@chitmark/sdk 0.6.1 → 0.6.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. package/README.md +24 -10
  2. package/dist/edge.cjs +65 -19
  3. package/dist/edge.cjs.map +1 -1
  4. package/dist/edge.d.cts +3 -2
  5. package/dist/edge.d.ts +3 -2
  6. package/dist/edge.js +63 -20
  7. package/dist/edge.js.map +1 -1
  8. package/dist/index.cjs +68 -19
  9. package/dist/index.cjs.map +1 -1
  10. package/dist/index.d.cts +14 -5
  11. package/dist/index.d.ts +14 -5
  12. package/dist/index.js +66 -20
  13. package/dist/index.js.map +1 -1
  14. package/dist/trusted-ip-Fb-K6nwG.d.cts +608 -0
  15. package/dist/trusted-ip-Fb-K6nwG.d.ts +608 -0
  16. package/package.json +12 -12
  17. package/dist/http-status-CYKIa-SM.d.cts +0 -435
  18. package/dist/http-status-CYKIa-SM.d.ts +0 -435
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/http-status.ts","../src/middleware/express.ts","../src/middleware/next.ts"],"names":["out"],"mappings":";;;AAKO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAE3B,IAAM,WAAA,GAAc,OAAA;AAEpB,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;AClBA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,WAAW,CAAA;AAC/D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMA,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;ACzCO,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AAqBA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAE/B,eAAsB,kBAAA,CACpB,KAAA,EACA,OAAA,GAAqC,EAAC,EACT;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,kBAAkB,OAAA,CAAQ,OAAA;AAChC,EAAA,IAAI,eAAA,KAAoB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,eAAA,EAAiB;AACvE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,mBAAmB,OAAA,CAAQ,QAAA;AACjC,EAAA,IAAI,gBAAA,KAAqB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,gBAAA,EAAkB;AACzE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;AChLO,IAAM,WAAN,MAAe;AAAA,EACH,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACtC,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,GAAgE,EAAC,EACpC;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAKY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UACrE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;AC5RO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,iEAAA;AAAA,EACV,oBAAA,EACE,4EAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAEO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACSO,SAAS,YAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,GAAuB,EAAC,EAKP;AACjB,EAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,EAAG,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA,CAAA;AAChF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA;AAErC,MAAA,MAAM,CAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,KAAA,EAAO,IAAI,IAAA,EAAM,KAAA;AAAA,UACjB,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,SAAA,EAAA,CACG,OAAO,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,KAAM,QAAA,GAClC,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,GACxB,KAAA,CAAA,KAAc,EAAA;AAAA,UACpB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,UAAU,GAAA,CAAI;AAAA;AAChB,OACD,CAAA;AAED,MAAA,GAAA,CAAI,OAAO,QAAA,GAAW,CAAA;AAEtB,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA,KAAa,WAAA,EAAa;AAC5C,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ;AACzB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,SAAS,CAAA,CACrC,IAAA,CAAK,EAAE,KAAA,EAAO,SAAA,EAAW,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAA;AACF;;;ACvEA,eAAsB,iBAAA,CACpB,MAAA,EACA,GAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,IACtD,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA,EAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,IAAK,EAAA;AAAA,MAC1C,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AAAA,MAC5C,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MACvC,UAAU,OAAA,CAAQ;AAAA;AACpB,GACD,CAAA;AACH","file":"index.cjs","sourcesContent":["import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n override name = \"ChitmarkError\";\n readonly status?: number;\n readonly code?: string;\n readonly body?: ChitmarkErrorBody | string;\n\n constructor(\n message: string,\n options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n ) {\n super(message);\n this.status = options?.status;\n this.code = options?.code;\n this.body = options?.body;\n }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n override name = \"ChitmarkApiError\";\n\n constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n const msg =\n message ??\n (typeof body === \"string\"\n ? body\n : body.message || body.error || `Chitmark API error (${status})`);\n super(msg, {\n status,\n code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n body,\n });\n }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n return {\n decision: \"challenge\" satisfies Decision,\n actorType: \"unknown\",\n confidence: 0,\n reasons: [reason],\n principal: {\n resolved: false,\n identityBasis: [\"degraded\"],\n },\n verdictToken: \"\",\n eventId: `evt_degraded_${session ?? \"unknown\"}`,\n degraded: true,\n enforcementMode: \"enforce\",\n };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n if (verdict.degraded && verdict.decision === \"allow\") {\n return {\n ...verdict,\n decision: \"challenge\",\n reasons: [\n ...verdict.reasons,\n \"Client enforced: degraded decision must not be allow\",\n ],\n };\n }\n return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n production: \"https://api.chitmark.com\",\n staging: \"https://api.staging.chitmark.com\",\n development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\n/** Keep in parity with the package version and the Python SDK. */\nexport const SDK_VERSION = \"0.6.0\";\n\nexport function resolveBaseUrl(\n env: ChitmarkEnv = \"production\",\n baseUrl?: string,\n): string {\n return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only, no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n if (typeof process === \"undefined\") return undefined;\n const value = process.env?.CHITMARK_BASE_URL;\n return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n const normalized = email.trim().toLowerCase();\n const data = new TextEncoder().encode(normalized);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n const trimmed = ip.trim();\n // IPv4 (optionally from x-forwarded-for first hop)\n const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n if (first.includes(\".\") && !first.includes(\":\")) {\n const parts = first.split(\".\");\n if (parts.length === 4) {\n return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n }\n }\n // IPv6: keep first 3 hextets (~/48)\n if (first.includes(\":\")) {\n const hextets = first.split(\":\").filter(Boolean);\n const head = hextets.slice(0, 3).join(\":\");\n return `${head}::/48`;\n }\n return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n if (!formData) return undefined;\n const allowed = new Set([\n \"companyDomain\",\n \"company_domain\",\n \"domain\",\n \"plan\",\n \"referrer\",\n \"utm_source\",\n \"utm_medium\",\n \"utm_campaign\",\n ]);\n const out: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(formData)) {\n if (allowed.has(key) && value != null) {\n out[key] = value;\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n const bytes = new Uint8Array(buffer);\n let hex = \"\";\n for (const b of bytes) {\n hex += b.toString(16).padStart(2, \"0\");\n }\n return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n subject: Subject,\n piiMode: PiiMode,\n): Promise<Subject> {\n if (piiMode === \"raw\") {\n return subject;\n }\n\n if (piiMode === \"none\") {\n return {\n userAgent: subject.userAgent,\n headers: pickWebBotAuthHeaders(subject.headers),\n };\n }\n\n // hashed (default)\n const prepared: Subject = {\n userAgent: subject.userAgent,\n headers: subject.headers,\n };\n\n if (subject.emailSha256) {\n prepared.emailSha256 = subject.emailSha256;\n } else if (subject.email) {\n prepared.emailSha256 = await hashEmailSha256(subject.email);\n }\n\n if (subject.ipTrunc) {\n prepared.ipTrunc = subject.ipTrunc;\n } else if (subject.ip) {\n prepared.ipTrunc = truncateIp(subject.ip);\n }\n\n const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n if (hashedForm) {\n prepared.formDataHashed = hashedForm;\n }\n\n return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n const keys = [\"signature-agent\", \"signature-input\", \"signature\"];\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n const lower = k.toLowerCase();\n if (keys.includes(lower) && typeof v === \"string\") {\n out[lower] = v;\n } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n out[lower] = v[0];\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n if (headers instanceof Headers) {\n const out: Record<string, string> = {};\n headers.forEach((value, key) => {\n out[key.toLowerCase()] = value;\n });\n return out;\n }\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n if (typeof v === \"string\") out[k.toLowerCase()] = v;\n else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n }\n return out;\n}\n","/**\n * Client-side verdictToken verification.\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin hint (`aud`), issuing tenant (`tid`), and `jti`\n * with a short `exp`. This module validates shape, signature (against the JWKS\n * served from GET /.well-known/jwks.json), expiry, session binding, and, when\n * expected values are supplied, tenant and origin binding. `aud` reflects\n * request headers and is attacker influenced: always verify `session` and\n * `tenantId`, never `aud` alone. Rejection reasons are surfaced as\n * `VerdictTokenError.code`.\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\nexport interface VerdictTokenClaims {\n eventId: string;\n decision: Decision;\n actorType: ActorType;\n confidence: number;\n aud: string;\n sub: string;\n /** Issuing tenant, server-derived from the API key used at verify time. */\n tid: string;\n jti: string;\n iat: number;\n exp: number;\n degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n | \"malformed_token\"\n | \"wrong_algorithm\"\n | \"jwks_unavailable\"\n | \"unknown_kid\"\n | \"invalid_signature\"\n | \"expired\"\n | \"not_yet_valid\"\n | \"wrong_session\"\n | \"wrong_aud\"\n | \"wrong_tenant\";\n\nexport class VerdictTokenError extends ChitmarkError {\n override name = \"VerdictTokenError\";\n\n constructor(code: VerdictTokenErrorCode, message: string) {\n super(message, { code });\n }\n}\n\nexport interface VerifyVerdictTokenOptions {\n /** Expected session: token `sub` must equal this or verification fails. */\n session?: string;\n /** Expected issuing tenant: token `tid` must equal this or verification fails. */\n tenantId?: string;\n /** Expected origin hint: token `aud` must equal this or verification fails. */\n aud?: string;\n /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n jwksUrl?: string;\n /** Pre-fetched JWKS; skips the network fetch when provided. */\n jwks?: { keys: Array<Record<string, unknown>> };\n /** Injectable fetch (Node 24+/browsers have a global). */\n fetch?: typeof fetch;\n /** Clock override for tests. */\n nowMs?: number;\n /** Clock skew tolerance in seconds; defaults to 30. */\n leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\nexport async function verifyVerdictToken(\n token: string,\n options: VerifyVerdictTokenOptions = {},\n): Promise<VerdictTokenClaims> {\n const nowMs = options.nowMs ?? Date.now();\n const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n const parts = token.split(\".\");\n if (parts.length !== 3) {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n }\n const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n let header: Record<string, unknown>;\n let payload: Record<string, unknown>;\n try {\n header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n } catch {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n }\n\n if (header[\"alg\"] !== \"ES256\") {\n throw new VerdictTokenError(\n \"wrong_algorithm\",\n `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n );\n }\n const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n if (!kid) {\n throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n }\n\n const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n const nowSeconds = Math.floor(nowMs / 1000);\n if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n }\n if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n }\n\n const expectedSession = options.session;\n if (expectedSession !== undefined && payload[\"sub\"] !== expectedSession) {\n throw new VerdictTokenError(\n \"wrong_session\",\n \"verdictToken was minted for a different session\",\n );\n }\n const expectedTenantId = options.tenantId;\n if (expectedTenantId !== undefined && payload[\"tid\"] !== expectedTenantId) {\n throw new VerdictTokenError(\n \"wrong_tenant\",\n \"verdictToken was minted for a different tenant\",\n );\n }\n const expectedAud = options.aud;\n if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n throw new VerdictTokenError(\n \"wrong_aud\",\n \"verdictToken was minted for a different origin\",\n );\n }\n\n const jwk = await findJwk(kid, options);\n if (!jwk) {\n throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n }\n\n let publicKey: CryptoKey;\n try {\n publicKey = await crypto.subtle.importKey(\n \"jwk\",\n jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"verify\"],\n );\n } catch {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"JWKS key is not a valid P-256 public key\",\n );\n }\n\n const signatureBytes = decodeBase64UrlBytes(signatureB64);\n const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n new Uint8Array(signatureBuffer).set(signatureBytes);\n\n const valid = await crypto.subtle.verify(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n publicKey,\n signatureBuffer,\n new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n );\n if (!valid) {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"verdictToken signature failed verification\",\n );\n }\n\n return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n kid: string,\n options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n let jwks = options.jwks;\n if (!jwks) {\n const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n try {\n const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n const res = await fetchImpl(jwksUrl);\n if (!res.ok) {\n throw new Error(`JWKS fetch failed with ${res.status}`);\n }\n jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n } catch (err) {\n throw new VerdictTokenError(\n \"jwks_unavailable\",\n `Failed to load JWKS from ${jwksUrl}: ${\n err instanceof Error ? err.message : \"unknown error\"\n }`,\n );\n }\n }\n if (!Array.isArray(jwks.keys)) {\n throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n }\n return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n return out;\n}\n","import {\n ChitmarkApiError,\n ChitmarkError,\n degradedChallengeVerdict,\n enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n DEFAULT_TIMEOUT_MS,\n SDK_VERSION,\n envBaseUrl,\n resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n verifyVerdictToken,\n type VerdictTokenClaims,\n type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n ChallengeRequest,\n ChallengeResponse,\n ChallengeCompletionResponse,\n ChallengeProof,\n ChitmarkOptions,\n FeedbackRequest,\n FeedbackResponse,\n OnDegraded,\n PiiMode,\n Verdict,\n VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client (Open Agent Ledger): three verbs:\n * verify, feedback, challenge. Trust decisions on agent-mediated actions,\n * tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n * action: \"signup\",\n * subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n private readonly apiKey: string;\n private readonly baseUrl: string;\n private readonly timeoutMs: number;\n private readonly piiMode: PiiMode;\n private readonly onDegraded: OnDegraded;\n private readonly fetchImpl: typeof fetch;\n private readonly clientName: string;\n\n constructor(options: ChitmarkOptions) {\n if (!options.apiKey) {\n throw new ChitmarkError(\"Chitmark apiKey is required\");\n }\n if (options.onDegraded && options.onDegraded !== \"challenge\") {\n throw new ChitmarkError(\n 'onDegraded must be \"challenge\": fail to challenge, never to allow',\n );\n }\n this.apiKey = options.apiKey;\n this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n this.piiMode = options.piiMode ?? \"hashed\";\n this.onDegraded = \"challenge\";\n this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n }\n\n /**\n * Score + route an inbound action (signup / trial / …).\n * Hot path at the edge; client budget defaults to 800ms.\n * On timeout/transport error, or a malformed verdict shape from the API,\n * returns a degraded challenge verdict (never allow, never crashes).\n *\n * Persist `v.eventId` on the account row: feedback joins only on that id.\n */\n async verify(request: VerifyRequest): Promise<Verdict> {\n const subject = await prepareSubject(\n {\n ...request.subject,\n headers: flattenHeaders(request.subject.headers),\n },\n this.piiMode,\n );\n\n const body: VerifyRequest = {\n ...request,\n subject,\n };\n\n try {\n const verdict = await this.request<Verdict>(\"/v1/verify\", {\n method: \"POST\",\n body,\n idempotencyKey: request.idempotencyKey,\n });\n if (!isWellFormedVerdict(verdict)) {\n return degradedChallengeVerdict(\n \"Degraded: verify returned a malformed verdict shape\",\n request.session,\n );\n }\n return enforceDegradedNeverAllow(verdict);\n } catch (err) {\n if (err instanceof ChitmarkApiError) {\n throw err;\n }\n return degradedChallengeVerdict(\n err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n request.session,\n );\n }\n }\n\n /**\n * Report a downstream outcome joined on the stored eventId from verify.\n * This is the data moat: attribution is a schema contract, not a fuzzy match.\n * `idempotencyKey` is sent as both the Idempotency-Key header and body field\n * (header takes precedence server-side) so exact retries replay the original\n * acknowledgement.\n */\n async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n return this.request<FeedbackResponse>(\"/v1/feedback\", {\n method: \"POST\",\n body: request,\n idempotencyKey: request.idempotencyKey,\n });\n }\n\n /**\n * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n */\n async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n return this.request<ChallengeResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Complete a challenge by submitting its solved proof. Clears only the bound\n * session, once. Re-verify with `context.challengeId` to have the next\n * verify honor the cleared session.\n */\n async completeChallenge(request: {\n eventId: string;\n challengeId: string;\n session: string;\n proof: ChallengeProof;\n }): Promise<ChallengeCompletionResponse> {\n return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Verify a verdictToken's signature against the API's JWKS and its session /\n * tenant binding. Rejects expired tokens, unknown kids, and\n * invalid signatures with `VerdictTokenError`. Pass `session` and `tenantId`\n * to enforce session and tenant binding (recommended); `aud` enforces the\n * origin hint only.\n */\n async verifyVerdictToken(\n token: string,\n options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\"> = {},\n ): Promise<VerdictTokenClaims> {\n return verifyVerdictToken(token, {\n ...options,\n jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n fetch: this.fetchImpl,\n });\n }\n\n /**\n * Low-level HTTP helper. Prefer verify / feedback / challenge.\n */\n async request<T>(\n path: string,\n init: {\n method: string;\n body?: unknown;\n idempotencyKey?: string;\n },\n ): Promise<T> {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n try {\n const headers: Record<string, string> = {\n Authorization: `Bearer ${this.apiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n \"User-Agent\": this.clientName,\n \"X-Chitmark-Client\": this.clientName,\n };\n if (init.idempotencyKey) {\n headers[\"Idempotency-Key\"] = init.idempotencyKey;\n }\n\n const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n method: init.method,\n headers,\n body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n signal: controller.signal,\n });\n\n const text = await res.text();\n let parsed: unknown = undefined;\n if (text) {\n try {\n parsed = JSON.parse(text) as unknown;\n } catch {\n parsed = text;\n }\n }\n\n if (!res.ok) {\n const errBody =\n typeof parsed === \"object\" && parsed !== null\n ? (parsed as { error?: string; message?: string; code?: string })\n : text;\n const normalized =\n typeof errBody === \"string\"\n ? errBody\n : {\n error: errBody.error ?? `http_${res.status}`,\n message: errBody.message,\n code: errBody.code,\n };\n throw new ChitmarkApiError(res.status, normalized);\n }\n\n return parsed as T;\n } catch (err) {\n if (err instanceof ChitmarkApiError) throw err;\n if (err instanceof Error && err.name === \"AbortError\") {\n throw new ChitmarkError(`Request timed out after ${this.timeoutMs}ms`, {\n code: \"timeout\",\n });\n }\n throw err instanceof Error\n ? new ChitmarkError(err.message, { code: \"transport\" })\n : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n } finally {\n clearTimeout(timer);\n }\n }\n\n /** Public accessors for inspection / tests. */\n get config(): {\n baseUrl: string;\n timeoutMs: number;\n piiMode: PiiMode;\n onDegraded: OnDegraded;\n } {\n return {\n baseUrl: this.baseUrl,\n timeoutMs: this.timeoutMs,\n piiMode: this.piiMode,\n onDegraded: this.onDegraded,\n };\n }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow: the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n if (typeof value !== \"object\" || value === null) return false;\n const v = value as Partial<Verdict>;\n return (\n typeof v.decision === \"string\" &&\n VERDICT_DECISIONS.has(v.decision) &&\n typeof v.eventId === \"string\" &&\n v.eventId.length > 0 &&\n typeof v.degraded === \"boolean\"\n );\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n ok: 200,\n created: 201,\n badRequest: 400,\n unauthorized: 401,\n forbidden: 403,\n notFound: 404,\n conflict: 409,\n preconditionRequired: 428,\n tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n created: \"Resource was created after an explicit non-degraded allow.\",\n badRequest: \"Required request fields are missing or malformed.\",\n unauthorized: \"API key is missing or invalid.\",\n forbidden: \"Verify returned deny; block the action.\",\n notFound: \"Referenced Chitmark resource was not found.\",\n conflict: \"Idempotency key was reused with a materially different payload.\",\n preconditionRequired:\n \"Verify returned challenge or degraded; require friction before continuing.\",\n tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n if (verdict.degraded || verdict.decision === \"challenge\") {\n return CHITMARK_HTTP_STATUS.preconditionRequired;\n }\n if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n return CHITMARK_HTTP_STATUS.ok;\n}\n","import type { Chitmark } from \"../client.js\";\nimport { CHITMARK_HTTP_STATUS } from \"../http-status.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\n/**\n * Minimal Express-compatible types (no express dependency).\n */\nexport interface ExpressLikeRequest {\n hostname?: string;\n path?: string;\n ip?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n headers: Record<string, string | string[] | undefined>;\n}\n\nexport interface ExpressLikeResponse {\n status: (code: number) => ExpressLikeResponse;\n json: (body: unknown) => unknown;\n locals: Record<string, unknown>;\n}\n\nexport type ExpressNext = (err?: unknown) => void;\n\nexport interface GateOptions {\n /** Optional session binder. */\n session?: (req: ExpressLikeRequest) => string | undefined;\n /** Custom surface string. */\n surface?: (req: ExpressLikeRequest) => string;\n}\n\n/**\n * Express middleware factory: verify on the hot path, attach verdict to res.locals.\n *\n * - deny → 403\n * - challenge (incl. degraded) → 428\n * - allow → next()\n *\n * @example\n * ```ts\n * app.post(\"/signup\", chitmarkGate(chitmark, \"signup\"), signupHandler);\n * ```\n */\nexport function chitmarkGate(\n client: Chitmark,\n action: Action,\n options: GateOptions = {},\n): (\n req: ExpressLikeRequest,\n res: ExpressLikeResponse,\n next: ExpressNext,\n) => Promise<void> {\n return async (req, res, next) => {\n try {\n const surface = options.surface?.(req) ?? `${req.hostname ?? \"\"}${req.path ?? \"\"}`;\n const session = options.session?.(req);\n\n const v: Verdict = await client.verify({\n action,\n surface,\n session,\n subject: {\n email: req.body?.email,\n ip: req.ip,\n userAgent:\n (typeof req.headers[\"user-agent\"] === \"string\"\n ? req.headers[\"user-agent\"]\n : undefined) ?? \"\",\n headers: req.headers,\n formData: req.body,\n },\n });\n\n res.locals.chitmark = v;\n\n if (v.degraded || v.decision === \"challenge\") {\n res\n .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n .json({ challenge: true, eventId: v.eventId });\n return;\n }\n if (v.decision === \"deny\") {\n res\n .status(CHITMARK_HTTP_STATUS.forbidden)\n .json({ error: \"blocked\", eventId: v.eventId });\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n","import type { Chitmark } from \"../client.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\nexport interface NextVerifyOptions {\n action: Action;\n surface?: string;\n session?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n}\n\n/**\n * Helper for Next.js App Router route handlers.\n * Returns the verdict; caller maps decision → Response.\n *\n * @example\n * ```ts\n * const v = await verifyNextRequest(chitmark, req, { action: \"signup\", body });\n * const status = verdictToHttpStatus(v);\n * ```\n */\nexport async function verifyNextRequest(\n client: Chitmark,\n req: Request,\n options: NextVerifyOptions,\n): Promise<Verdict> {\n const url = new URL(req.url);\n return client.verify({\n action: options.action,\n surface: options.surface ?? `${url.host}${url.pathname}`,\n session: options.session,\n subject: {\n email: options.body?.email,\n ip: req.headers.get(\"x-forwarded-for\") ?? \"\",\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\n headers: Object.fromEntries(req.headers),\n formData: options.body,\n },\n });\n}\n\nexport { verdictToHttpStatus } from \"../http-status.js\";\n"]}
1
+ {"version":3,"sources":["../src/errors.ts","../src/internal/constants.ts","../src/pii.ts","../src/internal/prepare.ts","../src/verify-token.ts","../src/client.ts","../src/http-status.ts","../src/trusted-ip.ts","../src/middleware/express.ts","../src/middleware/next.ts"],"names":["out"],"mappings":";;;AAKO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,eAAA;AAAA,EACP,MAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,SAAS,OAAA,EAAS,MAAA;AACvB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AACrB,IAAA,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA;AAAA,EACvB;AACF;AAKO,IAAM,gBAAA,GAAN,cAA+B,aAAA,CAAc;AAAA,EACzC,IAAA,GAAO,kBAAA;AAAA,EAEhB,WAAA,CAAY,MAAA,EAAgB,IAAA,EAAkC,OAAA,EAAkB;AAC9E,IAAA,MAAM,GAAA,GACJ,OAAA,KACC,OAAO,IAAA,KAAS,QAAA,GACb,IAAA,GACA,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,KAAA,IAAS,CAAA,oBAAA,EAAuB,MAAM,CAAA,CAAA,CAAA,CAAA;AACjE,IAAA,KAAA,CAAM,GAAA,EAAK;AAAA,MACT,MAAA;AAAA,MACA,MAAM,OAAO,IAAA,KAAS,WAAY,IAAA,CAAK,IAAA,IAAQ,KAAK,KAAA,GAAS,MAAA;AAAA,MAC7D;AAAA,KACD,CAAA;AAAA,EACH;AACF;AAMO,SAAS,wBAAA,CAAyB,QAAgB,OAAA,EAA2B;AAClF,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,WAAA;AAAA,IACV,SAAA,EAAW,SAAA;AAAA,IACX,UAAA,EAAY,CAAA;AAAA,IACZ,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,IAChB,SAAA,EAAW;AAAA,MACT,QAAA,EAAU,KAAA;AAAA,MACV,aAAA,EAAe,CAAC,UAAU;AAAA,KAC5B;AAAA,IACA,YAAA,EAAc,EAAA;AAAA,IACd,OAAA,EAAS,CAAA,aAAA,EAAgB,OAAA,IAAW,SAAS,CAAA,CAAA;AAAA,IAC7C,QAAA,EAAU,IAAA;AAAA,IACV,eAAA,EAAiB;AAAA,GACnB;AACF;AAKO,SAAS,0BAA0B,OAAA,EAA2B;AACnE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,OAAA,EAAS;AACpD,IAAA,OAAO;AAAA,MACL,GAAG,OAAA;AAAA,MACH,QAAA,EAAU,WAAA;AAAA,MACV,OAAA,EAAS;AAAA,QACP,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX;AAAA;AACF,KACF;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;;;AC5EO,IAAM,iBAAA,GAAiD;AAAA,EAC5D,UAAA,EAAY,0BAAA;AAAA,EACZ,OAAA,EAAS,kCAAA;AAAA,EACT,WAAA,EAAa;AACf,CAAA;AAEO,IAAM,kBAAA,GAAqB,GAAA;AAE3B,IAAM,WAAA,GAAc,OAAA;AAEpB,SAAS,cAAA,CACd,GAAA,GAAmB,YAAA,EACnB,OAAA,EACQ;AACR,EAAA,OAAA,CAAQ,WAAW,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9D;AAMO,SAAS,UAAA,GAAiC;AAC/C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,EAAa,OAAO,MAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAA,EAAK,iBAAA;AAC3B,EAAA,OAAO,KAAA,GAAQ,KAAA,CAAM,IAAA,EAAK,GAAI,MAAA;AAChC;;;AClBA,eAAsB,gBAAgB,KAAA,EAAgC;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AAChD,EAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AACzD,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAKO,SAAS,WAAW,EAAA,EAAoB;AAC7C,EAAA,MAAM,OAAA,GAAU,GAAG,IAAA,EAAK;AAExB,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,EAAG,MAAK,IAAK,OAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,GAAG,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,OAAO,CAAA,EAAG,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,CAAC,CAAC,CAAA,KAAA,CAAA;AAAA,IAC5C;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,MAAM,UAAU,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,OAAO,CAAA;AAC/C,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAC,CAAA,CAAE,KAAK,GAAG,CAAA;AACzC,IAAA,OAAO,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,KAAA;AACT;AAMO,SAAS,iBACd,QAAA,EACqC;AACrC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,eAAA;AAAA,IACA,gBAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACnD,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,SAAS,IAAA,EAAM;AACrC,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAEA,SAAS,YAAY,MAAA,EAA6B;AAChD,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAM,CAAA;AACnC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,GAAA,IAAO,EAAE,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAAA,EACvC;AACA,EAAA,OAAO,GAAA;AACT;;;AClEA,eAAsB,cAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO;AAAA,MACL,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,OAAA,EAAS,qBAAA,CAAsB,OAAA,CAAQ,OAAO;AAAA,KAChD;AAAA,EACF;AAGA,EAAA,MAAM,QAAA,GAAoB;AAAA,IACxB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,SAAS,OAAA,CAAQ;AAAA,GACnB;AAEA,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,QAAA,CAAS,cAAc,OAAA,CAAQ,WAAA;AAAA,EACjC,CAAA,MAAA,IAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,QAAA,CAAS,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,QAAA,CAAS,UAAU,OAAA,CAAQ,OAAA;AAAA,EAC7B,CAAA,MAAA,IAAW,QAAQ,EAAA,EAAI;AACrB,IAAA,QAAA,CAAS,OAAA,GAAU,UAAA,CAAW,OAAA,CAAQ,EAAE,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,cAAA,IAAkB,gBAAA,CAAiB,QAAQ,QAAQ,CAAA;AAC9E,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,QAAA,CAAS,cAAA,GAAiB,UAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,sBACP,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,CAAC,iBAAA,EAAmB,iBAAA,EAAmB,WAAW,CAAA;AAC/D,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,MAAM,KAAA,GAAQ,EAAE,WAAA,EAAY;AAC5B,IAAA,IAAI,KAAK,QAAA,CAAS,KAAK,CAAA,IAAK,OAAO,MAAM,QAAA,EAAU;AACjD,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA;AAAA,IACf,CAAA,MAAA,IAAW,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,IAAK,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG;AAC3D,MAAA,GAAA,CAAI,KAAK,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA;AAAA,IAClB;AAAA,EACF;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,MAAA,GAAS,IAAI,GAAA,GAAM,MAAA;AAC7C;AAKO,SAAS,eACd,OAAA,EACoC;AACpC,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,mBAAmB,OAAA,EAAS;AAC9B,IAAA,MAAMA,OAA8B,EAAC;AACrC,IAAA,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AAC9B,MAAAA,IAAAA,CAAI,GAAA,CAAI,WAAA,EAAa,CAAA,GAAI,KAAA;AAAA,IAC3B,CAAC,CAAA;AACD,IAAA,OAAOA,IAAAA;AAAA,EACT;AACA,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAC5C,IAAA,IAAI,OAAO,CAAA,KAAM,QAAA,MAAc,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,CAAA;AAAA,SAAA,IACzC,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,GAAI,EAAE,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,GAAA;AACT;;;ACtDO,IAAM,oBAAA,GAAuB;AAkC7B,IAAM,iBAAA,GAAN,cAAgC,aAAA,CAAc;AAAA,EAC1C,IAAA,GAAO,mBAAA;AAAA,EAEhB,WAAA,CAAY,MAA6B,OAAA,EAAiB;AACxD,IAAA,KAAA,CAAM,OAAA,EAAS,EAAE,IAAA,EAAM,CAAA;AAAA,EACzB;AACF;AA+BA,IAAM,gBAAA,GAAmB,gDAAA;AACzB,IAAM,sBAAA,GAAyB,EAAA;AAQ/B,eAAsB,kBAAA,CACpB,OACA,OAAA,EAC6B;AAC7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,IAAA,CAAK,GAAA,EAAI;AACxC,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,sBAAA;AAE/C,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,4BAA4B,CAAA;AAAA,EAC7E;AACA,EAAA,MAAM,CAAC,SAAA,EAAW,UAAA,EAAY,YAAY,CAAA,GAAI,KAAA;AAE9C,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,SAAS,CAAC,CAAA;AAC9C,IAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,eAAA,CAAgB,UAAU,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,iBAAA,EAAmB,oCAAoC,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,OAAA,EAAS;AAC7B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,iBAAA;AAAA,MACA,CAAA,iCAAA,EAAoC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC3D;AAAA,EACF;AAGA,EAAA,IAAI,MAAA,CAAO,KAAK,CAAA,KAAM,KAAA,EAAO;AAC3B,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,YAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAO,MAAA,CAAO,KAAK,MAAM,QAAA,GAAW,MAAA,CAAO,KAAK,CAAA,GAAI,EAAA;AAChE,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,6BAA6B,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,GAAA,GAAM,OAAO,OAAA,CAAQ,KAAK,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAK,CAAA,GAAI,GAAA;AAClE,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA;AAC1C,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,SAAA,EAAW,0BAA0B,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,OAAO,QAAA,CAAS,GAAG,CAAA,IAAK,GAAA,GAAM,aAAa,aAAA,EAAe;AAC5D,IAAA,MAAM,IAAI,iBAAA,CAAkB,eAAA,EAAiB,mCAAmC,CAAA;AAAA,EAClF;AAEA,EAAA,MAAM,cAAA,GAAiB,QAAQ,MAAA,IAAU,oBAAA;AACzC,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,cAAA,EAAgB;AACrC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,OAAA,EAAS;AACtC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,eAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,KAAM,OAAA,CAAQ,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,cAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,cAAc,OAAA,CAAQ,GAAA;AAC5B,EAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAM,WAAA,EAAa;AAC/D,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,WAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,iBAAA,CAAkB,aAAA,EAAe,CAAA,wBAAA,EAA2B,GAAG,CAAA,CAAE,CAAA;AAAA,EAC7E;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,MAAM,OAAO,MAAA,CAAO,SAAA;AAAA,MAC9B,KAAA;AAAA,MACA,GAAA;AAAA,MACA,EAAE,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,OAAA,EAAQ;AAAA,MACrC,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,qBAAqB,YAAY,CAAA;AACxD,EAAA,MAAM,eAAA,GAAkB,IAAI,WAAA,CAAY,cAAA,CAAe,UAAU,CAAA;AACjE,EAAA,IAAI,UAAA,CAAW,eAAe,CAAA,CAAE,GAAA,CAAI,cAAc,CAAA;AAElD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA;AAAA,IAChC,EAAE,IAAA,EAAM,OAAA,EAAS,IAAA,EAAM,SAAA,EAAU;AAAA,IACjC,SAAA;AAAA,IACA,eAAA;AAAA,IACA,IAAI,aAAY,CAAE,MAAA,CAAO,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE;AAAA,GACvD;AACA,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,OAAA,CACb,KACA,OAAA,EAC8C;AAC9C,EAAA,IAAI,OAAO,OAAA,CAAQ,IAAA;AACnB,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,gBAAA;AACnC,IAAA,IAAI;AACF,MAAA,MAAM,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AACnE,MAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MACxD;AACA,MAAA,IAAA,GAAQ,MAAM,IAAI,IAAA,EAAK;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,kBAAA;AAAA,QACA,4BAA4B,OAAO,CAAA,EAAA,EACjC,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,eACvC,CAAA;AAAA,OACF;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,iBAAA,CAAkB,kBAAA,EAAoB,iCAAiC,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,IAAA,CAAK,CAAC,QAAQ,GAAA,CAAI,KAAK,MAAM,GAAG,CAAA;AACnD;AAEA,SAAS,gBAAgB,KAAA,EAAuB;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,MAAA,EAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AACnF;AAEA,SAAS,qBAAqB,KAAA,EAA2B;AACvD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AACxE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AACxC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACvE,EAAA,OAAO,GAAA;AACT;;;AClOO,IAAM,WAAN,MAAe;AAAA,EACH,MAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EAEjB,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,cAAc,6BAA6B,CAAA;AAAA,IACvD;AACA,IAAA,IAAI,OAAA,CAAQ,UAAA,IAAc,OAAA,CAAQ,UAAA,KAAe,WAAA,EAAa;AAC5D,MAAA,MAAM,IAAI,aAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,UAAU,cAAA,CAAe,OAAA,CAAQ,KAAK,OAAA,CAAQ,OAAA,IAAW,YAAY,CAAA;AAC1E,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACtC,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,QAAA;AAClC,IAAA,IAAA,CAAK,UAAA,GAAa,WAAA;AAClB,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAClE,IAAA,IAAA,CAAK,UAAA,GAAa,OAAA,CAAQ,UAAA,IAAc,CAAA,cAAA,EAAiB,WAAW,CAAA,CAAA;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OAAO,OAAA,EAA0C;AACrD,IAAA,MAAM,UAAU,MAAM,cAAA;AAAA,MACpB;AAAA,QACE,GAAG,OAAA,CAAQ,OAAA;AAAA,QACX,OAAA,EAAS,cAAA,CAAe,OAAA,CAAQ,OAAA,CAAQ,OAAO;AAAA,OACjD;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,IAAA,GAAsB;AAAA,MAC1B,GAAG,OAAA;AAAA,MACH;AAAA,KACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAiB,YAAA,EAAc;AAAA,QACxD,MAAA,EAAQ,MAAA;AAAA,QACR,IAAA;AAAA,QACA,gBAAgB,OAAA,CAAQ;AAAA,OACzB,CAAA;AACD,MAAA,IAAI,CAAC,mBAAA,CAAoB,OAAO,CAAA,EAAG;AACjC,QAAA,OAAO,wBAAA;AAAA,UACL,qDAAA;AAAA,UACA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAO,0BAA0B,OAAO,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,gBAAA,EAAkB;AACnC,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,OAAO,wBAAA;AAAA,QACL,GAAA,YAAe,KAAA,GAAQ,CAAA,UAAA,EAAa,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,yBAAA;AAAA,QACpD,OAAA,CAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,SAAS,OAAA,EAAqD;AAClE,IAAA,OAAO,IAAA,CAAK,QAA0B,cAAA,EAAgB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM,OAAA;AAAA,MACN,gBAAgB,OAAA,CAAQ;AAAA,KACzB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,OAAA,EAAuD;AACrE,IAAA,OAAO,IAAA,CAAK,QAA2B,eAAA,EAAiB;AAAA,MACtD,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkB,OAAA,EAKiB;AACvC,IAAA,OAAO,IAAA,CAAK,QAAqC,eAAA,EAAiB;AAAA,MAChE,MAAA,EAAQ,MAAA;AAAA,MACR,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBAAA,CACJ,KAAA,EACA,OAAA,EAC6B;AAC7B,IAAA,OAAO,mBAAmB,KAAA,EAAO;AAAA,MAC/B,GAAG,OAAA;AAAA,MACH,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAA;AAAA,MACxB,OAAO,IAAA,CAAK;AAAA,KACb,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CACJ,IAAA,EACA,IAAA,EAKY;AACZ,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAkC;AAAA,QACtC,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAA,QACpC,cAAA,EAAgB,kBAAA;AAAA,QAChB,MAAA,EAAQ,kBAAA;AAAA,QACR,cAAc,IAAA,CAAK,UAAA;AAAA,QACnB,qBAAqB,IAAA,CAAK;AAAA,OAC5B;AACA,MAAA,IAAI,KAAK,cAAA,EAAgB;AACvB,QAAA,OAAA,CAAQ,iBAAiB,IAAI,IAAA,CAAK,cAAA;AAAA,MACpC;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,SAAA,CAAU,GAAG,IAAA,CAAK,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI;AAAA,QACzD,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,IAAA,KAAS,KAAA,CAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,CAAA;AAAA,QAC5D,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAI,MAAA,GAAkB,KAAA,CAAA;AACtB,MAAA,IAAI,IAAA,EAAM;AACR,QAAA,IAAI;AACF,UAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QAC1B,CAAA,CAAA,MAAQ;AACN,UAAA,MAAA,GAAS,IAAA;AAAA,QACX;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,UACJ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,OACpC,MAAA,GACD,IAAA;AACN,QAAA,MAAM,UAAA,GACJ,OAAO,OAAA,KAAY,QAAA,GACf,OAAA,GACA;AAAA,UACE,KAAA,EAAO,OAAA,CAAQ,KAAA,IAAS,CAAA,KAAA,EAAQ,IAAI,MAAM,CAAA,CAAA;AAAA,UAC1C,SAAS,OAAA,CAAQ,OAAA;AAAA,UACjB,MAAM,OAAA,CAAQ;AAAA,SAChB;AACN,QAAA,MAAM,IAAI,gBAAA,CAAiB,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA;AAAA,MACnD;AAEA,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,kBAAkB,MAAM,GAAA;AAC3C,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,aAAA,CAAc,CAAA,wBAAA,EAA2B,IAAA,CAAK,SAAS,CAAA,EAAA,CAAA,EAAM;AAAA,UACrE,IAAA,EAAM;AAAA,SACP,CAAA;AAAA,MACH;AACA,MAAA,MAAM,eAAe,KAAA,GACjB,IAAI,aAAA,CAAc,GAAA,CAAI,SAAS,EAAE,IAAA,EAAM,WAAA,EAAa,IACpD,IAAI,aAAA,CAAc,2BAA2B,EAAE,IAAA,EAAM,aAAa,CAAA;AAAA,IACxE,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,MAAA,GAKF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK;AAAA,KACnB;AAAA,EACF;AACF;AAEA,IAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,WAAA,EAAa,MAAM,CAAC,CAAA;AAM9E,SAAS,oBAAoB,KAAA,EAAkC;AACpE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,MAAM,OAAO,KAAA;AACxD,EAAA,MAAM,CAAA,GAAI,KAAA;AACV,EAAA,OACE,OAAO,CAAA,CAAE,QAAA,KAAa,YACtB,iBAAA,CAAkB,GAAA,CAAI,EAAE,QAAQ,CAAA,IAChC,OAAO,CAAA,CAAE,OAAA,KAAY,YACrB,CAAA,CAAE,OAAA,CAAQ,SAAS,CAAA,IACnB,OAAO,EAAE,QAAA,KAAa,SAAA;AAE1B;;;AC7SO,IAAM,oBAAA,GAAuB;AAAA,EAClC,EAAA,EAAI,GAAA;AAAA,EACJ,OAAA,EAAS,GAAA;AAAA,EACT,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,GAAA;AAAA,EACd,SAAA,EAAW,GAAA;AAAA,EACX,QAAA,EAAU,GAAA;AAAA,EACV,QAAA,EAAU,GAAA;AAAA,EACV,oBAAA,EAAsB,GAAA;AAAA,EACtB,eAAA,EAAiB;AACnB;AAKO,IAAM,4BAAA,GAA+B;AAAA,EAC1C,EAAA,EAAI,0FAAA;AAAA,EACJ,OAAA,EAAS,4DAAA;AAAA,EACT,UAAA,EAAY,mDAAA;AAAA,EACZ,YAAA,EAAc,gCAAA;AAAA,EACd,SAAA,EAAW,yCAAA;AAAA,EACX,QAAA,EAAU,6CAAA;AAAA,EACV,QAAA,EAAU,6EAAA;AAAA,EACV,oBAAA,EACE,0IAAA;AAAA,EACF,eAAA,EAAiB;AACnB;AAeO,SAAS,gBAAgB,OAAA,EAAmD;AACjF,EAAA,OAAO,OAAA,CAAQ,QAAA,KAAa,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAClD;AAMO,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,OAAA,CAAQ,QAAA,KAAa,WAAA,EAAa;AACxD,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAQ,OAAO,oBAAA,CAAqB,SAAA;AAC7D,EAAA,IAAI,CAAC,eAAA,CAAgB,OAAO,CAAA,EAAG;AAC7B,IAAA,OAAO,oBAAA,CAAqB,oBAAA;AAAA,EAC9B;AACA,EAAA,OAAO,oBAAA,CAAqB,EAAA;AAC9B;;;ACnDO,SAAS,mBAAmB,GAAA,EAAsB;AACvD,EAAA,MAAM,QAAA,GACJ,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAA,EAAG,IAAA,EAAK,IAC1C,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA,EAAG,MAAK,IACnC,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,wBAAwB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAC/D,EAAA;AACF,EAAA,IAAI,UAAU,OAAO,QAAA;AAIrB,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,IAAK,EAAA;AACtE;;;AC+BO,SAAS,YAAA,CACd,MAAA,EACA,MAAA,EACA,OAAA,GAAuB,EAAC,EAKP;AACjB,EAAA,OAAO,OAAO,GAAA,EAAK,GAAA,EAAK,IAAA,KAAS;AAC/B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA,IAAK,CAAA,EAAG,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA,EAAG,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAA,CAAA;AAChF,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,GAAU,GAAG,CAAA;AAErC,MAAA,MAAM,CAAA,GAAa,MAAM,MAAA,CAAO,MAAA,CAAO;AAAA,QACrC,MAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA;AAAA,QACA,OAAA,EAAS;AAAA,UACP,KAAA,EAAO,IAAI,IAAA,EAAM,KAAA;AAAA,UACjB,IAAI,GAAA,CAAI,EAAA;AAAA,UACR,SAAA,EAAA,CACG,OAAO,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,KAAM,QAAA,GAClC,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,GACxB,KAAA,CAAA,KAAc,EAAA;AAAA,UACpB,SAAS,GAAA,CAAI,OAAA;AAAA,UACb,UAAU,GAAA,CAAI;AAAA;AAChB,OACD,CAAA;AAED,MAAA,GAAA,CAAI,OAAO,QAAA,GAAW,CAAA;AAEtB,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA,KAAa,WAAA,EAAa;AAC5C,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAA,CAAE,aAAa,MAAA,EAAQ;AACzB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,SAAS,CAAA,CACrC,IAAA,CAAK,EAAE,KAAA,EAAO,SAAA,EAAW,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAChD,QAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAA,CAAgB,CAAC,CAAA,EAAG;AAEvB,QAAA,GAAA,CACG,MAAA,CAAO,oBAAA,CAAqB,oBAAoB,CAAA,CAChD,IAAA,CAAK,EAAE,SAAA,EAAW,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,CAAA;AAC/C,QAAA;AAAA,MACF;AACA,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAG,CAAA;AAAA,IACV;AAAA,EACF,CAAA;AACF;;;AChFA,eAAsB,iBAAA,CACpB,MAAA,EACA,GAAA,EACA,OAAA,EACkB;AAClB,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAC3B,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,OAAA,EAAS,QAAQ,OAAA,IAAW,CAAA,EAAG,IAAI,IAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAAA,IACtD,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,QAAQ,IAAA,EAAM,KAAA;AAAA,MACrB,EAAA,EAAI,mBAAmB,GAAG,CAAA;AAAA,MAC1B,SAAA,EAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AAAA,MAC5C,OAAA,EAAS,MAAA,CAAO,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AAAA,MACvC,UAAU,OAAA,CAAQ;AAAA;AACpB,GACD,CAAA;AACH","file":"index.cjs","sourcesContent":["import type { ChitmarkErrorBody, Decision, Verdict } from \"./types.js\";\n\n/**\n * Base error for all Chitmark client failures.\n */\nexport class ChitmarkError extends Error {\n override name = \"ChitmarkError\";\n readonly status?: number;\n readonly code?: string;\n readonly body?: ChitmarkErrorBody | string;\n\n constructor(\n message: string,\n options?: { status?: number; code?: string; body?: ChitmarkErrorBody | string },\n ) {\n super(message);\n this.status = options?.status;\n this.code = options?.code;\n this.body = options?.body;\n }\n}\n\n/**\n * Raised when the API returns a non-2xx response.\n */\nexport class ChitmarkApiError extends ChitmarkError {\n override name = \"ChitmarkApiError\";\n\n constructor(status: number, body: ChitmarkErrorBody | string, message?: string) {\n const msg =\n message ??\n (typeof body === \"string\"\n ? body\n : body.message || body.error || `Chitmark API error (${status})`);\n super(msg, {\n status,\n code: typeof body === \"object\" ? (body.code ?? body.error) : undefined,\n body,\n });\n }\n}\n\n/**\n * Build the degraded challenge verdict used on timeout / transport failure.\n * Golden rule: fail to challenge, never to allow.\n */\nexport function degradedChallengeVerdict(reason: string, session?: string): Verdict {\n return {\n decision: \"challenge\" satisfies Decision,\n actorType: \"unknown\",\n confidence: 0,\n reasons: [reason],\n principal: {\n resolved: false,\n identityBasis: [\"degraded\"],\n },\n verdictToken: \"\",\n eventId: `evt_degraded_${session ?? \"unknown\"}`,\n degraded: true,\n enforcementMode: \"enforce\",\n };\n}\n\n/**\n * Ensure degraded responses never surface as allow (defense in depth client-side).\n */\nexport function enforceDegradedNeverAllow(verdict: Verdict): Verdict {\n if (verdict.degraded && verdict.decision === \"allow\") {\n return {\n ...verdict,\n decision: \"challenge\",\n reasons: [\n ...verdict.reasons,\n \"Client enforced: degraded decision must not be allow\",\n ],\n };\n }\n return verdict;\n}\n","import type { ChitmarkEnv } from \"../types.js\";\n\nexport const DEFAULT_BASE_URLS: Record<ChitmarkEnv, string> = {\n production: \"https://api.chitmark.com\",\n staging: \"https://api.staging.chitmark.com\",\n development: \"http://127.0.0.1:8787\",\n};\n\nexport const DEFAULT_TIMEOUT_MS = 800;\n/** Keep in parity with the package version and the Python SDK. */\nexport const SDK_VERSION = \"0.6.0\";\n\nexport function resolveBaseUrl(\n env: ChitmarkEnv = \"production\",\n baseUrl?: string,\n): string {\n return (baseUrl ?? DEFAULT_BASE_URLS[env]).replace(/\\/$/, \"\");\n}\n\n/**\n * CHITMARK_BASE_URL environment override, when present (Node only, no-op on\n * Workers/browsers where `process` is undefined).\n */\nexport function envBaseUrl(): string | undefined {\n if (typeof process === \"undefined\") return undefined;\n const value = process.env?.CHITMARK_BASE_URL;\n return value ? value.trim() : undefined;\n}\n","/**\n * Client-side PII minimization helpers.\n * Default SDK mode hashes email and truncates IP before leaving the customer process.\n */\n\n/**\n * SHA-256 hex digest of lowercased, trimmed email.\n * Uses Web Crypto (Node 18+, browsers, Workers).\n */\nexport async function hashEmailSha256(email: string): Promise<string> {\n const normalized = email.trim().toLowerCase();\n const data = new TextEncoder().encode(normalized);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return bufferToHex(digest);\n}\n\n/**\n * Truncate IPv4 to /24 or IPv6 to /48 for coarse geo without host identity.\n */\nexport function truncateIp(ip: string): string {\n const trimmed = ip.trim();\n // IPv4 (optionally from x-forwarded-for first hop)\n const first = trimmed.split(\",\")[0]?.trim() ?? trimmed;\n if (first.includes(\".\") && !first.includes(\":\")) {\n const parts = first.split(\".\");\n if (parts.length === 4) {\n return `${parts[0]}.${parts[1]}.${parts[2]}.0/24`;\n }\n }\n // IPv6: keep first 3 hextets (~/48)\n if (first.includes(\":\")) {\n const hextets = first.split(\":\").filter(Boolean);\n const head = hextets.slice(0, 3).join(\":\");\n return `${head}::/48`;\n }\n return first;\n}\n\n/**\n * Reduce form payload to non-PII keys (domain-style fields only for hashed mode).\n * Free-text is dropped; companyDomain-style keys are kept as-is when domain-like.\n */\nexport function minimizeFormData(\n formData: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n if (!formData) return undefined;\n const allowed = new Set([\n \"companyDomain\",\n \"company_domain\",\n \"domain\",\n \"plan\",\n \"referrer\",\n \"utm_source\",\n \"utm_medium\",\n \"utm_campaign\",\n ]);\n const out: Record<string, unknown> = {};\n for (const [key, value] of Object.entries(formData)) {\n if (allowed.has(key) && value != null) {\n out[key] = value;\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\nfunction bufferToHex(buffer: ArrayBuffer): string {\n const bytes = new Uint8Array(buffer);\n let hex = \"\";\n for (const b of bytes) {\n hex += b.toString(16).padStart(2, \"0\");\n }\n return hex;\n}\n","import type { PiiMode, Subject } from \"../types.js\";\nimport { hashEmailSha256, minimizeFormData, truncateIp } from \"../pii.js\";\n\n/**\n * Apply client-side PII mode to a subject before the wire.\n */\nexport async function prepareSubject(\n subject: Subject,\n piiMode: PiiMode,\n): Promise<Subject> {\n if (piiMode === \"raw\") {\n return subject;\n }\n\n if (piiMode === \"none\") {\n return {\n userAgent: subject.userAgent,\n headers: pickWebBotAuthHeaders(subject.headers),\n };\n }\n\n // hashed (default)\n const prepared: Subject = {\n userAgent: subject.userAgent,\n headers: subject.headers,\n };\n\n if (subject.emailSha256) {\n prepared.emailSha256 = subject.emailSha256;\n } else if (subject.email) {\n prepared.emailSha256 = await hashEmailSha256(subject.email);\n }\n\n if (subject.ipTrunc) {\n prepared.ipTrunc = subject.ipTrunc;\n } else if (subject.ip) {\n prepared.ipTrunc = truncateIp(subject.ip);\n }\n\n const hashedForm = subject.formDataHashed ?? minimizeFormData(subject.formData);\n if (hashedForm) {\n prepared.formDataHashed = hashedForm;\n }\n\n return prepared;\n}\n\nfunction pickWebBotAuthHeaders(\n headers?: Record<string, string | string[] | undefined>,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n const keys = [\"signature-agent\", \"signature-input\", \"signature\"];\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n const lower = k.toLowerCase();\n if (keys.includes(lower) && typeof v === \"string\") {\n out[lower] = v;\n } else if (keys.includes(lower) && Array.isArray(v) && v[0]) {\n out[lower] = v[0];\n }\n }\n return Object.keys(out).length > 0 ? out : undefined;\n}\n\n/**\n * Normalize header maps (Node / Fetch) to plain string records for JSON.\n */\nexport function flattenHeaders(\n headers?: Record<string, string | string[] | undefined> | Headers,\n): Record<string, string> | undefined {\n if (!headers) return undefined;\n if (headers instanceof Headers) {\n const out: Record<string, string> = {};\n headers.forEach((value, key) => {\n out[key.toLowerCase()] = value;\n });\n return out;\n }\n const out: Record<string, string> = {};\n for (const [k, v] of Object.entries(headers)) {\n if (typeof v === \"string\") out[k.toLowerCase()] = v;\n else if (Array.isArray(v) && v[0]) out[k.toLowerCase()] = v[0];\n }\n return out;\n}\n","/**\n * Client-side verdictToken verification.\n *\n * A verdictToken is an ES256 JWT decision receipt minted by the edge and bound\n * to session (`sub`), origin hint (`aud`), issuing tenant (`tid`), and a unique\n * `jti` (correlation id) with a short `exp` (5 minutes). Every signed token\n * requires a `kid` in the JWT header. Signature verification proves\n * authenticity and integrity; it does not make the JWT single-use. This module\n * always enforces `session` and `tenantId` (security boundary), validates\n * `iss` against the Chitmark issuer, and optionally `aud`. `aud` reflects\n * request headers and is attacker influenced: never enforce `aud` alone.\n * Rejection reasons are surfaced as `VerdictTokenError.code`.\n *\n * JWKS: respect `Cache-Control` and, when present, `ETag` /\n * `Last-Modified` via conditional requests (instead of a hard-coded\n * refresh interval). Refresh immediately on unknown `kid`. Do not fetch on\n * every verification; never permanently pin a single signing key. Each JWKS\n * key is EC P-256 for ES256: require JWT `alg === \"ES256\"` before verifying\n * (`wrong_algorithm` otherwise); never trust the token-requested algorithm.\n * Rotation overlaps old and new keys; keep the retiring key until tokens under it\n * expire (≥ 5 minutes + 60 seconds). Pass a cached `jwks` option to skip\n * the network call. An empty JWKS (`keys: []`) means no token can be\n * cryptographically verified: fail closed; never treat an empty set as\n * evidence that a token is valid (local/CI may emit `unsigned.<eventId>`).\n */\n\nimport { ChitmarkError } from \"./errors.js\";\nimport type { ActorType, Decision } from \"./types.js\";\n\n/** Canonical issuer claim on every signed verdictToken. */\nexport const VERDICT_TOKEN_ISSUER = \"https://api.chitmark.com\";\n\nexport interface VerdictTokenClaims {\n /** Issuer: https://api.chitmark.com. */\n iss: string;\n eventId: string;\n decision: Decision;\n actorType: ActorType;\n confidence: number;\n aud: string;\n sub: string;\n /** Issuing tenant, server-derived from the API key used at verify time. */\n tid: string;\n /** Unique token identifier (correlation). Not single-use unless you track it. */\n jti: string;\n iat: number;\n exp: number;\n degraded: boolean;\n}\n\nexport type VerdictTokenErrorCode =\n | \"malformed_token\"\n | \"wrong_algorithm\"\n | \"wrong_type\"\n | \"jwks_unavailable\"\n | \"unknown_kid\"\n | \"invalid_signature\"\n | \"expired\"\n | \"not_yet_valid\"\n | \"wrong_issuer\"\n | \"wrong_session\"\n | \"wrong_aud\"\n | \"wrong_tenant\";\n\nexport class VerdictTokenError extends ChitmarkError {\n override name = \"VerdictTokenError\";\n\n constructor(code: VerdictTokenErrorCode, message: string) {\n super(message, { code });\n }\n}\n\nexport interface VerifyVerdictTokenOptions {\n /** Expected session: token `sub` must equal this or verification fails. */\n session: string;\n /** Expected issuing tenant: token `tid` must equal this or verification fails. */\n tenantId: string;\n /** Expected origin hint: token `aud` must equal this or verification fails. */\n aud?: string;\n /**\n * Expected issuer (`iss`). Defaults to {@link VERDICT_TOKEN_ISSUER}.\n * Override only in tests.\n */\n issuer?: string;\n /** JWKS URL; defaults to https://api.chitmark.com/.well-known/jwks.json. */\n jwksUrl?: string;\n /**\n * Pre-fetched / cached JWKS; skips the network fetch when provided.\n * Prefer caching via HTTP headers (`Cache-Control`, `ETag`, and\n * `Last-Modified` when present) with conditional refresh and immediate\n * refresh on unknown `kid`, rather than fetching on every verification.\n */\n jwks?: { keys: Array<Record<string, unknown>> };\n /** Injectable fetch (Node 24+/browsers have a global). */\n fetch?: typeof fetch;\n /** Clock override for tests. */\n nowMs?: number;\n /** Clock skew tolerance in seconds; defaults to 30. */\n leewaySeconds?: number;\n}\n\nconst DEFAULT_JWKS_URL = \"https://api.chitmark.com/.well-known/jwks.json\";\nconst DEFAULT_LEEWAY_SECONDS = 30;\n\n/**\n * Verify a verdictToken signature and binding.\n *\n * `session` and `tenantId` are required: they are the security boundary for\n * cross-service authorization, not optional hints.\n */\nexport async function verifyVerdictToken(\n token: string,\n options: VerifyVerdictTokenOptions,\n): Promise<VerdictTokenClaims> {\n const nowMs = options.nowMs ?? Date.now();\n const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;\n\n const parts = token.split(\".\");\n if (parts.length !== 3) {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken must be a JWT\");\n }\n const [headerB64, payloadB64, signatureB64] = parts as [string, string, string];\n\n let header: Record<string, unknown>;\n let payload: Record<string, unknown>;\n try {\n header = JSON.parse(decodeBase64Url(headerB64)) as Record<string, unknown>;\n payload = JSON.parse(decodeBase64Url(payloadB64)) as Record<string, unknown>;\n } catch {\n throw new VerdictTokenError(\"malformed_token\", \"verdictToken is not valid JWT JSON\");\n }\n\n if (header[\"alg\"] !== \"ES256\") {\n throw new VerdictTokenError(\n \"wrong_algorithm\",\n `verdictToken must use ES256, got ${String(header[\"alg\"])}`,\n );\n }\n // RFC 8725 §3.11: explicit typing keeps this receipt distinct from any\n // other JWT a tenant might accept. The edge always mints typ \"JWT\".\n if (header[\"typ\"] !== \"JWT\") {\n throw new VerdictTokenError(\n \"wrong_type\",\n `verdictToken must be a JWT, got ${String(header[\"typ\"])}`,\n );\n }\n const kid = typeof header[\"kid\"] === \"string\" ? header[\"kid\"] : \"\";\n if (!kid) {\n throw new VerdictTokenError(\"unknown_kid\", \"verdictToken is missing kid\");\n }\n\n const exp = typeof payload[\"exp\"] === \"number\" ? payload[\"exp\"] : NaN;\n const iat = typeof payload[\"iat\"] === \"number\" ? payload[\"iat\"] : NaN;\n const nowSeconds = Math.floor(nowMs / 1000);\n if (Number.isFinite(exp) && exp < nowSeconds - leewaySeconds) {\n throw new VerdictTokenError(\"expired\", \"verdictToken has expired\");\n }\n if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {\n throw new VerdictTokenError(\"not_yet_valid\", \"verdictToken iat is in the future\");\n }\n\n const expectedIssuer = options.issuer ?? VERDICT_TOKEN_ISSUER;\n if (payload[\"iss\"] !== expectedIssuer) {\n throw new VerdictTokenError(\n \"wrong_issuer\",\n \"verdictToken was not issued by Chitmark\",\n );\n }\n if (payload[\"sub\"] !== options.session) {\n throw new VerdictTokenError(\n \"wrong_session\",\n \"verdictToken was minted for a different session\",\n );\n }\n if (payload[\"tid\"] !== options.tenantId) {\n throw new VerdictTokenError(\n \"wrong_tenant\",\n \"verdictToken was minted for a different tenant\",\n );\n }\n const expectedAud = options.aud;\n if (expectedAud !== undefined && payload[\"aud\"] !== expectedAud) {\n throw new VerdictTokenError(\n \"wrong_aud\",\n \"verdictToken was minted for a different origin\",\n );\n }\n\n const jwk = await findJwk(kid, options);\n if (!jwk) {\n throw new VerdictTokenError(\"unknown_kid\", `JWKS has no key for kid ${kid}`);\n }\n\n let publicKey: CryptoKey;\n try {\n publicKey = await crypto.subtle.importKey(\n \"jwk\",\n jwk as unknown as JsonWebKey,\n { name: \"ECDSA\", namedCurve: \"P-256\" },\n false,\n [\"verify\"],\n );\n } catch {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"JWKS key is not a valid P-256 public key\",\n );\n }\n\n const signatureBytes = decodeBase64UrlBytes(signatureB64);\n const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n new Uint8Array(signatureBuffer).set(signatureBytes);\n\n const valid = await crypto.subtle.verify(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n publicKey,\n signatureBuffer,\n new TextEncoder().encode(`${headerB64}.${payloadB64}`),\n );\n if (!valid) {\n throw new VerdictTokenError(\n \"invalid_signature\",\n \"verdictToken signature failed verification\",\n );\n }\n\n return payload as unknown as VerdictTokenClaims;\n}\n\nasync function findJwk(\n kid: string,\n options: VerifyVerdictTokenOptions,\n): Promise<Record<string, unknown> | undefined> {\n let jwks = options.jwks;\n if (!jwks) {\n const jwksUrl = options.jwksUrl ?? DEFAULT_JWKS_URL;\n try {\n const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n const res = await fetchImpl(jwksUrl);\n if (!res.ok) {\n throw new Error(`JWKS fetch failed with ${res.status}`);\n }\n jwks = (await res.json()) as { keys: Array<Record<string, unknown>> };\n } catch (err) {\n throw new VerdictTokenError(\n \"jwks_unavailable\",\n `Failed to load JWKS from ${jwksUrl}: ${\n err instanceof Error ? err.message : \"unknown error\"\n }`,\n );\n }\n }\n if (!Array.isArray(jwks.keys)) {\n throw new VerdictTokenError(\"jwks_unavailable\", \"JWKS response has no keys array\");\n }\n return jwks.keys.find((key) => key[\"kid\"] === kid);\n}\n\nfunction decodeBase64Url(value: string): string {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n return new TextDecoder().decode(Uint8Array.from(binary, (ch) => ch.charCodeAt(0)));\n}\n\nfunction decodeBase64UrlBytes(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n const out = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);\n return out;\n}\n","import {\n ChitmarkApiError,\n ChitmarkError,\n degradedChallengeVerdict,\n enforceDegradedNeverAllow,\n} from \"./errors.js\";\nimport {\n DEFAULT_TIMEOUT_MS,\n SDK_VERSION,\n envBaseUrl,\n resolveBaseUrl,\n} from \"./internal/constants.js\";\nimport { flattenHeaders, prepareSubject } from \"./internal/prepare.js\";\nimport {\n verifyVerdictToken,\n type VerdictTokenClaims,\n type VerifyVerdictTokenOptions,\n} from \"./verify-token.js\";\nimport type {\n ChallengeRequest,\n ChallengeResponse,\n ChallengeCompletionResponse,\n ChallengeProof,\n ChitmarkOptions,\n FeedbackRequest,\n FeedbackResponse,\n OnDegraded,\n PiiMode,\n Verdict,\n VerifyRequest,\n} from \"./types.js\";\n\n/**\n * Official Chitmark client (Open Agent Ledger): three verbs:\n * verify, feedback, challenge. Trust decisions on agent-mediated actions,\n * tuned by business outcomes.\n *\n * @example\n * ```ts\n * const chitmark = new Chitmark({ apiKey: process.env.CHITMARK_API_KEY! });\n * const verdict = await chitmark.verify({\n * action: \"signup\",\n * subject: { email, ip, userAgent },\n * });\n * ```\n */\nexport class Chitmark {\n private readonly apiKey: string;\n private readonly baseUrl: string;\n private readonly timeoutMs: number;\n private readonly piiMode: PiiMode;\n private readonly onDegraded: OnDegraded;\n private readonly fetchImpl: typeof fetch;\n private readonly clientName: string;\n\n constructor(options: ChitmarkOptions) {\n if (!options.apiKey) {\n throw new ChitmarkError(\"Chitmark apiKey is required\");\n }\n if (options.onDegraded && options.onDegraded !== \"challenge\") {\n throw new ChitmarkError(\n 'onDegraded must be \"challenge\": fail to challenge, never to allow',\n );\n }\n this.apiKey = options.apiKey;\n this.baseUrl = resolveBaseUrl(options.env, options.baseUrl ?? envBaseUrl());\n this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n this.piiMode = options.piiMode ?? \"hashed\";\n this.onDegraded = \"challenge\";\n this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n this.clientName = options.clientName ?? `chitmark-node/${SDK_VERSION}`;\n }\n\n /**\n * Score + route an inbound action (signup / trial / …).\n * Client budget defaults to 800ms.\n *\n * Store-outage degradation arrives as **HTTP 200** with a Verdict body\n * (`degraded: true`, `decision: \"challenge\"`). The SDK deserializes that\n * like any other Verdict. Verify never returns HTTP 503.\n *\n * HTTP 4xx / 429 Error responses throw `ChitmarkApiError`. Transport\n * timeout / network failure (or a malformed 200 body) synthesizes a local\n * degraded challenge Verdict (never allow, never crashes).\n *\n * Persist `v.eventId` on the account row: feedback joins only on that id.\n */\n async verify(request: VerifyRequest): Promise<Verdict> {\n const subject = await prepareSubject(\n {\n ...request.subject,\n headers: flattenHeaders(request.subject.headers),\n },\n this.piiMode,\n );\n\n const body: VerifyRequest = {\n ...request,\n subject,\n };\n\n try {\n const verdict = await this.request<Verdict>(\"/v1/verify\", {\n method: \"POST\",\n body,\n idempotencyKey: request.idempotencyKey,\n });\n if (!isWellFormedVerdict(verdict)) {\n return degradedChallengeVerdict(\n \"Degraded: verify returned a malformed verdict shape\",\n request.session,\n );\n }\n return enforceDegradedNeverAllow(verdict);\n } catch (err) {\n if (err instanceof ChitmarkApiError) {\n throw err;\n }\n return degradedChallengeVerdict(\n err instanceof Error ? `Degraded: ${err.message}` : \"Degraded: verify failed\",\n request.session,\n );\n }\n }\n\n /**\n * Report a downstream outcome joined on the stored eventId from verify.\n *\n * Security invariant: feedback cannot create attribution. It only attaches\n * an outcome to an existing verify event for this tenant. Unknown or\n * cross-tenant eventIds return 404. Never invent a join from email/IP.\n *\n * Append-only (not latest-wins): multiple outcomes may attach to one\n * eventId. Exact duplicates share one feedbackId. Compatible labels\n * coexist; conflicting pairs quarantine the new observation without\n * deleting prior evidence. HTTP `{ ok: true }` still acknowledges\n * quarantined ingest.\n *\n * `idempotencyKey` is sent as both the Idempotency-Key header and body field\n * (header takes precedence server-side) so exact retries replay the original\n * acknowledgement.\n */\n async feedback(request: FeedbackRequest): Promise<FeedbackResponse> {\n return this.request<FeedbackResponse>(\"/v1/feedback\", {\n method: \"POST\",\n body: request,\n idempotencyKey: request.idempotencyKey,\n });\n }\n\n /**\n * Issue an asymmetric-cost challenge after decision === challenge | degraded.\n */\n async challenge(request: ChallengeRequest): Promise<ChallengeResponse> {\n return this.request<ChallengeResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Complete a challenge by submitting its solved proof. Clears only the bound\n * session, once. Does not authorize the action: re-verify with\n * `context.challengeId` and proceed only on non-degraded allow.\n */\n async completeChallenge(request: {\n eventId: string;\n challengeId: string;\n session: string;\n proof: ChallengeProof;\n }): Promise<ChallengeCompletionResponse> {\n return this.request<ChallengeCompletionResponse>(\"/v1/challenge\", {\n method: \"POST\",\n body: request,\n });\n }\n\n /**\n * Verify a verdictToken's signature against the API's JWKS and its session /\n * tenant binding. Prefers a cached `jwks` (refresh periodically and on\n * unknown `kid`); do not fetch on every call. Rejects expired tokens,\n * unknown kids, and invalid signatures with `VerdictTokenError`. Always\n * pass `session` and `tenantId` (required security boundary); `aud`\n * optionally enforces the origin hint only.\n */\n async verifyVerdictToken(\n token: string,\n options: Omit<VerifyVerdictTokenOptions, \"jwksUrl\" | \"fetch\">,\n ): Promise<VerdictTokenClaims> {\n return verifyVerdictToken(token, {\n ...options,\n jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,\n fetch: this.fetchImpl,\n });\n }\n\n /**\n * Low-level HTTP helper. Prefer verify / feedback / challenge.\n */\n async request<T>(\n path: string,\n init: {\n method: string;\n body?: unknown;\n idempotencyKey?: string;\n },\n ): Promise<T> {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n try {\n const headers: Record<string, string> = {\n Authorization: `Bearer ${this.apiKey}`,\n \"Content-Type\": \"application/json\",\n Accept: \"application/json\",\n \"User-Agent\": this.clientName,\n \"X-Chitmark-Client\": this.clientName,\n };\n if (init.idempotencyKey) {\n headers[\"Idempotency-Key\"] = init.idempotencyKey;\n }\n\n const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n method: init.method,\n headers,\n body: init.body !== undefined ? JSON.stringify(init.body) : undefined,\n signal: controller.signal,\n });\n\n const text = await res.text();\n let parsed: unknown = undefined;\n if (text) {\n try {\n parsed = JSON.parse(text) as unknown;\n } catch {\n parsed = text;\n }\n }\n\n if (!res.ok) {\n const errBody =\n typeof parsed === \"object\" && parsed !== null\n ? (parsed as { error?: string; message?: string; code?: string })\n : text;\n const normalized =\n typeof errBody === \"string\"\n ? errBody\n : {\n error: errBody.error ?? `http_${res.status}`,\n message: errBody.message,\n code: errBody.code,\n };\n throw new ChitmarkApiError(res.status, normalized);\n }\n\n return parsed as T;\n } catch (err) {\n if (err instanceof ChitmarkApiError) throw err;\n if (err instanceof Error && err.name === \"AbortError\") {\n throw new ChitmarkError(`Request timed out after ${this.timeoutMs}ms`, {\n code: \"timeout\",\n });\n }\n throw err instanceof Error\n ? new ChitmarkError(err.message, { code: \"transport\" })\n : new ChitmarkError(\"Unknown transport error\", { code: \"transport\" });\n } finally {\n clearTimeout(timer);\n }\n }\n\n /** Public accessors for inspection / tests. */\n get config(): {\n baseUrl: string;\n timeoutMs: number;\n piiMode: PiiMode;\n onDegraded: OnDegraded;\n } {\n return {\n baseUrl: this.baseUrl,\n timeoutMs: this.timeoutMs,\n piiMode: this.piiMode,\n onDegraded: this.onDegraded,\n };\n }\n}\n\nconst VERDICT_DECISIONS: ReadonlySet<string> = new Set([\"allow\", \"challenge\", \"deny\"]);\n\n/**\n * Minimal shape guard for a 200 verify response. A malformed verdict must\n * never be treated as allow: the gating fields are what gate correctness.\n */\nexport function isWellFormedVerdict(value: unknown): value is Verdict {\n if (typeof value !== \"object\" || value === null) return false;\n const v = value as Partial<Verdict>;\n return (\n typeof v.decision === \"string\" &&\n VERDICT_DECISIONS.has(v.decision) &&\n typeof v.eventId === \"string\" &&\n v.eventId.length > 0 &&\n typeof v.degraded === \"boolean\"\n );\n}\n","import type { Verdict } from \"./types.js\";\n\nexport const CHITMARK_HTTP_STATUS = {\n ok: 200,\n created: 201,\n badRequest: 400,\n unauthorized: 401,\n forbidden: 403,\n notFound: 404,\n conflict: 409,\n preconditionRequired: 428,\n tooManyRequests: 429,\n} as const;\n\nexport type ChitmarkHttpStatus =\n (typeof CHITMARK_HTTP_STATUS)[keyof typeof CHITMARK_HTTP_STATUS];\n\nexport const CHITMARK_HTTP_STATUS_MEANING = {\n ok: \"Request succeeded. For verify gates, continue only after an explicit non-degraded allow.\",\n created: \"Resource was created after an explicit non-degraded allow.\",\n badRequest: \"Required request fields are missing or malformed.\",\n unauthorized: \"API key is missing or invalid.\",\n forbidden: \"Verify returned deny; block the action.\",\n notFound: \"Referenced Chitmark resource was not found.\",\n conflict: \"Idempotency key is already associated with a different payload fingerprint.\",\n preconditionRequired:\n \"428 means the request is not rejected permanently; a required verification precondition must be satisfied before the action can proceed.\",\n tooManyRequests: \"Request was rate limited.\",\n} as const satisfies Record<keyof typeof CHITMARK_HTTP_STATUS, string>;\n\n/**\n * Explicit non-degraded allow. Use this (or `isEligibleAllow`) before any\n * protected action so unknown / malformed decisions cannot fall through.\n */\nexport type EligibleAllowVerdict = Verdict & {\n decision: \"allow\";\n degraded: false;\n};\n\n/**\n * Type guard for the only verdict that may continue a gated action.\n * Fail closed: anything that is not an explicit non-degraded allow is ineligible.\n */\nexport function isEligibleAllow(verdict: Verdict): verdict is EligibleAllowVerdict {\n return verdict.decision === \"allow\" && !verdict.degraded;\n}\n\n/**\n * Map a verify verdict to an HTTP status for framework drop-ins.\n * Unknown or malformed decisions fail to challenge (428), never to allow (200).\n */\nexport function verdictToHttpStatus(verdict: Verdict): ChitmarkHttpStatus {\n if (verdict.degraded || verdict.decision === \"challenge\") {\n return CHITMARK_HTTP_STATUS.preconditionRequired;\n }\n if (verdict.decision === \"deny\") return CHITMARK_HTTP_STATUS.forbidden;\n if (!isEligibleAllow(verdict)) {\n return CHITMARK_HTTP_STATUS.preconditionRequired;\n }\n return CHITMARK_HTTP_STATUS.ok;\n}\n","/**\n * Resolve a client IP for verify subject signals from a Fetch Request.\n *\n * Prefer platform-set headers (`cf-connecting-ip`, `x-real-ip`,\n * `x-vercel-forwarded-for`). `X-Forwarded-For` is only safe when a trusted\n * proxy boundary strips or rewrites client-supplied values. Do not read XFF\n * on a directly reachable origin. On Cloudflare Workers, prefer\n * `verifyRequest` from `@chitmark/sdk/edge`, which owns this lookup.\n */\nexport function getTrustedClientIp(req: Request): string {\n const platform =\n req.headers.get(\"cf-connecting-ip\")?.trim() ||\n req.headers.get(\"x-real-ip\")?.trim() ||\n req.headers.get(\"x-vercel-forwarded-for\")?.split(\",\")[0]?.trim() ||\n \"\";\n if (platform) return platform;\n\n // Last resort: first XFF hop. Only valid behind a trusted proxy that\n // overwrites this header at the edge.\n return req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ?? \"\";\n}\n","import type { Chitmark } from \"../client.js\";\nimport { CHITMARK_HTTP_STATUS, isEligibleAllow } from \"../http-status.js\";\nimport type { Action, Verdict } from \"../types.js\";\n\n/**\n * Minimal Express-compatible types (no express dependency).\n */\nexport interface ExpressLikeRequest {\n hostname?: string;\n path?: string;\n ip?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n headers: Record<string, string | string[] | undefined>;\n}\n\nexport interface ExpressLikeResponse {\n status: (code: number) => ExpressLikeResponse;\n json: (body: unknown) => unknown;\n locals: Record<string, unknown>;\n}\n\nexport type ExpressNext = (err?: unknown) => void;\n\nexport interface GateOptions {\n /** Optional session binder. */\n session?: (req: ExpressLikeRequest) => string | undefined;\n /** Custom surface string. */\n surface?: (req: ExpressLikeRequest) => string;\n}\n\n/**\n * Express middleware factory: verify on the hot path, attach verdict to res.locals.\n *\n * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a\n * boolean operational flag (when true, decision is always challenge).\n * HTTP mapping:\n * - `decision === \"deny\"` → 403\n * - `decision === \"challenge\"` or `degraded` → 428\n * - anything else that is not an explicit non-degraded allow → 428 (fail closed)\n * - explicit non-degraded allow → next()\n *\n * 428 means the request is not rejected permanently; a required verification\n * precondition must be satisfied before the action can proceed.\n * @example\n * ```ts\n * app.post(\"/signup\", chitmarkGate(chitmark, \"signup\"), signupHandler);\n * ```\n */\nexport function chitmarkGate(\n client: Chitmark,\n action: Action,\n options: GateOptions = {},\n): (\n req: ExpressLikeRequest,\n res: ExpressLikeResponse,\n next: ExpressNext,\n) => Promise<void> {\n return async (req, res, next) => {\n try {\n const surface = options.surface?.(req) ?? `${req.hostname ?? \"\"}${req.path ?? \"\"}`;\n const session = options.session?.(req);\n\n const v: Verdict = await client.verify({\n action,\n surface,\n session,\n subject: {\n email: req.body?.email,\n ip: req.ip,\n userAgent:\n (typeof req.headers[\"user-agent\"] === \"string\"\n ? req.headers[\"user-agent\"]\n : undefined) ?? \"\",\n headers: req.headers,\n formData: req.body,\n },\n });\n\n res.locals.chitmark = v;\n\n if (v.degraded || v.decision === \"challenge\") {\n res\n .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n .json({ challenge: true, eventId: v.eventId });\n return;\n }\n if (v.decision === \"deny\") {\n res\n .status(CHITMARK_HTTP_STATUS.forbidden)\n .json({ error: \"blocked\", eventId: v.eventId });\n return;\n }\n if (!isEligibleAllow(v)) {\n // Unknown / malformed decision: fail to challenge, never to allow.\n res\n .status(CHITMARK_HTTP_STATUS.preconditionRequired)\n .json({ challenge: true, eventId: v.eventId });\n return;\n }\n next();\n } catch (err) {\n next(err);\n }\n };\n}\n","import type { Chitmark } from \"../client.js\";\nimport type { Action, Verdict } from \"../types.js\";\nimport { getTrustedClientIp } from \"../trusted-ip.js\";\n\nexport interface NextVerifyOptions {\n action: Action;\n surface?: string;\n session?: string;\n body?: {\n email?: string;\n [key: string]: unknown;\n };\n}\n\n/**\n * Helper for Next.js App Router route handlers.\n * Returns the verdict; caller maps decision → Response.\n *\n * IP comes from {@link getTrustedClientIp}: platform headers first, then\n * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.\n *\n * @example\n * ```ts\n * const v = await verifyNextRequest(chitmark, req, { action: \"signup\", body });\n * const status = verdictToHttpStatus(v);\n * ```\n */\nexport async function verifyNextRequest(\n client: Chitmark,\n req: Request,\n options: NextVerifyOptions,\n): Promise<Verdict> {\n const url = new URL(req.url);\n return client.verify({\n action: options.action,\n surface: options.surface ?? `${url.host}${url.pathname}`,\n session: options.session,\n subject: {\n email: options.body?.email,\n ip: getTrustedClientIp(req),\n userAgent: req.headers.get(\"user-agent\") ?? \"\",\n headers: Object.fromEntries(req.headers),\n formData: options.body,\n },\n });\n}\n\nexport { verdictToHttpStatus } from \"../http-status.js\";\nexport { getTrustedClientIp } from \"../trusted-ip.js\";\n"]}
package/dist/index.d.cts CHANGED
@@ -1,5 +1,5 @@
1
- import { C as Chitmark, A as Action, b as Verdict } from './http-status-CYKIa-SM.cjs';
2
- export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EnforcementMode, F as FeedbackRequest, s as FeedbackResponse, O as OnDegraded, t as Outcome, P as PiiMode, u as Principal, S as Subject, v as VerdictTokenClaims, w as VerdictTokenError, x as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, y as VerifyVerdictTokenOptions, z as degradedChallengeVerdict, B as enforceDegradedNeverAllow, G as hashEmailSha256, H as minimizeFormData, I as truncateIp, J as verdictToHttpStatus, K as verifyVerdictToken } from './http-status-CYKIa-SM.cjs';
1
+ import { C as Chitmark, A as Action, b as Verdict } from './trusted-ip-Fb-K6nwG.cjs';
2
+ export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EligibleAllowVerdict, s as EnforcementMode, F as FeedbackRequest, t as FeedbackResponse, u as FeedbackSource, v as FeedbackUnit, O as OnDegraded, w as Outcome, P as PiiMode, x as Principal, S as Subject, y as VERDICT_TOKEN_ISSUER, z as VerdictTokenClaims, B as VerdictTokenError, G as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, H as VerifyVerdictTokenOptions, I as degradedChallengeVerdict, J as enforceDegradedNeverAllow, K as getTrustedClientIp, L as hashEmailSha256, M as isEligibleAllow, N as minimizeFormData, Q as truncateIp, R as verdictToHttpStatus, T as verifyVerdictToken } from './trusted-ip-Fb-K6nwG.cjs';
3
3
 
4
4
  /**
5
5
  * Minimal Express-compatible types (no express dependency).
@@ -29,10 +29,16 @@ interface GateOptions {
29
29
  /**
30
30
  * Express middleware factory: verify on the hot path, attach verdict to res.locals.
31
31
  *
32
- * - deny → 403
33
- * - challenge (incl. degraded) → 428
34
- * - allow → next()
32
+ * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a
33
+ * boolean operational flag (when true, decision is always challenge).
34
+ * HTTP mapping:
35
+ * - `decision === "deny"` → 403
36
+ * - `decision === "challenge"` or `degraded` → 428
37
+ * - anything else that is not an explicit non-degraded allow → 428 (fail closed)
38
+ * - explicit non-degraded allow → next()
35
39
  *
40
+ * 428 means the request is not rejected permanently; a required verification
41
+ * precondition must be satisfied before the action can proceed.
36
42
  * @example
37
43
  * ```ts
38
44
  * app.post("/signup", chitmarkGate(chitmark, "signup"), signupHandler);
@@ -53,6 +59,9 @@ interface NextVerifyOptions {
53
59
  * Helper for Next.js App Router route handlers.
54
60
  * Returns the verdict; caller maps decision → Response.
55
61
  *
62
+ * IP comes from {@link getTrustedClientIp}: platform headers first, then
63
+ * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.
64
+ *
56
65
  * @example
57
66
  * ```ts
58
67
  * const v = await verifyNextRequest(chitmark, req, { action: "signup", body });
package/dist/index.d.ts CHANGED
@@ -1,5 +1,5 @@
1
- import { C as Chitmark, A as Action, b as Verdict } from './http-status-CYKIa-SM.js';
2
- export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EnforcementMode, F as FeedbackRequest, s as FeedbackResponse, O as OnDegraded, t as Outcome, P as PiiMode, u as Principal, S as Subject, v as VerdictTokenClaims, w as VerdictTokenError, x as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, y as VerifyVerdictTokenOptions, z as degradedChallengeVerdict, B as enforceDegradedNeverAllow, G as hashEmailSha256, H as minimizeFormData, I as truncateIp, J as verdictToHttpStatus, K as verifyVerdictToken } from './http-status-CYKIa-SM.js';
1
+ import { C as Chitmark, A as Action, b as Verdict } from './trusted-ip-Fb-K6nwG.js';
2
+ export { c as ActorType, d as CHITMARK_HTTP_STATUS, e as CHITMARK_HTTP_STATUS_MEANING, f as ChallengeCompletionResponse, g as ChallengeMethod, h as ChallengeProof, i as ChallengeRequest, j as ChallengeResponse, k as ChallengeRiskTier, l as ChitmarkApiError, m as ChitmarkEnv, n as ChitmarkError, o as ChitmarkErrorBody, p as ChitmarkHttpStatus, q as ChitmarkOptions, D as Decision, r as DecisionCosts, E as EligibleAllowVerdict, s as EnforcementMode, F as FeedbackRequest, t as FeedbackResponse, u as FeedbackSource, v as FeedbackUnit, O as OnDegraded, w as Outcome, P as PiiMode, x as Principal, S as Subject, y as VERDICT_TOKEN_ISSUER, z as VerdictTokenClaims, B as VerdictTokenError, G as VerdictTokenErrorCode, V as VerifyContext, a as VerifyRequest, H as VerifyVerdictTokenOptions, I as degradedChallengeVerdict, J as enforceDegradedNeverAllow, K as getTrustedClientIp, L as hashEmailSha256, M as isEligibleAllow, N as minimizeFormData, Q as truncateIp, R as verdictToHttpStatus, T as verifyVerdictToken } from './trusted-ip-Fb-K6nwG.js';
3
3
 
4
4
  /**
5
5
  * Minimal Express-compatible types (no express dependency).
@@ -29,10 +29,16 @@ interface GateOptions {
29
29
  /**
30
30
  * Express middleware factory: verify on the hot path, attach verdict to res.locals.
31
31
  *
32
- * - deny → 403
33
- * - challenge (incl. degraded) → 428
34
- * - allow → next()
32
+ * Verdict shape: `decision` is allow | challenge | deny; `degraded` is a
33
+ * boolean operational flag (when true, decision is always challenge).
34
+ * HTTP mapping:
35
+ * - `decision === "deny"` → 403
36
+ * - `decision === "challenge"` or `degraded` → 428
37
+ * - anything else that is not an explicit non-degraded allow → 428 (fail closed)
38
+ * - explicit non-degraded allow → next()
35
39
  *
40
+ * 428 means the request is not rejected permanently; a required verification
41
+ * precondition must be satisfied before the action can proceed.
36
42
  * @example
37
43
  * ```ts
38
44
  * app.post("/signup", chitmarkGate(chitmark, "signup"), signupHandler);
@@ -53,6 +59,9 @@ interface NextVerifyOptions {
53
59
  * Helper for Next.js App Router route handlers.
54
60
  * Returns the verdict; caller maps decision → Response.
55
61
  *
62
+ * IP comes from {@link getTrustedClientIp}: platform headers first, then
63
+ * `X-Forwarded-For` only as a last resort behind a trusted proxy boundary.
64
+ *
56
65
  * @example
57
66
  * ```ts
58
67
  * const v = await verifyNextRequest(chitmark, req, { action: "signup", body });
package/dist/index.js CHANGED
@@ -184,6 +184,7 @@ function flattenHeaders(headers) {
184
184
  }
185
185
 
186
186
  // src/verify-token.ts
187
+ var VERDICT_TOKEN_ISSUER = "https://api.chitmark.com";
187
188
  var VerdictTokenError = class extends ChitmarkError {
188
189
  name = "VerdictTokenError";
189
190
  constructor(code, message) {
@@ -192,7 +193,7 @@ var VerdictTokenError = class extends ChitmarkError {
192
193
  };
193
194
  var DEFAULT_JWKS_URL = "https://api.chitmark.com/.well-known/jwks.json";
194
195
  var DEFAULT_LEEWAY_SECONDS = 30;
195
- async function verifyVerdictToken(token, options = {}) {
196
+ async function verifyVerdictToken(token, options) {
196
197
  const nowMs = options.nowMs ?? Date.now();
197
198
  const leewaySeconds = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;
198
199
  const parts = token.split(".");
@@ -214,6 +215,12 @@ async function verifyVerdictToken(token, options = {}) {
214
215
  `verdictToken must use ES256, got ${String(header["alg"])}`
215
216
  );
216
217
  }
218
+ if (header["typ"] !== "JWT") {
219
+ throw new VerdictTokenError(
220
+ "wrong_type",
221
+ `verdictToken must be a JWT, got ${String(header["typ"])}`
222
+ );
223
+ }
217
224
  const kid = typeof header["kid"] === "string" ? header["kid"] : "";
218
225
  if (!kid) {
219
226
  throw new VerdictTokenError("unknown_kid", "verdictToken is missing kid");
@@ -227,15 +234,20 @@ async function verifyVerdictToken(token, options = {}) {
227
234
  if (Number.isFinite(iat) && iat > nowSeconds + leewaySeconds) {
228
235
  throw new VerdictTokenError("not_yet_valid", "verdictToken iat is in the future");
229
236
  }
230
- const expectedSession = options.session;
231
- if (expectedSession !== void 0 && payload["sub"] !== expectedSession) {
237
+ const expectedIssuer = options.issuer ?? VERDICT_TOKEN_ISSUER;
238
+ if (payload["iss"] !== expectedIssuer) {
239
+ throw new VerdictTokenError(
240
+ "wrong_issuer",
241
+ "verdictToken was not issued by Chitmark"
242
+ );
243
+ }
244
+ if (payload["sub"] !== options.session) {
232
245
  throw new VerdictTokenError(
233
246
  "wrong_session",
234
247
  "verdictToken was minted for a different session"
235
248
  );
236
249
  }
237
- const expectedTenantId = options.tenantId;
238
- if (expectedTenantId !== void 0 && payload["tid"] !== expectedTenantId) {
250
+ if (payload["tid"] !== options.tenantId) {
239
251
  throw new VerdictTokenError(
240
252
  "wrong_tenant",
241
253
  "verdictToken was minted for a different tenant"
@@ -350,9 +362,15 @@ var Chitmark = class {
350
362
  }
351
363
  /**
352
364
  * Score + route an inbound action (signup / trial / …).
353
- * Hot path at the edge; client budget defaults to 800ms.
354
- * On timeout/transport error, or a malformed verdict shape from the API,
355
- * returns a degraded challenge verdict (never allow, never crashes).
365
+ * Client budget defaults to 800ms.
366
+ *
367
+ * Store-outage degradation arrives as **HTTP 200** with a Verdict body
368
+ * (`degraded: true`, `decision: "challenge"`). The SDK deserializes that
369
+ * like any other Verdict. Verify never returns HTTP 503.
370
+ *
371
+ * HTTP 4xx / 429 Error responses throw `ChitmarkApiError`. Transport
372
+ * timeout / network failure (or a malformed 200 body) synthesizes a local
373
+ * degraded challenge Verdict (never allow, never crashes).
356
374
  *
357
375
  * Persist `v.eventId` on the account row: feedback joins only on that id.
358
376
  */
@@ -393,7 +411,17 @@ var Chitmark = class {
393
411
  }
394
412
  /**
395
413
  * Report a downstream outcome joined on the stored eventId from verify.
396
- * This is the data moat: attribution is a schema contract, not a fuzzy match.
414
+ *
415
+ * Security invariant: feedback cannot create attribution. It only attaches
416
+ * an outcome to an existing verify event for this tenant. Unknown or
417
+ * cross-tenant eventIds return 404. Never invent a join from email/IP.
418
+ *
419
+ * Append-only (not latest-wins): multiple outcomes may attach to one
420
+ * eventId. Exact duplicates share one feedbackId. Compatible labels
421
+ * coexist; conflicting pairs quarantine the new observation without
422
+ * deleting prior evidence. HTTP `{ ok: true }` still acknowledges
423
+ * quarantined ingest.
424
+ *
397
425
  * `idempotencyKey` is sent as both the Idempotency-Key header and body field
398
426
  * (header takes precedence server-side) so exact retries replay the original
399
427
  * acknowledgement.
@@ -416,8 +444,8 @@ var Chitmark = class {
416
444
  }
417
445
  /**
418
446
  * Complete a challenge by submitting its solved proof. Clears only the bound
419
- * session, once. Re-verify with `context.challengeId` to have the next
420
- * verify honor the cleared session.
447
+ * session, once. Does not authorize the action: re-verify with
448
+ * `context.challengeId` and proceed only on non-degraded allow.
421
449
  */
422
450
  async completeChallenge(request) {
423
451
  return this.request("/v1/challenge", {
@@ -427,12 +455,13 @@ var Chitmark = class {
427
455
  }
428
456
  /**
429
457
  * Verify a verdictToken's signature against the API's JWKS and its session /
430
- * tenant binding. Rejects expired tokens, unknown kids, and
431
- * invalid signatures with `VerdictTokenError`. Pass `session` and `tenantId`
432
- * to enforce session and tenant binding (recommended); `aud` enforces the
433
- * origin hint only.
458
+ * tenant binding. Prefers a cached `jwks` (refresh periodically and on
459
+ * unknown `kid`); do not fetch on every call. Rejects expired tokens,
460
+ * unknown kids, and invalid signatures with `VerdictTokenError`. Always
461
+ * pass `session` and `tenantId` (required security boundary); `aud`
462
+ * optionally enforces the origin hint only.
434
463
  */
435
- async verifyVerdictToken(token, options = {}) {
464
+ async verifyVerdictToken(token, options) {
436
465
  return verifyVerdictToken(token, {
437
466
  ...options,
438
467
  jwksUrl: `${this.baseUrl}/.well-known/jwks.json`,
@@ -529,18 +558,31 @@ var CHITMARK_HTTP_STATUS_MEANING = {
529
558
  unauthorized: "API key is missing or invalid.",
530
559
  forbidden: "Verify returned deny; block the action.",
531
560
  notFound: "Referenced Chitmark resource was not found.",
532
- conflict: "Idempotency key was reused with a materially different payload.",
533
- preconditionRequired: "Verify returned challenge or degraded; require friction before continuing.",
561
+ conflict: "Idempotency key is already associated with a different payload fingerprint.",
562
+ preconditionRequired: "428 means the request is not rejected permanently; a required verification precondition must be satisfied before the action can proceed.",
534
563
  tooManyRequests: "Request was rate limited."
535
564
  };
565
+ function isEligibleAllow(verdict) {
566
+ return verdict.decision === "allow" && !verdict.degraded;
567
+ }
536
568
  function verdictToHttpStatus(verdict) {
537
569
  if (verdict.degraded || verdict.decision === "challenge") {
538
570
  return CHITMARK_HTTP_STATUS.preconditionRequired;
539
571
  }
540
572
  if (verdict.decision === "deny") return CHITMARK_HTTP_STATUS.forbidden;
573
+ if (!isEligibleAllow(verdict)) {
574
+ return CHITMARK_HTTP_STATUS.preconditionRequired;
575
+ }
541
576
  return CHITMARK_HTTP_STATUS.ok;
542
577
  }
543
578
 
579
+ // src/trusted-ip.ts
580
+ function getTrustedClientIp(req) {
581
+ const platform = req.headers.get("cf-connecting-ip")?.trim() || req.headers.get("x-real-ip")?.trim() || req.headers.get("x-vercel-forwarded-for")?.split(",")[0]?.trim() || "";
582
+ if (platform) return platform;
583
+ return req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "";
584
+ }
585
+
544
586
  // src/middleware/express.ts
545
587
  function chitmarkGate(client, action, options = {}) {
546
588
  return async (req, res, next) => {
@@ -568,6 +610,10 @@ function chitmarkGate(client, action, options = {}) {
568
610
  res.status(CHITMARK_HTTP_STATUS.forbidden).json({ error: "blocked", eventId: v.eventId });
569
611
  return;
570
612
  }
613
+ if (!isEligibleAllow(v)) {
614
+ res.status(CHITMARK_HTTP_STATUS.preconditionRequired).json({ challenge: true, eventId: v.eventId });
615
+ return;
616
+ }
571
617
  next();
572
618
  } catch (err) {
573
619
  next(err);
@@ -584,7 +630,7 @@ async function verifyNextRequest(client, req, options) {
584
630
  session: options.session,
585
631
  subject: {
586
632
  email: options.body?.email,
587
- ip: req.headers.get("x-forwarded-for") ?? "",
633
+ ip: getTrustedClientIp(req),
588
634
  userAgent: req.headers.get("user-agent") ?? "",
589
635
  headers: Object.fromEntries(req.headers),
590
636
  formData: options.body
@@ -592,6 +638,6 @@ async function verifyNextRequest(client, req, options) {
592
638
  });
593
639
  }
594
640
 
595
- export { CHITMARK_HTTP_STATUS, CHITMARK_HTTP_STATUS_MEANING, Chitmark, ChitmarkApiError, ChitmarkError, VerdictTokenError, chitmarkGate, degradedChallengeVerdict, enforceDegradedNeverAllow, hashEmailSha256, minimizeFormData, truncateIp, verdictToHttpStatus, verifyNextRequest, verifyVerdictToken };
641
+ export { CHITMARK_HTTP_STATUS, CHITMARK_HTTP_STATUS_MEANING, Chitmark, ChitmarkApiError, ChitmarkError, VERDICT_TOKEN_ISSUER, VerdictTokenError, chitmarkGate, degradedChallengeVerdict, enforceDegradedNeverAllow, getTrustedClientIp, hashEmailSha256, isEligibleAllow, minimizeFormData, truncateIp, verdictToHttpStatus, verifyNextRequest, verifyVerdictToken };
596
642
  //# sourceMappingURL=index.js.map
597
643
  //# sourceMappingURL=index.js.map