gazetta 0.6.0 → 0.8.0

package/dist/auth/factory.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `AuthIdentityProvider` factory — constructs the right provider
+ * from the typed `admin.auth` block in `site.config.ts`.
+ *
+ * # Why a factory and not direct provider exports
+ *
+ * Operators write `admin.auth: { trust: 'cloudflare-access', teamDomain: 'acme' }`
+ * in `site.config.ts`. The admin-api boot code receives this config
+ * (typed as `AuthConfig`) and needs to dispatch to the right provider
+ * factory. Centralizing the dispatch here keeps the built-in
+ * trust-mode set closed (per `design-auth-rbac.md` Q1) while
+ * leaving the operator-config field type open to any
+ * `AuthIdentityProvider` instance — including those returned by
+ * plugin-supplied factories.
+ *
+ * # Plugin promotion path
+ *
+ * Per ADR-0009 + `design-plugins.md`: external trust modes ship as
+ * npm packages exporting a factory function returning
+ * `AuthIdentityProvider`. The operator imports the factory and
+ * assigns its result to `admin.auth` directly (Pattern A factory-
+ * call-at-field). No runtime register method; no central registry
+ * for plugin-contributed providers — the type system accepts any
+ * conforming instance.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: dispatch only. Doesn't read from disk, doesn't construct
+ *     middleware. Pure function over (config) → AuthIdentityProvider.
+ *   - OCP: adding a trust mode is one new case in the switch + one
+ *     import. Existing cases unchanged.
+ *   - DIP: callers depend on AuthIdentityProvider, not on which
+ *     trust mode the operator picked.
+ */
+import type { AuthIdentityProvider } from './provider.js';
+import type { AuthConfig } from './config.js';
+/**
+ * Build the configured `AuthIdentityProvider`. Returns the
+ * `none`-mode provider when `config` is undefined (the default
+ * when `site.config.ts` has no `admin.auth` block).
+ */
+export declare function buildAuthProvider(config: AuthConfig | undefined): AuthIdentityProvider;
+//# sourceMappingURL=factory.d.ts.map

package/dist/auth/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/auth/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAS7C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,oBAAoB,CAkCtF"}

package/dist/auth/factory.js

@@ -0,0 +1,48 @@
+import { AuthConfigurationError } from './errors.js';
+import { noneAuthProvider } from './providers/none.js';
+import { createForwardedUserAuthProvider } from './providers/forwarded-user.js';
+import { createCloudflareAccessAuthProvider } from './providers/cloudflare-access.js';
+import { createAzureEasyAuthProvider } from './providers/azure-easy-auth.js';
+import { createAwsCognitoAuthProvider } from './providers/aws-cognito.js';
+import { createTailscaleAuthProvider } from './providers/tailscale.js';
+/**
+ * Build the configured `AuthIdentityProvider`. Returns the
+ * `none`-mode provider when `config` is undefined (the default
+ * when `site.config.ts` has no `admin.auth` block).
+ */
+export function buildAuthProvider(config) {
+    if (!config)
+        return noneAuthProvider;
+    switch (config.trust) {
+        case 'none':
+            return noneAuthProvider;
+        case 'forwarded-user':
+            return createForwardedUserAuthProvider({
+                trustedProxies: config.trustedProxies,
+                allowAnyOrigin: config.allowAnyOrigin,
+            });
+        case 'cloudflare-access':
+            return createCloudflareAccessAuthProvider({
+                teamDomain: config.teamDomain,
+                audience: config.audience,
+            });
+        case 'azure-easy-auth':
+            return createAzureEasyAuthProvider({});
+        case 'aws-cognito':
+            return createAwsCognitoAuthProvider({
+                region: config.region,
+                audience: config.audience,
+            });
+        case 'tailscale':
+            return createTailscaleAuthProvider({});
+        default: {
+            // Exhaustive check — the discriminated union should make
+            // this unreachable, but defense-in-depth against an operator
+            // bypassing the schema (e.g., constructing the manifest
+            // programmatically).
+            const exhaustiveCheck = config;
+            throw new AuthConfigurationError(`Unknown trust mode in admin.auth: ${JSON.stringify(exhaustiveCheck)}`);
+        }
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/auth/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/auth/factory.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAA;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAA;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAEtE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,gBAAgB,CAAA;IAEpC,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,gBAAgB,CAAA;QACzB,KAAK,gBAAgB;YACnB,OAAO,+BAA+B,CAAC;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC,CAAA;QACJ,KAAK,mBAAmB;YACtB,OAAO,kCAAkC,CAAC;gBACxC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;QACJ,KAAK,iBAAiB;YACpB,OAAO,2BAA2B,CAAC,EAAE,CAAC,CAAA;QACxC,KAAK,aAAa;YAChB,OAAO,4BAA4B,CAAC;gBAClC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;QACJ,KAAK,WAAW;YACd,OAAO,2BAA2B,CAAC,EAAE,CAAC,CAAA;QACxC,OAAO,CAAC,CAAC,CAAC;YACR,yDAAyD;YACzD,6DAA6D;YAC7D,wDAAwD;YACxD,qBAAqB;YACrB,MAAM,eAAe,GAAU,MAAM,CAAA;YACrC,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;QAC1G,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Auth + RBAC barrel export. Imports are stable across cuts;
+ * subsequent cuts (forwarded-user, cloudflare-access, etc.) add
+ * exports without breaking the existing surface.
+ */
+export type { AuthRequest, AuthIdentityProvider } from './provider.js';
+export type { Principal, Role, RoleMapping, TrustMode, BuiltInCapability, } from './types.js';
+export { BUILT_IN_ROLES, RESERVED_CAPABILITY_PREFIXES } from './types.js';
+export { AuthError, AuthConfigurationError, AuthenticationError, AuthorizationError } from './errors.js';
+export { AuthConfigSchema, isReservedPrefix, type AuthConfig } from './config.js';
+export { noneAuthProvider, UNKNOWN_ACTOR_ID } from './providers/none.js';
+export { createForwardedUserAuthProvider, type ForwardedUserConfig } from './providers/forwarded-user.js';
+export { createCloudflareAccessAuthProvider, type CloudflareAccessConfig } from './providers/cloudflare-access.js';
+export { createAzureEasyAuthProvider, type AzureEasyAuthConfig } from './providers/azure-easy-auth.js';
+export { createAwsCognitoAuthProvider, type AwsCognitoConfig } from './providers/aws-cognito.js';
+export { createTailscaleAuthProvider, type TailscaleConfig } from './providers/tailscale.js';
+export { ipMatchesAny, parseRule, parseRules, type ParsedRule } from './ip-match.js';
+export { capabilityGrants, expandRole } from './capabilities.js';
+export { resolveRole, validateCustomRoles, type ResolveRoleArgs, type ResolvedRole } from './role-resolver.js';
+export { buildAuthProvider } from './factory.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACtE,YAAY,EACV,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACxG,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,+BAA+B,EAAE,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACzG,OAAO,EAAE,kCAAkC,EAAE,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAClH,OAAO,EAAE,2BAA2B,EAAE,KAAK,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9G,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,14 @@
+export { BUILT_IN_ROLES, RESERVED_CAPABILITY_PREFIXES } from './types.js';
+export { AuthError, AuthConfigurationError, AuthenticationError, AuthorizationError } from './errors.js';
+export { AuthConfigSchema, isReservedPrefix } from './config.js';
+export { noneAuthProvider, UNKNOWN_ACTOR_ID } from './providers/none.js';
+export { createForwardedUserAuthProvider } from './providers/forwarded-user.js';
+export { createCloudflareAccessAuthProvider } from './providers/cloudflare-access.js';
+export { createAzureEasyAuthProvider } from './providers/azure-easy-auth.js';
+export { createAwsCognitoAuthProvider } from './providers/aws-cognito.js';
+export { createTailscaleAuthProvider } from './providers/tailscale.js';
+export { ipMatchesAny, parseRule, parseRules } from './ip-match.js';
+export { capabilityGrants, expandRole } from './capabilities.js';
+export { resolveRole, validateCustomRoles } from './role-resolver.js';
+export { buildAuthProvider } from './factory.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACxG,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,+BAA+B,EAA4B,MAAM,+BAA+B,CAAA;AACzG,OAAO,EAAE,kCAAkC,EAA+B,MAAM,kCAAkC,CAAA;AAClH,OAAO,EAAE,2BAA2B,EAA4B,MAAM,gCAAgC,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAyB,MAAM,4BAA4B,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAwB,MAAM,0BAA0B,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAA2C,MAAM,oBAAoB,CAAA;AAC9G,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}

package/dist/auth/ip-match.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Parsed CIDR rule. Exposed for tests and reuse by other providers
+ * that may want to validate operator-supplied rule strings.
+ */
+export interface ParsedRule {
+    /** Original rule string (for diagnostics). */
+    raw: string;
+    /** Address family — 4 (IPv4) or 6 (IPv6). */
+    family: 4 | 6;
+    /** Network address as bigint (left-aligned for IPv4 to fit IPv6). */
+    network: bigint;
+    /** Number of leading bits that must match. 32 for IPv4-exact; 128 for IPv6-exact. */
+    prefixBits: number;
+}
+/**
+ * Parse a single rule. Throws on malformed input. Operator's
+ * `trustedProxies` array passes through this once at boot; rules
+ * are validated then cached as `ParsedRule[]` for fast per-request
+ * checks.
+ */
+export declare function parseRule(raw: string): ParsedRule;
+/** Build all rules; throws on the first malformed entry with rule context. */
+export declare function parseRules(rawRules: readonly string[]): ParsedRule[];
+/**
+ * Test whether an IP matches any rule. Returns false for unknown
+ * input (empty string, malformed) — fail-closed.
+ */
+export declare function ipMatchesAny(ip: string | undefined, rules: readonly ParsedRule[]): boolean;
+//# sourceMappingURL=ip-match.d.ts.map

package/dist/auth/ip-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.d.ts","sourceRoot":"","sources":["../../src/auth/ip-match.ts"],"names":[],"mappings":"AAoCA;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,6CAA6C;IAC7C,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;IACb,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAA;IACf,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CA8BjD;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,EAAE,CAEpE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAiB1F"}

package/dist/auth/ip-match.js

@@ -0,0 +1,162 @@
+/**
+ * IP / CIDR membership testing for header-spoofing protection.
+ *
+ * # Why a custom matcher and not a library
+ *
+ * Three reasons:
+ *   - Zero-dep: `net.isIP` ships with Node 22; we only need
+ *     equality + CIDR-prefix checks. A library adds 50KB to a
+ *     small concern.
+ *   - IPv4 + IPv6 mixing: industrial libs (e.g. `ipaddr.js`) handle
+ *     edge cases we don't have (IPv4-mapped IPv6 addresses, etc.).
+ *     For the auth use case the operator-supplied list is small and
+ *     well-understood — they wrote each entry by hand.
+ *   - Multi-instance discipline: the matcher is a pure function over
+ *     `(ip, ruleList)`. No state, no async, no shared mutable cache.
+ *
+ * # Supported syntax
+ *
+ *   - `1.2.3.4` — exact IPv4 match
+ *   - `10.0.0.0/8` — IPv4 CIDR
+ *   - `fe80::1` — exact IPv6 match
+ *   - `fd00::/8` — IPv6 CIDR
+ *
+ * Mixed-family rules are fine; an IPv4 source is checked only
+ * against IPv4 rules, IPv6 against IPv6.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: this module owns IP-vs-rule comparison; doesn't read
+ *     headers, doesn't construct providers.
+ *   - LSP: future provider-specific source-IP needs (e.g.,
+ *     `cloudflare-access` reads `Cf-Connecting-IP`) consume the
+ *     same matcher.
+ */
+import { isIP } from 'node:net';
+/**
+ * Parse a single rule. Throws on malformed input. Operator's
+ * `trustedProxies` array passes through this once at boot; rules
+ * are validated then cached as `ParsedRule[]` for fast per-request
+ * checks.
+ */
+export function parseRule(raw) {
+    const slash = raw.indexOf('/');
+    let addr;
+    let prefix;
+    if (slash >= 0) {
+        addr = raw.slice(0, slash);
+        const prefixStr = raw.slice(slash + 1);
+        prefix = Number.parseInt(prefixStr, 10);
+        if (!Number.isInteger(prefix) || prefix < 0) {
+            throw new Error(`Invalid CIDR prefix in "${raw}": "${prefixStr}" must be a non-negative integer`);
+        }
+    }
+    else {
+        addr = raw;
+        prefix = -1; // sentinel: exact match — set per-family below
+    }
+    const family = isIP(addr);
+    if (family === 0) {
+        throw new Error(`Invalid IP address in "${raw}": "${addr}" is not a valid IPv4 or IPv6 address`);
+    }
+    const maxPrefix = family === 4 ? 32 : 128;
+    if (prefix === -1)
+        prefix = maxPrefix;
+    if (prefix > maxPrefix) {
+        throw new Error(`Invalid CIDR prefix in "${raw}": ${prefix} exceeds max ${maxPrefix} for IPv${family}`);
+    }
+    const fullBits = family === 4 ? ipv4ToBigInt(addr) : ipv6ToBigInt(addr);
+    // Mask off non-prefix bits so the network is canonical (operator
+    // can write 10.1.2.3/8 and we treat it the same as 10.0.0.0/8).
+    const totalBits = family === 4 ? 32 : 128;
+    const network = fullBits & cidrMask(prefix, totalBits);
+    return { raw, family: family, network, prefixBits: prefix };
+}
+/** Build all rules; throws on the first malformed entry with rule context. */
+export function parseRules(rawRules) {
+    return rawRules.map(parseRule);
+}
+/**
+ * Test whether an IP matches any rule. Returns false for unknown
+ * input (empty string, malformed) — fail-closed.
+ */
+export function ipMatchesAny(ip, rules) {
+    if (!ip)
+        return false;
+    const family = isIP(ip);
+    if (family === 0)
+        return false;
+    let value;
+    try {
+        value = family === 4 ? ipv4ToBigInt(ip) : ipv6ToBigInt(ip);
+    }
+    catch {
+        return false;
+    }
+    const totalBits = family === 4 ? 32 : 128;
+    for (const rule of rules) {
+        if (rule.family !== family)
+            continue;
+        const masked = value & cidrMask(rule.prefixBits, totalBits);
+        if (masked === rule.network)
+            return true;
+    }
+    return false;
+}
+// --- Internals ---
+function ipv4ToBigInt(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        throw new Error(`Invalid IPv4: ${ip}`);
+    let n = 0n;
+    for (const part of parts) {
+        const octet = Number.parseInt(part, 10);
+        if (!Number.isInteger(octet) || octet < 0 || octet > 255) {
+            throw new Error(`Invalid IPv4 octet: ${part}`);
+        }
+        n = (n << 8n) | BigInt(octet);
+    }
+    return n;
+}
+function ipv6ToBigInt(ip) {
+    // Handle :: shorthand by expanding to the right number of zero
+    // groups. Doesn't handle IPv4-mapped IPv6 addresses
+    // (e.g. ::ffff:1.2.3.4) — operators with hybrid stacks list
+    // both representations explicitly.
+    const doubleColon = ip.indexOf('::');
+    let groups;
+    if (doubleColon >= 0) {
+        const left = ip.slice(0, doubleColon).split(':').filter(Boolean);
+        const right = ip
+            .slice(doubleColon + 2)
+            .split(':')
+            .filter(Boolean);
+        const fillCount = 8 - left.length - right.length;
+        if (fillCount < 0)
+            throw new Error(`Invalid IPv6: too many groups in ${ip}`);
+        groups = [...left, ...new Array(fillCount).fill('0'), ...right];
+    }
+    else {
+        groups = ip.split(':');
+    }
+    if (groups.length !== 8)
+        throw new Error(`Invalid IPv6: expected 8 groups, got ${groups.length} in ${ip}`);
+    let n = 0n;
+    for (const group of groups) {
+        const value = Number.parseInt(group, 16);
+        if (!Number.isInteger(value) || value < 0 || value > 0xffff) {
+            throw new Error(`Invalid IPv6 group: ${group}`);
+        }
+        n = (n << 16n) | BigInt(value);
+    }
+    return n;
+}
+function cidrMask(prefixBits, totalBits) {
+    if (prefixBits === 0)
+        return 0n;
+    if (prefixBits === totalBits)
+        return (1n << BigInt(totalBits)) - 1n;
+    const ones = (1n << BigInt(prefixBits)) - 1n;
+    return ones << BigInt(totalBits - prefixBits);
+}
+//# sourceMappingURL=ip-match.js.map

package/dist/auth/ip-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.js","sourceRoot":"","sources":["../../src/auth/ip-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAiB/B;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,IAAY,CAAA;IAChB,IAAI,MAAc,CAAA;IAClB,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACtC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,OAAO,SAAS,kCAAkC,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,GAAG,CAAA;QACV,MAAM,GAAG,CAAC,CAAC,CAAA,CAAC,+CAA+C;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,OAAO,IAAI,uCAAuC,CAAC,CAAA;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACzC,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,MAAM,GAAG,SAAS,CAAA;IACrC,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,MAAM,MAAM,gBAAgB,SAAS,WAAW,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACvE,iEAAiE;IACjE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACzC,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAe,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,QAA2B;IACpD,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAAsB,EAAE,KAA4B;IAC/E,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;IACvB,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,IAAI,KAAa,CAAA;IACjB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,SAAQ;QACpC,MAAM,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC3D,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oBAAoB;AAEpB,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,+DAA+D;IAC/D,oDAAoD;IACpD,4DAA4D;IAC5D,mCAAmC;IACnC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,MAAgB,CAAA;IACpB,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,EAAE;aACb,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAChD,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAA;QAC5E,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,CAAA;IAC1G,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB,EAAE,SAAiB;IACrD,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAA;IACnE,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAA;IAC5C,OAAO,IAAI,IAAI,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,CAAA;AAC/C,CAAC"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `AuthIdentityProvider` — the seam between Gazetta and upstream
+ * authentication.
+ *
+ * # The contract
+ *
+ * Each provider knows how to extract a `Principal` from one trust
+ * mode's request shape. The `extractPrincipal(req)` method is
+ * synchronous-or-async; the auth middleware awaits it and attaches
+ * the result to the Hono request context.
+ *
+ * # Error semantics
+ *
+ *   - Returns `null` when the request has no identity (anonymous,
+ *     no upstream auth applied) — the middleware decides whether to
+ *     reject (401) or grant the `unknown` principal based on the
+ *     trust mode
+ *   - Throws `AuthenticationError` when the identity is corrupt
+ *     (signature verification failed, header malformed)
+ *   - Never throws on transport errors (per Universal Provider
+ *     Requirement #5 — fail-open) — JWKS fetch failures fall back
+ *     to fail-closed reject with a structured log
+ *
+ * # Why a registered factory pattern
+ *
+ * Trust modes are operator-configurable in `site.config.ts`. The
+ * dispatcher reads `admin.auth.trust` and constructs the matching
+ * provider. Plugin promotion (per ADR-0009 + `design-plugins.md`):
+ * external trust modes ship as npm packages exporting a factory
+ * function returning `AuthIdentityProvider`; operators import the
+ * factory and assign the result to `admin.auth` directly. No
+ * runtime register method.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: each provider owns one trust mode's mechanics; doesn't
+ *     read config, doesn't dispatch, doesn't wire middleware.
+ *   - LSP: every provider satisfies the same interface; consumers
+ *     branch only on `provider.trustMode` for diagnostics, never
+ *     for behavior.
+ *   - DIP: middleware depends on this interface, not on concrete
+ *     classes.
+ *   - ISP: interface stays narrow — name + extract function. No
+ *     capability-detection methods every provider must stub out.
+ */
+import type { Principal, TrustMode } from './types.js';
+/**
+ * Minimal request shape the provider needs. We don't depend on Hono
+ * directly here so providers can be unit-tested with synthetic
+ * requests; the middleware adapts the Hono request before calling.
+ */
+export interface AuthRequest {
+    /** Map of header name → value. Header names are lowercased per HTTP convention. */
+    headers: ReadonlyMap<string, string>;
+    /** Source IP after trust-mode-driven extraction. Optional. */
+    sourceIp?: string;
+    /** Method + URL — providers rarely need these, but available. */
+    method?: string;
+    url?: string;
+}
+/**
+ * The provider contract. Trust-mode-specific implementations live
+ * under `auth/providers/`.
+ */
+export interface AuthIdentityProvider {
+    /** Identifies the trust mode this provider implements. */
+    readonly trustMode: TrustMode;
+    /**
+     * Pull identity from the request. Returns `null` when no identity
+     * is present (anonymous request); throws `AuthenticationError` for
+     * corrupted credentials. Configuration errors surface at provider
+     * construction, not here.
+     */
+    extractPrincipal(req: AuthRequest): Promise<Principal | null>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/auth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CAC9D"}

package/dist/auth/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":""}

package/dist/auth/providers/aws-cognito.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `aws-cognito` trust mode — AWS Application Load Balancer fronting
+ * the admin with Cognito user pool authentication. ALB injects a
+ * signed JWT in the `x-amzn-oidc-data` header containing the
+ * authenticated user's claims.
+ *
+ * # Why JWT verification (just like cloudflare-access)
+ *
+ * The ALB-issued token is signed with AWS's per-region key. Verifying
+ * the signature is the security contract — without it, anyone behind
+ * the LB or with header-injection access can forge identity.
+ *
+ * # JWKS endpoint shape
+ *
+ * AWS publishes the verification keys at:
+ *
+ *     https://public-keys.auth.elb.{region}.amazonaws.com/{kid}
+ *
+ * Unlike Cloudflare's single-JWKS endpoint, AWS's endpoint is keyed
+ * by the JWT header's `kid`. jose's `createRemoteJWKSet` doesn't fit
+ * this shape; we wire a custom `JWTVerifyGetKey` that fetches the
+ * specific kid. The `jwksFactory` injection point makes this pluggable
+ * for tests.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: same as cloudflare-access — JWT verification only.
+ *   - LSP: same `AuthIdentityProvider` shape.
+ *   - DIP: jwksFactory injection point lets tests run without HTTP.
+ */
+import { type JWTVerifyGetKey } from 'jose';
+import type { AuthIdentityProvider } from '../provider.js';
+export interface AwsCognitoConfig {
+    /**
+     * AWS region the ALB runs in. Required to construct the JWKS URL
+     * (`public-keys.auth.elb.{region}.amazonaws.com`).
+     */
+    region: string;
+    /**
+     * Optional `aud` claim — Cognito user-pool app client id. Setting
+     * this prevents token replay across other Cognito-protected apps
+     * sharing the same user pool.
+     */
+    audience?: string;
+    /** Optional default role until Cut 6's role-resolver wires up. */
+    defaultRole?: string;
+    /**
+     * Internal: factory for the JWKS verifier. Tests inject a stub.
+     * Production builds a fetch-based key resolver per AWS's
+     * keyed-by-kid endpoint shape.
+     */
+    jwksFactory?: (region: string) => JWTVerifyGetKey;
+}
+export declare function createAwsCognitoAuthProvider(config: AwsCognitoConfig): AuthIdentityProvider;
+//# sourceMappingURL=aws-cognito.d.ts.map

package/dist/auth/providers/aws-cognito.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-cognito.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/aws-cognito.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAA8B,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAEvE,OAAO,KAAK,EAAE,oBAAoB,EAAe,MAAM,gBAAgB,CAAA;AAIvE,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,CAAA;CAClD;AAyDD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CA2C3F"}

package/dist/auth/providers/aws-cognito.js

@@ -0,0 +1,114 @@
+/**
+ * `aws-cognito` trust mode — AWS Application Load Balancer fronting
+ * the admin with Cognito user pool authentication. ALB injects a
+ * signed JWT in the `x-amzn-oidc-data` header containing the
+ * authenticated user's claims.
+ *
+ * # Why JWT verification (just like cloudflare-access)
+ *
+ * The ALB-issued token is signed with AWS's per-region key. Verifying
+ * the signature is the security contract — without it, anyone behind
+ * the LB or with header-injection access can forge identity.
+ *
+ * # JWKS endpoint shape
+ *
+ * AWS publishes the verification keys at:
+ *
+ *     https://public-keys.auth.elb.{region}.amazonaws.com/{kid}
+ *
+ * Unlike Cloudflare's single-JWKS endpoint, AWS's endpoint is keyed
+ * by the JWT header's `kid`. jose's `createRemoteJWKSet` doesn't fit
+ * this shape; we wire a custom `JWTVerifyGetKey` that fetches the
+ * specific kid. The `jwksFactory` injection point makes this pluggable
+ * for tests.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: same as cloudflare-access — JWT verification only.
+ *   - LSP: same `AuthIdentityProvider` shape.
+ *   - DIP: jwksFactory injection point lets tests run without HTTP.
+ */
+import { jwtVerify } from 'jose';
+import { AuthenticationError, AuthConfigurationError } from '../errors.js';
+import { expandRole } from '../capabilities.js';
+/**
+ * Default JWKS factory — fetches AWS's per-kid public key. Each
+ * verification call may hit a different kid; the resolver caches
+ * downloaded keys to keep verification fast under steady load.
+ *
+ * Operators may want to override this with a `createRemoteJWKSet`
+ * variant if they front Cognito directly (without ALB) — that's
+ * outside Cut 5's scope; the injection point keeps it open.
+ */
+function defaultJwksFactory(region) {
+    const cache = new Map();
+    return async (header) => {
+        if (!header.kid) {
+            throw new AuthenticationError('AWS Cognito JWT has no kid in header');
+        }
+        const cached = cache.get(header.kid);
+        if (cached)
+            return cached;
+        const url = `https://public-keys.auth.elb.${region}.amazonaws.com/${encodeURIComponent(header.kid)}`;
+        const res = await fetch(url);
+        if (!res.ok) {
+            throw new AuthenticationError(`AWS public-keys endpoint returned ${res.status} for kid ${header.kid}`);
+        }
+        const pem = await res.text();
+        // Defer to Web Crypto's importKey via jose — actually jose
+        // accepts CryptoKey directly. We use Node's crypto subtle to
+        // import the PEM. This works in Node 22+ which has full WebCrypto.
+        const subtle = (globalThis.crypto ?? require('node:crypto').webcrypto).subtle;
+        const key = await subtle.importKey('spki', pemToDer(pem), { name: 'ECDSA', namedCurve: header.alg === 'ES512' ? 'P-521' : 'P-256' }, false, ['verify']);
+        cache.set(header.kid, key);
+        return key;
+    };
+}
+function pemToDer(pem) {
+    const body = pem
+        .replace(/-----BEGIN [^-]+-----/, '')
+        .replace(/-----END [^-]+-----/, '')
+        .replace(/\s+/g, '');
+    const bin = Buffer.from(body, 'base64');
+    return bin.buffer.slice(bin.byteOffset, bin.byteOffset + bin.byteLength);
+}
+export function createAwsCognitoAuthProvider(config) {
+    if (!config.region || config.region.length === 0) {
+        throw new AuthConfigurationError('aws-cognito trust mode requires region (e.g. "us-east-1")');
+    }
+    if (!/^[a-z]{2}-[a-z]+-\d+$/.test(config.region)) {
+        throw new AuthConfigurationError(`Invalid region "${config.region}": expected AWS region format like "us-east-1" or "eu-west-2"`);
+    }
+    const jwks = (config.jwksFactory ?? defaultJwksFactory)(config.region);
+    const defaultRole = config.defaultRole ?? 'editor';
+    return {
+        trustMode: 'aws-cognito',
+        async extractPrincipal(req) {
+            const token = req.headers.get('x-amzn-oidc-data');
+            if (!token)
+                return null;
+            let payload;
+            try {
+                const result = await jwtVerify(token, jwks, {
+                    audience: config.audience,
+                });
+                payload = result.payload;
+            }
+            catch (err) {
+                throw new AuthenticationError(`AWS Cognito JWT verification failed: ${err.message}`);
+            }
+            const id = payload.sub ?? payload.username;
+            if (!id) {
+                throw new AuthenticationError('AWS Cognito JWT has no sub or username claim');
+            }
+            return {
+                id,
+                email: payload.email,
+                role: defaultRole,
+                trustMode: 'aws-cognito',
+                capabilities: expandRole(defaultRole) ?? [],
+            };
+        },
+    };
+}
+//# sourceMappingURL=aws-cognito.js.map

package/dist/auth/providers/aws-cognito.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-cognito.js","sourceRoot":"","sources":["../../../src/auth/providers/aws-cognito.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAA;AAGvE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AA+B/C;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC1C,OAAO,KAAK,EAAE,MAAsC,EAAE,EAAE;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAA;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,MAAM,GAAG,GAAG,gCAAgC,MAAM,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACpG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,GAAG,CAAC,MAAM,YAAY,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QACxG,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC5B,2DAA2D;QAC3D,6DAA6D;QAC7D,mEAAmE;QACnE,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAA;QAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,MAAM,EACN,QAAQ,CAAC,GAAG,CAAC,EACb,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EACzE,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;SAClC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAwB;IACnE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAAC,2DAA2D,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAC9B,mBAAmB,MAAM,CAAC,MAAM,+DAA+D,CAChG,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAA;IAElD,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,KAAK,CAAC,gBAAgB,CAAC,GAAgB;YACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEvB,IAAI,OAAsB,CAAA;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAgB,KAAK,EAAE,IAAI,EAAE;oBACzD,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAA;gBACF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,wCAAyC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;YACjG,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAA;YAC/E,CAAC;YAED,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,aAAa;gBACxB,YAAY,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE;aAC5C,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/auth/providers/azure-easy-auth.d.ts

@@ -0,0 +1,7 @@
+import type { AuthIdentityProvider } from '../provider.js';
+export interface AzureEasyAuthConfig {
+    /** Optional default role until Cut 6's role-resolver wires up. */
+    defaultRole?: string;
+}
+export declare function createAzureEasyAuthProvider(config?: AzureEasyAuthConfig): AuthIdentityProvider;
+//# sourceMappingURL=azure-easy-auth.d.ts.map

package/dist/auth/providers/azure-easy-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-easy-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/azure-easy-auth.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,oBAAoB,EAAe,MAAM,gBAAgB,CAAA;AAIvE,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAeD,wBAAgB,2BAA2B,CAAC,MAAM,GAAE,mBAAwB,GAAG,oBAAoB,CAkDlG"}