gazetta 0.7.0 → 0.8.0

package/dist/auth/config.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Zod schema for the `admin.auth` block in `site.config.ts`. This
+ * cut ships only the `none`-mode shape; subsequent cuts add Zod
+ * variants for `forwarded-user`, `cloudflare-access`, etc.
+ *
+ * # Why a discriminated union
+ *
+ * Each trust mode's configuration shape is genuinely different
+ * (`forwarded-user` has `trustedProxyCount`; `cloudflare-access`
+ * has `teamDomain`; `none` has no provider-specific fields). A
+ * discriminated union on `trust:` lets TypeScript narrow per
+ * mode automatically and gives operators IDE autocomplete for the
+ * fields their chosen mode accepts.
+ *
+ * # Defaults
+ *
+ * Operators who don't set `admin.auth` run in `none` mode. The
+ * site-loader treats absent `admin.auth` as `{ trust: 'none' }`.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: schema validation only; doesn't construct providers.
+ *   - OCP: adding a trust mode appends one variant to the union;
+ *     existing variants unchanged.
+ */
+import { z } from 'zod';
+/**
+ * Top-level discriminated union. All v1 trust modes locked.
+ * Future plugin-supplied modes (per design-auth-rbac.md Q1's plugin
+ * promotion trigger) extend the union via the plugin contract — not
+ * by editing this file.
+ */
+export declare const AuthConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    trust: z.ZodLiteral<"none">;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        capabilities: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    trust: z.ZodLiteral<"forwarded-user">;
+    trustedProxies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowAnyOrigin: z.ZodOptional<z.ZodBoolean>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        capabilities: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    roleMapping: z.ZodOptional<z.ZodObject<{
+        claim: z.ZodString;
+        map: z.ZodRecord<z.ZodString, z.ZodString>;
+        defaultRole: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    trust: z.ZodLiteral<"cloudflare-access">;
+    teamDomain: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        capabilities: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    roleMapping: z.ZodOptional<z.ZodObject<{
+        claim: z.ZodString;
+        map: z.ZodRecord<z.ZodString, z.ZodString>;
+        defaultRole: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    trust: z.ZodLiteral<"azure-easy-auth">;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        capabilities: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    roleMapping: z.ZodOptional<z.ZodObject<{
+        claim: z.ZodString;
+        map: z.ZodRecord<z.ZodString, z.ZodString>;
+        defaultRole: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    trust: z.ZodLiteral<"aws-cognito">;
+    region: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        capabilities: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    roleMapping: z.ZodOptional<z.ZodObject<{
+        claim: z.ZodString;
+        map: z.ZodRecord<z.ZodString, z.ZodString>;
+        defaultRole: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    trust: z.ZodLiteral<"tailscale">;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        capabilities: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
+    roleMapping: z.ZodOptional<z.ZodObject<{
+        claim: z.ZodString;
+        map: z.ZodRecord<z.ZodString, z.ZodString>;
+        defaultRole: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>>;
+    strict: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>], "trust">;
+export type AuthConfig = z.infer<typeof AuthConfigSchema>;
+/**
+ * Reserved-prefix check. Future plugin-supplied capabilities use
+ * plugin-scoped prefixes (e.g., `@my-org/...:`); custom roles MUST
+ * NOT redefine reserved built-in prefixes with conflicting
+ * semantics. The role-resolver enforces this at load time.
+ */
+export declare function isReservedPrefix(capability: string): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAkLvB;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAO3B,CAAA;AAEF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAM5D"}

package/dist/auth/config.js

@@ -0,0 +1,221 @@
+/**
+ * Zod schema for the `admin.auth` block in `site.config.ts`. This
+ * cut ships only the `none`-mode shape; subsequent cuts add Zod
+ * variants for `forwarded-user`, `cloudflare-access`, etc.
+ *
+ * # Why a discriminated union
+ *
+ * Each trust mode's configuration shape is genuinely different
+ * (`forwarded-user` has `trustedProxyCount`; `cloudflare-access`
+ * has `teamDomain`; `none` has no provider-specific fields). A
+ * discriminated union on `trust:` lets TypeScript narrow per
+ * mode automatically and gives operators IDE autocomplete for the
+ * fields their chosen mode accepts.
+ *
+ * # Defaults
+ *
+ * Operators who don't set `admin.auth` run in `none` mode. The
+ * site-loader treats absent `admin.auth` as `{ trust: 'none' }`.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: schema validation only; doesn't construct providers.
+ *   - OCP: adding a trust mode appends one variant to the union;
+ *     existing variants unchanged.
+ */
+import { z } from 'zod';
+import { RESERVED_CAPABILITY_PREFIXES } from './types.js';
+/**
+ * Capability-shape regex. Either a wildcard (`'*'`) or
+ * `<prefix>:<rest>` where `rest` may itself be a wildcard.
+ * Plugin-supplied capabilities use scoped prefixes (e.g.,
+ * `@my-org/search:rebuild-index`); the schema accepts those too.
+ */
+const capabilityRegex = /^(\*|[a-zA-Z@][a-zA-Z0-9@/_-]*:[a-zA-Z*][a-zA-Z0-9_-]*)$/;
+const capabilitySchema = z.string().regex(capabilityRegex, 'Capability must be either "*" or "<prefix>:<rest>"');
+/**
+ * Custom role definition — operator-declared in `site.config.ts`.
+ * Built-in roles (`admin`, `editor`, `viewer`) are predefined and
+ * don't appear here; operators only declare custom roles.
+ */
+const roleSchema = z
+    .object({
+    capabilities: z.array(capabilitySchema).readonly(),
+})
+    .strict();
+const roleMappingSchema = z
+    .object({
+    /** Which JSON claim / header field carries the upstream group list. */
+    claim: z.string(),
+    /** Map from upstream group name to Gazetta role name. */
+    map: z.record(z.string(), z.string()),
+    /** Fallback role when no group matches. `null` denies access. */
+    defaultRole: z.string().nullable().optional(),
+})
+    .strict();
+/**
+ * `none` trust mode — the default. No provider-specific fields.
+ * Operators omitting `admin.auth` entirely fall back to this shape
+ * with all defaults.
+ */
+const noneAuthSchema = z
+    .object({
+    trust: z.literal('none'),
+    /** Custom role declarations (rare in `none` mode but allowed). */
+    roles: z.record(z.string(), roleSchema).optional(),
+    /** Strict mode — invalid roles fail boot vs. log warning. */
+    strict: z.boolean().optional(),
+})
+    .strict();
+/**
+ * `forwarded-user` trust mode — generic reverse-proxy mode. The
+ * upstream layer (oauth2-proxy, Authelia, Caddy with `forward_auth`,
+ * etc.) populates `X-Forwarded-User` and optionally
+ * `X-Forwarded-Email` / `X-Forwarded-Groups`.
+ *
+ * # Header-spoofing protection
+ *
+ * Operators MUST configure source-IP protection per
+ * `design-auth-rbac.md` Q1: either `trustedProxies` (whitelist of
+ * IPs/CIDRs that may set the headers) OR `allowAnyOrigin: true`
+ * (explicit opt-in for dev / private networks).
+ *
+ * Default: fail-closed. Without `trustedProxies` AND without
+ * `allowAnyOrigin`, the provider rejects every request — surfaces
+ * as 401 with a config-hint message. This matches Q4's
+ * "fail-closed" recommendation in the design's "Source-IP whitelist
+ * semantics" open question.
+ */
+const forwardedUserAuthSchema = z
+    .object({
+    trust: z.literal('forwarded-user'),
+    /**
+     * IPs or CIDR blocks that may set the forwarded headers. Each
+     * entry is an IP literal (`192.168.1.10`) or CIDR
+     * (`10.0.0.0/8`, `fd00::/8`). Empty array + missing
+     * `allowAnyOrigin` → all requests rejected.
+     */
+    trustedProxies: z.array(z.string()).optional(),
+    /**
+     * Explicit opt-out of source-IP protection. Use ONLY in dev or
+     * trusted private networks (Tailscale, internal VPNs).
+     * Production deployments behind a public load balancer MUST
+     * use `trustedProxies` instead.
+     */
+    allowAnyOrigin: z.boolean().optional(),
+    roles: z.record(z.string(), roleSchema).optional(),
+    roleMapping: roleMappingSchema.optional(),
+    strict: z.boolean().optional(),
+})
+    .strict()
+    .refine(cfg => cfg.allowAnyOrigin || (cfg.trustedProxies && cfg.trustedProxies.length > 0), {
+    message: 'forwarded-user trust mode requires trustedProxies (IP whitelist) OR allowAnyOrigin: true. Without either, every request is rejected — likely a misconfiguration. Set trustedProxies for production deployments behind a known proxy; set allowAnyOrigin: true only in dev or trusted private networks.',
+    path: ['trustedProxies'],
+});
+/**
+ * `cloudflare-access` trust mode — Cloudflare Zero Trust fronting
+ * the admin. The platform issues a signed JWT in
+ * `Cf-Access-Jwt-Assertion` (or `CF_Authorization` cookie); Gazetta
+ * verifies the signature against Cloudflare's published JWKS.
+ *
+ * # Why no source-IP check
+ *
+ * The signed JWT IS the trust. Source IP would be Cloudflare's edge
+ * regardless of the original client; verifying the signature is the
+ * security boundary.
+ *
+ * # `audience` claim verification
+ *
+ * Optional but strongly recommended. Cloudflare Access tokens carry
+ * an `aud` claim identifying the application; production deployments
+ * SHOULD set this to prevent token replay across other
+ * Access-protected apps in the same team.
+ */
+const cloudflareAccessAuthSchema = z
+    .object({
+    trust: z.literal('cloudflare-access'),
+    /**
+     * Cloudflare Zero Trust team domain (the part before
+     * `.cloudflareaccess.com`). Lowercase alphanumeric + hyphens.
+     */
+    teamDomain: z.string().regex(/^[a-z0-9][a-z0-9-]*$/, 'teamDomain must be lowercase alphanumeric + hyphens'),
+    /** Optional aud claim — recommended for production. */
+    audience: z.string().optional(),
+    roles: z.record(z.string(), roleSchema).optional(),
+    roleMapping: roleMappingSchema.optional(),
+    strict: z.boolean().optional(),
+})
+    .strict();
+/**
+ * `azure-easy-auth` trust mode — Azure App Service Easy Auth.
+ * Trust boundary is the App Service sandbox; Gazetta just decodes
+ * the X-MS-CLIENT-PRINCIPAL header. No provider-specific config
+ * fields — the platform handles auth.
+ */
+const azureEasyAuthSchema = z
+    .object({
+    trust: z.literal('azure-easy-auth'),
+    roles: z.record(z.string(), roleSchema).optional(),
+    roleMapping: roleMappingSchema.optional(),
+    strict: z.boolean().optional(),
+})
+    .strict();
+/**
+ * `aws-cognito` trust mode — AWS ALB + Cognito user pool. JWT
+ * verification against per-region public keys.
+ */
+const awsCognitoAuthSchema = z
+    .object({
+    trust: z.literal('aws-cognito'),
+    /** AWS region (e.g. "us-east-1"). Required for the JWKS URL. */
+    region: z.string().regex(/^[a-z]{2}-[a-z]+-\d+$/, 'region must be an AWS region like "us-east-1"'),
+    /** Optional aud claim — Cognito user-pool app client id. */
+    audience: z.string().optional(),
+    roles: z.record(z.string(), roleSchema).optional(),
+    roleMapping: roleMappingSchema.optional(),
+    strict: z.boolean().optional(),
+})
+    .strict();
+/**
+ * `tailscale` trust mode — Tailscale Funnel / serve. Trust comes
+ * from the tailnet itself (only authenticated members can reach
+ * the listener). No provider-specific config.
+ */
+const tailscaleAuthSchema = z
+    .object({
+    trust: z.literal('tailscale'),
+    roles: z.record(z.string(), roleSchema).optional(),
+    roleMapping: roleMappingSchema.optional(),
+    strict: z.boolean().optional(),
+})
+    .strict();
+/**
+ * Top-level discriminated union. All v1 trust modes locked.
+ * Future plugin-supplied modes (per design-auth-rbac.md Q1's plugin
+ * promotion trigger) extend the union via the plugin contract — not
+ * by editing this file.
+ */
+export const AuthConfigSchema = z.discriminatedUnion('trust', [
+    noneAuthSchema,
+    forwardedUserAuthSchema,
+    cloudflareAccessAuthSchema,
+    azureEasyAuthSchema,
+    awsCognitoAuthSchema,
+    tailscaleAuthSchema,
+]);
+/**
+ * Reserved-prefix check. Future plugin-supplied capabilities use
+ * plugin-scoped prefixes (e.g., `@my-org/...:`); custom roles MUST
+ * NOT redefine reserved built-in prefixes with conflicting
+ * semantics. The role-resolver enforces this at load time.
+ */
+export function isReservedPrefix(capability) {
+    if (capability === '*')
+        return true;
+    const colonIdx = capability.indexOf(':');
+    if (colonIdx <= 0)
+        return false;
+    const prefix = capability.slice(0, colonIdx);
+    return RESERVED_CAPABILITY_PREFIXES.includes(prefix);
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AAEzD;;;;;GAKG;AACH,MAAM,eAAe,GAAG,0DAA0D,CAAA;AAElF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAA;AAEhH;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,uEAAuE;IACvE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,yDAAyD;IACzD,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,iEAAiE;IACjE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxB,kEAAkE;IAClE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;IAClD,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;IAC1F,OAAO,EACL,wSAAwS;IAC1S,IAAI,EAAE,CAAC,gBAAgB,CAAC;CACzB,CAAC,CAAA;AAEJ;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACrC;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,qDAAqD,CAAC;IAC3G,uDAAuD;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC/B,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,EAAE,+CAA+C,CAAC;IAClG,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,MAAM,EAAE,CAAA;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE;IAC5D,cAAc;IACd,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;CACpB,CAAC,CAAA;AAIF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC5C,OAAQ,4BAAkD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC7E,CAAC"}

package/dist/auth/errors.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Auth-specific error taxonomy. Distinct from validation errors;
+ * downstream consumers (route handlers, audit recorder) catch these
+ * to map to the right HTTP status and audit outcome.
+ *
+ * # Why a dedicated taxonomy
+ *
+ * Per `design-plugins.md`'s Universal Provider Requirements, every
+ * provider surface has its own error taxonomy. Auth's errors split
+ * along three axes:
+ *
+ *   - Configuration errors (invalid `site.config.ts admin.auth`
+ *     block) — surface at boot, fail closed
+ *   - Authentication errors (the upstream provider couldn't extract
+ *     identity) — surface as 401
+ *   - Authorization errors (principal lacks the required capability)
+ *     — surface as 403
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: error classes own only error identity and HTTP-status
+ *     mapping. They don't carry rendering logic — route handlers
+ *     map to JSON via `error-response.ts`.
+ *   - LSP: every subclass extends `AuthError` so route handlers
+ *     can branch on the base class then narrow by instanceof.
+ */
+/** Base class for all auth-related errors. */
+export declare class AuthError extends Error {
+    readonly name: string;
+    /** HTTP status the route should return. Subclasses override. */
+    readonly httpStatus: number;
+    constructor(message: string);
+}
+/**
+ * Thrown at config-load time when `admin.auth` is malformed (unknown
+ * trust mode, role-mapping references unknown capabilities, etc.).
+ * Admin won't start.
+ */
+export declare class AuthConfigurationError extends AuthError {
+    readonly name = "AuthConfigurationError";
+    readonly httpStatus = 500;
+}
+/**
+ * Thrown when the upstream provider's expected header / claim is
+ * missing, malformed, or fails signature verification. Surfaces as
+ * 401 with `WWW-Authenticate` hint pointing back at the upstream.
+ */
+export declare class AuthenticationError extends AuthError {
+    readonly name = "AuthenticationError";
+    readonly httpStatus = 401;
+}
+/**
+ * Thrown when an authenticated principal lacks the capability the
+ * route requires. Surfaces as 403 with structured body listing
+ * `missing` capabilities and the principal's `role`.
+ */
+export declare class AuthorizationError extends AuthError {
+    readonly name = "AuthorizationError";
+    readonly httpStatus = 403;
+    /**
+     * Capabilities the principal would need to authorize this request.
+     * Surfaced in the 403 body so authenticated users see what they
+     * can't do — per design-auth-rbac.md "Failure mode": existence-
+     * leak risk doesn't justify 404-hide-existence semantics for
+     * already-authenticated users.
+     */
+    readonly missing: ReadonlyArray<string>;
+    /** Principal's role at decision time — surfaced in the 403 body. */
+    readonly role: string;
+    constructor(message: string, missing: ReadonlyArray<string>, role: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,8CAA8C;AAC9C,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAkB,IAAI,EAAE,MAAM,CAAc;IAC5C,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAM;gBACrB,OAAO,EAAE,MAAM;CAG5B;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,SAAS;IACnD,SAAkB,IAAI,4BAA2B;IACjD,SAAkB,UAAU,OAAM;CACnC;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,SAAkB,IAAI,yBAAwB;IAC9C,SAAkB,UAAU,OAAM;CACnC;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;IAC/C,SAAkB,IAAI,wBAAuB;IAC7C,SAAkB,UAAU,OAAM;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBACT,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM;CAK1E"}

package/dist/auth/errors.js

@@ -0,0 +1,78 @@
+/**
+ * Auth-specific error taxonomy. Distinct from validation errors;
+ * downstream consumers (route handlers, audit recorder) catch these
+ * to map to the right HTTP status and audit outcome.
+ *
+ * # Why a dedicated taxonomy
+ *
+ * Per `design-plugins.md`'s Universal Provider Requirements, every
+ * provider surface has its own error taxonomy. Auth's errors split
+ * along three axes:
+ *
+ *   - Configuration errors (invalid `site.config.ts admin.auth`
+ *     block) — surface at boot, fail closed
+ *   - Authentication errors (the upstream provider couldn't extract
+ *     identity) — surface as 401
+ *   - Authorization errors (principal lacks the required capability)
+ *     — surface as 403
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: error classes own only error identity and HTTP-status
+ *     mapping. They don't carry rendering logic — route handlers
+ *     map to JSON via `error-response.ts`.
+ *   - LSP: every subclass extends `AuthError` so route handlers
+ *     can branch on the base class then narrow by instanceof.
+ */
+/** Base class for all auth-related errors. */
+export class AuthError extends Error {
+    name = 'AuthError';
+    /** HTTP status the route should return. Subclasses override. */
+    httpStatus = 500;
+    constructor(message) {
+        super(message);
+    }
+}
+/**
+ * Thrown at config-load time when `admin.auth` is malformed (unknown
+ * trust mode, role-mapping references unknown capabilities, etc.).
+ * Admin won't start.
+ */
+export class AuthConfigurationError extends AuthError {
+    name = 'AuthConfigurationError';
+    httpStatus = 500;
+}
+/**
+ * Thrown when the upstream provider's expected header / claim is
+ * missing, malformed, or fails signature verification. Surfaces as
+ * 401 with `WWW-Authenticate` hint pointing back at the upstream.
+ */
+export class AuthenticationError extends AuthError {
+    name = 'AuthenticationError';
+    httpStatus = 401;
+}
+/**
+ * Thrown when an authenticated principal lacks the capability the
+ * route requires. Surfaces as 403 with structured body listing
+ * `missing` capabilities and the principal's `role`.
+ */
+export class AuthorizationError extends AuthError {
+    name = 'AuthorizationError';
+    httpStatus = 403;
+    /**
+     * Capabilities the principal would need to authorize this request.
+     * Surfaced in the 403 body so authenticated users see what they
+     * can't do — per design-auth-rbac.md "Failure mode": existence-
+     * leak risk doesn't justify 404-hide-existence semantics for
+     * already-authenticated users.
+     */
+    missing;
+    /** Principal's role at decision time — surfaced in the 403 body. */
+    role;
+    constructor(message, missing, role) {
+        super(message);
+        this.missing = missing;
+        this.role = role;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,8CAA8C;AAC9C,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAW,WAAW,CAAA;IAC5C,gEAAgE;IACvD,UAAU,GAAW,GAAG,CAAA;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;IAChB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IACjC,IAAI,GAAG,wBAAwB,CAAA;IAC/B,UAAU,GAAG,GAAG,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAC9B,IAAI,GAAG,qBAAqB,CAAA;IAC5B,UAAU,GAAG,GAAG,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC7B,IAAI,GAAG,oBAAoB,CAAA;IAC3B,UAAU,GAAG,GAAG,CAAA;IAClC;;;;;;OAMG;IACM,OAAO,CAAuB;IACvC,oEAAoE;IAC3D,IAAI,CAAQ;IACrB,YAAY,OAAe,EAAE,OAA8B,EAAE,IAAY;QACvE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF"}

package/dist/auth/factory.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `AuthIdentityProvider` factory — constructs the right provider
+ * from the typed `admin.auth` block in `site.config.ts`.
+ *
+ * # Why a factory and not direct provider exports
+ *
+ * Operators write `admin.auth: { trust: 'cloudflare-access', teamDomain: 'acme' }`
+ * in `site.config.ts`. The admin-api boot code receives this config
+ * (typed as `AuthConfig`) and needs to dispatch to the right provider
+ * factory. Centralizing the dispatch here keeps the built-in
+ * trust-mode set closed (per `design-auth-rbac.md` Q1) while
+ * leaving the operator-config field type open to any
+ * `AuthIdentityProvider` instance — including those returned by
+ * plugin-supplied factories.
+ *
+ * # Plugin promotion path
+ *
+ * Per ADR-0009 + `design-plugins.md`: external trust modes ship as
+ * npm packages exporting a factory function returning
+ * `AuthIdentityProvider`. The operator imports the factory and
+ * assigns its result to `admin.auth` directly (Pattern A factory-
+ * call-at-field). No runtime register method; no central registry
+ * for plugin-contributed providers — the type system accepts any
+ * conforming instance.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: dispatch only. Doesn't read from disk, doesn't construct
+ *     middleware. Pure function over (config) → AuthIdentityProvider.
+ *   - OCP: adding a trust mode is one new case in the switch + one
+ *     import. Existing cases unchanged.
+ *   - DIP: callers depend on AuthIdentityProvider, not on which
+ *     trust mode the operator picked.
+ */
+import type { AuthIdentityProvider } from './provider.js';
+import type { AuthConfig } from './config.js';
+/**
+ * Build the configured `AuthIdentityProvider`. Returns the
+ * `none`-mode provider when `config` is undefined (the default
+ * when `site.config.ts` has no `admin.auth` block).
+ */
+export declare function buildAuthProvider(config: AuthConfig | undefined): AuthIdentityProvider;
+//# sourceMappingURL=factory.d.ts.map

package/dist/auth/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/auth/factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAS7C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,oBAAoB,CAkCtF"}

package/dist/auth/factory.js

@@ -0,0 +1,48 @@
+import { AuthConfigurationError } from './errors.js';
+import { noneAuthProvider } from './providers/none.js';
+import { createForwardedUserAuthProvider } from './providers/forwarded-user.js';
+import { createCloudflareAccessAuthProvider } from './providers/cloudflare-access.js';
+import { createAzureEasyAuthProvider } from './providers/azure-easy-auth.js';
+import { createAwsCognitoAuthProvider } from './providers/aws-cognito.js';
+import { createTailscaleAuthProvider } from './providers/tailscale.js';
+/**
+ * Build the configured `AuthIdentityProvider`. Returns the
+ * `none`-mode provider when `config` is undefined (the default
+ * when `site.config.ts` has no `admin.auth` block).
+ */
+export function buildAuthProvider(config) {
+    if (!config)
+        return noneAuthProvider;
+    switch (config.trust) {
+        case 'none':
+            return noneAuthProvider;
+        case 'forwarded-user':
+            return createForwardedUserAuthProvider({
+                trustedProxies: config.trustedProxies,
+                allowAnyOrigin: config.allowAnyOrigin,
+            });
+        case 'cloudflare-access':
+            return createCloudflareAccessAuthProvider({
+                teamDomain: config.teamDomain,
+                audience: config.audience,
+            });
+        case 'azure-easy-auth':
+            return createAzureEasyAuthProvider({});
+        case 'aws-cognito':
+            return createAwsCognitoAuthProvider({
+                region: config.region,
+                audience: config.audience,
+            });
+        case 'tailscale':
+            return createTailscaleAuthProvider({});
+        default: {
+            // Exhaustive check — the discriminated union should make
+            // this unreachable, but defense-in-depth against an operator
+            // bypassing the schema (e.g., constructing the manifest
+            // programmatically).
+            const exhaustiveCheck = config;
+            throw new AuthConfigurationError(`Unknown trust mode in admin.auth: ${JSON.stringify(exhaustiveCheck)}`);
+        }
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/auth/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/auth/factory.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAA;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAA;AACrF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAC5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAEtE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,gBAAgB,CAAA;IAEpC,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,gBAAgB,CAAA;QACzB,KAAK,gBAAgB;YACnB,OAAO,+BAA+B,CAAC;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CAAC,CAAA;QACJ,KAAK,mBAAmB;YACtB,OAAO,kCAAkC,CAAC;gBACxC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;QACJ,KAAK,iBAAiB;YACpB,OAAO,2BAA2B,CAAC,EAAE,CAAC,CAAA;QACxC,KAAK,aAAa;YAChB,OAAO,4BAA4B,CAAC;gBAClC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;QACJ,KAAK,WAAW;YACd,OAAO,2BAA2B,CAAC,EAAE,CAAC,CAAA;QACxC,OAAO,CAAC,CAAC,CAAC;YACR,yDAAyD;YACzD,6DAA6D;YAC7D,wDAAwD;YACxD,qBAAqB;YACrB,MAAM,eAAe,GAAU,MAAM,CAAA;YACrC,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;QAC1G,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Auth + RBAC barrel export. Imports are stable across cuts;
+ * subsequent cuts (forwarded-user, cloudflare-access, etc.) add
+ * exports without breaking the existing surface.
+ */
+export type { AuthRequest, AuthIdentityProvider } from './provider.js';
+export type { Principal, Role, RoleMapping, TrustMode, BuiltInCapability, } from './types.js';
+export { BUILT_IN_ROLES, RESERVED_CAPABILITY_PREFIXES } from './types.js';
+export { AuthError, AuthConfigurationError, AuthenticationError, AuthorizationError } from './errors.js';
+export { AuthConfigSchema, isReservedPrefix, type AuthConfig } from './config.js';
+export { noneAuthProvider, UNKNOWN_ACTOR_ID } from './providers/none.js';
+export { createForwardedUserAuthProvider, type ForwardedUserConfig } from './providers/forwarded-user.js';
+export { createCloudflareAccessAuthProvider, type CloudflareAccessConfig } from './providers/cloudflare-access.js';
+export { createAzureEasyAuthProvider, type AzureEasyAuthConfig } from './providers/azure-easy-auth.js';
+export { createAwsCognitoAuthProvider, type AwsCognitoConfig } from './providers/aws-cognito.js';
+export { createTailscaleAuthProvider, type TailscaleConfig } from './providers/tailscale.js';
+export { ipMatchesAny, parseRule, parseRules, type ParsedRule } from './ip-match.js';
+export { capabilityGrants, expandRole } from './capabilities.js';
+export { resolveRole, validateCustomRoles, type ResolveRoleArgs, type ResolvedRole } from './role-resolver.js';
+export { buildAuthProvider } from './factory.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACtE,YAAY,EACV,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACxG,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,+BAA+B,EAAE,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACzG,OAAO,EAAE,kCAAkC,EAAE,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAClH,OAAO,EAAE,2BAA2B,EAAE,KAAK,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC9G,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,14 @@
+export { BUILT_IN_ROLES, RESERVED_CAPABILITY_PREFIXES } from './types.js';
+export { AuthError, AuthConfigurationError, AuthenticationError, AuthorizationError } from './errors.js';
+export { AuthConfigSchema, isReservedPrefix } from './config.js';
+export { noneAuthProvider, UNKNOWN_ACTOR_ID } from './providers/none.js';
+export { createForwardedUserAuthProvider } from './providers/forwarded-user.js';
+export { createCloudflareAccessAuthProvider } from './providers/cloudflare-access.js';
+export { createAzureEasyAuthProvider } from './providers/azure-easy-auth.js';
+export { createAwsCognitoAuthProvider } from './providers/aws-cognito.js';
+export { createTailscaleAuthProvider } from './providers/tailscale.js';
+export { ipMatchesAny, parseRule, parseRules } from './ip-match.js';
+export { capabilityGrants, expandRole } from './capabilities.js';
+export { resolveRole, validateCustomRoles } from './role-resolver.js';
+export { buildAuthProvider } from './factory.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACxG,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAmB,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,+BAA+B,EAA4B,MAAM,+BAA+B,CAAA;AACzG,OAAO,EAAE,kCAAkC,EAA+B,MAAM,kCAAkC,CAAA;AAClH,OAAO,EAAE,2BAA2B,EAA4B,MAAM,gCAAgC,CAAA;AACtG,OAAO,EAAE,4BAA4B,EAAyB,MAAM,4BAA4B,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAwB,MAAM,0BAA0B,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAA2C,MAAM,oBAAoB,CAAA;AAC9G,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}