@wizzlethorpe/vaults 0.10.0 → 0.12.0

package/dist/render/auth-template.js

@@ -6,15 +6,18 @@ export function renderAuthMiddleware(cfg) {
     const rolesLiteral = JSON.stringify(cfg.roles);
     const passwordsLiteral = JSON.stringify(cfg.rolePasswords);
     const patreonLiteral = JSON.stringify(cfg.patreon ?? null);
+    const oidcLiteral = JSON.stringify(cfg.oidc ?? null);
     return `// Auto-generated by the vaults CLI. Do not edit by hand.
 // Roles, password hashes, and routing live here so the deployed Function
 // is fully self-contained and doesn't need any other binding besides
 // SESSION_SECRET (set via wrangler secret). When Patreon is configured,
-// PATREON_CLIENT_SECRET also has to be set as a Wrangler secret.
+// PATREON_CLIENT_SECRET also has to be set as a Wrangler secret; when
+// OIDC is configured, OAUTH_CLIENT_SECRET likewise.
 
 const ROLES = ${rolesLiteral};
 const PASSWORDS = ${passwordsLiteral};
 const PATREON = ${patreonLiteral};
+const OIDC = ${oidcLiteral};
 const COOKIE_NAME = "vault_role";
 // Non-HttpOnly companion cookie carrying the role name only; the auth check
 // uses COOKIE_NAME (which is signed and HttpOnly), this one is purely for UI.
@@ -97,6 +100,17 @@ export const onRequest = async (ctx) => {
     }
   }
 
+  // /auth/oidc/* — only mounted when the build saw an OIDC config with at
+  // least one role rule. Same session-cookie contract as password login.
+  if (OIDC) {
+    if (url.pathname === "/auth/oidc/start" && request.method === "GET") {
+      return handleOidcStart(request, env);
+    }
+    if (url.pathname === "/auth/oidc/callback" && request.method === "GET") {
+      return handleOidcCallback(request, env);
+    }
+  }
+
   // /_batch; bulk source fetch for sync clients (Foundry). Body is
   // newline-separated paths under text/plain so the request stays CORS-
   // simple (no preflight per file → no OPTIONS rate-limit). Response is
@@ -500,8 +514,11 @@ function escAttr(s) { return String(s).replace(/[&<>"]/g, (c) => ({ "&": "&amp;"
 // /login with an error param on failure. CSRF state rides through a short-
 // lived signed cookie so the callback can verify the round-trip.
 
-const PATREON_STATE_COOKIE = "vault_patreon_state";
-const PATREON_STATE_TTL = 600; // 10 minutes — long enough for the user to authorise
+// Shared by the Patreon and OIDC flows; only one OAuth round-trip can be in
+// flight per browser at a time, and the state UUID check keeps a callback
+// from one flow from completing the other's.
+const STATE_COOKIE = "vault_oauth_state";
+const STATE_TTL = 600; // 10 minutes — long enough for the user to authorise
 
 async function handlePatreonStart(request, env) {
   if (!env.PATREON_CLIENT_SECRET) {
@@ -538,7 +555,7 @@ async function handlePatreonCallback(request, env) {
 
   const stateData = await readStateCookie(request, env.SESSION_SECRET);
   // Always clear the state cookie regardless of outcome.
-  const clearState = clearCookieVariants(PATREON_STATE_COOKIE);
+  const clearState = clearCookieVariants(STATE_COOKIE);
 
   if (!stateData || stateData.state !== state) {
     const headers = new Headers({ Location: "/login?error=patreon_state_mismatch" });
@@ -648,23 +665,168 @@ async function patreonFetchIdentity(accessToken) {
   return await res.json();
 }
 
-// State cookie: stores { state, next } signed with SESSION_SECRET, used to
-// verify the OAuth callback came from our /start handler and not a forgery.
-// Lifetime is short (PATREON_STATE_TTL); kept distinct from the long-lived
+// ── OIDC OAuth (optional, additive to password login) ────────────────────
+// Bound only when OIDC !== null (i.e. the build saw an oidc block with at
+// least one role rule). Standard authorization-code flow with PKCE (S256):
+// the code_verifier rides in the signed state cookie, the challenge goes to
+// the authorization endpoint. Identity comes from the userinfo endpoint;
+// the visitor's email is matched against per-role email/domain rules.
+
+async function handleOidcStart(request, env) {
+  if (!env.OAUTH_CLIENT_SECRET) {
+    return new Response("OIDC login is misconfigured: OAUTH_CLIENT_SECRET secret is missing.", { status: 500 });
+  }
+  const url = new URL(request.url);
+  const next = safeNext(url.searchParams.get("next"));
+  const stateValue = crypto.randomUUID();
+  const verifier = base64UrlEncode(crypto.getRandomValues(new Uint8Array(32)));
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  const challenge = base64UrlEncode(new Uint8Array(digest));
+  const stateCookie = await signStateCookie({ state: stateValue, next, verifier }, env.SESSION_SECRET);
+
+  const authorize = new URL(OIDC.authorizationEndpoint);
+  authorize.searchParams.set("response_type", "code");
+  authorize.searchParams.set("client_id", OIDC.clientId);
+  authorize.searchParams.set("redirect_uri", url.origin + "/auth/oidc/callback");
+  authorize.searchParams.set("scope", "openid email");
+  authorize.searchParams.set("state", stateValue);
+  authorize.searchParams.set("code_challenge", challenge);
+  authorize.searchParams.set("code_challenge_method", "S256");
+
+  const headers = new Headers({ Location: authorize.toString() });
+  headers.append("Set-Cookie", stateCookie);
+  return new Response(null, { status: 302, headers });
+}
+
+async function handleOidcCallback(request, env) {
+  if (!env.OAUTH_CLIENT_SECRET) {
+    return loginRedirect("/", "oidc_misconfigured");
+  }
+  const url = new URL(request.url);
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  if (!code || !state) return loginRedirect("/", "oidc_failed");
+
+  const stateData = await readStateCookie(request, env.SESSION_SECRET);
+  // Always clear the state cookie regardless of outcome.
+  const clearState = clearCookieVariants(STATE_COOKIE);
+
+  if (!stateData || stateData.state !== state) {
+    const headers = new Headers({ Location: "/login?error=oidc_state_mismatch" });
+    for (const v of clearState) headers.append("Set-Cookie", v);
+    return new Response(null, { status: 302, headers });
+  }
+  const next = stateData.next || "/";
+
+  // Exchange code → access token; used once, immediately, for userinfo.
+  let access;
+  try {
+    access = await oidcExchangeCode(code, url.origin + "/auth/oidc/callback", env.OAUTH_CLIENT_SECRET, stateData.verifier);
+  } catch (err) {
+    console.warn("OIDC token exchange failed:", err);
+    const headers = new Headers({ Location: "/login?error=oidc_token_exchange" });
+    for (const v of clearState) headers.append("Set-Cookie", v);
+    return new Response(null, { status: 302, headers });
+  }
+
+  let email;
+  try { email = await oidcFetchEmail(access); }
+  catch (err) {
+    console.warn("OIDC userinfo fetch failed:", err);
+    const headers = new Headers({ Location: "/login?error=oidc_identity" });
+    for (const v of clearState) headers.append("Set-Cookie", v);
+    return new Response(null, { status: 302, headers });
+  }
+
+  const role = matchOidcRole(email, OIDC.roleRules);
+  if (!role) {
+    // Authenticated, but no rule grants this email a role.
+    const headers = new Headers({ Location: "/login?error=oidc_no_role&next=" + encodeURIComponent(next) });
+    for (const v of clearState) headers.append("Set-Cookie", v);
+    return new Response(null, { status: 302, headers });
+  }
+
+  const cookie = await signSessionCookie(role, env.SESSION_SECRET);
+  const headers = new Headers({ Location: next });
+  headers.append("Set-Cookie", cookie);
+  headers.append("Set-Cookie", DISPLAY_COOKIE_NAME + "=" + encodeURIComponent(role)
+    + "; Path=/; Secure; SameSite=None; Partitioned; Max-Age=" + COOKIE_MAX_AGE);
+  for (const v of clearState) headers.append("Set-Cookie", v);
+  return new Response(null, { status: 302, headers });
+}
+
+// Duplicated from cli/src/render/oidc-match.ts — the worker can't import TS
+// modules, so keep the two copies in sync. Matching is exact and case-
+// insensitive; a domain rule matches only the exact domain after the last
+// '@' (subdomains are not implied).
+function matchOidcRole(email, roleRules) {
+  const at = email.lastIndexOf("@");
+  if (at < 0) return null;
+  const lower = email.toLowerCase();
+  const domain = lower.slice(at + 1);
+  for (let i = ROLES.length - 1; i >= 0; i--) {
+    const rule = roleRules[ROLES[i]];
+    if (!rule) continue;
+    if ((rule.emails || []).some((e) => e.toLowerCase() === lower)) return ROLES[i];
+    if (domain && (rule.domains || []).some((d) => d.toLowerCase() === domain)) return ROLES[i];
+  }
+  return null;
+}
+
+async function oidcExchangeCode(code, redirectUri, clientSecret, verifier) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    client_id: OIDC.clientId,
+    client_secret: clientSecret,
+    redirect_uri: redirectUri,
+    code_verifier: verifier || "",
+  });
+  const res = await fetch(OIDC.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString(),
+  });
+  if (!res.ok) throw new Error("token exchange status " + res.status);
+  const data = await res.json();
+  if (!data.access_token) throw new Error("no access_token in response");
+  return data.access_token;
+}
+
+async function oidcFetchEmail(accessToken) {
+  const res = await fetch(OIDC.userinfoEndpoint, {
+    headers: { Authorization: "Bearer " + accessToken },
+  });
+  if (!res.ok) throw new Error("userinfo status " + res.status);
+  const data = await res.json();
+  if (typeof data.email !== "string" || !data.email) throw new Error("userinfo returned no email");
+  return data.email;
+}
+
+function base64UrlEncode(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
+}
+
+// State cookie: stores { state, next } (plus the PKCE verifier for OIDC)
+// signed with SESSION_SECRET, used to verify the OAuth callback came from
+// our /start handler and not a forgery. Shared by both OAuth flows.
+// Lifetime is short (STATE_TTL); kept distinct from the long-lived
 // session cookie so a stolen state cookie can't impersonate a session.
 
 async function signStateCookie(payload, secret) {
-  const exp = Math.floor(Date.now() / 1000) + PATREON_STATE_TTL;
+  const exp = Math.floor(Date.now() / 1000) + STATE_TTL;
   const data = JSON.stringify({ ...payload, exp });
   const sig = await hmac(data, secret);
   const value = btoa(data) + "." + sig;
-  return PATREON_STATE_COOKIE + "=" + value
-    + "; Path=/; Secure; SameSite=Lax; HttpOnly; Max-Age=" + PATREON_STATE_TTL;
+  return STATE_COOKIE + "=" + value
+    + "; Path=/; Secure; SameSite=Lax; HttpOnly; Max-Age=" + STATE_TTL;
 }
 
 async function readStateCookie(request, secret) {
   const cookies = parseCookie(request.headers.get("Cookie") || "");
-  const raw = cookies[PATREON_STATE_COOKIE];
+  const raw = cookies[STATE_COOKIE];
   if (!raw) return null;
   const dot = raw.lastIndexOf(".");
   if (dot < 0) return null;
@@ -890,10 +1052,17 @@ export const LOGIN_HTML = `<!doctype html>
   }
   .patreon-btn:hover { filter: brightness(1.05); }
   .patreon-hint { color: var(--muted); font-size: 0.78rem; margin-top: 0.6rem; text-align: center; }
+  .oidc-btn {
+    display: flex; align-items: center; justify-content: center;
+    width: 100%; padding: 0.55rem 1rem; font: inherit; font-size: 0.95rem;
+    background: var(--accent); color: var(--accent-fg); border: 0; border-radius: 4px;
+    cursor: pointer; text-decoration: none;
+  }
+  .oidc-btn:hover { filter: brightness(1.05); }
 </style>
 </head>
 <body>
-<div class="login-card"__PATREON_ROLES_ATTR__>
+<div class="login-card"__PATREON_ROLES_ATTR____OIDC_ATTR__>
   <h1>Sign in</h1>
   <p id="err" class="login-error" hidden></p>
   <form method="POST" action="/login">
@@ -918,6 +1087,10 @@ export const LOGIN_HTML = `<!doctype html>
       selector above only matters for password sign-in.
     </p>
   </div>
+  <div id="oidc-section" hidden>
+    <div class="login-divider">or</div>
+    <a id="oidc-btn" class="oidc-btn" href="#">Sign in</a>
+  </div>
 </div>
 <script>
   const params = new URLSearchParams(location.search);
@@ -936,6 +1109,12 @@ export const LOGIN_HTML = `<!doctype html>
       patreon_no_tier: "Signed in to Patreon, but your current pledge doesn't grant any of the configured tiers.",
       patreon_misconfigured: "Patreon login is misconfigured for this deploy.",
       patreon_failed: "Patreon sign-in failed.",
+      oidc_state_mismatch: "Sign-in expired or was tampered with. Please try again.",
+      oidc_token_exchange: "Couldn't complete sign-in with the identity provider. Try again.",
+      oidc_identity: "Signed in, but the identity provider didn't return an email address.",
+      oidc_no_role: "Signed in, but your account isn't authorized for any role here.",
+      oidc_misconfigured: "Single sign-on is misconfigured for this deploy.",
+      oidc_failed: "Sign-in failed.",
     };
     el.textContent = messages[err] || "Sign-in failed.";
     el.hidden = false;
@@ -948,6 +1127,14 @@ export const LOGIN_HTML = `<!doctype html>
     section.hidden = false;
     document.getElementById("patreon-btn").href = "/auth/patreon/start?next=" + encodeURIComponent(next);
   }
+  // Same pattern for OIDC: the build stamps data-oidc with the provider's
+  // display name when configured with at least one role rule.
+  if (card.dataset.oidc) {
+    document.getElementById("oidc-section").hidden = false;
+    const oidcBtn = document.getElementById("oidc-btn");
+    oidcBtn.textContent = "Sign in with " + card.dataset.oidc;
+    oidcBtn.href = "/auth/oidc/start?next=" + encodeURIComponent(next);
+  }
   // Autofocus moved here so it picks the right field whether the password
   // form is visible or the user is going for the Patreon button.
   const pwd = document.getElementById("password");

package/dist/render/auth-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-template.js","sourceRoot":"","sources":["../../src/render/auth-template.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAsBnE,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAE3D,OAAO;;;;;;gBAMO,YAAY;oBACR,gBAAgB;kBAClB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAg0B/B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0GlB,CAAC"}
+{"version":3,"file":"auth-template.js","sourceRoot":"","sources":["../../src/render/auth-template.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAuCnE,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IAErD,OAAO;;;;;;;gBAOO,YAAY;oBACR,gBAAgB;kBAClB,cAAc;eACjB,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+9BzB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAmIlB,CAAC"}

package/dist/render/handlers/builtin/battlemap.js

@@ -22,9 +22,10 @@
 // The browser runtime (BATTLEMAP_RUNTIME below) ships as a built-in asset
 // concatenated into _handlers.js; styles go into _handlers.css.
 //
-// Layer paths are vault-relative and resolve to the absolute served URL. They
-// must also be staged into the deploy — true when the page already references
-// them (e.g. a Scene's foundry.data_json), which is the common case.
+// Layer paths are vault-relative and resolve to the absolute served URL. The
+// build's per-variant asset scanner stages them via battlemapLayerPaths below,
+// so a layer nothing else references (e.g. a web-only composited overlay)
+// still ships with the deploy.
 import yaml from "js-yaml";
 import { htmlEscape } from "../../../escape.js";
 import { registerBuiltinAssets } from "../assets.js";
@@ -35,6 +36,32 @@ function servedSrc(path) {
 function errorBox(message) {
     return { html: `<div class="vaults-bm-error">${htmlEscape(message)}</div>` };
 }
+// ```battlemap fenced blocks in raw markdown source.
+const FENCE_RE = /^```battlemap[ \t]*\r?\n([\s\S]*?)^```/gm;
+/** All layer image paths (vault-relative) named by ```battlemap blocks in a
+ *  markdown source. Used by the build's asset scanner to stage layers into
+ *  each variant; unparseable blocks contribute nothing. */
+export function battlemapLayerPaths(source) {
+    const paths = [];
+    for (const match of source.matchAll(FENCE_RE)) {
+        let spec;
+        try {
+            spec = (yaml.load(match[1]) ?? {});
+        }
+        catch {
+            continue;
+        }
+        for (const lv of Array.isArray(spec.levels) ? spec.levels : []) {
+            if (!Array.isArray(lv?.layers))
+                continue;
+            for (const p of lv.layers) {
+                if (typeof p === "string" && p.length > 0)
+                    paths.push(p);
+            }
+        }
+    }
+    return paths;
+}
 export const battlemapHandler = {
     codeBlock: "battlemap",
     render(content) {

package/dist/render/handlers/builtin/battlemap.js.map

@@ -1 +1 @@
-{"version":3,"file":"battlemap.js","sourceRoot":"","sources":["../../../../src/render/handlers/builtin/battlemap.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,EAAE;AACF,iBAAiB;AACjB,uFAAuF;AACvF,2FAA2F;AAC3F,0FAA0F;AAC1F,kFAAkF;AAClF,oEAAoE;AACpE,YAAY;AACZ,mBAAmB;AACnB,yDAAyD;AACzD,iEAAiE;AACjE,0BAA0B;AAC1B,gBAAgB;AAChB,iEAAiE;AACjE,wEAAwE;AACxE,QAAQ;AACR,EAAE;AACF,0EAA0E;AAC1E,gEAAgE;AAChE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,qEAAqE;AAErE,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAmBrD,mEAAmE;AACnE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,EAAE,IAAI,EAAE,gCAAgC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,SAAS,EAAE,WAAW;IACtB,MAAM,CAAC,OAAe;QACpB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAY,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACZ,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACjD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC;gBAC/B,CAAC,CAAE,EAAE,CAAC,MAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC5F,CAAC,CAAC,EAAE;SACP,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAExC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QAE7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtE,MAAM,SAAS,GAAG,MAAM;aACrB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CACb,wEAAwE,CAAC,GAAG;cAC1E,mBAAmB,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAC5G;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,KAAK,GACT,CAAC,IAAI,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,EAAE,CAAC;cACjH,4GAA4G,CAAC;QAEjH,MAAM,KAAK,GAAG,MAAM;aACjB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM;iBACnB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACZ,aAAa,SAAS,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CACzF;iBACA,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,6BAA6B,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG;kBACrF,eAAe,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;QAC1D,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5F,MAAM,IAAI,GACR,gCAAgC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;cAClE,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;cAClD,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;cAClD,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;cAC1D,6BAA6B;cAC7B,gDAAgD,SAAS,QAAQ;cACjE,gCAAgC,KAAK,QAAQ;cAC7C,QAAQ;cACR,gCAAgC,KAAK,GAAG,OAAO,QAAQ;cACvD,QAAQ,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,6EAA6E;AAE7E,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGzB,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;CAexB,CAAC;AAEF,qBAAqB,CAAC,gBAAgB,EAAE;IACtC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACjF,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;CACzE,CAAC,CAAC"}
+{"version":3,"file":"battlemap.js","sourceRoot":"","sources":["../../../../src/render/handlers/builtin/battlemap.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,EAAE;AACF,iBAAiB;AACjB,uFAAuF;AACvF,2FAA2F;AAC3F,0FAA0F;AAC1F,kFAAkF;AAClF,oEAAoE;AACpE,YAAY;AACZ,mBAAmB;AACnB,yDAAyD;AACzD,iEAAiE;AACjE,0BAA0B;AAC1B,gBAAgB;AAChB,iEAAiE;AACjE,wEAAwE;AACxE,QAAQ;AACR,EAAE;AACF,0EAA0E;AAC1E,gEAAgE;AAChE,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,+BAA+B;AAE/B,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAmBrD,mEAAmE;AACnE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,EAAE,IAAI,EAAE,gCAAgC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,qDAAqD;AACrD,MAAM,QAAQ,GAAG,0CAA0C,CAAC;AAE5D;;2DAE2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAY,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,MAAqB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC;gBAAE,SAAS;YACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,MAAmB,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,SAAS,EAAE,WAAW;IACtB,MAAM,CAAC,OAAe;QACpB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAY,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACZ,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YACjD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC;gBAC/B,CAAC,CAAE,EAAE,CAAC,MAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC5F,CAAC,CAAC,EAAE;SACP,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAExC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QAE7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,IAAI,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtE,MAAM,SAAS,GAAG,MAAM;aACrB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CACb,wEAAwE,CAAC,GAAG;cAC1E,mBAAmB,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAC5G;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,KAAK,GACT,CAAC,IAAI,CAAC,CAAC,CAAC,qGAAqG,CAAC,CAAC,CAAC,EAAE,CAAC;cACjH,4GAA4G,CAAC;QAEjH,MAAM,KAAK,GAAG,MAAM;aACjB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACb,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM;iBACnB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACZ,aAAa,SAAS,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,mBAAmB,CACzF;iBACA,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,6BAA6B,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG;kBACrF,eAAe,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;QAC1D,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5F,MAAM,IAAI,GACR,gCAAgC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;cAClE,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;cAClD,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;cAClD,GAAG,OAAO,CAAC,CAAC,CAAC,eAAe,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;cAC1D,6BAA6B;cAC7B,gDAAgD,SAAS,QAAQ;cACjE,gCAAgC,KAAK,QAAQ;cAC7C,QAAQ;cACR,gCAAgC,KAAK,GAAG,OAAO,QAAQ;cACvD,QAAQ,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,6EAA6E;AAE7E,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkGzB,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;CAexB,CAAC;AAEF,qBAAqB,CAAC,gBAAgB,EAAE;IACtC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACjF,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;CACzE,CAAC,CAAC"}

package/dist/render/oidc-match.js

@@ -0,0 +1,30 @@
+// Pure email-to-role matching logic for the OIDC login flow, extracted so
+// tests can exercise it without spinning up a Pages Function. The shipped
+// middleware in auth-template.ts duplicates this logic verbatim — it has to
+// live there as plain JS since the worker can't import TS modules at
+// runtime. Keep the two copies in sync (small enough that drift is easy to
+// spot in review).
+/**
+ * Return the highest-ranked role whose rule matches the email, or null.
+ * Roles are ordered low → high; iterate from highest so a visitor matching
+ * several rules gets the strongest role, mirroring the Patreon tier matcher.
+ */
+export function matchOidcRole(email, roleRules, roles) {
+    const at = email.lastIndexOf("@");
+    if (at < 0)
+        return null;
+    const lower = email.toLowerCase();
+    const domain = lower.slice(at + 1);
+    for (let i = roles.length - 1; i >= 0; i--) {
+        const role = roles[i];
+        const rule = roleRules[role];
+        if (!rule)
+            continue;
+        if ((rule.emails ?? []).some((e) => e.toLowerCase() === lower))
+            return role;
+        if (domain && (rule.domains ?? []).some((d) => d.toLowerCase() === domain))
+            return role;
+    }
+    return null;
+}
+//# sourceMappingURL=oidc-match.js.map

package/dist/render/oidc-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-match.js","sourceRoot":"","sources":["../../src/render/oidc-match.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,qEAAqE;AACrE,2EAA2E;AAC3E,mBAAmB;AAgBnB;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,SAAuC,EACvC,KAAe;IAEf,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5E,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wizzlethorpe/vaults",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Sync an Obsidian vault to a Cloudflare-hosted wiki with role-based access. Renders locally, deploys to Cloudflare Pages.",
   "keywords": [
     "obsidian",