf-8");
+    headers.set("x-request-id", init.requestId);
+    return new Response(JSON.stringify(body), { status, headers });
+}
+export function getRequestId(request) {
+    return request.headers.get("x-request-id")?.trim() || randomUUID();
+}
+export async function readJsonBody(request, maxBytes) {
+    const contentType = request.headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("application/json")) {
+        return {
+            ok: false,
+            status: 415,
+            code: "UNSUPPORTED_MEDIA_TYPE",
+            message: "Content-Type must be application/json.",
+        };
+    }
+    const declaredLength = request.headers.get("content-length");
+    if (declaredLength !== null) {
+        const declared = Number(declaredLength);
+        if (Number.isFinite(declared) && declared > maxBytes) {
+            return {
+                ok: false,
+                status: 413,
+                code: "PAYLOAD_TOO_LARGE",
+                message: `Payload exceeds ${maxBytes} bytes.`,
+            };
+        }
+    }
+    const buffer = await request.arrayBuffer();
+    if (buffer.byteLength > maxBytes) {
+        return {
+            ok: false,
+            status: 413,
+            code: "PAYLOAD_TOO_LARGE",
+            message: `Payload exceeds ${maxBytes} bytes.`,
+        };
+    }
+    try {
+        const text = new TextDecoder().decode(buffer);
+        return { ok: true, value: text === "" ? {} : JSON.parse(text) };
+    }
+    catch {
+        return {
+            ok: false,
+            status: 400,
+            code: "INVALID_JSON",
+            message: "Request body is not valid JSON.",
+        };
+    }
+}
+export function applyCors(response, request, allowedOrigins) {
+    const origin = request.headers.get("Origin");
+    if (origin === null || !allowedOrigins.includes(origin)) {
+        return response;
+    }
+    const headers = new Headers(response.headers);
+    headers.set("access-control-allow-origin", origin);
+    headers.set("vary", "Origin");
+    headers.set("access-control-allow-headers", "authorization, content-type, cf-access-jwt-assertion, x-request-id");
+    headers.set("access-control-allow-methods", "GET, POST, OPTIONS");
+    return new Response(response.body, { status: response.status, headers });
+}
+//# sourceMappingURL=http.js.map

package/dist/api/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/api/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,IAAa,EACb,OAAqD;IACnD,SAAS,EAAE,UAAU,EAAE;CACxB;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,QAAgB;IAKhB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,wCAAwC;SAClD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACrD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mBAAmB,QAAQ,SAAS;aAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,mBAAmB,QAAQ,SAAS;SAC9C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iCAAiC;SAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,QAAkB,EAClB,OAAgB,EAChB,cAAiC;IAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CACT,8BAA8B,EAC9B,oEAAoE,CACrE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IAClE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/auth/access.d.ts

@@ -0,0 +1,21 @@
+import * as jose from "jose";
+import type { Authenticator } from "./types.js";
+export interface CloudflareAccessOptions {
+    /** Access team domain host, e.g. `myteam.cloudflareaccess.com`. */
+    readonly teamDomain: string;
+    /** Expected JWT audience (AUD tag from the Access application). */
+    readonly audience: string;
+    /** Optional allow-list of subjects and/or emails. Empty means any valid Access identity. */
+    readonly allowedSubjects?: readonly string[];
+    readonly allowedEmails?: readonly string[];
+    /**
+     * Injected JWKS loader for tests. Production uses the Access certs URL.
+     * Never log tokens.
+     */
+    readonly getKey?: jose.JWTVerifyGetKey;
+}
+/**
+ * Cloudflare Access JWT authenticator. Fails closed when verification cannot complete.
+ */
+export declare function createCloudflareAccessAuthenticator(options: CloudflareAccessOptions): Authenticator;
+//# sourceMappingURL=access.d.ts.map

package/dist/auth/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/auth/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAGV,aAAa,EAEd,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,uBAAuB;IACtC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC;CACxC;AAoBD;;GAEG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,uBAAuB,GAC/B,aAAa,CAqDf"}

package/dist/auth/access.js

@@ -0,0 +1,131 @@
+import * as jose from "jose";
+function extractBearerOrAccessJwt(request) {
+    const accessHeader = request.headers.get("Cf-Access-Jwt-Assertion");
+    if (accessHeader !== null && accessHeader.trim() !== "") {
+        return accessHeader.trim();
+    }
+    const authorization = request.headers.get("Authorization");
+    if (authorization === null) {
+        return null;
+    }
+    const match = /^Bearer\s+(\S+)/i.exec(authorization);
+    return match?.[1] ?? null;
+}
+function issuerFor(teamDomain) {
+    const host = teamDomain.replace(/^https?:\/\//, "").replace(/\/+$/, "");
+    return `https://${host}`;
+}
+/**
+ * Cloudflare Access JWT authenticator. Fails closed when verification cannot complete.
+ */
+export function createCloudflareAccessAuthenticator(options) {
+    const issuer = issuerFor(options.teamDomain);
+    const jwksUrl = new URL(`${issuer}/cdn-cgi/access/certs`);
+    const getKey = options.getKey ?? jose.createRemoteJWKSet(jwksUrl);
+    return {
+        async authenticate(request) {
+            const token = extractBearerOrAccessJwt(request);
+            if (token === null) {
+                return failure("MISSING_CREDENTIAL", "Missing Access JWT credential.");
+            }
+            let payload;
+            try {
+                const verified = await jose.jwtVerify(token, getKey, {
+                    issuer,
+                    audience: options.audience,
+                    clockTolerance: 5,
+                });
+                payload = verified.payload;
+            }
+            catch (error) {
+                return mapJoseError(error);
+            }
+            const subject = payload.sub;
+            if (typeof subject !== "string" || subject.trim() === "") {
+                return failure("MALFORMED_CREDENTIAL", "Access token is missing a subject claim.");
+            }
+            const emailClaim = payload.email ?? payload.preferred_username;
+            const email = typeof emailClaim === "string" ? emailClaim.toLowerCase() : undefined;
+            const identity = {
+                subject,
+                issuer,
+                audience: options.audience,
+                ...(email !== undefined ? { email } : {}),
+            };
+            if (!identityAllowed(identity, options)) {
+                return failure("IDENTITY_NOT_ALLOWED", "Authenticated identity is not permitted by installation policy.");
+            }
+            return { ok: true, identity };
+        },
+    };
+}
+function identityAllowed(identity, options) {
+    const subjects = options.allowedSubjects ?? [];
+    const emails = options.allowedEmails ?? [];
+    if (subjects.length === 0 && emails.length === 0) {
+        return true;
+    }
+    if (subjects.includes(identity.subject)) {
+        return true;
+    }
+    if (identity.email !== undefined &&
+        emails.map((value) => value.toLowerCase()).includes(identity.email)) {
+        return true;
+    }
+    return false;
+}
+function mapJoseError(error) {
+    const code = typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        typeof error.code === "string"
+        ? error.code
+        : "";
+    const message = error instanceof Error ? error.message : "Token verification failed.";
+    const claim = typeof error === "object" &&
+        error !== null &&
+        "claim" in error &&
+        typeof error.claim === "string"
+        ? error.claim
+        : "";
+    if (code === "ERR_JWKS_TIMEOUT" ||
+        code === "ERR_JWKS_INVALID" ||
+        code === "ERR_JOSE_GENERIC" ||
+        /JWKS|fetch|network|ENOTFOUND|ECONN|keyset/i.test(message)) {
+        return failure("KEY_UNAVAILABLE", "Unable to retrieve Access verification keys.");
+    }
+    if (code === "ERR_JWT_EXPIRED" || claim === "exp") {
+        return failure("EXPIRED", "Access token has expired.");
+    }
+    if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" &&
+        (claim === "aud" || /audience|"aud"/i.test(message))) {
+        return failure("INVALID_AUDIENCE", "Access token audience is invalid.");
+    }
+    if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" &&
+        (claim === "iss" || /issuer|"iss"/i.test(message))) {
+        return failure("INVALID_ISSUER", "Access token issuer is invalid.");
+    }
+    if (code === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") {
+        return failure("INVALID_SIGNATURE", "Access token signature is invalid.");
+    }
+    if (code === "ERR_JWS_INVALID" ||
+        code === "ERR_JWT_INVALID" ||
+        code === "ERR_JWKS_NO_MATCHING_KEY") {
+        return failure("MALFORMED_CREDENTIAL", "Access token could not be verified.");
+    }
+    // Claim validation without a mapped claim, or unknown JOSE failures.
+    if (/audience|"aud"/i.test(message)) {
+        return failure("INVALID_AUDIENCE", "Access token audience is invalid.");
+    }
+    if (/issuer|"iss"/i.test(message)) {
+        return failure("INVALID_ISSUER", "Access token issuer is invalid.");
+    }
+    if (/signature/i.test(message)) {
+        return failure("INVALID_SIGNATURE", "Access token signature is invalid.");
+    }
+    return failure("MALFORMED_CREDENTIAL", "Access token could not be verified.");
+}
+function failure(code, message) {
+    return { ok: false, status: 401, code, message };
+}
+//# sourceMappingURL=access.js.map

package/dist/auth/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/auth/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAuB7B,SAAS,wBAAwB,CAAC,OAAgB;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACpE,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,WAAW,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC,CACjD,OAAgC;IAEhC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,uBAAuB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAElE,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,OAAO,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;oBACnD,MAAM;oBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,cAAc,EAAE,CAAC;iBAClB,CAAC,CAAC;gBACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACzD,OAAO,OAAO,CACZ,sBAAsB,EACtB,0CAA0C,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,kBAAkB,CAAC;YAC/D,MAAM,KAAK,GACT,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAExE,MAAM,QAAQ,GAAa;gBACzB,OAAO;gBACP,MAAM;gBACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;YAEF,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBACxC,OAAO,OAAO,CACZ,sBAAsB,EACtB,iEAAiE,CAClE,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAAkB,EAClB,OAAgC;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,KAAK,SAAS;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,OAAQ,KAA2B,CAAC,IAAI,KAAK,QAAQ;QACnD,CAAC,CAAE,KAA0B,CAAC,IAAI;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;IACxE,MAAM,KAAK,GACT,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,IAAI,KAAK;QAChB,OAAQ,KAA4B,CAAC,KAAK,KAAK,QAAQ;QACrD,CAAC,CAAE,KAA2B,CAAC,KAAK;QACpC,CAAC,CAAC,EAAE,CAAC;IAET,IACE,IAAI,KAAK,kBAAkB;QAC3B,IAAI,KAAK,kBAAkB;QAC3B,IAAI,KAAK,kBAAkB;QAC3B,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAC1D,CAAC;QACD,OAAO,OAAO,CACZ,iBAAiB,EACjB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,iBAAiB,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACzD,CAAC;IACD,IACE,IAAI,KAAK,iCAAiC;QAC1C,CAAC,KAAK,KAAK,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACpD,CAAC;QACD,OAAO,OAAO,CAAC,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,IAAI,KAAK,iCAAiC;QAC1C,CAAC,KAAK,KAAK,KAAK,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAI,KAAK,uCAAuC,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,IAAI,KAAK,iBAAiB;QAC1B,IAAI,KAAK,iBAAiB;QAC1B,IAAI,KAAK,0BAA0B,EACnC,CAAC;QACD,OAAO,OAAO,CACZ,sBAAsB,EACtB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC,sBAAsB,EAAE,qCAAqC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,OAAO,CACd,IAA+B,EAC/B,OAAe;IAEf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,23 @@
+export interface Identity {
+    /** Stable subject from the identity provider (e.g. Access `sub`). */
+    readonly subject: string;
+    readonly email?: string;
+    readonly issuer: string;
+    readonly audience?: string;
+}
+export type AuthenticationFailureCode = "MISSING_CREDENTIAL" | "MALFORMED_CREDENTIAL" | "INVALID_SIGNATURE" | "INVALID_ISSUER" | "INVALID_AUDIENCE" | "EXPIRED" | "KEY_UNAVAILABLE" | "IDENTITY_NOT_ALLOWED";
+export interface AuthenticationSuccess {
+    readonly ok: true;
+    readonly identity: Identity;
+}
+export interface AuthenticationFailure {
+    readonly ok: false;
+    readonly status: 401;
+    readonly code: AuthenticationFailureCode;
+    readonly message: string;
+}
+export type AuthenticationResult = AuthenticationSuccess | AuthenticationFailure;
+export interface Authenticator {
+    authenticate(request: Request): Promise<AuthenticationResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,gBAAgB,GAChB,kBAAkB,GAClB,SAAS,GACT,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,qBAAqB,CAAC;AAE1B,MAAM,WAAW,aAAa;IAC5B,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC/D"}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/authz/sites.d.ts

@@ -0,0 +1,41 @@
+import type { Identity } from "../auth/types.js";
+export type SitePermission = "read" | "publish" | "status" | "rollback" | "validate";
+export interface SiteBinding {
+    /**
+     * Server-owned publishing destination. Never taken from the client body.
+     * Opaque to HTTP clients — used only when constructing publishers.
+     */
+    readonly destinationRef: string;
+    readonly permissions: readonly SitePermission[];
+    readonly allowedSubjects?: readonly string[];
+    readonly allowedEmails?: readonly string[];
+}
+export interface SiteAuthorizationConfig {
+    readonly sites: Readonly<Record<string, SiteBinding>>;
+}
+export interface AuthorizationSuccess {
+    readonly ok: true;
+    readonly siteId: string;
+    readonly binding: SiteBinding;
+}
+export interface AuthorizationFailure {
+    readonly ok: false;
+    readonly status: 403 | 404;
+    readonly code: "FORBIDDEN" | "SITE_NOT_FOUND";
+    readonly message: string;
+}
+export type AuthorizationResult = AuthorizationSuccess | AuthorizationFailure;
+export interface AccessibleSiteSummary {
+    readonly siteId: string;
+    readonly permissions: readonly SitePermission[];
+}
+export interface SiteAuthorizer {
+    authorize(identity: Identity, siteId: string, permission: SitePermission): AuthorizationResult;
+    /** Sites this identity may access (any grant), without destination secrets. */
+    listAccessibleSites(identity: Identity): readonly AccessibleSiteSummary[];
+}
+/**
+ * Default-deny site authorizer. Identity must match site grants and permissions.
+ */
+export declare function createSiteAuthorizer(config: SiteAuthorizationConfig): SiteAuthorizer;
+//# sourceMappingURL=sites.d.ts.map

package/dist/authz/sites.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sites.d.ts","sourceRoot":"","sources":["../../src/authz/sites.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,MAAM,cAAc,GACtB,MAAM,GACN,SAAS,GACT,QAAQ,GACR,UAAU,GACV,UAAU,CAAC;AAEf,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAC;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,gBAAgB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,oBAAoB,CAAC;AAE9E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CACP,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,cAAc,GACzB,mBAAmB,CAAC;IACvB,+EAA+E;IAC/E,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,qBAAqB,EAAE,CAAC;CAC3E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,uBAAuB,GAC9B,cAAc,CA4ChB"}

package/dist/authz/sites.js

@@ -0,0 +1,60 @@
+/**
+ * Default-deny site authorizer. Identity must match site grants and permissions.
+ */
+export function createSiteAuthorizer(config) {
+    return {
+        authorize(identity, siteId, permission) {
+            const binding = config.sites[siteId];
+            if (binding === undefined) {
+                return {
+                    ok: false,
+                    status: 404,
+                    code: "SITE_NOT_FOUND",
+                    message: "Site not found.",
+                };
+            }
+            if (!identityMatches(identity, binding)) {
+                return {
+                    ok: false,
+                    status: 403,
+                    code: "FORBIDDEN",
+                    message: "Not authorised for this site.",
+                };
+            }
+            if (!binding.permissions.includes(permission)) {
+                return {
+                    ok: false,
+                    status: 403,
+                    code: "FORBIDDEN",
+                    message: "Permission denied for this operation.",
+                };
+            }
+            return { ok: true, siteId, binding };
+        },
+        listAccessibleSites(identity) {
+            const sites = [];
+            for (const [siteId, binding] of Object.entries(config.sites)) {
+                if (identityMatches(identity, binding)) {
+                    sites.push({ siteId, permissions: binding.permissions });
+                }
+            }
+            return sites.sort((a, b) => a.siteId.localeCompare(b.siteId));
+        },
+    };
+}
+function identityMatches(identity, binding) {
+    const subjects = binding.allowedSubjects ?? [];
+    const emails = binding.allowedEmails ?? [];
+    if (subjects.length === 0 && emails.length === 0) {
+        return false;
+    }
+    if (subjects.includes(identity.subject)) {
+        return true;
+    }
+    if (identity.email !== undefined &&
+        emails.map((value) => value.toLowerCase()).includes(identity.email)) {
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=sites.js.map

package/dist/authz/sites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sites.js","sourceRoot":"","sources":["../../src/authz/sites.ts"],"names":[],"mappings":"AAsDA;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA+B;IAE/B,OAAO;QACL,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU;YACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,iBAAiB;iBAC3B,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBACxC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,+BAA+B;iBACzC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,uCAAuC;iBACjD,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACvC,CAAC;QAED,mBAAmB,CAAC,QAAQ;YAC1B,MAAM,KAAK,GAA4B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,IAAI,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;oBACvC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAkB,EAAE,OAAoB;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,QAAQ,CAAC,KAAK,KAAK,SAAS;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @contentrail/cloudflare — server-only Worker publishing API.
+ * Do not import from browser bundles. Secrets stay in Worker bindings.
+ */
+export { createCloudflareAccessAuthenticator, type CloudflareAccessOptions, } from "./auth/access.js";
+export type { AuthenticationFailure, AuthenticationFailureCode, AuthenticationResult, AuthenticationSuccess, Authenticator, Identity, } from "./auth/types.js";
+export { createSiteAuthorizer, type AccessibleSiteSummary, type AuthorizationFailure, type AuthorizationResult, type AuthorizationSuccess, type SiteAuthorizer, type SiteAuthorizationConfig, type SiteBinding, type SitePermission, } from "./authz/sites.js";
+export { createPublishFetchHandler, type PublishApiOptions, } from "./api/handler.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,mCAAmC,EACnC,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+/**
+ * @contentrail/cloudflare — server-only Worker publishing API.
+ * Do not import from browser bundles. Secrets stay in Worker bindings.
+ */
+export { createCloudflareAccessAuthenticator, } from "./auth/access.js";
+export { createSiteAuthorizer, } from "./authz/sites.js";
+export { createPublishFetchHandler, } from "./api/handler.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,mCAAmC,GAEpC,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,oBAAoB,GASrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC"}

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@contentrail/cloudflare",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "private": false,
+  "type": "module",
+  "description": "Server-only Cloudflare Worker publishing API with Access auth and site authorization.",
+  "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "node": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "jose": "^6.2.14",
+    "@contentrail/core": "0.2.0",
+    "@contentrail/publisher": "0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "typescript": "5.9.3",
+    "zod": "4.6.7"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Hridhin-k/contentrail.git",
+    "directory": "packages/cloudflare"
+  },
+  "bugs": {
+    "url": "https://github.com/Hridhin-k/contentrail/issues"
+  },
+  "homepage": "https://github.com/Hridhin-k/contentrail#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "pnpm run build && tsc -p tsconfig.test.json && node --test test-dist/**/*.test.js"
+  }
 }