gazetta 0.7.0 → 0.8.0

package/dist/auth/ip-match.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Parsed CIDR rule. Exposed for tests and reuse by other providers
+ * that may want to validate operator-supplied rule strings.
+ */
+export interface ParsedRule {
+    /** Original rule string (for diagnostics). */
+    raw: string;
+    /** Address family — 4 (IPv4) or 6 (IPv6). */
+    family: 4 | 6;
+    /** Network address as bigint (left-aligned for IPv4 to fit IPv6). */
+    network: bigint;
+    /** Number of leading bits that must match. 32 for IPv4-exact; 128 for IPv6-exact. */
+    prefixBits: number;
+}
+/**
+ * Parse a single rule. Throws on malformed input. Operator's
+ * `trustedProxies` array passes through this once at boot; rules
+ * are validated then cached as `ParsedRule[]` for fast per-request
+ * checks.
+ */
+export declare function parseRule(raw: string): ParsedRule;
+/** Build all rules; throws on the first malformed entry with rule context. */
+export declare function parseRules(rawRules: readonly string[]): ParsedRule[];
+/**
+ * Test whether an IP matches any rule. Returns false for unknown
+ * input (empty string, malformed) — fail-closed.
+ */
+export declare function ipMatchesAny(ip: string | undefined, rules: readonly ParsedRule[]): boolean;
+//# sourceMappingURL=ip-match.d.ts.map

package/dist/auth/ip-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.d.ts","sourceRoot":"","sources":["../../src/auth/ip-match.ts"],"names":[],"mappings":"AAoCA;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAA;IACX,6CAA6C;IAC7C,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;IACb,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAA;IACf,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CA8BjD;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,EAAE,CAEpE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAiB1F"}

package/dist/auth/ip-match.js

@@ -0,0 +1,162 @@
+/**
+ * IP / CIDR membership testing for header-spoofing protection.
+ *
+ * # Why a custom matcher and not a library
+ *
+ * Three reasons:
+ *   - Zero-dep: `net.isIP` ships with Node 22; we only need
+ *     equality + CIDR-prefix checks. A library adds 50KB to a
+ *     small concern.
+ *   - IPv4 + IPv6 mixing: industrial libs (e.g. `ipaddr.js`) handle
+ *     edge cases we don't have (IPv4-mapped IPv6 addresses, etc.).
+ *     For the auth use case the operator-supplied list is small and
+ *     well-understood — they wrote each entry by hand.
+ *   - Multi-instance discipline: the matcher is a pure function over
+ *     `(ip, ruleList)`. No state, no async, no shared mutable cache.
+ *
+ * # Supported syntax
+ *
+ *   - `1.2.3.4` — exact IPv4 match
+ *   - `10.0.0.0/8` — IPv4 CIDR
+ *   - `fe80::1` — exact IPv6 match
+ *   - `fd00::/8` — IPv6 CIDR
+ *
+ * Mixed-family rules are fine; an IPv4 source is checked only
+ * against IPv4 rules, IPv6 against IPv6.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: this module owns IP-vs-rule comparison; doesn't read
+ *     headers, doesn't construct providers.
+ *   - LSP: future provider-specific source-IP needs (e.g.,
+ *     `cloudflare-access` reads `Cf-Connecting-IP`) consume the
+ *     same matcher.
+ */
+import { isIP } from 'node:net';
+/**
+ * Parse a single rule. Throws on malformed input. Operator's
+ * `trustedProxies` array passes through this once at boot; rules
+ * are validated then cached as `ParsedRule[]` for fast per-request
+ * checks.
+ */
+export function parseRule(raw) {
+    const slash = raw.indexOf('/');
+    let addr;
+    let prefix;
+    if (slash >= 0) {
+        addr = raw.slice(0, slash);
+        const prefixStr = raw.slice(slash + 1);
+        prefix = Number.parseInt(prefixStr, 10);
+        if (!Number.isInteger(prefix) || prefix < 0) {
+            throw new Error(`Invalid CIDR prefix in "${raw}": "${prefixStr}" must be a non-negative integer`);
+        }
+    }
+    else {
+        addr = raw;
+        prefix = -1; // sentinel: exact match — set per-family below
+    }
+    const family = isIP(addr);
+    if (family === 0) {
+        throw new Error(`Invalid IP address in "${raw}": "${addr}" is not a valid IPv4 or IPv6 address`);
+    }
+    const maxPrefix = family === 4 ? 32 : 128;
+    if (prefix === -1)
+        prefix = maxPrefix;
+    if (prefix > maxPrefix) {
+        throw new Error(`Invalid CIDR prefix in "${raw}": ${prefix} exceeds max ${maxPrefix} for IPv${family}`);
+    }
+    const fullBits = family === 4 ? ipv4ToBigInt(addr) : ipv6ToBigInt(addr);
+    // Mask off non-prefix bits so the network is canonical (operator
+    // can write 10.1.2.3/8 and we treat it the same as 10.0.0.0/8).
+    const totalBits = family === 4 ? 32 : 128;
+    const network = fullBits & cidrMask(prefix, totalBits);
+    return { raw, family: family, network, prefixBits: prefix };
+}
+/** Build all rules; throws on the first malformed entry with rule context. */
+export function parseRules(rawRules) {
+    return rawRules.map(parseRule);
+}
+/**
+ * Test whether an IP matches any rule. Returns false for unknown
+ * input (empty string, malformed) — fail-closed.
+ */
+export function ipMatchesAny(ip, rules) {
+    if (!ip)
+        return false;
+    const family = isIP(ip);
+    if (family === 0)
+        return false;
+    let value;
+    try {
+        value = family === 4 ? ipv4ToBigInt(ip) : ipv6ToBigInt(ip);
+    }
+    catch {
+        return false;
+    }
+    const totalBits = family === 4 ? 32 : 128;
+    for (const rule of rules) {
+        if (rule.family !== family)
+            continue;
+        const masked = value & cidrMask(rule.prefixBits, totalBits);
+        if (masked === rule.network)
+            return true;
+    }
+    return false;
+}
+// --- Internals ---
+function ipv4ToBigInt(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        throw new Error(`Invalid IPv4: ${ip}`);
+    let n = 0n;
+    for (const part of parts) {
+        const octet = Number.parseInt(part, 10);
+        if (!Number.isInteger(octet) || octet < 0 || octet > 255) {
+            throw new Error(`Invalid IPv4 octet: ${part}`);
+        }
+        n = (n << 8n) | BigInt(octet);
+    }
+    return n;
+}
+function ipv6ToBigInt(ip) {
+    // Handle :: shorthand by expanding to the right number of zero
+    // groups. Doesn't handle IPv4-mapped IPv6 addresses
+    // (e.g. ::ffff:1.2.3.4) — operators with hybrid stacks list
+    // both representations explicitly.
+    const doubleColon = ip.indexOf('::');
+    let groups;
+    if (doubleColon >= 0) {
+        const left = ip.slice(0, doubleColon).split(':').filter(Boolean);
+        const right = ip
+            .slice(doubleColon + 2)
+            .split(':')
+            .filter(Boolean);
+        const fillCount = 8 - left.length - right.length;
+        if (fillCount < 0)
+            throw new Error(`Invalid IPv6: too many groups in ${ip}`);
+        groups = [...left, ...new Array(fillCount).fill('0'), ...right];
+    }
+    else {
+        groups = ip.split(':');
+    }
+    if (groups.length !== 8)
+        throw new Error(`Invalid IPv6: expected 8 groups, got ${groups.length} in ${ip}`);
+    let n = 0n;
+    for (const group of groups) {
+        const value = Number.parseInt(group, 16);
+        if (!Number.isInteger(value) || value < 0 || value > 0xffff) {
+            throw new Error(`Invalid IPv6 group: ${group}`);
+        }
+        n = (n << 16n) | BigInt(value);
+    }
+    return n;
+}
+function cidrMask(prefixBits, totalBits) {
+    if (prefixBits === 0)
+        return 0n;
+    if (prefixBits === totalBits)
+        return (1n << BigInt(totalBits)) - 1n;
+    const ones = (1n << BigInt(prefixBits)) - 1n;
+    return ones << BigInt(totalBits - prefixBits);
+}
+//# sourceMappingURL=ip-match.js.map

package/dist/auth/ip-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.js","sourceRoot":"","sources":["../../src/auth/ip-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAiB/B;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,IAAY,CAAA;IAChB,IAAI,MAAc,CAAA;IAClB,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC1B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACtC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,OAAO,SAAS,kCAAkC,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,GAAG,CAAA;QACV,MAAM,GAAG,CAAC,CAAC,CAAA,CAAC,+CAA+C;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,OAAO,IAAI,uCAAuC,CAAC,CAAA;IAClG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACzC,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,MAAM,GAAG,SAAS,CAAA;IACrC,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,MAAM,MAAM,gBAAgB,SAAS,WAAW,MAAM,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACvE,iEAAiE;IACjE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACzC,MAAM,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAe,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,QAA2B;IACpD,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAAsB,EAAE,KAA4B;IAC/E,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;IACvB,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,IAAI,KAAa,CAAA;IACjB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,SAAQ;QACpC,MAAM,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QAC3D,IAAI,MAAM,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oBAAoB;AAEpB,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAA;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,+DAA+D;IAC/D,oDAAoD;IACpD,4DAA4D;IAC5D,mCAAmC;IACnC,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,MAAgB,CAAA;IACpB,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,EAAE;aACb,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAChD,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAA;QAC5E,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,CAAA;IAC1G,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,QAAQ,CAAC,UAAkB,EAAE,SAAiB;IACrD,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAA;IACnE,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAA;IAC5C,OAAO,IAAI,IAAI,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,CAAA;AAC/C,CAAC"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `AuthIdentityProvider` — the seam between Gazetta and upstream
+ * authentication.
+ *
+ * # The contract
+ *
+ * Each provider knows how to extract a `Principal` from one trust
+ * mode's request shape. The `extractPrincipal(req)` method is
+ * synchronous-or-async; the auth middleware awaits it and attaches
+ * the result to the Hono request context.
+ *
+ * # Error semantics
+ *
+ *   - Returns `null` when the request has no identity (anonymous,
+ *     no upstream auth applied) — the middleware decides whether to
+ *     reject (401) or grant the `unknown` principal based on the
+ *     trust mode
+ *   - Throws `AuthenticationError` when the identity is corrupt
+ *     (signature verification failed, header malformed)
+ *   - Never throws on transport errors (per Universal Provider
+ *     Requirement #5 — fail-open) — JWKS fetch failures fall back
+ *     to fail-closed reject with a structured log
+ *
+ * # Why a registered factory pattern
+ *
+ * Trust modes are operator-configurable in `site.config.ts`. The
+ * dispatcher reads `admin.auth.trust` and constructs the matching
+ * provider. Plugin promotion (per ADR-0009 + `design-plugins.md`):
+ * external trust modes ship as npm packages exporting a factory
+ * function returning `AuthIdentityProvider`; operators import the
+ * factory and assign the result to `admin.auth` directly. No
+ * runtime register method.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: each provider owns one trust mode's mechanics; doesn't
+ *     read config, doesn't dispatch, doesn't wire middleware.
+ *   - LSP: every provider satisfies the same interface; consumers
+ *     branch only on `provider.trustMode` for diagnostics, never
+ *     for behavior.
+ *   - DIP: middleware depends on this interface, not on concrete
+ *     classes.
+ *   - ISP: interface stays narrow — name + extract function. No
+ *     capability-detection methods every provider must stub out.
+ */
+import type { Principal, TrustMode } from './types.js';
+/**
+ * Minimal request shape the provider needs. We don't depend on Hono
+ * directly here so providers can be unit-tested with synthetic
+ * requests; the middleware adapts the Hono request before calling.
+ */
+export interface AuthRequest {
+    /** Map of header name → value. Header names are lowercased per HTTP convention. */
+    headers: ReadonlyMap<string, string>;
+    /** Source IP after trust-mode-driven extraction. Optional. */
+    sourceIp?: string;
+    /** Method + URL — providers rarely need these, but available. */
+    method?: string;
+    url?: string;
+}
+/**
+ * The provider contract. Trust-mode-specific implementations live
+ * under `auth/providers/`.
+ */
+export interface AuthIdentityProvider {
+    /** Identifies the trust mode this provider implements. */
+    readonly trustMode: TrustMode;
+    /**
+     * Pull identity from the request. Returns `null` when no identity
+     * is present (anonymous request); throws `AuthenticationError` for
+     * corrupted credentials. Configuration errors surface at provider
+     * construction, not here.
+     */
+    extractPrincipal(req: AuthRequest): Promise<Principal | null>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/auth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAA;CAC9D"}

package/dist/auth/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":""}

package/dist/auth/providers/aws-cognito.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `aws-cognito` trust mode — AWS Application Load Balancer fronting
+ * the admin with Cognito user pool authentication. ALB injects a
+ * signed JWT in the `x-amzn-oidc-data` header containing the
+ * authenticated user's claims.
+ *
+ * # Why JWT verification (just like cloudflare-access)
+ *
+ * The ALB-issued token is signed with AWS's per-region key. Verifying
+ * the signature is the security contract — without it, anyone behind
+ * the LB or with header-injection access can forge identity.
+ *
+ * # JWKS endpoint shape
+ *
+ * AWS publishes the verification keys at:
+ *
+ *     https://public-keys.auth.elb.{region}.amazonaws.com/{kid}
+ *
+ * Unlike Cloudflare's single-JWKS endpoint, AWS's endpoint is keyed
+ * by the JWT header's `kid`. jose's `createRemoteJWKSet` doesn't fit
+ * this shape; we wire a custom `JWTVerifyGetKey` that fetches the
+ * specific kid. The `jwksFactory` injection point makes this pluggable
+ * for tests.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: same as cloudflare-access — JWT verification only.
+ *   - LSP: same `AuthIdentityProvider` shape.
+ *   - DIP: jwksFactory injection point lets tests run without HTTP.
+ */
+import { type JWTVerifyGetKey } from 'jose';
+import type { AuthIdentityProvider } from '../provider.js';
+export interface AwsCognitoConfig {
+    /**
+     * AWS region the ALB runs in. Required to construct the JWKS URL
+     * (`public-keys.auth.elb.{region}.amazonaws.com`).
+     */
+    region: string;
+    /**
+     * Optional `aud` claim — Cognito user-pool app client id. Setting
+     * this prevents token replay across other Cognito-protected apps
+     * sharing the same user pool.
+     */
+    audience?: string;
+    /** Optional default role until Cut 6's role-resolver wires up. */
+    defaultRole?: string;
+    /**
+     * Internal: factory for the JWKS verifier. Tests inject a stub.
+     * Production builds a fetch-based key resolver per AWS's
+     * keyed-by-kid endpoint shape.
+     */
+    jwksFactory?: (region: string) => JWTVerifyGetKey;
+}
+export declare function createAwsCognitoAuthProvider(config: AwsCognitoConfig): AuthIdentityProvider;
+//# sourceMappingURL=aws-cognito.d.ts.map

package/dist/auth/providers/aws-cognito.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-cognito.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/aws-cognito.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAA8B,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAEvE,OAAO,KAAK,EAAE,oBAAoB,EAAe,MAAM,gBAAgB,CAAA;AAIvE,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,eAAe,CAAA;CAClD;AAyDD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CA2C3F"}

package/dist/auth/providers/aws-cognito.js

@@ -0,0 +1,114 @@
+/**
+ * `aws-cognito` trust mode — AWS Application Load Balancer fronting
+ * the admin with Cognito user pool authentication. ALB injects a
+ * signed JWT in the `x-amzn-oidc-data` header containing the
+ * authenticated user's claims.
+ *
+ * # Why JWT verification (just like cloudflare-access)
+ *
+ * The ALB-issued token is signed with AWS's per-region key. Verifying
+ * the signature is the security contract — without it, anyone behind
+ * the LB or with header-injection access can forge identity.
+ *
+ * # JWKS endpoint shape
+ *
+ * AWS publishes the verification keys at:
+ *
+ *     https://public-keys.auth.elb.{region}.amazonaws.com/{kid}
+ *
+ * Unlike Cloudflare's single-JWKS endpoint, AWS's endpoint is keyed
+ * by the JWT header's `kid`. jose's `createRemoteJWKSet` doesn't fit
+ * this shape; we wire a custom `JWTVerifyGetKey` that fetches the
+ * specific kid. The `jwksFactory` injection point makes this pluggable
+ * for tests.
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: same as cloudflare-access — JWT verification only.
+ *   - LSP: same `AuthIdentityProvider` shape.
+ *   - DIP: jwksFactory injection point lets tests run without HTTP.
+ */
+import { jwtVerify } from 'jose';
+import { AuthenticationError, AuthConfigurationError } from '../errors.js';
+import { expandRole } from '../capabilities.js';
+/**
+ * Default JWKS factory — fetches AWS's per-kid public key. Each
+ * verification call may hit a different kid; the resolver caches
+ * downloaded keys to keep verification fast under steady load.
+ *
+ * Operators may want to override this with a `createRemoteJWKSet`
+ * variant if they front Cognito directly (without ALB) — that's
+ * outside Cut 5's scope; the injection point keeps it open.
+ */
+function defaultJwksFactory(region) {
+    const cache = new Map();
+    return async (header) => {
+        if (!header.kid) {
+            throw new AuthenticationError('AWS Cognito JWT has no kid in header');
+        }
+        const cached = cache.get(header.kid);
+        if (cached)
+            return cached;
+        const url = `https://public-keys.auth.elb.${region}.amazonaws.com/${encodeURIComponent(header.kid)}`;
+        const res = await fetch(url);
+        if (!res.ok) {
+            throw new AuthenticationError(`AWS public-keys endpoint returned ${res.status} for kid ${header.kid}`);
+        }
+        const pem = await res.text();
+        // Defer to Web Crypto's importKey via jose — actually jose
+        // accepts CryptoKey directly. We use Node's crypto subtle to
+        // import the PEM. This works in Node 22+ which has full WebCrypto.
+        const subtle = (globalThis.crypto ?? require('node:crypto').webcrypto).subtle;
+        const key = await subtle.importKey('spki', pemToDer(pem), { name: 'ECDSA', namedCurve: header.alg === 'ES512' ? 'P-521' : 'P-256' }, false, ['verify']);
+        cache.set(header.kid, key);
+        return key;
+    };
+}
+function pemToDer(pem) {
+    const body = pem
+        .replace(/-----BEGIN [^-]+-----/, '')
+        .replace(/-----END [^-]+-----/, '')
+        .replace(/\s+/g, '');
+    const bin = Buffer.from(body, 'base64');
+    return bin.buffer.slice(bin.byteOffset, bin.byteOffset + bin.byteLength);
+}
+export function createAwsCognitoAuthProvider(config) {
+    if (!config.region || config.region.length === 0) {
+        throw new AuthConfigurationError('aws-cognito trust mode requires region (e.g. "us-east-1")');
+    }
+    if (!/^[a-z]{2}-[a-z]+-\d+$/.test(config.region)) {
+        throw new AuthConfigurationError(`Invalid region "${config.region}": expected AWS region format like "us-east-1" or "eu-west-2"`);
+    }
+    const jwks = (config.jwksFactory ?? defaultJwksFactory)(config.region);
+    const defaultRole = config.defaultRole ?? 'editor';
+    return {
+        trustMode: 'aws-cognito',
+        async extractPrincipal(req) {
+            const token = req.headers.get('x-amzn-oidc-data');
+            if (!token)
+                return null;
+            let payload;
+            try {
+                const result = await jwtVerify(token, jwks, {
+                    audience: config.audience,
+                });
+                payload = result.payload;
+            }
+            catch (err) {
+                throw new AuthenticationError(`AWS Cognito JWT verification failed: ${err.message}`);
+            }
+            const id = payload.sub ?? payload.username;
+            if (!id) {
+                throw new AuthenticationError('AWS Cognito JWT has no sub or username claim');
+            }
+            return {
+                id,
+                email: payload.email,
+                role: defaultRole,
+                trustMode: 'aws-cognito',
+                capabilities: expandRole(defaultRole) ?? [],
+            };
+        },
+    };
+}
+//# sourceMappingURL=aws-cognito.js.map

package/dist/auth/providers/aws-cognito.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-cognito.js","sourceRoot":"","sources":["../../../src/auth/providers/aws-cognito.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAA;AAGvE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AA+B/C;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC1C,OAAO,KAAK,EAAE,MAAsC,EAAE,EAAE;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAmB,CAAC,sCAAsC,CAAC,CAAA;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,MAAM,GAAG,GAAG,gCAAgC,MAAM,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACpG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,GAAG,CAAC,MAAM,YAAY,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;QACxG,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC5B,2DAA2D;QAC3D,6DAA6D;QAC7D,mEAAmE;QACnE,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAA;QAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,MAAM,EACN,QAAQ,CAAC,GAAG,CAAC,EACb,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EACzE,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,IAAI,GAAG,GAAG;SACb,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;SAClC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAwB;IACnE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAAC,2DAA2D,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,sBAAsB,CAC9B,mBAAmB,MAAM,CAAC,MAAM,+DAA+D,CAChG,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAA;IAElD,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,KAAK,CAAC,gBAAgB,CAAC,GAAgB;YACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEvB,IAAI,OAAsB,CAAA;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAgB,KAAK,EAAE,IAAI,EAAE;oBACzD,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAA;gBACF,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,wCAAyC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;YACjG,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAA;YAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAA;YAC/E,CAAC;YAED,OAAO;gBACL,EAAE;gBACF,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,aAAa;gBACxB,YAAY,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE;aAC5C,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/auth/providers/azure-easy-auth.d.ts

@@ -0,0 +1,7 @@
+import type { AuthIdentityProvider } from '../provider.js';
+export interface AzureEasyAuthConfig {
+    /** Optional default role until Cut 6's role-resolver wires up. */
+    defaultRole?: string;
+}
+export declare function createAzureEasyAuthProvider(config?: AzureEasyAuthConfig): AuthIdentityProvider;
+//# sourceMappingURL=azure-easy-auth.d.ts.map

package/dist/auth/providers/azure-easy-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-easy-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/azure-easy-auth.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,oBAAoB,EAAe,MAAM,gBAAgB,CAAA;AAIvE,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAeD,wBAAgB,2BAA2B,CAAC,MAAM,GAAE,mBAAwB,GAAG,oBAAoB,CAkDlG"}

package/dist/auth/providers/azure-easy-auth.js

@@ -0,0 +1,48 @@
+import { AuthenticationError } from '../errors.js';
+import { expandRole } from '../capabilities.js';
+const NAMEID_CLAIM = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier';
+const EMAIL_CLAIM = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress';
+export function createAzureEasyAuthProvider(config = {}) {
+    const defaultRole = config.defaultRole ?? 'editor';
+    return {
+        trustMode: 'azure-easy-auth',
+        async extractPrincipal(req) {
+            const encoded = req.headers.get('x-ms-client-principal');
+            if (!encoded || encoded.length === 0) {
+                // No identity header — anonymous. Easy Auth is configured
+                // to require auth; reaching Gazetta without the header
+                // means the request bypassed the platform (only possible
+                // if the operator misconfigured).
+                return null;
+            }
+            let parsed;
+            try {
+                const json = Buffer.from(encoded, 'base64').toString('utf-8');
+                parsed = JSON.parse(json);
+            }
+            catch (err) {
+                throw new AuthenticationError(`X-MS-CLIENT-PRINCIPAL header is not valid base64-encoded JSON: ${err.message}`);
+            }
+            if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.claims)) {
+                throw new AuthenticationError('X-MS-CLIENT-PRINCIPAL is malformed (missing claims array)');
+            }
+            // Prefer X-MS-CLIENT-PRINCIPAL-ID when present (stable id);
+            // fall back to the nameidentifier claim.
+            const idHeader = req.headers.get('x-ms-client-principal-id');
+            const nameIdClaim = parsed.claims.find(c => c.typ === NAMEID_CLAIM)?.val;
+            const id = idHeader ?? nameIdClaim;
+            if (!id) {
+                throw new AuthenticationError('X-MS-CLIENT-PRINCIPAL has no nameidentifier claim and no X-MS-CLIENT-PRINCIPAL-ID');
+            }
+            const email = parsed.claims.find(c => c.typ === EMAIL_CLAIM)?.val;
+            return {
+                id,
+                email,
+                role: defaultRole,
+                trustMode: 'azure-easy-auth',
+                capabilities: expandRole(defaultRole) ?? [],
+            };
+        },
+    };
+}
+//# sourceMappingURL=azure-easy-auth.js.map

package/dist/auth/providers/azure-easy-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-easy-auth.js","sourceRoot":"","sources":["../../../src/auth/providers/azure-easy-auth.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAiB/C,MAAM,YAAY,GAAG,sEAAsE,CAAA;AAC3F,MAAM,WAAW,GAAG,oEAAoE,CAAA;AAExF,MAAM,UAAU,2BAA2B,CAAC,SAA8B,EAAE;IAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAA;IAClD,OAAO;QACL,SAAS,EAAE,iBAAiB;QAC5B,KAAK,CAAC,gBAAgB,CAAC,GAAgB;YACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YACxD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,0DAA0D;gBAC1D,uDAAuD;gBACvD,yDAAyD;gBACzD,kCAAkC;gBAClC,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,MAA4B,CAAA;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAC7D,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAA;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAC3B,kEAAmE,GAAa,CAAC,OAAO,EAAE,CAC3F,CAAA;YACH,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,mBAAmB,CAAC,2DAA2D,CAAC,CAAA;YAC5F,CAAC;YAED,4DAA4D;YAC5D,yCAAyC;YACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;YAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,GAAG,CAAA;YACxE,MAAM,EAAE,GAAG,QAAQ,IAAI,WAAW,CAAA;YAClC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,mBAAmB,CAC3B,mFAAmF,CACpF,CAAA;YACH,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC,EAAE,GAAG,CAAA;YAEjE,OAAO;gBACL,EAAE;gBACF,KAAK;gBACL,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,iBAAiB;gBAC5B,YAAY,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE;aAC5C,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/auth/providers/cloudflare-access.d.ts

@@ -0,0 +1,71 @@
+/**
+ * `cloudflare-access` trust mode — Cloudflare Zero Trust / Access
+ * fronting the admin. The platform issues a signed JWT in the
+ * `Cf-Access-Jwt-Assertion` header (or cookie); Gazetta verifies
+ * the signature against Cloudflare's published JWKS and reads the
+ * subject + email from the verified payload.
+ *
+ * # Why JWT verification, not header trust
+ *
+ * Cloudflare Access's JWT carries a real signature. Anyone behind
+ * the Worker boundary can claim a header value, but only Cloudflare's
+ * private key can produce a valid token. Verifying the signature is
+ * the security contract — without it, this trust mode is no safer
+ * than `forwarded-user` without a whitelist.
+ *
+ * # JWKS endpoint shape
+ *
+ * Cloudflare publishes per-team-domain JWKS at:
+ *
+ *     https://{teamDomain}.cloudflareaccess.com/cdn-cgi/access/certs
+ *
+ * Operators set `teamDomain` in `site.config.ts admin.auth`; the
+ * provider builds the URL and uses `jose`'s `createRemoteJWKSet`
+ * for verification + automatic key rotation.
+ *
+ * # Failure modes
+ *
+ *   - JWT missing / expired / signature invalid → `AuthenticationError`
+ *     (middleware → 401)
+ *   - JWKS endpoint unreachable → `AuthenticationError` (fail-CLOSED
+ *     here, NOT fail-open like Universal Provider Requirement #5
+ *     suggests for transport errors — auth is the security boundary;
+ *     a JWKS outage that fails open would let unsigned tokens
+ *     through)
+ *   - `aud` claim mismatch (when configured) → `AuthenticationError`
+ *
+ * # SOLID lenses
+ *
+ *   - SRP: JWT verification only. Source-IP extraction is not this
+ *     provider's concern (Cloudflare's signed assertion IS the trust;
+ *     the source IP would be Cloudflare's edge anyway).
+ *   - DIP: jose's `createRemoteJWKSet` is the verifier dependency;
+ *     test injects a different verifier via the optional
+ *     `jwksFactory` constructor option for unit tests.
+ */
+import { type JWTVerifyGetKey } from 'jose';
+import type { AuthIdentityProvider } from '../provider.js';
+export interface CloudflareAccessConfig {
+    /**
+     * Cloudflare Zero Trust team domain (the part before
+     * `.cloudflareaccess.com`). Required. Example: `'acme'` for
+     * `https://acme.cloudflareaccess.com`.
+     */
+    teamDomain: string;
+    /**
+     * Optional `aud` claim verification. Cloudflare Access tokens
+     * carry an `aud` claim identifying the application; production
+     * deployments SHOULD set this to prevent token replay across
+     * Access-protected apps in the same team domain.
+     */
+    audience?: string;
+    /** Optional default role until Cut 6's role-resolver wires up. */
+    defaultRole?: string;
+    /**
+     * Internal: factory for the JWKS verifier. Tests inject a stub;
+     * production calls `createRemoteJWKSet`.
+     */
+    jwksFactory?: (jwksUrl: URL) => JWTVerifyGetKey;
+}
+export declare function createCloudflareAccessAuthProvider(config: CloudflareAccessConfig): AuthIdentityProvider;
+//# sourceMappingURL=cloudflare-access.d.ts.map

package/dist/auth/providers/cloudflare-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-access.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/cloudflare-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAkD,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAE3F,OAAO,KAAK,EAAE,oBAAoB,EAAe,MAAM,gBAAgB,CAAA;AAIvE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,eAAe,CAAA;CAChD;AAgBD,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,sBAAsB,GAAG,oBAAoB,CA6DvG"}