@jungjaehoon/mama-os 0.53.0 → 0.57.0

package/dist/agent/claude-native-tool-policy.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Owner decision 2026-09-26: the Claude owner runtime writes only inside its workspace and has
+ * web access. The rules go on the CLI (--allowedTools): measured with Claude Code 2.1.282, project
+ * settings permissions were not applied to non-interactive runs while their sandbox was. An Edit
+ * path rule also governs Write and NotebookEdit; "//" anchors it at an absolute path. Under dontAsk
+ * an unmatched call is denied. Bash is confined by the sandbox in the workspace project settings.
+ */
+export declare function claudeOwnerAllowedTools(workspaceDir: string): string[];
+/** CLI deny rules also govern native children; project permission rules are ignored in -p. */
+export declare function claudeOwnerDisallowedTools(paths: readonly string[], workspaceDir: string): string[];
+export interface ClaudeToolRole {
+    allowedTools?: readonly string[];
+    blockedTools?: readonly string[];
+}
+/** Project the turn's native builtin grant onto Claude's --tools value. */
+export declare function projectClaudeNativeTools(role: ClaudeToolRole | undefined): string | undefined;
+//# sourceMappingURL=claude-native-tool-policy.d.ts.map

package/dist/agent/claude-native-tool-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-native-tool-policy.d.ts","sourceRoot":"","sources":["../../src/agent/claude-native-tool-policy.ts"],"names":[],"mappings":"AA+BA;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAYtE;AAED,8FAA8F;AAC9F,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,YAAY,EAAE,MAAM,GACnB,MAAM,EAAE,CAQV;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AASD,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAe7F"}

package/dist/agent/claude-native-tool-policy.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeOwnerAllowedTools = claudeOwnerAllowedTools;
+exports.claudeOwnerDisallowedTools = claudeOwnerDisallowedTools;
+exports.projectClaudeNativeTools = projectClaudeNativeTools;
+/**
+ * Role tool names that resolve to Claude CLI builtin tools. Catalog/MCP actions
+ * are granted through a different surface; this map covers only the CLI's own
+ * builtins.
+ */
+const CLAUDE_NATIVE_TOOL_MAP = {
+    native_subagent: 'Agent',
+    Read: 'Read',
+    Write: 'Write',
+    Edit: 'Edit',
+    NotebookEdit: 'NotebookEdit',
+    Bash: 'Bash',
+    Glob: 'Glob',
+    Grep: 'Grep',
+    WebFetch: 'WebFetch',
+    WebSearch: 'WebSearch',
+};
+const CLAUDE_BUILTIN_TOOLS = [
+    'Agent',
+    'Read',
+    'Write',
+    'Edit',
+    'NotebookEdit',
+    'Bash',
+    'Glob',
+    'Grep',
+    'WebFetch',
+    'WebSearch',
+];
+/**
+ * Owner decision 2026-09-26: the Claude owner runtime writes only inside its workspace and has
+ * web access. The rules go on the CLI (--allowedTools): measured with Claude Code 2.1.282, project
+ * settings permissions were not applied to non-interactive runs while their sandbox was. An Edit
+ * path rule also governs Write and NotebookEdit; "//" anchors it at an absolute path. Under dontAsk
+ * an unmatched call is denied. Bash is confined by the sandbox in the workspace project settings.
+ */
+function claudeOwnerAllowedTools(workspaceDir) {
+    return [
+        'Read',
+        'Glob',
+        'Grep',
+        `Edit(/${workspaceDir}/**)`,
+        'Bash',
+        'WebFetch',
+        'WebSearch',
+        'mcp__mama__*',
+        'Agent',
+    ];
+}
+/** CLI deny rules also govern native children; project permission rules are ignored in -p. */
+function claudeOwnerDisallowedTools(paths, workspaceDir) {
+    return [
+        ...paths.flatMap((path) => [`Read(/${path})`, `Read(/${path}/**)`]),
+        ...['Edit', 'Write', 'NotebookEdit'].flatMap((tool) => [
+            `${tool}(/${workspaceDir}/.claude)`,
+            `${tool}(/${workspaceDir}/.claude/**)`,
+        ]),
+    ];
+}
+function isBlocked(cliName, blocked) {
+    if (blocked.has(cliName))
+        return true;
+    return Object.entries(CLAUDE_NATIVE_TOOL_MAP).some(([roleName, mapped]) => mapped === cliName && blocked.has(roleName));
+}
+/** Project the turn's native builtin grant onto Claude's --tools value. */
+function projectClaudeNativeTools(role) {
+    const allowed = role?.allowedTools ?? [];
+    const blocked = new Set(role?.blockedTools ?? []);
+    if (blocked.has('*'))
+        return '';
+    if (allowed.includes('*')) {
+        const granted = CLAUDE_BUILTIN_TOOLS.filter((tool) => !isBlocked(tool, blocked));
+        return granted.join(',');
+    }
+    const granted = new Set();
+    for (const [roleName, cliName] of Object.entries(CLAUDE_NATIVE_TOOL_MAP)) {
+        if (allowed.includes(roleName) && !blocked.has(roleName) && !blocked.has(cliName)) {
+            granted.add(cliName);
+        }
+    }
+    return [...granted].join(',');
+}
+//# sourceMappingURL=claude-native-tool-policy.js.map

package/dist/agent/claude-native-tool-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-native-tool-policy.js","sourceRoot":"","sources":["../../src/agent/claude-native-tool-policy.ts"],"names":[],"mappings":";;AAsCA,0DAYC;AAGD,gEAWC;AAeD,4DAeC;AA9FD;;;;GAIG;AACH,MAAM,sBAAsB,GAAqC;IAC/D,eAAe,EAAE,OAAO;IACxB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF,MAAM,oBAAoB,GAAsB;IAC9C,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,cAAc;IACd,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,WAAW;CACZ,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,YAAoB;IAC1D,OAAO;QACL,MAAM;QACN,MAAM;QACN,MAAM;QACN,SAAS,YAAY,MAAM;QAC3B,MAAM;QACN,UAAU;QACV,WAAW;QACX,cAAc;QACd,OAAO;KACR,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,SAAgB,0BAA0B,CACxC,KAAwB,EACxB,YAAoB;IAEpB,OAAO;QACL,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC;QACnE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,GAAG,IAAI,KAAK,YAAY,WAAW;YACnC,GAAG,IAAI,KAAK,YAAY,cAAc;SACvC,CAAC;KACH,CAAC;AACJ,CAAC;AAOD,SAAS,SAAS,CAAC,OAAe,EAAE,OAA4B;IAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAChD,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,wBAAwB,CAAC,IAAgC;IACvE,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC"}

package/dist/api/attachment-actions.d.ts

@@ -0,0 +1,16 @@
+import type { ActionRegistration } from '@jungjaehoon/mama-core';
+import type { ConnectorRegistry } from '../connectors/framework/connector-registry.js';
+import type { StoredSourceReader } from './stored-source-reader.js';
+import { type OwnerFileSender } from './file-delivery.js';
+export interface AttachmentActionPorts {
+    stored?: StoredSourceReader | null;
+    connectors?: () => ConnectorRegistry | null;
+    workspaceDir?: string;
+    downloadsDir?: string;
+    telegram?: () => OwnerFileSender | null;
+    discord?: () => OwnerFileSender | null;
+    slack?: () => OwnerFileSender | null;
+}
+export declare function safeFileName(name: string): string;
+export declare function createAttachmentActionRegistrations(ports?: AttachmentActionPorts): ActionRegistration[];
+//# sourceMappingURL=attachment-actions.d.ts.map

package/dist/api/attachment-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-actions.d.ts","sourceRoot":"","sources":["../../src/api/attachment-actions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,kBAAkB,EAGnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAQvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAC;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;CACtC;AAiKD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYjD;AAyBD,wBAAgB,mCAAmC,CACjD,KAAK,GAAE,qBAA0B,GAChC,kBAAkB,EAAE,CA2GtB"}

package/dist/api/attachment-actions.js

@@ -0,0 +1,278 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeFileName = safeFileName;
+exports.createAttachmentActionRegistrations = createAttachmentActionRegistrations;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const attachments_js_1 = require("../connectors/framework/attachments.js");
+const index_js_1 = require("../connectors/chatwork/index.js");
+const index_js_2 = require("../connectors/slack/index.js");
+const file_delivery_js_1 = require("./file-delivery.js");
+const attachmentRefSchema = {
+    type: 'object',
+    required: ['observationRef'],
+    additionalProperties: false,
+    properties: {
+        observationRef: {
+            type: 'string',
+            pattern: '\\S',
+            description: 'Exact stored observation handle returned by source.search, e.g. "obs_test".',
+        },
+    },
+};
+const attachmentDownloadSchema = {
+    type: 'object',
+    required: ['observationRef', 'fileId'],
+    additionalProperties: false,
+    properties: {
+        observationRef: {
+            type: 'string',
+            pattern: '\\S',
+            description: 'Exact stored observation handle carrying the message attachment.',
+        },
+        fileId: {
+            type: 'string',
+            pattern: '\\S',
+            description: 'Provider file id returned by source.attachment.list.',
+        },
+    },
+};
+const ownerFileSchema = {
+    type: 'object',
+    required: ['path'],
+    additionalProperties: false,
+    properties: {
+        path: {
+            type: 'string',
+            pattern: '\\S',
+            description: 'Absolute path under the workspace files directory.',
+        },
+        caption: {
+            type: 'string',
+            maxLength: 1_024,
+            description: 'Optional file caption.',
+        },
+    },
+};
+function requiredStoredReader(ports) {
+    if (!ports.stored) {
+        const error = new Error('Stored source reader is not configured for attachment actions');
+        error.name = 'attachment_source_unavailable';
+        throw error;
+    }
+    return ports.stored;
+}
+function sourceAllowance(context) {
+    return context.readAllowance?.maxSourceMs === undefined
+        ? undefined
+        : { maxSourceMs: context.readAllowance.maxSourceMs };
+}
+async function readObservation(ports, input, context) {
+    const observationRef = input.observationRef;
+    if (typeof observationRef !== 'string' || observationRef.trim() === '') {
+        throw new Error('attachment action requires observationRef');
+    }
+    const result = await requiredStoredReader(ports).readObservation(observationRef, context.access, sourceAllowance(context));
+    if (!result || typeof result !== 'object' || Array.isArray(result)) {
+        throw new Error(`Stored observation ${observationRef} is malformed`);
+    }
+    const observation = result;
+    if (typeof observation.source !== 'string' || observation.source.trim() === '') {
+        throw new Error(`Stored observation ${observationRef} has no connector source`);
+    }
+    return observation;
+}
+function providerFor(ports, source) {
+    if (source !== 'chatwork' && source !== 'slack') {
+        throw new Error(`Connector ${source} does not support source attachments`);
+    }
+    const registry = ports.connectors?.();
+    if (!registry)
+        throw new Error(`Connector registry is not available for ${source} attachments`);
+    const connector = registry.get(source);
+    if (!connector)
+        throw new Error(`Connector ${source} is not active for attachments`);
+    return (0, attachments_js_1.attachmentConnector)(connector);
+}
+function record(metadata, key) {
+    const value = metadata?.[key];
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .map((item) => (typeof item === 'string' || typeof item === 'number' ? String(item) : ''))
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function roomIdFor(observation) {
+    const metadata = observation.metadata ?? {};
+    const direct = metadata.roomId ?? metadata.chatworkRoomId ?? metadata.channelId;
+    if (typeof direct === 'string' && direct.trim() !== '')
+        return direct.trim();
+    if (typeof direct === 'number' && Number.isSafeInteger(direct))
+        return String(direct);
+    const originalChannel = metadata.originalChannel;
+    if (typeof originalChannel === 'string') {
+        if (observation.source === 'chatwork' && /^\d+$/.test(originalChannel.trim())) {
+            return originalChannel.trim();
+        }
+        const separator = originalChannel.indexOf(':');
+        if (separator > 0 && originalChannel.slice(0, separator) === observation.source) {
+            const suffix = originalChannel.slice(separator + 1).trim();
+            if (suffix !== '')
+                return suffix;
+        }
+    }
+    throw new Error(`Observation ${observation.observationRef} has no ${observation.source} room id`);
+}
+function idsFor(observation) {
+    const metadata = observation.metadata;
+    if (observation.source === 'chatwork') {
+        const ids = record(metadata, 'chatworkFileIds');
+        if (ids.length > 0)
+            return { ids, fileIdRule: 'metadata_file_id' };
+        const contentIds = (0, index_js_1.extractChatworkFileIds)(observation.content ?? '');
+        return { ids: contentIds, fileIdRule: contentIds.length > 0 ? 'text_marker' : undefined };
+    }
+    const ids = record(metadata, 'slackFileIds');
+    if (ids.length > 0)
+        return { ids, fileIdRule: 'metadata_file_id' };
+    const contentIds = (0, index_js_2.extractSlackFileIds)(observation.content ?? '');
+    return { ids: contentIds, fileIdRule: contentIds.length > 0 ? 'text_marker' : undefined };
+}
+function safeFileName(name) {
+    // Keep the provider's name readable (the owner receives this file); drop only what could
+    // leave the directory or break a path.
+    const safe = [...name]
+        .map((char) => char === '/' || char === '\\' || char < ' ' || (char >= '\u007f' && char <= '\u009f')
+        ? '_'
+        : char)
+        .join('');
+    if (safe === '' || safe === '.' || safe === '..')
+        throw new Error('Attachment filename is empty');
+    return safe;
+}
+function attachmentRequest(observation) {
+    const { ids, fileIdRule } = idsFor(observation);
+    return {
+        roomId: roomIdFor(observation),
+        sourceAtMs: observation.sourceAt ?? null,
+        ...(observation.metadata?.accountId === undefined
+            ? {}
+            : { accountId: String(observation.metadata.accountId) }),
+        ...(typeof observation.author === 'string' ? { author: observation.author } : {}),
+        ...(observation.metadata?.messageId === undefined
+            ? {}
+            : { messageId: String(observation.metadata.messageId) }),
+        ...(ids.length === 0 ? {} : { fileIds: ids }),
+        ...(fileIdRule === undefined ? {} : { fileIdRule }),
+    };
+}
+function workspaceFilesRoot(ports) {
+    if (!ports.workspaceDir?.trim())
+        throw new Error('Attachment workspace directory is not configured');
+    return (0, node_path_1.join)(ports.workspaceDir, 'files');
+}
+function createAttachmentActionRegistrations(ports = {}) {
+    return [
+        {
+            contract: {
+                name: 'source.attachment.list',
+                summary: 'List files attached to one preserved Chatwork or Slack observation, including the matching rule, provider file id, name, size, and upload time.',
+                inputSchema: attachmentRefSchema,
+                examples: [{ title: 'List message attachments', input: { observationRef: 'obs_test' } }],
+            },
+            exec: async (input, context) => {
+                const observation = await readObservation(ports, input, context);
+                const provider = providerFor(ports, observation.source);
+                const files = await provider.listAttachments(attachmentRequest(observation));
+                return {
+                    observationRef: observation.observationRef,
+                    connector: observation.source,
+                    files,
+                };
+            },
+        },
+        {
+            contract: {
+                name: 'source.attachment.download',
+                summary: 'Download a file belonging to the cited Chatwork or Slack observation into the daemon downloads directory (read-only for the agent) and return its saved path and size.',
+                inputSchema: attachmentDownloadSchema,
+                examples: [
+                    {
+                        title: 'Fetch one listed attachment',
+                        input: { observationRef: 'obs_test', fileId: 'file_test' },
+                    },
+                ],
+            },
+            exec: async (input, context) => {
+                const values = input;
+                const fileId = values.fileId;
+                if (typeof fileId !== 'string' || fileId.trim() === '')
+                    throw new Error('fileId is required');
+                const observation = await readObservation(ports, values, context);
+                const roomId = roomIdFor(observation);
+                const provider = providerFor(ports, observation.source);
+                const request = attachmentRequest(observation);
+                const unrelated = request.fileIds !== undefined && !request.fileIds.includes(fileId);
+                const listed = unrelated
+                    ? []
+                    : await provider.listAttachments({
+                        ...request,
+                        ...(request.fileIds === undefined ? {} : { fileIds: [fileId] }),
+                    });
+                const descriptor = listed.find((file) => file.fileId === fileId);
+                if (!descriptor) {
+                    throw new Error(`File ${fileId} does not belong to observation ${observation.observationRef} room ${roomId}`);
+                }
+                if (!ports.downloadsDir?.trim())
+                    throw new Error('Attachment downloads directory is not configured');
+                const targetDir = (0, node_path_1.join)(ports.downloadsDir, observation.source, safeFileName(roomId));
+                (0, node_fs_1.mkdirSync)(targetDir, { recursive: true, mode: 0o700 });
+                const targetPath = (0, node_path_1.join)(targetDir, `${safeFileName(fileId)}_${safeFileName(descriptor.name)}`);
+                const downloaded = await provider.downloadAttachment({
+                    roomId,
+                    fileId,
+                    targetPath,
+                });
+                const size = (0, node_fs_1.statSync)(targetPath).size;
+                if (size !== downloaded.size) {
+                    throw new Error(`Downloaded file ${fileId} size changed while saving`);
+                }
+                return {
+                    observationRef: observation.observationRef,
+                    connector: observation.source,
+                    fileId,
+                    path: targetPath,
+                    size,
+                };
+            },
+        },
+        ...['telegram', 'discord', 'slack'].map((messenger) => ({
+            contract: {
+                name: `deliver.${messenger}.file`,
+                summary: `Send one regular file under the owner workspace files directory through ${messenger}; images and documents use the messenger upload API.`,
+                inputSchema: ownerFileSchema,
+                examples: [
+                    { title: 'Send a workspace result', input: { path: '/workspace/files/result.xlsx' } },
+                ],
+            },
+            exec: async (input, context) => {
+                const values = input;
+                const path = values.path;
+                if (typeof path !== 'string' || path.trim() === '')
+                    throw new Error('path is required');
+                if (typeof context.operationId !== 'string' || context.operationId.trim() === '') {
+                    throw new Error(`deliver.${messenger}.file requires an operation id`);
+                }
+                const sender = ports[messenger]?.();
+                if (!sender)
+                    throw new Error(`${messenger} file delivery port is not configured`);
+                const validated = (0, file_delivery_js_1.validateWorkspaceFile)(workspaceFilesRoot(ports), path);
+                const caption = values.caption === undefined ? undefined : String(values.caption);
+                const result = await sender.sendFile(validated.path, caption, context.operationId);
+                return { path: validated.path, ...result };
+            },
+        })),
+    ];
+}
+//# sourceMappingURL=attachment-actions.js.map

package/dist/api/attachment-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-actions.js","sourceRoot":"","sources":["../../src/api/attachment-actions.ts"],"names":[],"mappings":";;AA4LA,oCAYC;AAyBD,kFA6GC;AA9UD,qCAA8C;AAC9C,yCAAiC;AAQjC,2EAIgD;AAChD,8DAAyE;AACzE,2DAAmE;AAEnE,yDAAiF;AAYjF,MAAM,mBAAmB,GAAuB;IAC9C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,CAAC;IAC5B,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,6EAA6E;SAC3F;KACF;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAuB;IACnD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC;IACtC,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,kEAAkE;SAChF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,MAAM,eAAe,GAAuB;IAC1C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,oDAAoD;SAClE;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,wBAAwB;SACtC;KACF;CACF,CAAC;AAYF,SAAS,oBAAoB,CAAC,KAA4B;IACxD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC7C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB;IAEtB,OAAO,OAAO,CAAC,aAAa,EAAE,WAAW,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA4B,EAC5B,KAA8B,EAC9B,OAAsB;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,eAAe,CAC9D,cAAc,EACd,OAAO,CAAC,MAAM,EACd,eAAe,CAAC,OAAO,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAG,MAAgD,CAAC;IACrE,IAAI,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,0BAA0B,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAClB,KAA4B,EAC5B,MAAc;IAEd,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,sCAAsC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,cAAc,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,gCAAgC,CAAC,CAAC;IACrF,OAAO,IAAA,oCAAmB,EAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,QAA6C,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,WAAwC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACjD,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9E,OAAO,eAAe,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,CAAC,cAAc,WAAW,WAAW,CAAC,MAAM,UAAU,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,WAAwC;IAItD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,IAAA,iCAAsB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,IAAA,8BAAmB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC5F,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY;IACvC,yFAAyF;IACzF,uCAAuC;IACvC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC;QACnF,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,CACT;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAwC;IACjE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC;QAC9B,UAAU,EAAE,WAAW,CAAC,QAAQ,IAAI,IAAI;QACxC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,IAAA,gBAAI,EAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,mCAAmC,CACjD,QAA+B,EAAE;IAEjC,OAAO;QACL;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,iJAAiJ;gBACnJ,WAAW,EAAE,mBAAmB;gBAChC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,CAAC;aACzF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAgC,EAAE,OAAO,CAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC7E,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,KAAK;iBACN,CAAC;YACJ,CAAC;SACF;QACD;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,wKAAwK;gBAC1K,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE;oBACR;wBACE,KAAK,EAAE,6BAA6B;wBACpC,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE;qBAC3D;iBACF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,SAAS;oBACtB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC;wBAC7B,GAAG,OAAO;wBACV,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;qBAChE,CAAC,CAAC;gBACP,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,QAAQ,MAAM,mCAAmC,WAAW,CAAC,cAAc,SAAS,MAAM,EAAE,CAC7F,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;oBAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrF,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,MAAM,UAAU,GAAG,IAAA,gBAAI,EACrB,SAAS,EACT,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;oBACnD,MAAM;oBACN,MAAM;oBACN,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBACvC,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,4BAA4B,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,MAAM;oBACN,IAAI,EAAE,UAAU;oBAChB,IAAI;iBACL,CAAC;YACJ,CAAC;SACF;QACD,GAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACjE,QAAQ,EAAE;gBACR,IAAI,EAAE,WAAW,SAAS,OAAO;gBACjC,OAAO,EAAE,2EAA2E,SAAS,sDAAsD;gBACnJ,WAAW,EAAE,eAAe;gBAC5B,QAAQ,EAAE;oBACR,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,EAAE;iBACtF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,OAAsB,EAAE,EAAE;gBACrD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACxF,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjF,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,gCAAgC,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,uCAAuC,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,IAAA,wCAAqB,EAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACnF,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/api/auth-middleware.d.ts

@@ -1,59 +1,19 @@
-/**
- * Shared authentication middleware for MAMA API routes.
- *
- * Extracted from graph-api.ts to allow reuse across all API endpoints.
- * Uses timing-safe comparison and supports localhost bypass when no token is configured.
- */
-import type { IncomingMessage } from 'http';
-import type { Request, Response, NextFunction } from 'express';
-interface AuthOptions {
-    allowQueryToken?: boolean;
-}
-interface SecurityLogContext {
-    clientAddress: string;
-    remoteAddress: string | null;
-    forwardedFor: string | null;
-    cfConnectingIp: string | null;
-    cfRay: string | null;
-    method: string | null;
-    path: string | null;
-    viaTunnel: boolean;
-}
-/**
- * Check if request originates from localhost
- */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** The archive's local-dashboard / remote-Bearer authentication boundary. */
 export declare function isLocalRequest(req: IncomingMessage): boolean;
-export declare function hasCloudflareAccessIdentity(req: IncomingMessage): boolean;
+export declare function isTunnelRequest(req: IncomingMessage): boolean;
 /**
- * Trust Cloudflare Access authenticated requests when:
- * 1. Peer is localhost (request came through local Cloudflare Tunnel), AND
- * 2. Request has CF Access identity headers (user passed Cloudflare Access login)
- *
- * No environment variable needed — if cf-ray + CF Access headers arrive
- * from localhost, it's a Cloudflare Tunnel by definition.
- * MAMA_TRUST_CLOUDFLARE_ACCESS=true is still supported as explicit opt-in
- * but is no longer required.
+ * Direct localhost is the no-token dashboard path. A tunneled localhost request
+ * is remote for this decision and therefore needs either a token or Cloudflare
+ * Access JWT verification.
  */
-export declare function isTrustedCloudflareAccessRequest(req: IncomingMessage): boolean;
-export declare function getClientAddress(req: IncomingMessage): string;
-export declare function getSecurityLogContext(req: IncomingMessage): SecurityLogContext;
-export declare function logUnauthorizedAttempt(req: IncomingMessage, options?: AuthOptions): void;
-/**
- * Check if request is authenticated.
- *
- * - If no token configured: allows direct localhost only
- * - If token configured + real localhost (no tunnel headers): allows without token
- * - If token configured + tunnel/remote: requires Bearer token
- */
-export declare function isAuthenticated(req: IncomingMessage, options?: AuthOptions): boolean;
-/**
- * Express middleware that rejects unauthenticated requests with 401.
- *
- * Usage:
- *   app.post('/api/sensitive', requireAuth, handler);
- *   app.use('/api/cron', requireAuth, cronRouter);
- */
-export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
-export declare function requireAdminAuth(req: Request, res: Response, next: NextFunction): void;
-export {};
+export type ViewerIdentity = 'local' | 'token' | `access:${string}`;
+/** Observation only: owner email membership does not change the authentication policy. */
+export interface ViewerAuthObservation {
+    accessVerified: boolean;
+    unknownIdentity: boolean;
+}
+export declare function authenticateViewerRequest(req: IncomingMessage, observation?: ViewerAuthObservation): Promise<ViewerIdentity | null>;
+export declare function isAuthenticated(req: IncomingMessage): Promise<boolean>;
+export declare function requireViewerAuth(req: IncomingMessage, res: ServerResponse, identity?: ViewerIdentity | null): Promise<boolean>;
 //# sourceMappingURL=auth-middleware.d.ts.map

package/dist/api/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB/D,UAAU,WAAW;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,UAAU,kBAAkB;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAG5D;AAUD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAOzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAM9E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAE7D;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAsB9E;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CA2B5F;AA4BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAwBxF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAoBjF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAkCtF"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAK5D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAI7D;AAcD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,MAAM,EAAE,CAAC;AAEpE,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,eAAe,EACpB,WAAW,CAAC,EAAE,qBAAqB,GAClC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAsBhC;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5E;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,GAC/B,OAAO,CAAC,OAAO,CAAC,CAelB"}