octocms 0.4.16 → 0.4.18

package/README.md

@@ -2,7 +2,7 @@
 
 A file-based CMS for Next.js. Schema defined in TypeScript, content stored as JSON files, Git-backed, no database.
 
-**[octocms.com](https://octocms.com)** · [Docs](https://octocms.com/docs)
+**[octocms.gunkin.dev](https://octocms.gunkin.dev)** · [Docs](https://octocms.gunkin.dev/docs)
 
 ## Requirements
 
@@ -47,7 +47,7 @@ Visit `http://localhost:3000/cms` to open the editor.
 ```bash
 GITHUB_ID=              # GitHub App client ID
 GITHUB_SECRET=          # GitHub App client secret
-NEXTAUTH_SECRET=        # Random string: openssl rand -base64 32
+NEXTAUTH_SECRET=     # Random string: openssl rand -base64 32
 NEXTAUTH_URL=http://localhost:3000
 
 # Required in production

package/dist/admin/actions/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../admin/actions/agent.ts"],"names":[],"mappings":"AAEA,OAAO,kBAAkB,CAAC;AAS1B,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAClB;IACE,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEN;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAOvE;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBjG;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAYzF"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../admin/actions/agent.ts"],"names":[],"mappings":"AAEA,OAAO,kBAAkB,CAAC;AAO1B,MAAM,MAAM,iBAAiB,GACzB;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAClB;IACE,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEN;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAOvE;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBjG;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAYzF"}

package/dist/admin/actions/agent.js

@@ -1,11 +1,10 @@
 "use server";
 import "../../chunk-B5LE2OEC.js";
 import "./registerConfig";
-import { getServerSession } from "next-auth/next";
 import { getAgentConfig } from "../../agent/configStore";
 import { getAgentStatus, isAgentEnabled } from "../../agent/featureFlag";
 import { acceptProposal, isProposal } from "../../agent/proposals";
-import { authOptions } from "../auth";
+import { getCmsSession } from "../auth/session";
 async function getAgentClientStatus() {
   const cfg = getAgentConfig();
   if (!cfg || !isAgentEnabled(cfg)) return { enabled: false };
@@ -18,7 +17,7 @@ async function acceptProposalAction(proposal) {
   if (!cfg || !isAgentEnabled(cfg)) {
     throw new Error("Chat agent is disabled.");
   }
-  const session = await getServerSession(authOptions);
+  const session = await getCmsSession();
   if (!session) {
     throw new Error("Unauthorized.");
   }
@@ -36,7 +35,7 @@ async function rejectProposalAction(_reason) {
   if (!cfg || !isAgentEnabled(cfg)) {
     throw new Error("Chat agent is disabled.");
   }
-  const session = await getServerSession(authOptions);
+  const session = await getCmsSession();
   if (!session) {
     throw new Error("Unauthorized.");
   }

package/dist/admin/actions/agent.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../admin/actions/agent.ts"],"sourcesContent":["'use server';\n\nimport './registerConfig';\n\nimport { getServerSession } from 'next-auth/next';\n\nimport { getAgentConfig } from '../../agent/configStore';\nimport { getAgentStatus, isAgentEnabled } from '../../agent/featureFlag';\nimport { acceptProposal, isProposal, type AcceptResult } from '../../agent/proposals';\nimport { authOptions } from '../auth';\n\nexport type AgentClientStatus =\n  | { enabled: false }\n  | {\n      enabled: true;\n      provider: 'anthropic' | 'openai' | 'local';\n      model: string;\n    };\n\n/**\n * Server-side check exposed to the admin client (Header nav link).\n *\n * Never returns the API key. Returns `{ enabled: false }` when the chat API is\n * disabled (missing config, key, or budget). The `/cms/chat` page still renders\n * a setup guide; this action is for optional client UI that needs a boolean gate.\n */\nexport async function getAgentClientStatus(): Promise<AgentClientStatus> {\n  const cfg = getAgentConfig();\n  if (!cfg || !isAgentEnabled(cfg)) return { enabled: false };\n  // Recompute via getAgentStatus so we exercise the same code path the route uses.\n  const status = getAgentStatus(cfg);\n  if (!status.enabled) return { enabled: false };\n  return { enabled: true, provider: cfg.provider.type, model: cfg.provider.model };\n}\n\nexport type AcceptProposalActionResult =\n  | { ok: true; entryPath: string }\n  | { ok: false; error: string; fieldErrors?: Record<string, string> };\n\n/**\n * Server action — apply a chat-agent edit/create proposal.\n *\n * Replaces the previous `POST /api/agent/proposals/accept` Route Handler. The\n * client (`useChatStream`) calls this directly via the Server Action transport\n * — no public endpoint, no thin re-export file.\n *\n * Stateless by design: the entire proposal payload arrives over the wire and\n * is re-validated here (and again inside `acceptProposal` via the schema\n * validator + `saveFile`).\n *\n * Returns `{ ok: false, error }` on validation / write failures so the client\n * can render an inline error without try/catch around the action call.\n * Throws only when the agent is disabled or the caller is unauthenticated —\n * those are caller-bug shapes, not user-facing flow.\n */\nexport async function acceptProposalAction(proposal: unknown): Promise<AcceptProposalActionResult> {\n  const cfg = getAgentConfig();\n  if (!cfg || !isAgentEnabled(cfg)) {\n    throw new Error('Chat agent is disabled.');\n  }\n\n  const session = await getServerSession(authOptions);\n  if (!session) {\n    throw new Error('Unauthorized.');\n  }\n\n  if (!isProposal(proposal)) {\n    return { ok: false, error: 'Invalid proposal payload.' };\n  }\n\n  const result: AcceptResult = await acceptProposal(proposal);\n  if (!result.ok) {\n    return result.fieldErrors\n      ? { ok: false, error: result.error, fieldErrors: result.fieldErrors }\n      : { ok: false, error: result.error };\n  }\n  return { ok: true, entryPath: result.entryPath };\n}\n\n/**\n * Server action — record that the user dismissed a proposal.\n *\n * Replaces the previous `POST /api/agent/proposals/reject` Route Handler.\n * There's no server-side proposal record to mark rejected; this just\n * acknowledges the click. The client reflects rejection in its own state and\n * feeds the rejection back to the model on the next chat turn as a synthetic\n * system note. The `reason` argument is currently ignored — kept for forward\n * compatibility (e.g. analytics / per-rejection telemetry).\n *\n * Auth-gated to keep the surface consistent with `acceptProposalAction`.\n */\nexport async function rejectProposalAction(_reason?: string | null): Promise<{ ok: true }> {\n  const cfg = getAgentConfig();\n  if (!cfg || !isAgentEnabled(cfg)) {\n    throw new Error('Chat agent is disabled.');\n  }\n\n  const session = await getServerSession(authOptions);\n  if (!session) {\n    throw new Error('Unauthorized.');\n  }\n\n  return { ok: true };\n}\n"],"mappings":";;AAEA,OAAO;AAEP,SAAS,wBAAwB;AAEjC,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB,sBAAsB;AAC/C,SAAS,gBAAgB,kBAAqC;AAC9D,SAAS,mBAAmB;AAiB5B,eAAsB,uBAAmD;AACvE,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,OAAO,CAAC,eAAe,GAAG,EAAG,QAAO,EAAE,SAAS,MAAM;AAE1D,QAAM,SAAS,eAAe,GAAG;AACjC,MAAI,CAAC,OAAO,QAAS,QAAO,EAAE,SAAS,MAAM;AAC7C,SAAO,EAAE,SAAS,MAAM,UAAU,IAAI,SAAS,MAAM,OAAO,IAAI,SAAS,MAAM;AACjF;AAsBA,eAAsB,qBAAqB,UAAwD;AACjG,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG;AAChC,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,QAAM,UAAU,MAAM,iBAAiB,WAAW;AAClD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,eAAe;AAAA,EACjC;AAEA,MAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAO,EAAE,IAAI,OAAO,OAAO,4BAA4B;AAAA,EACzD;AAEA,QAAM,SAAuB,MAAM,eAAe,QAAQ;AAC1D,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,OAAO,cACV,EAAE,IAAI,OAAO,OAAO,OAAO,OAAO,aAAa,OAAO,YAAY,IAClE,EAAE,IAAI,OAAO,OAAO,OAAO,MAAM;AAAA,EACvC;AACA,SAAO,EAAE,IAAI,MAAM,WAAW,OAAO,UAAU;AACjD;AAcA,eAAsB,qBAAqB,SAAgD;AACzF,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG;AAChC,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,QAAM,UAAU,MAAM,iBAAiB,WAAW;AAClD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,eAAe;AAAA,EACjC;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;","names":[]}
+{"version":3,"sources":["../../../admin/actions/agent.ts"],"sourcesContent":["'use server';\n\nimport './registerConfig';\n\nimport { getAgentConfig } from '../../agent/configStore';\nimport { getAgentStatus, isAgentEnabled } from '../../agent/featureFlag';\nimport { acceptProposal, isProposal, type AcceptResult } from '../../agent/proposals';\nimport { getCmsSession } from '../auth/session';\n\nexport type AgentClientStatus =\n  | { enabled: false }\n  | {\n      enabled: true;\n      provider: 'anthropic' | 'openai' | 'local';\n      model: string;\n    };\n\n/**\n * Server-side check exposed to the admin client (Header nav link).\n *\n * Never returns the API key. Returns `{ enabled: false }` when the chat API is\n * disabled (missing config, key, or budget). The `/cms/chat` page still renders\n * a setup guide; this action is for optional client UI that needs a boolean gate.\n */\nexport async function getAgentClientStatus(): Promise<AgentClientStatus> {\n  const cfg = getAgentConfig();\n  if (!cfg || !isAgentEnabled(cfg)) return { enabled: false };\n  // Recompute via getAgentStatus so we exercise the same code path the route uses.\n  const status = getAgentStatus(cfg);\n  if (!status.enabled) return { enabled: false };\n  return { enabled: true, provider: cfg.provider.type, model: cfg.provider.model };\n}\n\nexport type AcceptProposalActionResult =\n  | { ok: true; entryPath: string }\n  | { ok: false; error: string; fieldErrors?: Record<string, string> };\n\n/**\n * Server action — apply a chat-agent edit/create proposal.\n *\n * Replaces the previous `POST /api/agent/proposals/accept` Route Handler. The\n * client (`useChatStream`) calls this directly via the Server Action transport\n * — no public endpoint, no thin re-export file.\n *\n * Stateless by design: the entire proposal payload arrives over the wire and\n * is re-validated here (and again inside `acceptProposal` via the schema\n * validator + `saveFile`).\n *\n * Returns `{ ok: false, error }` on validation / write failures so the client\n * can render an inline error without try/catch around the action call.\n * Throws only when the agent is disabled or the caller is unauthenticated —\n * those are caller-bug shapes, not user-facing flow.\n */\nexport async function acceptProposalAction(proposal: unknown): Promise<AcceptProposalActionResult> {\n  const cfg = getAgentConfig();\n  if (!cfg || !isAgentEnabled(cfg)) {\n    throw new Error('Chat agent is disabled.');\n  }\n\n  const session = await getCmsSession();\n  if (!session) {\n    throw new Error('Unauthorized.');\n  }\n\n  if (!isProposal(proposal)) {\n    return { ok: false, error: 'Invalid proposal payload.' };\n  }\n\n  const result: AcceptResult = await acceptProposal(proposal);\n  if (!result.ok) {\n    return result.fieldErrors\n      ? { ok: false, error: result.error, fieldErrors: result.fieldErrors }\n      : { ok: false, error: result.error };\n  }\n  return { ok: true, entryPath: result.entryPath };\n}\n\n/**\n * Server action — record that the user dismissed a proposal.\n *\n * Replaces the previous `POST /api/agent/proposals/reject` Route Handler.\n * There's no server-side proposal record to mark rejected; this just\n * acknowledges the click. The client reflects rejection in its own state and\n * feeds the rejection back to the model on the next chat turn as a synthetic\n * system note. The `reason` argument is currently ignored — kept for forward\n * compatibility (e.g. analytics / per-rejection telemetry).\n *\n * Auth-gated to keep the surface consistent with `acceptProposalAction`.\n */\nexport async function rejectProposalAction(_reason?: string | null): Promise<{ ok: true }> {\n  const cfg = getAgentConfig();\n  if (!cfg || !isAgentEnabled(cfg)) {\n    throw new Error('Chat agent is disabled.');\n  }\n\n  const session = await getCmsSession();\n  if (!session) {\n    throw new Error('Unauthorized.');\n  }\n\n  return { ok: true };\n}\n"],"mappings":";;AAEA,OAAO;AAEP,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB,sBAAsB;AAC/C,SAAS,gBAAgB,kBAAqC;AAC9D,SAAS,qBAAqB;AAiB9B,eAAsB,uBAAmD;AACvE,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,OAAO,CAAC,eAAe,GAAG,EAAG,QAAO,EAAE,SAAS,MAAM;AAE1D,QAAM,SAAS,eAAe,GAAG;AACjC,MAAI,CAAC,OAAO,QAAS,QAAO,EAAE,SAAS,MAAM;AAC7C,SAAO,EAAE,SAAS,MAAM,UAAU,IAAI,SAAS,MAAM,OAAO,IAAI,SAAS,MAAM;AACjF;AAsBA,eAAsB,qBAAqB,UAAwD;AACjG,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG;AAChC,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,QAAM,UAAU,MAAM,cAAc;AACpC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,eAAe;AAAA,EACjC;AAEA,MAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAO,EAAE,IAAI,OAAO,OAAO,4BAA4B;AAAA,EACzD;AAEA,QAAM,SAAuB,MAAM,eAAe,QAAQ;AAC1D,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,OAAO,cACV,EAAE,IAAI,OAAO,OAAO,OAAO,OAAO,aAAa,OAAO,YAAY,IAClE,EAAE,IAAI,OAAO,OAAO,OAAO,MAAM;AAAA,EACvC;AACA,SAAO,EAAE,IAAI,MAAM,WAAW,OAAO,UAAU;AACjD;AAcA,eAAsB,qBAAqB,SAAgD;AACzF,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,OAAO,CAAC,eAAe,GAAG,GAAG;AAChC,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,QAAM,UAAU,MAAM,cAAc;AACpC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,eAAe;AAAA,EACjC;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;","names":[]}

package/dist/admin/auth/cookies.d.ts

@@ -0,0 +1,16 @@
+export declare const CMS_SESSION_COOKIE = "octocms-session";
+export declare const CMS_OAUTH_STATE_COOKIE = "octocms-oauth-state";
+export type CookieOptions = {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: 'lax' | 'strict' | 'none';
+    path: string;
+    maxAge?: number;
+};
+export declare function sessionCookieOptions(): CookieOptions;
+export declare function oauthStateCookieOptions(): CookieOptions;
+/** Serialize cookie for `Set-Cookie` header (Route Handler responses). */
+export declare function formatSetCookie(name: string, value: string, options: CookieOptions): string;
+/** Clear cookie via `Set-Cookie` with Max-Age=0. */
+export declare function formatClearCookie(name: string, options: Pick<CookieOptions, 'path' | 'secure' | 'sameSite'>): string;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/admin/auth/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../admin/auth/cookies.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AACpD,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAK5D,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,oBAAoB,IAAI,aAAa,CAQpD;AAED,wBAAgB,uBAAuB,IAAI,aAAa,CAQvD;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAM3F;AAED,oDAAoD;AACpD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,CAAC,GAAG,MAAM,CAKpH"}

package/dist/admin/auth/cookies.js

@@ -0,0 +1,45 @@
+import "../../chunk-B5LE2OEC.js";
+const CMS_SESSION_COOKIE = "octocms-session";
+const CMS_OAUTH_STATE_COOKIE = "octocms-oauth-state";
+const SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+const OAUTH_STATE_MAX_AGE_SECONDS = 5 * 60;
+function sessionCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: SESSION_MAX_AGE_SECONDS
+  };
+}
+function oauthStateCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: OAUTH_STATE_MAX_AGE_SECONDS
+  };
+}
+function formatSetCookie(name, value, options) {
+  const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${options.path}`, `SameSite=${options.sameSite}`];
+  if (options.httpOnly) parts.push("HttpOnly");
+  if (options.secure) parts.push("Secure");
+  if (options.maxAge !== void 0) parts.push(`Max-Age=${options.maxAge}`);
+  return parts.join("; ");
+}
+function formatClearCookie(name, options) {
+  const parts = [`${name}=`, `Path=${options.path}`, "Max-Age=0", `SameSite=${options.sameSite}`];
+  parts.push("HttpOnly");
+  if (options.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+export {
+  CMS_OAUTH_STATE_COOKIE,
+  CMS_SESSION_COOKIE,
+  formatClearCookie,
+  formatSetCookie,
+  oauthStateCookieOptions,
+  sessionCookieOptions
+};
+//# sourceMappingURL=cookies.js.map

package/dist/admin/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../admin/auth/cookies.ts"],"sourcesContent":["export const CMS_SESSION_COOKIE = 'octocms-session';\nexport const CMS_OAUTH_STATE_COOKIE = 'octocms-oauth-state';\n\nconst SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60; // 30 days — parity with typical OAuth sessions\nconst OAUTH_STATE_MAX_AGE_SECONDS = 5 * 60;\n\nexport type CookieOptions = {\n  httpOnly: boolean;\n  secure: boolean;\n  sameSite: 'lax' | 'strict' | 'none';\n  path: string;\n  maxAge?: number;\n};\n\nexport function sessionCookieOptions(): CookieOptions {\n  return {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: SESSION_MAX_AGE_SECONDS,\n  };\n}\n\nexport function oauthStateCookieOptions(): CookieOptions {\n  return {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: OAUTH_STATE_MAX_AGE_SECONDS,\n  };\n}\n\n/** Serialize cookie for `Set-Cookie` header (Route Handler responses). */\nexport function formatSetCookie(name: string, value: string, options: CookieOptions): string {\n  const parts = [`${name}=${encodeURIComponent(value)}`, `Path=${options.path}`, `SameSite=${options.sameSite}`];\n  if (options.httpOnly) parts.push('HttpOnly');\n  if (options.secure) parts.push('Secure');\n  if (options.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);\n  return parts.join('; ');\n}\n\n/** Clear cookie via `Set-Cookie` with Max-Age=0. */\nexport function formatClearCookie(name: string, options: Pick<CookieOptions, 'path' | 'secure' | 'sameSite'>): string {\n  const parts = [`${name}=`, `Path=${options.path}`, 'Max-Age=0', `SameSite=${options.sameSite}`];\n  parts.push('HttpOnly');\n  if (options.secure) parts.push('Secure');\n  return parts.join('; ');\n}\n"],"mappings":";AAAO,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAEtC,MAAM,0BAA0B,KAAK,KAAK,KAAK;AAC/C,MAAM,8BAA8B,IAAI;AAUjC,SAAS,uBAAsC;AACpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AACF;AAEO,SAAS,0BAAyC;AACvD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AACF;AAGO,SAAS,gBAAgB,MAAc,OAAe,SAAgC;AAC3F,QAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC,IAAI,QAAQ,QAAQ,IAAI,IAAI,YAAY,QAAQ,QAAQ,EAAE;AAC7G,MAAI,QAAQ,SAAU,OAAM,KAAK,UAAU;AAC3C,MAAI,QAAQ,OAAQ,OAAM,KAAK,QAAQ;AACvC,MAAI,QAAQ,WAAW,OAAW,OAAM,KAAK,WAAW,QAAQ,MAAM,EAAE;AACxE,SAAO,MAAM,KAAK,IAAI;AACxB;AAGO,SAAS,kBAAkB,MAAc,SAAsE;AACpH,QAAM,QAAQ,CAAC,GAAG,IAAI,KAAK,QAAQ,QAAQ,IAAI,IAAI,aAAa,YAAY,QAAQ,QAAQ,EAAE;AAC9F,QAAM,KAAK,UAAU;AACrB,MAAI,QAAQ,OAAQ,OAAM,KAAK,QAAQ;AACvC,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/admin/auth/env.d.ts

@@ -0,0 +1,6 @@
+/** Session sealing secret (`NEXTAUTH_SECRET`). */
+export declare function getSessionSecret(): string;
+/** Public app base URL for OAuth callback construction (`NEXTAUTH_URL`). */
+export declare function getAppUrl(): string;
+export declare function getOAuthCallbackUrl(): string;
+//# sourceMappingURL=env.d.ts.map

package/dist/admin/auth/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../admin/auth/env.ts"],"names":[],"mappings":"AAEA,kDAAkD;AAClD,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,IAAI,MAAM,CASlC;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/admin/auth/env.js

@@ -0,0 +1,25 @@
+import "../../chunk-B5LE2OEC.js";
+const trimOrEmpty = (value) => typeof value === "string" ? value.trim() : "";
+function getSessionSecret() {
+  const secret = trimOrEmpty(process.env.NEXTAUTH_SECRET);
+  if (!secret) {
+    throw new Error("Missing NEXTAUTH_SECRET. Generate one with: openssl rand -base64 32");
+  }
+  return secret;
+}
+function getAppUrl() {
+  const url = trimOrEmpty(process.env.NEXTAUTH_URL) || (process.env.NODE_ENV === "development" ? "http://localhost:3000" : "");
+  if (!url) {
+    throw new Error("Missing NEXTAUTH_URL \u2014 required in production for OAuth callbacks.");
+  }
+  return url.replace(/\/$/, "");
+}
+function getOAuthCallbackUrl() {
+  return `${getAppUrl()}/api/octocms/auth/callback`;
+}
+export {
+  getAppUrl,
+  getOAuthCallbackUrl,
+  getSessionSecret
+};
+//# sourceMappingURL=env.js.map

package/dist/admin/auth/env.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../admin/auth/env.ts"],"sourcesContent":["const trimOrEmpty = (value: string | undefined): string => (typeof value === 'string' ? value.trim() : '');\n\n/** Session sealing secret (`NEXTAUTH_SECRET`). */\nexport function getSessionSecret(): string {\n  const secret = trimOrEmpty(process.env.NEXTAUTH_SECRET);\n  if (!secret) {\n    throw new Error('Missing NEXTAUTH_SECRET. Generate one with: openssl rand -base64 32');\n  }\n  return secret;\n}\n\n/** Public app base URL for OAuth callback construction (`NEXTAUTH_URL`). */\nexport function getAppUrl(): string {\n  const url =\n    trimOrEmpty(process.env.NEXTAUTH_URL) || (process.env.NODE_ENV === 'development' ? 'http://localhost:3000' : '');\n\n  if (!url) {\n    throw new Error('Missing NEXTAUTH_URL — required in production for OAuth callbacks.');\n  }\n\n  return url.replace(/\\/$/, '');\n}\n\nexport function getOAuthCallbackUrl(): string {\n  return `${getAppUrl()}/api/octocms/auth/callback`;\n}\n"],"mappings":";AAAA,MAAM,cAAc,CAAC,UAAuC,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAGhG,SAAS,mBAA2B;AACzC,QAAM,SAAS,YAAY,QAAQ,IAAI,eAAe;AACtD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,SAAO;AACT;AAGO,SAAS,YAAoB;AAClC,QAAM,MACJ,YAAY,QAAQ,IAAI,YAAY,MAAM,QAAQ,IAAI,aAAa,gBAAgB,0BAA0B;AAE/G,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,yEAAoE;AAAA,EACtF;AAEA,SAAO,IAAI,QAAQ,OAAO,EAAE;AAC9B;AAEO,SAAS,sBAA8B;AAC5C,SAAO,GAAG,UAAU,CAAC;AACvB;","names":[]}

package/dist/admin/auth/oauthApp.d.ts

@@ -0,0 +1,8 @@
+import { OAuthApp } from '@octokit/oauth-app';
+import type { CmsSession } from './types';
+export declare function getOAuthApp(): InstanceType<typeof OAuthApp>;
+/** Reset singleton — test seam only. */
+export declare function resetOAuthAppForTests(): void;
+export declare function getAuthorizationUrl(state: string, redirectUrl: string): string;
+export declare function exchangeCodeForSession(code: string): Promise<CmsSession>;
+//# sourceMappingURL=oauthApp.d.ts.map

package/dist/admin/auth/oauthApp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthApp.d.ts","sourceRoot":"","sources":["../../../admin/auth/oauthApp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,KAAK,EAAE,UAAU,EAAW,MAAM,SAAS,CAAC;AAgBnD,wBAAgB,WAAW,IAAI,YAAY,CAAC,OAAO,QAAQ,CAAC,CAS3D;AAED,wCAAwC;AACxC,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAS9E;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoB9E"}

package/dist/admin/auth/oauthApp.js

@@ -0,0 +1,64 @@
+import "../../chunk-B5LE2OEC.js";
+import { OAuthApp } from "@octokit/oauth-app";
+import { Octokit } from "octokit";
+let oauthAppSingleton = null;
+function getClientId() {
+  var _a;
+  const id = (_a = process.env.GITHUB_ID) == null ? void 0 : _a.trim();
+  if (!id) throw new Error("Missing GITHUB_ID environment variable.");
+  return id;
+}
+function getClientSecret() {
+  var _a;
+  const secret = (_a = process.env.GITHUB_SECRET) == null ? void 0 : _a.trim();
+  if (!secret) throw new Error("Missing GITHUB_SECRET environment variable.");
+  return secret;
+}
+function getOAuthApp() {
+  if (!oauthAppSingleton) {
+    oauthAppSingleton = new OAuthApp({
+      clientType: "github-app",
+      clientId: getClientId(),
+      clientSecret: getClientSecret()
+    });
+  }
+  return oauthAppSingleton;
+}
+function resetOAuthAppForTests() {
+  oauthAppSingleton = null;
+}
+function getAuthorizationUrl(state, redirectUrl) {
+  const app = getOAuthApp();
+  const { url } = app.getWebFlowAuthorizationUrl({
+    state,
+    redirectUrl,
+    // GitHub Apps use app permissions — scopes are ignored for github-app client type.
+    scopes: ["repo"]
+  });
+  return url;
+}
+async function exchangeCodeForSession(code) {
+  var _a;
+  const app = getOAuthApp();
+  const { authentication } = await app.createToken({ code });
+  const accessToken = authentication.token;
+  if (!accessToken) {
+    throw new Error("GitHub did not return an access token.");
+  }
+  const octokit = new Octokit({ auth: accessToken });
+  const { data } = await octokit.rest.users.getAuthenticated();
+  const user = {
+    id: String(data.id),
+    name: (_a = data.name) != null ? _a : data.login,
+    email: data.email,
+    image: data.avatar_url
+  };
+  return { user, accessToken };
+}
+export {
+  exchangeCodeForSession,
+  getAuthorizationUrl,
+  getOAuthApp,
+  resetOAuthAppForTests
+};
+//# sourceMappingURL=oauthApp.js.map

package/dist/admin/auth/oauthApp.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../admin/auth/oauthApp.ts"],"sourcesContent":["import { OAuthApp } from '@octokit/oauth-app';\nimport { Octokit } from 'octokit';\n\nimport type { CmsSession, CmsUser } from './types';\n\nlet oauthAppSingleton: InstanceType<typeof OAuthApp> | null = null;\n\nfunction getClientId(): string {\n  const id = process.env.GITHUB_ID?.trim();\n  if (!id) throw new Error('Missing GITHUB_ID environment variable.');\n  return id;\n}\n\nfunction getClientSecret(): string {\n  const secret = process.env.GITHUB_SECRET?.trim();\n  if (!secret) throw new Error('Missing GITHUB_SECRET environment variable.');\n  return secret;\n}\n\nexport function getOAuthApp(): InstanceType<typeof OAuthApp> {\n  if (!oauthAppSingleton) {\n    oauthAppSingleton = new OAuthApp({\n      clientType: 'github-app',\n      clientId: getClientId(),\n      clientSecret: getClientSecret(),\n    });\n  }\n  return oauthAppSingleton;\n}\n\n/** Reset singleton — test seam only. */\nexport function resetOAuthAppForTests(): void {\n  oauthAppSingleton = null;\n}\n\nexport function getAuthorizationUrl(state: string, redirectUrl: string): string {\n  const app = getOAuthApp();\n  const { url } = app.getWebFlowAuthorizationUrl({\n    state,\n    redirectUrl,\n    // GitHub Apps use app permissions — scopes are ignored for github-app client type.\n    scopes: ['repo'],\n  });\n  return url;\n}\n\nexport async function exchangeCodeForSession(code: string): Promise<CmsSession> {\n  const app = getOAuthApp();\n  const { authentication } = await app.createToken({ code });\n\n  const accessToken = authentication.token;\n  if (!accessToken) {\n    throw new Error('GitHub did not return an access token.');\n  }\n\n  const octokit = new Octokit({ auth: accessToken });\n  const { data } = await octokit.rest.users.getAuthenticated();\n\n  const user: CmsUser = {\n    id: String(data.id),\n    name: data.name ?? data.login,\n    email: data.email,\n    image: data.avatar_url,\n  };\n\n  return { user, accessToken };\n}\n"],"mappings":";AAAA,SAAS,gBAAgB;AACzB,SAAS,eAAe;AAIxB,IAAI,oBAA0D;AAE9D,SAAS,cAAsB;AAP/B;AAQE,QAAM,MAAK,aAAQ,IAAI,cAAZ,mBAAuB;AAClC,MAAI,CAAC,GAAI,OAAM,IAAI,MAAM,yCAAyC;AAClE,SAAO;AACT;AAEA,SAAS,kBAA0B;AAbnC;AAcE,QAAM,UAAS,aAAQ,IAAI,kBAAZ,mBAA2B;AAC1C,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,6CAA6C;AAC1E,SAAO;AACT;AAEO,SAAS,cAA6C;AAC3D,MAAI,CAAC,mBAAmB;AACtB,wBAAoB,IAAI,SAAS;AAAA,MAC/B,YAAY;AAAA,MACZ,UAAU,YAAY;AAAA,MACtB,cAAc,gBAAgB;AAAA,IAChC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGO,SAAS,wBAA8B;AAC5C,sBAAoB;AACtB;AAEO,SAAS,oBAAoB,OAAe,aAA6B;AAC9E,QAAM,MAAM,YAAY;AACxB,QAAM,EAAE,IAAI,IAAI,IAAI,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA;AAAA,IAEA,QAAQ,CAAC,MAAM;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,uBAAuB,MAAmC;AA9ChF;AA+CE,QAAM,MAAM,YAAY;AACxB,QAAM,EAAE,eAAe,IAAI,MAAM,IAAI,YAAY,EAAE,KAAK,CAAC;AAEzD,QAAM,cAAc,eAAe;AACnC,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,QAAM,UAAU,IAAI,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjD,QAAM,EAAE,KAAK,IAAI,MAAM,QAAQ,KAAK,MAAM,iBAAiB;AAE3D,QAAM,OAAgB;AAAA,IACpB,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,OAAM,UAAK,SAAL,YAAa,KAAK;AAAA,IACxB,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,EACd;AAEA,SAAO,EAAE,MAAM,YAAY;AAC7B;","names":[]}

package/dist/admin/auth/seal.d.ts

@@ -0,0 +1,6 @@
+import type { CmsSession } from './types';
+/** Browser cookie size limit — stay under 4 KB including name and attributes. */
+export declare const MAX_SEALED_SESSION_BYTES = 3800;
+export declare function sealSession(payload: CmsSession, secret: string): Promise<string>;
+export declare function unsealSession(sealed: string, secret: string): Promise<CmsSession | null>;
+//# sourceMappingURL=seal.d.ts.map

package/dist/admin/auth/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../admin/auth/seal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAiC7C,wBAAsB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAetF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgB9F"}

package/dist/admin/auth/seal.js

@@ -0,0 +1,61 @@
+import "../../chunk-B5LE2OEC.js";
+const IV_LENGTH = 12;
+const MAX_SEALED_SESSION_BYTES = 3800;
+async function deriveAesKey(secret) {
+  const keyMaterial = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
+  return crypto.subtle.importKey("raw", keyMaterial, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padLen = (4 - padded.length % 4) % 4;
+  const base64 = padded + "=".repeat(padLen);
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+async function sealSession(payload, secret) {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+  const key = await deriveAesKey(secret);
+  const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+  const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext);
+  const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(ciphertext), iv.length);
+  const sealed = base64UrlEncode(combined);
+  if (sealed.length > MAX_SEALED_SESSION_BYTES) {
+    throw new Error("Session payload exceeds cookie size limit after sealing.");
+  }
+  return sealed;
+}
+async function unsealSession(sealed, secret) {
+  var _a;
+  try {
+    const combined = base64UrlDecode(sealed);
+    if (combined.length <= IV_LENGTH) return null;
+    const iv = combined.slice(0, IV_LENGTH);
+    const ciphertext = combined.slice(IV_LENGTH);
+    const key = await deriveAesKey(secret);
+    const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, key, ciphertext);
+    const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+    if (!((_a = parsed == null ? void 0 : parsed.user) == null ? void 0 : _a.id)) return null;
+    return parsed;
+  } catch (e) {
+    return null;
+  }
+}
+export {
+  MAX_SEALED_SESSION_BYTES,
+  sealSession,
+  unsealSession
+};
+//# sourceMappingURL=seal.js.map

package/dist/admin/auth/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../admin/auth/seal.ts"],"sourcesContent":["import type { CmsSession } from './types';\n\nconst IV_LENGTH = 12;\n/** Browser cookie size limit — stay under 4 KB including name and attributes. */\nexport const MAX_SEALED_SESSION_BYTES = 3800;\n\n/**\n * AES-256-GCM session seal using the Web Crypto API (Node 18+ / Vercel serverless).\n *\n * Key derivation: SHA-256 digest of the secret string → 256-bit AES key.\n * Wire format: base64url(iv || ciphertext) where ciphertext includes the GCM auth tag.\n */\nasync function deriveAesKey(secret: string): Promise<CryptoKey> {\n  const keyMaterial = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));\n  return crypto.subtle.importKey('raw', keyMaterial, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nfunction base64UrlDecode(value: string): Uint8Array {\n  const padded = value.replace(/-/g, '+').replace(/_/g, '/');\n  const padLen = (4 - (padded.length % 4)) % 4;\n  const base64 = padded + '='.repeat(padLen);\n  const binary = atob(base64);\n  const bytes = new Uint8Array(binary.length);\n  for (let i = 0; i < binary.length; i++) {\n    bytes[i] = binary.charCodeAt(i);\n  }\n  return bytes;\n}\n\nexport async function sealSession(payload: CmsSession, secret: string): Promise<string> {\n  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));\n  const key = await deriveAesKey(secret);\n  const plaintext = new TextEncoder().encode(JSON.stringify(payload));\n  const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);\n\n  const combined = new Uint8Array(iv.length + ciphertext.byteLength);\n  combined.set(iv, 0);\n  combined.set(new Uint8Array(ciphertext), iv.length);\n\n  const sealed = base64UrlEncode(combined);\n  if (sealed.length > MAX_SEALED_SESSION_BYTES) {\n    throw new Error('Session payload exceeds cookie size limit after sealing.');\n  }\n  return sealed;\n}\n\nexport async function unsealSession(sealed: string, secret: string): Promise<CmsSession | null> {\n  try {\n    const combined = base64UrlDecode(sealed);\n    if (combined.length <= IV_LENGTH) return null;\n\n    const iv = combined.slice(0, IV_LENGTH);\n    const ciphertext = combined.slice(IV_LENGTH);\n    const key = await deriveAesKey(secret);\n    const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);\n    const parsed = JSON.parse(new TextDecoder().decode(plaintext)) as CmsSession;\n\n    if (!parsed?.user?.id) return null;\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAEA,MAAM,YAAY;AAEX,MAAM,2BAA2B;AAQxC,eAAe,aAAa,QAAoC;AAC9D,QAAM,cAAc,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,MAAM,CAAC;AAC1F,SAAO,OAAO,OAAO,UAAU,OAAO,aAAa,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,SAAS,CAAC;AACvG;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,SAAS;AACb,aAAW,QAAQ,OAAO;AACxB,cAAU,OAAO,aAAa,IAAI;AAAA,EACpC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,UAAU,IAAK,OAAO,SAAS,KAAM;AAC3C,QAAM,SAAS,SAAS,IAAI,OAAO,MAAM;AACzC,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAEA,eAAsB,YAAY,SAAqB,QAAiC;AACtF,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,SAAS,CAAC;AAC3D,QAAM,MAAM,MAAM,aAAa,MAAM;AACrC,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AAClE,QAAM,aAAa,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AAEtF,QAAM,WAAW,IAAI,WAAW,GAAG,SAAS,WAAW,UAAU;AACjE,WAAS,IAAI,IAAI,CAAC;AAClB,WAAS,IAAI,IAAI,WAAW,UAAU,GAAG,GAAG,MAAM;AAElD,QAAM,SAAS,gBAAgB,QAAQ;AACvC,MAAI,OAAO,SAAS,0BAA0B;AAC5C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,eAAsB,cAAc,QAAgB,QAA4C;AAtDhG;AAuDE,MAAI;AACF,UAAM,WAAW,gBAAgB,MAAM;AACvC,QAAI,SAAS,UAAU,UAAW,QAAO;AAEzC,UAAM,KAAK,SAAS,MAAM,GAAG,SAAS;AACtC,UAAM,aAAa,SAAS,MAAM,SAAS;AAC3C,UAAM,MAAM,MAAM,aAAa,MAAM;AACrC,UAAM,YAAY,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,UAAU;AACtF,UAAM,SAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAE7D,QAAI,GAAC,sCAAQ,SAAR,mBAAc,IAAI,QAAO;AAC9B,WAAO;AAAA,EACT,SAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/admin/auth/session.d.ts

@@ -0,0 +1,19 @@
+import type { CmsSession, CmsSessionPublic } from './types';
+export type OAuthStatePayload = {
+    state: string;
+    returnTo: string;
+};
+export declare function toPublicSession(session: CmsSession): CmsSessionPublic;
+/** Read and decrypt the CMS session from the request cookies (Server Components, Actions, Route Handlers). */
+export declare function getCmsSession(): Promise<CmsSession | null>;
+export declare function setCmsSessionCookie(session: CmsSession): Promise<string>;
+export declare function clearCmsSessionCookie(): Promise<void>;
+export declare function setOAuthStateCookie(payload: OAuthStatePayload): Promise<void>;
+export declare function readOAuthStateCookie(): Promise<OAuthStatePayload | null>;
+export declare function clearOAuthStateCookie(): Promise<void>;
+/** Build Set-Cookie headers for Route Handlers that return a raw `Response`. */
+export declare function buildSessionSetCookieHeader(session: CmsSession): Promise<string>;
+export declare function buildSessionClearCookieHeader(): string;
+export declare function buildOAuthStateSetCookieHeader(payload: OAuthStatePayload): string;
+export declare function buildOAuthStateClearCookieHeader(): string;
+//# sourceMappingURL=session.d.ts.map

package/dist/admin/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../admin/auth/session.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAU5D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,gBAAgB,CAErE;AAED,8GAA8G;AAC9G,wBAAsB,aAAa,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAWhE;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3D;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnF;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAW9E;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3D;AAED,gFAAgF;AAChF,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAItF;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAGtD;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAEjF;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAGzD"}

package/dist/admin/auth/session.js

@@ -0,0 +1,89 @@
+import "../../chunk-B5LE2OEC.js";
+import { cookies } from "next/headers";
+import { getSessionSecret } from "./env";
+import { sealSession, unsealSession } from "./seal";
+import {
+  CMS_OAUTH_STATE_COOKIE,
+  CMS_SESSION_COOKIE,
+  formatClearCookie,
+  formatSetCookie,
+  oauthStateCookieOptions,
+  sessionCookieOptions
+} from "./cookies";
+function toPublicSession(session) {
+  return { user: session.user };
+}
+async function getCmsSession() {
+  var _a;
+  const cookieStore = await cookies();
+  const sealed = (_a = cookieStore.get(CMS_SESSION_COOKIE)) == null ? void 0 : _a.value;
+  if (!sealed) return null;
+  try {
+    const secret = getSessionSecret();
+    return unsealSession(sealed, secret);
+  } catch (e) {
+    return null;
+  }
+}
+async function setCmsSessionCookie(session) {
+  const secret = getSessionSecret();
+  const sealed = await sealSession(session, secret);
+  const cookieStore = await cookies();
+  cookieStore.set(CMS_SESSION_COOKIE, sealed, sessionCookieOptions());
+  return sealed;
+}
+async function clearCmsSessionCookie() {
+  const cookieStore = await cookies();
+  cookieStore.delete(CMS_SESSION_COOKIE);
+}
+async function setOAuthStateCookie(payload) {
+  const cookieStore = await cookies();
+  cookieStore.set(CMS_OAUTH_STATE_COOKIE, JSON.stringify(payload), oauthStateCookieOptions());
+}
+async function readOAuthStateCookie() {
+  var _a;
+  const cookieStore = await cookies();
+  const raw = (_a = cookieStore.get(CMS_OAUTH_STATE_COOKIE)) == null ? void 0 : _a.value;
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!(parsed == null ? void 0 : parsed.state)) return null;
+    return parsed;
+  } catch (e) {
+    return null;
+  }
+}
+async function clearOAuthStateCookie() {
+  const cookieStore = await cookies();
+  cookieStore.delete(CMS_OAUTH_STATE_COOKIE);
+}
+async function buildSessionSetCookieHeader(session) {
+  const secret = getSessionSecret();
+  const sealed = await sealSession(session, secret);
+  return formatSetCookie(CMS_SESSION_COOKIE, sealed, sessionCookieOptions());
+}
+function buildSessionClearCookieHeader() {
+  const opts = sessionCookieOptions();
+  return formatClearCookie(CMS_SESSION_COOKIE, opts);
+}
+function buildOAuthStateSetCookieHeader(payload) {
+  return formatSetCookie(CMS_OAUTH_STATE_COOKIE, JSON.stringify(payload), oauthStateCookieOptions());
+}
+function buildOAuthStateClearCookieHeader() {
+  const opts = oauthStateCookieOptions();
+  return formatClearCookie(CMS_OAUTH_STATE_COOKIE, opts);
+}
+export {
+  buildOAuthStateClearCookieHeader,
+  buildOAuthStateSetCookieHeader,
+  buildSessionClearCookieHeader,
+  buildSessionSetCookieHeader,
+  clearCmsSessionCookie,
+  clearOAuthStateCookie,
+  getCmsSession,
+  readOAuthStateCookie,
+  setCmsSessionCookie,
+  setOAuthStateCookie,
+  toPublicSession
+};
+//# sourceMappingURL=session.js.map

package/dist/admin/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../admin/auth/session.ts"],"sourcesContent":["import { cookies } from 'next/headers';\n\nimport { getSessionSecret } from './env';\nimport { sealSession, unsealSession } from './seal';\nimport type { CmsSession, CmsSessionPublic } from './types';\nimport {\n  CMS_OAUTH_STATE_COOKIE,\n  CMS_SESSION_COOKIE,\n  formatClearCookie,\n  formatSetCookie,\n  oauthStateCookieOptions,\n  sessionCookieOptions,\n} from './cookies';\n\nexport type OAuthStatePayload = {\n  state: string;\n  returnTo: string;\n};\n\nexport function toPublicSession(session: CmsSession): CmsSessionPublic {\n  return { user: session.user };\n}\n\n/** Read and decrypt the CMS session from the request cookies (Server Components, Actions, Route Handlers). */\nexport async function getCmsSession(): Promise<CmsSession | null> {\n  const cookieStore = await cookies();\n  const sealed = cookieStore.get(CMS_SESSION_COOKIE)?.value;\n  if (!sealed) return null;\n\n  try {\n    const secret = getSessionSecret();\n    return unsealSession(sealed, secret);\n  } catch {\n    return null;\n  }\n}\n\nexport async function setCmsSessionCookie(session: CmsSession): Promise<string> {\n  const secret = getSessionSecret();\n  const sealed = await sealSession(session, secret);\n  const cookieStore = await cookies();\n  cookieStore.set(CMS_SESSION_COOKIE, sealed, sessionCookieOptions());\n  return sealed;\n}\n\nexport async function clearCmsSessionCookie(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.delete(CMS_SESSION_COOKIE);\n}\n\nexport async function setOAuthStateCookie(payload: OAuthStatePayload): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(CMS_OAUTH_STATE_COOKIE, JSON.stringify(payload), oauthStateCookieOptions());\n}\n\nexport async function readOAuthStateCookie(): Promise<OAuthStatePayload | null> {\n  const cookieStore = await cookies();\n  const raw = cookieStore.get(CMS_OAUTH_STATE_COOKIE)?.value;\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw) as OAuthStatePayload;\n    if (!parsed?.state) return null;\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n\nexport async function clearOAuthStateCookie(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.delete(CMS_OAUTH_STATE_COOKIE);\n}\n\n/** Build Set-Cookie headers for Route Handlers that return a raw `Response`. */\nexport async function buildSessionSetCookieHeader(session: CmsSession): Promise<string> {\n  const secret = getSessionSecret();\n  const sealed = await sealSession(session, secret);\n  return formatSetCookie(CMS_SESSION_COOKIE, sealed, sessionCookieOptions());\n}\n\nexport function buildSessionClearCookieHeader(): string {\n  const opts = sessionCookieOptions();\n  return formatClearCookie(CMS_SESSION_COOKIE, opts);\n}\n\nexport function buildOAuthStateSetCookieHeader(payload: OAuthStatePayload): string {\n  return formatSetCookie(CMS_OAUTH_STATE_COOKIE, JSON.stringify(payload), oauthStateCookieOptions());\n}\n\nexport function buildOAuthStateClearCookieHeader(): string {\n  const opts = oauthStateCookieOptions();\n  return formatClearCookie(CMS_OAUTH_STATE_COOKIE, opts);\n}\n"],"mappings":";AAAA,SAAS,eAAe;AAExB,SAAS,wBAAwB;AACjC,SAAS,aAAa,qBAAqB;AAE3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOA,SAAS,gBAAgB,SAAuC;AACrE,SAAO,EAAE,MAAM,QAAQ,KAAK;AAC9B;AAGA,eAAsB,gBAA4C;AAxBlE;AAyBE,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,UAAS,iBAAY,IAAI,kBAAkB,MAAlC,mBAAqC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,SAAS,iBAAiB;AAChC,WAAO,cAAc,QAAQ,MAAM;AAAA,EACrC,SAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,SAAsC;AAC9E,QAAM,SAAS,iBAAiB;AAChC,QAAM,SAAS,MAAM,YAAY,SAAS,MAAM;AAChD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,oBAAoB,QAAQ,qBAAqB,CAAC;AAClE,SAAO;AACT;AAEA,eAAsB,wBAAuC;AAC3D,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,kBAAkB;AACvC;AAEA,eAAsB,oBAAoB,SAA2C;AACnF,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,wBAAwB,KAAK,UAAU,OAAO,GAAG,wBAAwB,CAAC;AAC5F;AAEA,eAAsB,uBAA0D;AAvDhF;AAwDE,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,OAAM,iBAAY,IAAI,sBAAsB,MAAtC,mBAAyC;AACrD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,EAAC,iCAAQ,OAAO,QAAO;AAC3B,WAAO;AAAA,EACT,SAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,wBAAuC;AAC3D,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,OAAO,sBAAsB;AAC3C;AAGA,eAAsB,4BAA4B,SAAsC;AACtF,QAAM,SAAS,iBAAiB;AAChC,QAAM,SAAS,MAAM,YAAY,SAAS,MAAM;AAChD,SAAO,gBAAgB,oBAAoB,QAAQ,qBAAqB,CAAC;AAC3E;AAEO,SAAS,gCAAwC;AACtD,QAAM,OAAO,qBAAqB;AAClC,SAAO,kBAAkB,oBAAoB,IAAI;AACnD;AAEO,SAAS,+BAA+B,SAAoC;AACjF,SAAO,gBAAgB,wBAAwB,KAAK,UAAU,OAAO,GAAG,wBAAwB,CAAC;AACnG;AAEO,SAAS,mCAA2C;AACzD,QAAM,OAAO,wBAAwB;AACrC,SAAO,kBAAkB,wBAAwB,IAAI;AACvD;","names":[]}

package/dist/admin/auth/types.d.ts

@@ -0,0 +1,17 @@
+export type CmsUser = {
+    id: string;
+    name?: string | null;
+    email?: string | null;
+    image?: string | null;
+};
+/** Server-side session stored in the sealed `octocms-session` cookie. */
+export type CmsSession = {
+    user: CmsUser;
+    /** GitHub user access token — used when `CMS_GITHUB_TOKEN` is unset. */
+    accessToken?: string;
+};
+/** JSON returned by `GET /api/octocms/auth/session` (no access token). */
+export type CmsSessionPublic = {
+    user: CmsUser;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/admin/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../admin/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,OAAO,CAAC;CACf,CAAC"}

package/dist/admin/auth/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/admin/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/admin/authRoutes.d.ts

@@ -0,0 +1,14 @@
+import type { CmsUser } from './auth/types';
+export type AuthorizeUserFn = (user: CmsUser) => boolean | Promise<boolean>;
+export type AuthRouteHandlers = {
+    authRoute: (request: Request, action: string) => Promise<Response>;
+};
+/**
+ * Factory for auth Route Handlers with optional access-control hook.
+ */
+export declare function createAuthRouteHandlers(options?: {
+    authorizeUser?: AuthorizeUserFn;
+}): AuthRouteHandlers;
+/** Default auth Route Handler dispatcher (no access-control hook). */
+export declare const authRoute: (request: Request, action: string) => Promise<Response>;
+//# sourceMappingURL=authRoutes.d.ts.map

package/dist/admin/authRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authRoutes.d.ts","sourceRoot":"","sources":["../../admin/authRoutes.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC;AA2HF;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,eAAe,CAAA;CAAE,GAAG,iBAAiB,CAyBxG;AAED,sEAAsE;AACtE,eAAO,MAAQ,SAAS,YA3JD,OAAO,UAAU,MAAM,KAAK,OAAO,CAAC,QAAQ,CA2Jb,CAAC"}