@jungjaehoon/mama-os 0.53.1 → 0.58.0

package/dist/api/attachment-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-actions.js","sourceRoot":"","sources":["../../src/api/attachment-actions.ts"],"names":[],"mappings":";;AAgMA,oCAYC;AAyBD,kFA6GC;AAlVD,qCAA8C;AAC9C,yCAAiC;AAQjC,2EAIgD;AAChD,8DAAyE;AACzE,2DAAmE;AAEnE,yDAAiF;AAYjF,MAAM,mBAAmB,GAAuB;IAC9C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,CAAC;IAC5B,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,6EAA6E;SAC3F;KACF;CACF,CAAC;AAEF,MAAM,wBAAwB,GAAuB;IACnD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,gBAAgB,EAAE,QAAQ,CAAC;IACtC,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,cAAc,EAAE;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,kEAAkE;SAChF;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,MAAM,eAAe,GAAuB;IAC1C,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,oDAAoD;SAClE;QACD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,wBAAwB;SACtC;KACF;CACF,CAAC;AAYF,SAAS,oBAAoB,CAAC,KAA4B;IACxD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC7C,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB;IAEtB,OAAO,OAAO,CAAC,aAAa,EAAE,WAAW,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA4B,EAC5B,KAA8B,EAC9B,OAAsB;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,eAAe,CAC9D,cAAc,EACd,OAAO,CAAC,MAAM,EACd,eAAe,CAAC,OAAO,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAG,MAAgD,CAAC;IACrE,IAAI,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,0BAA0B,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,WAAW,CAClB,KAA4B,EAC5B,MAAc;IAEd,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,aAAa,MAAM,8EAA8E,CAClG,CAAC;QACF,KAAK,CAAC,IAAI,GAAG,eAAe,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,cAAc,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,gCAAgC,CAAC,CAAC;IACrF,OAAO,IAAA,oCAAmB,EAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,QAA6C,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACzF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,WAAwC;IACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,SAAS,CAAC;IAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACjD,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9E,OAAO,eAAe,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,SAAS,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,MAAM,KAAK,EAAE;gBAAE,OAAO,MAAM,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,WAAW,CAAC,cAAc,WAAW,WAAW,CAAC,MAAM,UAAU,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,WAAwC;IAItD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,IAAA,iCAAsB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,IAAA,8BAAmB,EAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC5F,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY;IACvC,yFAAyF;IACzF,uCAAuC;IACvC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC;QACnF,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,CACT;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAwC;IACjE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC;QAC9B,UAAU,EAAE,WAAW,CAAC,QAAQ,IAAI,IAAI;QACxC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA4B;IACtD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,IAAA,gBAAI,EAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAgB,mCAAmC,CACjD,QAA+B,EAAE;IAEjC,OAAO;QACL;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,4RAA4R;gBAC9R,WAAW,EAAE,mBAAmB;gBAChC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,CAAC;aACzF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAgC,EAAE,OAAO,CAAC,CAAC;gBAC5F,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC7E,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,KAAK;iBACN,CAAC;YACJ,CAAC;SACF;QACD;YACE,QAAQ,EAAE;gBACR,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EACL,wKAAwK;gBAC1K,WAAW,EAAE,wBAAwB;gBACrC,QAAQ,EAAE;oBACR;wBACE,KAAK,EAAE,6BAA6B;wBACpC,KAAK,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE;qBAC3D;iBACF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;oBACpD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxD,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,SAAS;oBACtB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC;wBAC7B,GAAG,OAAO;wBACV,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;qBAChE,CAAC,CAAC;gBACP,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;gBACjE,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,QAAQ,MAAM,mCAAmC,WAAW,CAAC,cAAc,SAAS,MAAM,EAAE,CAC7F,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;oBAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrF,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,MAAM,UAAU,GAAG,IAAA,gBAAI,EACrB,SAAS,EACT,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAC3D,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;oBACnD,MAAM;oBACN,MAAM;oBACN,UAAU;iBACX,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBACvC,IAAI,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;oBAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,4BAA4B,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO;oBACL,cAAc,EAAE,WAAW,CAAC,cAAc;oBAC1C,SAAS,EAAE,WAAW,CAAC,MAAM;oBAC7B,MAAM;oBACN,IAAI,EAAE,UAAU;oBAChB,IAAI;iBACL,CAAC;YACJ,CAAC;SACF;QACD,GAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACjE,QAAQ,EAAE;gBACR,IAAI,EAAE,WAAW,SAAS,OAAO;gBACjC,OAAO,EAAE,2EAA2E,SAAS,sDAAsD;gBACnJ,WAAW,EAAE,eAAe;gBAC5B,QAAQ,EAAE;oBACR,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,EAAE;iBACtF;aACF;YACD,IAAI,EAAE,KAAK,EAAE,KAAc,EAAE,OAAsB,EAAE,EAAE;gBACrD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACxF,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjF,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,gCAAgC,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,uCAAuC,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,IAAA,wCAAqB,EAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBACzE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACnF,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/api/auth-middleware.d.ts

@@ -1,59 +1,19 @@
-/**
- * Shared authentication middleware for MAMA API routes.
- *
- * Extracted from graph-api.ts to allow reuse across all API endpoints.
- * Uses timing-safe comparison and supports localhost bypass when no token is configured.
- */
-import type { IncomingMessage } from 'http';
-import type { Request, Response, NextFunction } from 'express';
-interface AuthOptions {
-    allowQueryToken?: boolean;
-}
-interface SecurityLogContext {
-    clientAddress: string;
-    remoteAddress: string | null;
-    forwardedFor: string | null;
-    cfConnectingIp: string | null;
-    cfRay: string | null;
-    method: string | null;
-    path: string | null;
-    viaTunnel: boolean;
-}
-/**
- * Check if request originates from localhost
- */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** The archive's local-dashboard / remote-Bearer authentication boundary. */
 export declare function isLocalRequest(req: IncomingMessage): boolean;
-export declare function hasCloudflareAccessIdentity(req: IncomingMessage): boolean;
+export declare function isTunnelRequest(req: IncomingMessage): boolean;
 /**
- * Trust Cloudflare Access authenticated requests when:
- * 1. Peer is localhost (request came through local Cloudflare Tunnel), AND
- * 2. Request has CF Access identity headers (user passed Cloudflare Access login)
- *
- * No environment variable needed — if cf-ray + CF Access headers arrive
- * from localhost, it's a Cloudflare Tunnel by definition.
- * MAMA_TRUST_CLOUDFLARE_ACCESS=true is still supported as explicit opt-in
- * but is no longer required.
+ * Direct localhost is the no-token dashboard path. A tunneled localhost request
+ * is remote for this decision and therefore needs either a token or Cloudflare
+ * Access JWT verification.
  */
-export declare function isTrustedCloudflareAccessRequest(req: IncomingMessage): boolean;
-export declare function getClientAddress(req: IncomingMessage): string;
-export declare function getSecurityLogContext(req: IncomingMessage): SecurityLogContext;
-export declare function logUnauthorizedAttempt(req: IncomingMessage, options?: AuthOptions): void;
-/**
- * Check if request is authenticated.
- *
- * - If no token configured: allows direct localhost only
- * - If token configured + real localhost (no tunnel headers): allows without token
- * - If token configured + tunnel/remote: requires Bearer token
- */
-export declare function isAuthenticated(req: IncomingMessage, options?: AuthOptions): boolean;
-/**
- * Express middleware that rejects unauthenticated requests with 401.
- *
- * Usage:
- *   app.post('/api/sensitive', requireAuth, handler);
- *   app.use('/api/cron', requireAuth, cronRouter);
- */
-export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
-export declare function requireAdminAuth(req: Request, res: Response, next: NextFunction): void;
-export {};
+export type ViewerIdentity = 'local' | 'token' | `access:${string}`;
+/** Observation only: owner email membership does not change the authentication policy. */
+export interface ViewerAuthObservation {
+    accessVerified: boolean;
+    unknownIdentity: boolean;
+}
+export declare function authenticateViewerRequest(req: IncomingMessage, observation?: ViewerAuthObservation): Promise<ViewerIdentity | null>;
+export declare function isAuthenticated(req: IncomingMessage): Promise<boolean>;
+export declare function requireViewerAuth(req: IncomingMessage, res: ServerResponse, identity?: ViewerIdentity | null): Promise<boolean>;
 //# sourceMappingURL=auth-middleware.d.ts.map

package/dist/api/auth-middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB/D,UAAU,WAAW;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,UAAU,kBAAkB;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAG5D;AAUD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAOzE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAM9E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAE7D;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAsB9E;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CA2B5F;AA4BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAwBxF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAoBjF;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAkCtF"}
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAK5D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAI7D;AAcD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,MAAM,EAAE,CAAC;AAEpE,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,eAAe,EACpB,WAAW,CAAC,EAAE,qBAAqB,GAClC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAsBhC;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5E;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,GAC/B,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/api/auth-middleware.js

@@ -1,249 +1,72 @@
 "use strict";
-/**
- * Shared authentication middleware for MAMA API routes.
- *
- * Extracted from graph-api.ts to allow reuse across all API endpoints.
- * Uses timing-safe comparison and supports localhost bypass when no token is configured.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isLocalRequest = isLocalRequest;
-exports.hasCloudflareAccessIdentity = hasCloudflareAccessIdentity;
-exports.isTrustedCloudflareAccessRequest = isTrustedCloudflareAccessRequest;
-exports.getClientAddress = getClientAddress;
-exports.getSecurityLogContext = getSecurityLogContext;
-exports.logUnauthorizedAttempt = logUnauthorizedAttempt;
+exports.isTunnelRequest = isTunnelRequest;
+exports.authenticateViewerRequest = authenticateViewerRequest;
 exports.isAuthenticated = isAuthenticated;
-exports.requireAuth = requireAuth;
-exports.requireAdminAuth = requireAdminAuth;
+exports.requireViewerAuth = requireViewerAuth;
 const node_crypto_1 = require("node:crypto");
-const debugLogger = __importStar(require("@jungjaehoon/mama-core/debug-logger"));
-const security_monitor_js_1 = require("../security/security-monitor.js");
-const trusted_proxy_js_1 = require("../security/trusted-proxy.js");
-const { DebugLogger } = debugLogger;
-const authLogger = new DebugLogger('AuthSecurity');
-/**
- * Check if request originates from localhost
- */
+const cf_access_js_1 = require("./cf-access.js");
+/** The archive's local-dashboard / remote-Bearer authentication boundary. */
 function isLocalRequest(req) {
-    const remoteAddr = req.socket?.remoteAddress;
-    return remoteAddr === '127.0.0.1' || remoteAddr === '::1' || remoteAddr === '::ffff:127.0.0.1';
+    const remoteAddress = req.socket?.remoteAddress;
+    return (remoteAddress === '127.0.0.1' || remoteAddress === '::1' || remoteAddress === '::ffff:127.0.0.1');
 }
-/**
- * Detect if request is proxied through Cloudflare Tunnel (not truly local).
- * Tunnel adds cf-connecting-ip / cf-ray headers; real localhost requests don't.
- */
 function isTunnelRequest(req) {
-    return !!(req.headers['cf-connecting-ip'] || req.headers['cf-ray']);
+    return Object.keys(req.headers).some((name) => name === 'cf-connecting-ip' || name === 'cf-ray' || name.startsWith('cf-access-'));
 }
-function hasCloudflareAccessIdentity(req) {
-    const headers = req.headers;
-    return (typeof headers['cf-access-jwt-assertion'] === 'string' ||
-        typeof headers['cf-access-authenticated-user-email'] === 'string' ||
-        typeof headers['cf-access-authenticated-user-uuid'] === 'string');
+function safeTokenEqual(token, configured) {
+    const provided = Buffer.from(token);
+    const expected = Buffer.from(configured);
+    return provided.length === expected.length && (0, node_crypto_1.timingSafeEqual)(provided, expected);
 }
-/**
- * Trust Cloudflare Access authenticated requests when:
- * 1. Peer is localhost (request came through local Cloudflare Tunnel), AND
- * 2. Request has CF Access identity headers (user passed Cloudflare Access login)
- *
- * No environment variable needed — if cf-ray + CF Access headers arrive
- * from localhost, it's a Cloudflare Tunnel by definition.
- * MAMA_TRUST_CLOUDFLARE_ACCESS=true is still supported as explicit opt-in
- * but is no longer required.
- */
-function isTrustedCloudflareAccessRequest(req) {
-    if (!(0, trusted_proxy_js_1.isTrustedProxyPeer)(req.socket?.remoteAddress || null)) {
-        return false;
-    }
-    return hasCloudflareAccessIdentity(req);
+function requestToken(req) {
+    const header = req.headers.authorization;
+    if (typeof header !== 'string')
+        return null;
+    return header.startsWith('Bearer ') ? header.slice(7) : header;
 }
-function getClientAddress(req) {
-    return (0, trusted_proxy_js_1.getForwardedClientAddress)(req);
+async function authenticateViewerRequest(req, observation) {
+    const configured = process.env.MAMA_AUTH_TOKEN;
+    if (isLocalRequest(req) && !isTunnelRequest(req))
+        return 'local';
+    const token = requestToken(req);
+    const validToken = configured && token !== null && safeTokenEqual(token, configured);
+    if (validToken && !observation)
+        return 'token';
+    const email = await (0, cf_access_js_1.verifiedCfAccessEmail)(req.headers);
+    if (observation) {
+        observation.accessVerified = email !== null;
+        const owners = process.env.MAMA_VIEWER_OWNER_EMAILS;
+        observation.unknownIdentity =
+            email !== null &&
+                owners !== undefined &&
+                !owners
+                    .split(',')
+                    .map((owner) => owner.trim().toLowerCase())
+                    .includes(email.toLowerCase());
+    }
+    if (validToken)
+        return 'token';
+    return email === null
+        ? null
+        : `access:${(0, node_crypto_1.createHash)('sha256').update(email).digest('hex').slice(0, 12)}`;
 }
-function getSecurityLogContext(req) {
-    const rawUrl = req.url || '/';
-    let path = rawUrl;
-    try {
-        const host = req.headers.host || 'localhost';
-        path = new URL(rawUrl, `http://${host}`).pathname;
-    }
-    catch {
-        // Keep raw URL if parsing fails.
-    }
-    return {
-        clientAddress: getClientAddress(req),
-        remoteAddress: req.socket?.remoteAddress || null,
-        forwardedFor: typeof req.headers['x-forwarded-for'] === 'string' ? req.headers['x-forwarded-for'] : null,
-        cfConnectingIp: typeof req.headers['cf-connecting-ip'] === 'string' ? req.headers['cf-connecting-ip'] : null,
-        cfRay: typeof req.headers['cf-ray'] === 'string' ? req.headers['cf-ray'] : null,
-        method: 'method' in req && typeof req.method === 'string' ? req.method : null,
-        path,
-        viaTunnel: isTunnelRequest(req),
-    };
-}
-function logUnauthorizedAttempt(req, options = {}) {
-    let hasQueryToken = false;
-    if (options.allowQueryToken && req.url) {
-        try {
-            hasQueryToken = new URL(req.url, `http://${req.headers.host || 'localhost'}`).searchParams.has('token');
-        }
-        catch {
-            hasQueryToken = false;
-        }
-    }
-    const context = getSecurityLogContext(req);
-    const details = {
-        hasAuthorizationHeader: !!req.headers.authorization,
-        hasQueryToken,
-        allowQueryToken: !!options.allowQueryToken,
-    };
-    authLogger.warn('[SECURITY] Unauthorized request blocked', { ...context, ...details });
-    (0, security_monitor_js_1.recordSecurityEvent)({
-        type: 'unauthorized_request',
-        severity: 'warn',
-        message: 'Unauthorized request blocked',
-        ...context,
-        details,
-    });
+async function isAuthenticated(req) {
+    return (await authenticateViewerRequest(req)) !== null;
 }
-function safeTokenEqual(token, adminToken) {
-    if (token.length !== adminToken.length) {
-        return false;
-    }
-    return (0, node_crypto_1.timingSafeEqual)(Buffer.from(token), Buffer.from(adminToken));
-}
-function getRequestToken(req, options = {}) {
-    const authHeader = req.headers.authorization;
-    if (authHeader) {
-        return authHeader.startsWith('Bearer ') ? authHeader.slice(7) : authHeader;
-    }
-    if (options.allowQueryToken && req.url) {
-        try {
-            const host = req.headers.host || 'localhost';
-            const url = new URL(req.url, `http://${host}`);
-            return url.searchParams.get('token');
-        }
-        catch {
-            return null;
-        }
-    }
-    return null;
-}
-/**
- * Check if request is authenticated.
- *
- * - If no token configured: allows direct localhost only
- * - If token configured + real localhost (no tunnel headers): allows without token
- * - If token configured + tunnel/remote: requires Bearer token
- */
-function isAuthenticated(req, options = {}) {
-    const adminToken = process.env.MAMA_AUTH_TOKEN || process.env.MAMA_SERVER_TOKEN;
-    if (!adminToken) {
-        if (isTrustedCloudflareAccessRequest(req)) {
-            return true;
-        }
-        return isLocalRequest(req) && !isTunnelRequest(req);
-    }
-    // Real localhost (not via tunnel) — allow without token for local dashboard
-    if (isLocalRequest(req) && !isTunnelRequest(req)) {
+async function requireViewerAuth(req, res, identity) {
+    if ((identity === undefined ? await authenticateViewerRequest(req) : identity) !== null)
         return true;
-    }
-    if (isTrustedCloudflareAccessRequest(req)) {
-        return true;
-    }
-    // Remote or tunnel request — require Bearer token
-    const token = getRequestToken(req, options);
-    if (!token) {
-        return false;
-    }
-    return safeTokenEqual(token, adminToken);
-}
-/**
- * Express middleware that rejects unauthenticated requests with 401.
- *
- * Usage:
- *   app.post('/api/sensitive', requireAuth, handler);
- *   app.use('/api/cron', requireAuth, cronRouter);
- */
-function requireAuth(req, res, next) {
-    const clientAddress = getClientAddress(req);
-    // Banned IP → reject immediately
-    if ((0, security_monitor_js_1.isIpBanned)(clientAddress)) {
-        res.status(403).json({ error: true, code: 'FORBIDDEN', message: 'Access denied.' });
-        return;
-    }
-    if (!isAuthenticated(req)) {
-        logUnauthorizedAttempt(req);
-        (0, security_monitor_js_1.recordAuthFailure)(clientAddress);
-        res.status(401).json({
-            error: true,
-            code: 'UNAUTHORIZED',
-            message: 'Authentication required. Provide Authorization: Bearer <token> header.',
-        });
-        return;
-    }
-    next();
-}
-function requireAdminAuth(req, res, next) {
-    const clientAddress = getClientAddress(req);
-    const adminToken = process.env.MAMA_ADMIN_TOKEN;
-    if ((0, security_monitor_js_1.isIpBanned)(clientAddress)) {
-        res.status(403).json({ error: true, code: 'FORBIDDEN', message: 'Access denied.' });
-        return;
-    }
-    if (!adminToken) {
-        res.status(503).json({
-            error: true,
-            code: 'admin_token_required',
-            message: 'MAMA_ADMIN_TOKEN is required for admin provenance reads.',
-        });
-        return;
-    }
-    const authHeader = req.headers.authorization;
-    const token = typeof authHeader === 'string' && authHeader.startsWith('Bearer ') ? authHeader.slice(7) : null;
-    if (!token || !safeTokenEqual(token, adminToken)) {
-        logUnauthorizedAttempt(req);
-        (0, security_monitor_js_1.recordAuthFailure)(clientAddress);
-        res.status(401).json({
-            error: true,
-            code: 'UNAUTHORIZED',
-            message: 'Admin authentication required.',
-        });
-        return;
-    }
-    next();
+    res.writeHead(401, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'WWW-Authenticate': 'Bearer realm="MAMA API"',
+    });
+    res.end(JSON.stringify({
+        error: true,
+        code: 'UNAUTHORIZED',
+        message: 'Authentication required. Provide Authorization: Bearer <token> header.',
+    }));
+    return false;
 }
 //# sourceMappingURL=auth-middleware.js.map

package/dist/api/auth-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCH,wCAGC;AAUD,kEAOC;AAYD,4EAMC;AAED,4CAEC;AAED,sDAsBC;AAED,wDA2BC;AAmCD,0CAwBC;AASD,kCAoBC;AAED,4CAkCC;AA/PD,6CAA8C;AAG9C,iFAAmE;AACnE,yEAIyC;AACzC,mEAA6F;AAE7F,MAAM,EAAE,WAAW,EAAE,GAAG,WAIvB,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;AAiBnD;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAoB;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;IAC7C,OAAO,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,kBAAkB,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAoB;IAC3C,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAoB;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,OAAO,CACL,OAAO,OAAO,CAAC,yBAAyB,CAAC,KAAK,QAAQ;QACtD,OAAO,OAAO,CAAC,oCAAoC,CAAC,KAAK,QAAQ;QACjE,OAAO,OAAO,CAAC,mCAAmC,CAAC,KAAK,QAAQ,CACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gCAAgC,CAAC,GAAoB;IACnE,IAAI,CAAC,IAAA,qCAAkB,EAAC,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,2BAA2B,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAoB;IACnD,OAAO,IAAA,4CAAyB,EAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,qBAAqB,CAAC,GAAoB;IACxD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9B,IAAI,IAAI,GAAkB,MAAM,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;QAC7C,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,OAAO;QACL,aAAa,EAAE,gBAAgB,CAAC,GAAG,CAAC;QACpC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;QAChD,YAAY,EACV,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5F,cAAc,EACZ,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9F,KAAK,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/E,MAAM,EAAE,QAAQ,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC7E,IAAI;QACJ,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CAAC,GAAoB,EAAE,UAAuB,EAAE;IACpF,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,aAAa,GAAG,IAAI,GAAG,CACrB,GAAG,CAAC,GAAG,EACP,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAC5C,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG;QACd,sBAAsB,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa;QACnD,aAAa;QACb,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe;KAC3C,CAAC;IACF,UAAU,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACvF,IAAA,yCAAmB,EAAC;QAClB,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8BAA8B;QACvC,GAAG,OAAO;QACV,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,UAAkB;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB,EAAE,UAAuB,EAAE;IACtE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7E,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;YAC/C,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,GAAoB,EAAE,UAAuB,EAAE;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAChF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,4EAA4E;IAC5E,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kDAAkD;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACzE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE5C,iCAAiC;IACjC,IAAI,IAAA,gCAAU,EAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAA,uCAAiB,EAAC,aAAa,CAAC,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,wEAAwE;SAClF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC9E,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAEhD,IAAI,IAAA,gCAAU,EAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,MAAM,KAAK,GACT,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElG,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACjD,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAA,uCAAiB,EAAC,aAAa,CAAC,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC"}
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/api/auth-middleware.ts"],"names":[],"mappings":";;AAKA,wCAKC;AAED,0CAIC;AA2BD,8DAyBC;AAED,0CAEC;AAED,8CAmBC;AA7FD,6CAA0D;AAE1D,iDAAuD;AAEvD,6EAA6E;AAC7E,SAAgB,cAAc,CAAC,GAAoB;IACjD,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;IAChD,OAAO,CACL,aAAa,KAAK,WAAW,IAAI,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,kBAAkB,CACjG,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAAC,GAAoB;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,UAAkB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAeM,KAAK,UAAU,yBAAyB,CAC7C,GAAoB,EACpB,WAAmC;IAEnC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC/C,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACrF,IAAI,UAAU,IAAI,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,oCAAqB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,cAAc,GAAG,KAAK,KAAK,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACpD,WAAW,CAAC,eAAe;YACzB,KAAK,KAAK,IAAI;gBACd,MAAM,KAAK,SAAS;gBACpB,CAAC,MAAM;qBACJ,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;qBAC1C,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,UAAU;QAAE,OAAO,OAAO,CAAC;IAC/B,OAAO,KAAK,KAAK,IAAI;QACnB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAEM,KAAK,UAAU,eAAe,CAAC,GAAoB;IACxD,OAAO,CAAC,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,QAAgC;IAEhC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI;QACrF,OAAO,IAAI,CAAC;IACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,iCAAiC;QACjD,kBAAkB,EAAE,yBAAyB;KAC9C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,wEAAwE;KAClF,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/api/cf-access.d.ts

@@ -0,0 +1,6 @@
+import type { IncomingHttpHeaders } from 'node:http';
+/** Called when the viewer is constructed, so the daemon reports this once at startup. */
+export declare function logCfAccessConfiguration(): void;
+/** Verify the signed assertion, never the unsigned identity headers. No credentials are logged. */
+export declare function verifiedCfAccessEmail(headers: IncomingHttpHeaders): Promise<string | null>;
+//# sourceMappingURL=cf-access.d.ts.map

package/dist/api/cf-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-access.d.ts","sourceRoot":"","sources":["../../src/api/cf-access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAqCrD,yFAAyF;AACzF,wBAAgB,wBAAwB,IAAI,IAAI,CAO/C;AA4BD,mGAAmG;AACnG,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwDhG"}

package/dist/api/cf-access.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logCfAccessConfiguration = logCfAccessConfiguration;
+exports.verifiedCfAccessEmail = verifiedCfAccessEmail;
+const node_crypto_1 = require("node:crypto");
+const CACHE_MS = 10 * 60 * 1000;
+const SKEW_SECONDS = 60;
+const UNKNOWN_KID_REFRESH_MS = 60_000;
+const unknownKidRefreshes = new Map();
+const cache = new Map();
+let loggedDisabled = false;
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function config() {
+    const issuer = process.env.MAMA_CF_ACCESS_ISSUER?.trim().replace(/\/$/, '');
+    const audience = process.env.MAMA_CF_ACCESS_AUD?.trim();
+    if (!issuer || !audience)
+        return null;
+    try {
+        const url = new URL(issuer);
+        if (url.protocol !== 'https:' ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            url.pathname !== '/')
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return { issuer, audience };
+}
+/** Called when the viewer is constructed, so the daemon reports this once at startup. */
+function logCfAccessConfiguration() {
+    if (!config() && !loggedDisabled) {
+        loggedDisabled = true;
+        console.warn('[auth] Access verification is off; tunnelled requests require the viewer token. Configure MAMA_CF_ACCESS_ISSUER and MAMA_CF_ACCESS_AUD.');
+    }
+}
+async function jwks(issuer, force = false) {
+    const existing = cache.get(issuer);
+    if (!force && existing && existing.expires > Date.now())
+        return existing.keys;
+    // Never follow a redirect away from the configured issuer. Bound auth request latency.
+    const response = await fetch(`${issuer}/cdn-cgi/access/certs`, {
+        redirect: 'error',
+        signal: AbortSignal.timeout(5_000),
+    });
+    if (!response.ok)
+        throw new Error('Access key retrieval failed');
+    const payload = await response.json();
+    if (!record(payload) || !Array.isArray(payload.keys))
+        throw new Error('Invalid Access keys');
+    const keys = payload.keys.filter(record);
+    cache.set(issuer, { expires: Date.now() + CACHE_MS, keys });
+    return keys;
+}
+/** One shared rotation lookup per issuer per minute, including failed fetches. */
+function refreshUnknownKid(issuer) {
+    const previous = unknownKidRefreshes.get(issuer);
+    const now = Date.now();
+    if (previous && now - previous.at < UNKNOWN_KID_REFRESH_MS)
+        return previous.keys;
+    const keys = jwks(issuer, true);
+    unknownKidRefreshes.set(issuer, { at: now, keys });
+    return keys;
+}
+/** Verify the signed assertion, never the unsigned identity headers. No credentials are logged. */
+async function verifiedCfAccessEmail(headers) {
+    const settings = config();
+    const token = headers['cf-access-jwt-assertion'];
+    if (!settings || typeof token !== 'string')
+        return null;
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts.some((part) => !/^[A-Za-z0-9_-]+$/.test(part)))
+            return null;
+        const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+        const claims = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        if (!record(header) ||
+            !record(claims) ||
+            header.alg !== 'RS256' ||
+            typeof header.kid !== 'string')
+            return null;
+        if (claims.iss !== settings.issuer)
+            return null;
+        if (claims.aud !== settings.audience &&
+            !(Array.isArray(claims.aud) && claims.aud.includes(settings.audience)))
+            return null;
+        const now = Math.floor(Date.now() / 1000);
+        if (typeof claims.exp !== 'number' ||
+            !Number.isFinite(claims.exp) ||
+            claims.exp <= now - SKEW_SECONDS)
+            return null;
+        for (const time of [claims.nbf, claims.iat]) {
+            if (time !== undefined &&
+                (typeof time !== 'number' || !Number.isFinite(time) || time > now + SKEW_SECONDS))
+                return null;
+        }
+        if (typeof claims.email !== 'string' || !/^[^\s@]+@[^\s@]+$/.test(claims.email))
+            return null;
+        const matches = (item) => item.kid === header.kid &&
+            item.kty === 'RSA' &&
+            (item.alg === undefined || item.alg === 'RS256') &&
+            (item.use === undefined || item.use === 'sig');
+        let key = (await jwks(settings.issuer)).find(matches);
+        if (!key)
+            key = (await refreshUnknownKid(settings.issuer)).find(matches);
+        if (!key)
+            return null;
+        const valid = (0, node_crypto_1.verify)('RSA-SHA256', Buffer.from(`${parts[0]}.${parts[1]}`), (0, node_crypto_1.createPublicKey)({ key: key, format: 'jwk' }), Buffer.from(parts[2], 'base64url'));
+        return valid ? claims.email : null;
+    }
+    catch {
+        // Fetch errors may contain deployment details; authentication fails closed without logging them.
+        return null;
+    }
+}
+//# sourceMappingURL=cf-access.js.map

package/dist/api/cf-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf-access.js","sourceRoot":"","sources":["../../src/api/cf-access.ts"],"names":[],"mappings":";;AAuCA,4DAOC;AA6BD,sDAwDC;AAnID,6CAAuE;AAGvE,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;AACJ,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgE,CAAC;AACtF,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM;IACb,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,QAAQ,KAAK,GAAG;YAEpB,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,yFAAyF;AACzF,SAAgB,wBAAwB;IACtC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,cAAc,GAAG,IAAI,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,yIAAyI,CAC1I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,KAAK,GAAG,KAAK;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IAC9E,uFAAuF;IACvF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uBAAuB,EAAE;QAC7D,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjE,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,EAAE,GAAG,sBAAsB;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AAC5F,KAAK,UAAU,qBAAqB,CAAC,OAA4B;IACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,IACE,CAAC,MAAM,CAAC,MAAM,CAAC;YACf,CAAC,MAAM,CAAC,MAAM,CAAC;YACf,MAAM,CAAC,GAAG,KAAK,OAAO;YACtB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAE9B,OAAO,IAAI,CAAC;QACd,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IACE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ;YAChC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEtE,OAAO,IAAI,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,YAAY;YAEhC,OAAO,IAAI,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,IACE,IAAI,KAAK,SAAS;gBAClB,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,GAAG,YAAY,CAAC;gBAEjF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,MAAM,OAAO,GAAG,CAAC,IAA6B,EAAW,EAAE,CACzD,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YACvB,IAAI,CAAC,GAAG,KAAK,KAAK;YAClB,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC;YAChD,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QACjD,IAAI,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG;YAAE,GAAG,GAAG,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,KAAK,GAAG,IAAA,oBAAM,EAClB,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EACtC,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CACpC,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/api/file-delivery.d.ts

@@ -0,0 +1,29 @@
+export declare const OWNER_FILE_MAX_UPLOAD_BYTES: number;
+export declare const TELEGRAM_MAX_UPLOAD_BYTES: number;
+export declare const TELEGRAM_MAX_PHOTO_BYTES: number;
+export declare const TELEGRAM_IMAGE_EXTENSIONS: Set<string>;
+export interface OwnerFileDeliveryResult {
+    messageId?: number | string;
+    sentAs: 'photo' | 'document';
+    size: number;
+    idempotent?: boolean;
+}
+export interface OwnerFileSender {
+    sendFile(path: string, caption: string | undefined, operationId: string): Promise<TelegramFileDeliveryResult>;
+}
+export type TelegramFileDeliveryResult = OwnerFileDeliveryResult;
+export type TelegramFileSender = OwnerFileSender;
+export interface ValidatedWorkspaceFile {
+    path: string;
+    size: number;
+    sentAs: 'photo' | 'document';
+}
+export declare function validateWorkspaceFile(filesRoot: string, inputPath: string): ValidatedWorkspaceFile;
+/** Keep this descriptor open through upload so a later path replacement cannot change its bytes. */
+export declare function openWorkspaceFile(filesRoot: string, inputPath: string): ValidatedWorkspaceFile & {
+    fd: number;
+};
+/** Read the validated descriptor without reopening its mutable pathname. The caller closes it. */
+export declare function readWorkspaceFile(fd: number): AsyncGenerator<Buffer>;
+export declare function workspaceFileIdentity(fd: number, caption?: string): string;
+//# sourceMappingURL=file-delivery.d.ts.map

package/dist/api/file-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-delivery.d.ts","sourceRoot":"","sources":["../../src/api/file-delivery.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAC5D,eAAO,MAAM,yBAAyB,QAA8B,CAAC;AACrE,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AACzD,eAAO,MAAM,yBAAyB,aAAsD,CAAC;AAE7F,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED,MAAM,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AACjE,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,sBAAsB,CAIxB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,sBAAsB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CA2CzC;AAED,kGAAkG;AAClG,wBAAuB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAW3E;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAY1E"}